Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Permission, Has Yet To Pay | Hacker News Reader

Ed McMillen: Ubuntu Store Sold Super Meat Boy Without Permission, Has Yet To Pay

kotaku.com.au

207 pointskotakufanb98 comments

Pirates is way too heavy a term here. Canonical is large enough and the issue muddy enough that I don't think this is a warranted accusation. They're also shooting themselves in the foot, instead of coming to some kind of amicable arrangement they've now accused canonical of a serious crime which will lead to a response to that accusation rather than to a solution that would have been beneficial to all parties.

If you deal with a company that is much larger than yours that made a mistake or did something you don't agree with publicity is a means of last resort, not your first avenue for redress. And if you truly believe canonical pirated your game then you should sue them.

This is an excellent reminder why I prefer open source to closed source, projects like Arch and Debian would never suffer from this.

??? I'd hardly call "sold someone else's game without permission or royalties for a year" a "mistake".

seems to be more complex than that, they (Team Meat) wanted SMB in the store but never signed contracts, but canonical put it in the store anyway, so it isn't as if they just saw the game and decided they wanted it... it was a deal being discussed that wasn't completed. Negligent, but not malicious...

http://www.formspring.me/EdmundM/q/406960226210700795

If the deal is not done then you DON'T put it in the Ubuntu Store, period

Sign the papers first

Of course, since Canonical did that, they should try an amicable solution.

No, it's still more complicated than that.

From Ed's posts, it was originally placed in the store as a promotion related to a Humble Indie Bundle.

http://www.formspring.me/EdmundM/q/406960226210700795

I had read this, it seems to all depend on what that "blanket statement" was

For context, this is the Humble Indie Bundle's announcement that all HIB5 games, including Super Meat Boy, would be available for download from the Ubuntu Software Center for HIB owners: http://blog.humblebundle.com/post/24981005928/humble-indie-b...

I don't see any proof of that in the article. Again, if that's exactly what happened then they should sue them, this kind of trial-by-media isn't the way to resolve this. Canonical may be in the wrong, they may be not with just one side telling their story it could be just a silly communications issue or it could be that canonical's left hand doesn't now what it's right hand is doing. That isn't unusual at all. I'm pretty sure if they had sent Canonical a C&D they would have received an adequate response.

Of course blog posts are cheaper than lawyers but the end result is that they've now made themselves toxic and no distro will touch them from here.

Keep your dirty laundry out of sight until you've exhausted all other avenues seems to be a good rule of business. Once you go down the name calling road there is no turning back.

Mistakes happen, but this blogpost was not a mistake. The intent here is to inflict damage and it will likely be dealt with accordingly.

edit: and it looks like Canonical already paid.

Well, miscommunication happens very often. I can't think of any reason Canonical would do this on purpose.

Really? What is someone else pretended to have created the game, and uploaded it to the store?

Would Canonical have made a mistake then?

And Canonical did it because they desperately needed the money, or just because they are plain evil?

If they're selling software which they don't have the right to sell, and not sharing the profits with the rightful owner until and unless confronted, that fact should be communicated far and wide. It is a serious breach of ethics if intentional, a show-stopping flaw in Canonical's Software Center system if not, and illegal in any case.

It seems they just wanted some exposure on what Canonical did (aka media justice). They weren't going to sue them or go after them in other ways.

Quote from Ed (http://www.formspring.me/EdmundM/q/406960226210700795): "its not a huge deal, i just dont like being made to look like an asshole so i made my reasons public."

>Pirates is way too heavy a term here.

Yes, please reserve such defamatory language for nine year olds who download music, and not innocent corporations run by billionaires who distribute copyrighted material for profit without compensating its owners.

Don't forget 75 year old grandmothers who forget to lock down their home wifi router.

Actually it's worse.

Canonical made pirates of their customers, too.

They downloaded and used a piece of software which they didn't have a license for.

As shardling pointed out[0], the use of "pirates" was editorializing of the title by new user kotakufanb who apparently didn't observe the guidelines ("... please use the original title, unless it is misleading or linkbait") as the word "pirate" appears nowhere on the article.

