Hacker News Reader

Comment by lawl | Hacker News Reader

This is fun. But I have one wish. Overwrite console.log() so it logs onto the website and I don't need to open firebug :)

Edit: I think I solved lvl two to four all the same way. Not sure if that's intended. But I also don't want to spoil it for others.

Edit 2: This worked again at lvl 6, so I'll assume that's a bug. Click this pastebin for spoilers: http://pastebin.com/yfhDhE7P

View on HN

Good catch! We haven't been checking yet for tampering with functions, but we probably should. Don't think of it as a bug so much as a cheatcode you discovered :-)

First of all, this is absolutely impressive in concept.

Yes, it's too easy that way:

    map.pO = map.placeObject;
    map.placeObject = function(x, y, w){
        return map.pO(x, y, w=='block'?'empty':w);
    }

Does not even need call. But while you cannot protect from `Function['p'+'rototype']['c'+'all']`, I think using `defineProperty` to stop mucking with the code would go a long way into preventing blatant cheating at little cost. That or enclosed reference funcs.

Btw, you trust the level increment counter before succeeding in loading the level. Right now calls are 503ing, so basically I'm [gisting bogus solutions](https://gist.github.com/anonymous/f1b06d63848d6d013e26) but it's also saving those bogus level ups in localstorage...

Aww, I thought that was to easy. That trick works for basically any level.

Also, is there a good way to completly prevent tampering with functions, or is this just going to be an arms race?

> Also, is there a good way to completly prevent tampering with functions, or is this just going to be an arms race?

Let's hope for an arms race - it will be far more fun and educating at the same time.

hmm a multi player javascript API tampering arms race game would be pretty awesome too.

Object.defineProperty with 'writable' = false?

Object.freeze?

I just added a feature to the game that watches certain functions and compares them to what they were at the start of the game (during the level validation phase). I'm sure this can still be gamed though.

Don't use the functions from the map object, but keep a separate function reference for validation?

I mean if you want to cheat you always can. But that's not the point. Right now you can cheat using official apis.

Just use map._blah() for internal use

By the way: Same trick works for keys.

I did a similar thing for level 6: http://pastebin.com/aScFtgK8

Also, you can use String.fromCharCode(95) to write a '_' so that you can access the methods on map that start with an underscore

Does firebug override the ctrl+shift+K javascript console?, curious because I don't use it.

Reply on news.ycombinator.com