[0] https://news.ycombinator.com/item?id=4959153

Pirates is way too heavy a term here.

This is for-profit and closer to true piracy than file sharing is. It could be unintentional, but if they've already been contacted about it they really should be quicker to resolve the situation.

They're also shooting themselves in the foot,

No surprise there, see http://img820.imageshack.us/img820/1641/itsfinetrustme.png for an example of the judgment they've shown.

what was that? an exploit in the SMB game?

Yep. MySQL credentials in the binary.

Honest question: how could they have avoided that?

One obvious, safe way: set up an API on their servers, abstracting away the need to send actual MySQL calls over the Internet.

While this case is particularly egregious, you are still accepting data from an untrusted remote client.

Yes, but you can fine grain permissions so a unique client can alter a high score that they previously held, but not alter everyone's scores, which is difficult if not completely impossible in MySQL directly, as well as sanitize data to reject wildly incoherent submissions.

The possibilities of pre-formatting data are endless with an API. Not so much with an INSERT statement.

It is entirely possible to build this kind of API in a SQL server with constraints and stored procedures.

It's also entirely possible to write a webserver in bash.

Every public web site on the planet is "accepting data from an untrusted remote client" - but allowing public db access is something else entirely.

Not every public web site enforces its business logic in client-side JavaScript and just accepts as valid the data that's submitted to a server. Every game that wants to submit a score to a central scoreboard has this problem, and it's a little absurd to debate the exact protocol by which an insecure-by-design architecture gets exploited.

You can submit the input sequence used along with the high score. You've then transformed the problem for the attacker from simply sending up an artificial score to writing a program to solve the game, which is harder and was an existing vulnerability already.

I thought this was my exact point. I was responding to a comment that replacing the database connection with an API would solve the problem. It wouldn't. Accepting a score from the client is insecure by design.

Every game basically has to trust the scores submitted by users. That doesn't mean it should trust users to mess with other users' scores, and it certainly doesn't mean it should trust users to mess with levels that other users have designed.

If one must directly access the database from a client application, the right way is to make sure each user has an unique, secure database credential with only the minimal permissions necessary. However, direct database access is still a terrible idea in most cases, as it is a lot of work to prevent a resource starvation attack.

From what I recall of the story, the login for SMB's level database was stored in plaintext in the exe.

That picture is the guy who found it telling the devs, and the devs not understanding why it's a problem.

Cue their database being "hacked" a short while later... and another internet meme is born!

Here's a lesson, never trust user input!

This is not the first time, and not the last time either.

(I'm waiting for the posts saying they should be using PostgreSQL)

(I'm waiting for the posts saying they should be using PostgreSQL)

I'm not that guy, but I've always liked Postgres.

As someone who likes to understand potential security issues, and who has just embarked upon a project which is using PostgreSQL, what is the subtext of your comment?

Tommy Refenes has stated in an interview[1] that he said "it's fine" just because at the time he couldn't do anything about it. The level editor was programmed in a rush and he didn't think that anyone would exploit something offered to them for free.

In the end, the guy who warned him that an "evil hacker" could compromise the system, turned out to be that evil hacker himself.

For us web devs it pretty obvious that anything that can be exploited will be exploited. Tommy was naive about it. Imho, his "it's fine" comment made it worse - what he should have said is "thanks, but I can't fix it right now".

[1] http://www.youtube.com/watch?feature=player_detailpage&v...

>The level editor was programmed in a rush and he didn't think that anyone would exploit something offered to them for free.

There's simply no way he actually believed that. It reads as a way to further shift blame to the exploiter by painting him as someone who hasn't just exploited an indie game darling, but has taken advantage of their altruism.

>In the end, the guy who warned him that an "evil hacker" could compromise the system, turned out to be that evil hacker himself.

I really wonder if Mr. Hacker would have gone ahead and done that if Tommy hadn't been so smug about blowing the guy off. If "it's fine" was asking for trouble, "I've done this for a while now" was positively begging for it.

I vaguely recall this incident from when it happened, but having recently watched Indie Game The Movie puts a new perspective on it.

That chain of events fits the personalities demonstrated in the documentary like a glove.

That, my friend, is called spin. I don't believe for one moment that the response "I've done this for years" doesn't smack of eye rolling and dismissiveness.

The right answer would have been "DM me", but that was done by the other side.

It was not just that they sold his game without paying him (I understand there's more than enough reason to believe this was a regrettable mistake), it's that they claim that he declined to sell his games when in reality they declined to accept them. That makes him look like he's somewhy opposed to Ubuntu, and it is rather bad PR for him. I understand that he tried to get them to stop doing that, and chose to reply to what he saw as PR attack with bad PR instead of legal action (which probably would have made him look even worse). I don't think it was a very level headed decision, but I don't think what he's doing is wrong.

Pirates is wrongly re appropriated term, but it certainly fits better to a company selling something belong to someone else without an agreement and keeping all the money than say someone downloading an audio track to preview it before buying if it's good enough (and available enough at a reasonable price).

Anyways there's no mention of piracy in the original statement. It was not intended publicity, it's not as if they made a press release or something, it's just the answer to a question asked to the guy on a website that got picked up.

Here are the original posts: http://www.formspring.me/EdmundM/q/406941407635331564 http://www.formspring.me/EdmundM/q/406945771976419136 http://www.formspring.me/EdmundM/q/406960226210700795

These depicts a whole different situation than the one you seem to have grasped from the kotaku sensationalism.

The SMB guys hold the Linux/FOSS community in pretty low regard: http://www.reddit.com/r/linux/comments/g072l/super_meat_boy_... [1]

So, I would take their current claim with a large grain of salt.

---

[1] What's even sadder is Tommy (the programmer of the SMB team) clearly shows he knows nothing of Linux, the community, licensing, or even good programming for that matter. Here's a couple of examples:

1. There's a screenshot above of the lack of security with the high-score servers

2. Complete lack of portability. Humble Bundle of SMB (Linux port) doesn't even run.

3. Bugs. On Windows, you start the game and for some odd reason the game mutes itself.

The games great, but for such a buggy product, I'd keep programming opinions to myself.

The SMB linux port of SMB was done by a third party developer, not the original team.

If you ran into the same issue I did (blank screen but sound) there's a fix here:

http://askubuntu.com/questions/151567/super-meat-boy-gives-b...

I have a feeling the issue might be at least partly caused with issues on OpenGL/SDL/X11 or something like that. I've had no end of issues with fullscreen games under Linux.

To be charitable here, we're talking about a 2 man team (who shipped a successful product on their own) rather than a large AAA dev with an actual QA dept. Tommy might not be the greatest programmer (I remember reading something he wrote where he had some strange views on threading) but I think criticism has to be offset against that.

And at the end of the day they shipped a Linux game before Steam on Linux was even announced, apart from that one issue it seems to work flawlessly (for me at least) under Ubuntu including actually recognising an Xbox360 pad which Braid didn't.

>a serious crime

You keep using that word, I don't think it means what you think it means.

Piracy is not a crime, much less a serious one. Murder, for example, is a serious crime. Please don't spout nonsense. Copyright infringement is a civil offense, not even a felony.

That is not to say that what Canonical did - if the accusations are justified - is ethically sound. But please don't spread the bullshit propaganda of certain industry representatives.

At least in the US, some forms of copyright infringement are crimes, as demonstrated by the Ninjavideo, TVshack, and Megaupload cases.

At least in the case of Megaupload, that remains to be seen.

http://www.formspring.me/EdmundM/q/406960226210700795

dpitkin from canonical: "Hi, I just looked into it and the check to Tommy and Edmund from Canonical is in process for the 77 copies of Super Meat Boy. We have been working together since November to get it resolved, no piracy here just some miscommunication. David Pitkin Canonical"

edmund: "they got it from the HIB, HIB gives all the linux builds to Ubuntu during the promotion and does a blanket statment to all involved, we said we were interested in putting smb in the store but never heard back and never got a contract or exchanged information (hence why we were never paid) they never contacted us back after that and we simply never knew it was in their store."

So, which is it? Have canonical and edmund been communicating to fix since November? Or has this literally NEVER (edmund's statement) happened?

Given the HIB involvement, I'm very inclined to think that a massive miscommunication happened and that, frankly, edmund is just massively whining and whinging. Listen, I get it, he might be frustrated, but Edmund spoke in absolutes and we know how often absolutes are correct.

Either way, "pirating" is the wrong word. It's obvious there was no malice from Canonical. And I honestly don't know what Edmund was trying to achieve...he just looks bad in this whole exchange.

Edmund didn't use the word piracy. That was just some editorializing by the Kotaku reporter and has since been removed.

I think what Edmund wants is to rant a bit about how Canonical says he "declined to make their game available" when it was Canonical who didn't accept the game in the first place. It makes it look as though he has a problem with Ubuntu, which he doesn't.

Honestly, he just ranted about it on his formspring. He didn't make a press release or press charges. He's understandably annoyed that they made him look bad to save face and that they didn't pay him some money they should have.

edmund's statement is a bit curious. HIB didn't merely "give all the linux builds to Ubuntu during the promotion", they advertised that all the HIB5 games including Super Meat Boy would be available from the Ubuntu Software Center: http://blog.humblebundle.com/post/24981005928/humble-indie-b...

So Ubuntu was meant to allow HIB users to "buy" the games for no money and download it, just not to allow non-HIB customers to pay money for them. Which leaves a much more understandable avenue for them to screw up. Also, he says he's really pissed off with Ubuntu prior to HIB7 but they're the ones who refused to allow The Binding Of Isaac. Does that really seem terribly plausible?

Hi, I just looked into it and the check to Tommy and Edmund from Canonical is in process for the 77 copies of Super Meat Boy. We have been working together since November to get it resolved, no piracy here just some miscommunication.

David Pitkin Canonical

77 copies in a year? The same game sold 20.000 copies on Launchday on the Xbox360. Seems like Linux gaming still has a long way to go. Steam isnt doing it for direct profit reasons either, they just want to push the software platform of their new console!

But dont get me wrong, i like the direction, its just that linux gaming is totally irrelevant from a market perspective.

First we're talking about a potentiel market restricted to ubuntu users, the small portion that would give money for a piece of software. Then we're talking about a game added to the ubuntu store when it was released in a pay what you want bundle. Then again the dev is known for having a poor opinion of linux and its communities. The port itself has a few bugs.

Not exactly the recipe for success here.

As an example, I'm a linux gamer, I own a copy of the humble bundle including super meat boy and after using it for a couple years, I for sure will stay away from ubuntu for technical, personal and ethical reasons. So don't expect my money showing up on the ubuntu store.

It was put in the store way after its initial release on most platforms. And I'm pretty sure anyone who got it in the humble bundle got a direct download.

Trying to infer something about the state of Linux gaming from this single statistic is just kinda silly.

I did directly compare it to another closed plattform store, which is Xbox Live Arcade. When a very successfull game sold 77 copies in a year when the same game sold 1 million copies (on xbox alone) in a timeframe of similar length (0.0077%) that still says something. I am very certain that SMB still sells alot more than 77 copies on XBLA per day!

Of course you cant compare the Ubuntu Store with something like XBLA but still, its helps bringing stuff into perspective.

Anyone who got it in the Humble Bundle got a copy in the Ubuntu Software Center too.

I tried for nearly a year to get Google Chrome into the Ubuntu store. Each time I asked about it I got answers like "the relevant person is on vacation", "we'll get back to you", "sorry, forgot to respond". I eventually gave up. While I remain cranky about it I try to believe they are just not well organized and it wasn't anything malicious, which I hope is also the explanation here too.

Well, I highly doubt that, to be honest.

It's pretty simple and known why Chrome is not in software center: Google. They won't allow it. Chrome would have to go in the partner repository, hence needs collaboration with said partner. Think Skype.

The above poster is a Googler on the Chrome team so I'm guessing that he was doing that work on behalf of Google.

How does one apply for a job doing PR for canonical? I'm pretty sure even HN people could do a better job.

Please just link directly to the FormSpring rather than the blogified version. It gives all the relevant info.

http://www.formspring.me/EdmundM/q/406945771976419136

No, it doesn't.

The "blogified" version also links to some related tweets that add some important context.

Of course someone interested enough could cobble everything together themselves, but the whole point of linking to a secondary source is to let someone else do the synthesis.

Erm, it only quotes one tweet from the other dev that actually doesn't add anything at all by saying that they still didn't get paid which was implied.

It also had (it's been silently rewritten) an outrageously sensationalist title and lack context and follow up you have in the original source.

Dude looks really freakin' high.

http://www.formspring.me/EdmundM/picture

The word "pirates" does not seem to appear in the linked article.

7 hours into the discussion and no link to "Indie Game The Movie" movie that follows SMB devs for few months prior to the launch?

http://www.indiegamethemovie.com

http://www.imdb.com/title/tt1942884

Available as part of the current humble bundle for another 10 days.

https://www.humblebundle.com/

While watching the video/trailer for the most recent Humble Bundle, I was put off by the games this time around.

The one mentioned in this article for example, looked like a basic Flash game. So as an outsider to this indie gaming world, I can understand why they might have superficially rejected it - it's probably a great game if you give it a chance.

Just thought that someone should point this out because the comments have so far been the opposite.

I don't think that's the problem here. The problem the developers of the game have seems to be the fact that Canonical is claiming "the authors of Binding of Issac [sic] declined to make their game available" when the truth is they are the one who rejected the game. Put it plainly, they lied. To me personally, it felt like Canonical is trying to appear "open", while in fact they are controlling their own store's content, just like everyone else.

No, that's not quite right.

They initially rejected the game. Once it got popular, Canonical wanted to put it in, but because of the earlier rejection and the SMB stuff, Ed declined.

So their statement was technically correct, but without knowing the full context was misleading.

That's still not quite right. Edmund's full comment was:

"they are just trying to save face. they rejected isaac a while ago because its content "wasnt a good fit for the Ubuntu store" then changed their tune once they found out how popular it was and that it was a part of the HIB."

Ubuntu have had some kind of arrangement with the HIB for a while where they offer as many of the HIB games for download as possible through the Ubuntu Software Center, and HIB purchasers don't have to pay again for them. What presumably changed wasn't the popularity of the game but the fact that it was part of HIB7. I can't imagine Ubuntu expected it to be a massive seller for them, given that the unauthorized SMB apparently sold all of 77 copies.

Binding of Isaac was originally written in flash (I think it's since been re-implemented) but don't let that put you off: it's a polished piece of gaming perfection.

The theme probably puts some people off, but the underlying mechanics are perfectly judged.

> I think it's since been re-implemented

Nope, it is being reimplemented/rebooted and should be released flashless in 2013, but the current version remains flash-based:

> Edmund McMillen has confirmed that he is working on a remake of the game slated for release in 2013. He states that the primary purpose of the remake will be to take it out of Flash, and use a new engine to help limit the bugs with the game. It will feature completely re-balanced items and enemies, as well as redrawn graphics, possible local co-op support, new items, new enemies, and console support. It was announced that it will come with 2 Player Local Co-Op and will be called The Binding Of Isaac: Rebirth.

I gave it several chances and it's a terrible game, it does a great job of annoying the player.

Judging by it's popularity despite the lack of any kind of advertising campaign, I'd say it caters to a kind of player that isn't you, not that it's a terrible game. (Disclaimer: BoI is my favorite game of 2011)

I blame the THQ bundle. Seriously, all that awesome for just a $1 minimum. After that all these previously amazing indie games just look like flash toys.

They are still amazing though. especially Dungeon Defenders with its DLCs. :)

Which sadly happens to be buggy under linux

well, that sucks. I can't even get it to run on my Mint install, but I think my problem was my graphic card driver,

That was the only humble bundle I didn't buy. I do not agree with your conclusion at all.

The THQ bundle was but an attempt to boost the stock value of the company by showing people had interest in the games before filing for bankruptcy.

It was real real sub par in comparison of other bundles, it was crippled by being windows only and steam only on linux, it had no bonus content and didn't feature anything fresh. Also developers of those games mostly didn't see a dime of this.

Bankruptcy? What does Humble Bundles financial situation look like?

Err, THQ is going bankrupt, not HI.

> The one mentioned in this article for example, looked like a basic Flash game.

Binding of Isaac is a flash game, and is anything but basic (one of the best games of 2011, for all its technical issues).

I don't understand the hate for flash games. As a general purpose Ad Content creation platform, I absolutely hate flash, but when it comes down to games there are hundreds of open source engines, thousands of books on game development on the platform and hundreds of thousands of tutorials all over the internet.

It's a popular game platform that works really well for game developers with more of an artistic background than our traditional systems or web developer (and art is arguable more important than code in a successful video game). As a web developer I don't hate Linux kernel hackers for the tools and platforms they use, and there's no reason I should hate on the tools and platforms game developers use either. It's an entirely different field.

The Binding of Isaac devs have talked at some length about the issues they've faced with making a decent sized game in Flash. This isn't just outsides tearing down something that they don't understand. There are real technical problems with making a full game in Flash.

Actually you don't, according to david pitkin it's the lack of age restriction in the ubuntu store that cause this game to be rejected.

Here's the quote:

Hi Edmund, let's figure the confusion out as soon as possible. There were some crossed wires with the Humble Indie Bundle 5 launch and Super Meat Boy plus the lack of age restrictions in the Ubuntu App Store for Issac but nothing more I thought : (

David Pitkin,Director of Consumer Applications at Canonical.

Binding of Isaac is a fantastic game. The theme may be a bit strange and the graphics aren't anything special (though I do feel the graphics suit the gameplay), but the gameplay is top notch. In fact, I bought this bundle specifically for the Binding of Isaac DLC.

Machinarium was a flash game too and yet it is still a great game. Being a flash game doesn't necessarily mean the game is not any good. I do understand what you mean though - if it looks like a basic flash game, then perhaps its as shallow as the masses of flash games you can find on the web, but in this case its simply not the case.

Well, there are problems with BoI that occur specifically because it is a Flash game. (Thus the rewrite mentioned elsewhere.)

This is typical of the behavior of companies that are trying desperately to stay afloat.

> This is typical of the type of behavior ...

This sentence was brought to you by the department of redundancy department.

Lol...I should have caught that. Derpity derr.

Too much drama. I'm sure this will be sorted out.

They just run things on a net-365 basis is all.

Time to lawyer up!

Nope. http://www.formspring.me/EdmundM/q/406960226210700795

I thought piracy is cool now? Oh wait, it's only cool when the underdog does it. Nevermind.

It's sometimes cool even when big company does it for profit (Megaupload).

In don't think the nuance here is about underdogs.

Most file sharing is not for profit. Most file sharing is some kid who couldn't have possibly bought everything downloaded because it would have cost more than his families entire salary. Does that make it right? No. But it's more like street graffiti or petty theft from a convenience store. The judicial system unfairly favors the big content companies in these situations and people face several hundred thousand dollar penalties. The spirit of these laws was to target people selling bootleg copies of DVDs on the street, not the people who bought those DVDs. Megavideo should be facing these types of penalties, not moms.

Megavideo was profiting from piracy so they are more culpable, but the preemptive actions taken were also inappropriate given the crime. Despite it being mostly used for piracy, people did have legitimate files on it and their access was unexpectly lost due to the improper actions. Besides the collateral damage, even guilty people should have a day in court before any punishment occurs, I don't care what the crime is or how obvious some non-judge individual thinks it is.

This case is someone profiting from unauthorized distribution. This is a case where the unjust law is unlikely to be relevant; if the government preemptively raided canonical I think you can safely assume there would be a shit storm of support on canonical's side.

People don't simply react to the original crimes, they are reacting to all of the other moves that happen after the crime comes to light. In this case there is no draconian antipiracy in effect, no individuals committing petty crime so they can watch HBO, instead there is the most visible open source software violating intellectual property law in a way that is unlikely to have any negative effect on the company besides one day of mildly bad PR.

Reply on news.ycombinator.com