aspro said:

SteelAttack said:

What up, bitches?

My **** up your ***.

We're not on GameSpot you know

Yodariquo said:

Dvader said:

Yodariquo said:

Hey guys, I've been able to compromise Backloggery with a cross-site scripting vulnerability.  The script I wrote for automating game submissions tipped me off.  It's just proof of concept that users can insert arbitrary JavaScript, you can see the example here.  It shows an alert with the user's cookie data.

The site is also vulnerable to cross-site request forgeries, which just the fact that I can run a script to submit games is proof itself.  I've passed along the information through the contact form (I also previously sent along a report of an issue with the reset password form) so hopefully it will get fixed.

In english please.

I could do the 1up hack if I wanted.

Oh ok. You are like an online Neo, you can change webpages by your will alone.

Yodariquo said:

aspro said:

^They are out of your league man (that's a compliment).

are they using mysql over there? Can you tell?

Nothing with the vulnerabilities posted has to do with the database, but I don't have a definitive way to tell either way.  The site is in PHP, so the odds are heavily in favour of it, but PostgreSQL is still a reasonable possibility, and MSSQL far less likely but still technically possible.

I like Backloggery because it's simple.  Honestly, it's very much like something I would do, and was similar to what I considered as an option with the design of this site, but didn't really like the ugliness that would result on the database side, and felt we're better off not acting as a database.

In case you're wondering though, I'm not going out of my way to break the site, but once an idea pops into my mind, I can't help but follow through and see what happens.  And knowing it's there I send it along.  I'll post the full details in a blog post in a week so they have time to read and address it.

EDIT: Oh, and thanks for the compliment on that, but this type of thing isn't exactly high-end, moreso just due diligence.  I think it's just an oversight, but again I'll address it in a blog more specifically.

Yeah I was just wondering about mySQl, cause i sent them a request and they told me there "was no way" they could accomodate my request.  I know they were not being up front with me.

Yeah, you're alright man, if I had my old job, you'd be hired, easy. We always had not enough devs for the work we did, and that's what I meant by that.

aspro said:

Yeah I was just wondering about mySQl, cause i sent them a request and they told me there "was no way" they could accomodate my request.  I know they were not being up front with me.

Yeah, you're alright man, if I had my old job, you'd be hired, easy. We always had not enough devs for the work we did, and that's what I meant by that.

If only the employers around here thought like you

Can I ask what the request was?  I'm sure I could tell you whether it's possible technology-wise, though I'm thinking it may be something more ambigiuous that would depend on how they designed their database structure in the first-place.

Dvader said:

aspro said:

WHAT?! NMH for ps3 and 360?

I thought we were told that there would be ports of NMH and Muramasa already.

There was a rumour of a port of a game from a list of several possible games that included those two.  There was never anything definitive.

aspro said:

Yodariquo said:

aspro said:

Yeah I was just wondering about mySQl, cause i sent them a request and they told me there "was no way" they could accomodate my request.  I know they were not being up front with me.

Yeah, you're alright man, if I had my old job, you'd be hired, easy. We always had not enough devs for the work we did, and that's what I meant by that.

If only the employers around here thought like you

Can I ask what the request was?  I'm sure I could tell you whether it's possible technology-wise, though I'm thinking it may be something more ambigiuous that would depend on how they designed their database structure in the first-place.

oh i know it was possible -- it would have taken them 45-60 seconds. i just asked them to take my games categorized as XBOX and change it to whatever the offical code over there was for Xbox. (check out my backloggery and you'll see what i'm saying.

You could work remotely, consider getting a headhunter, sure they'll take a % of your first year of pay but 90% of something is better than ) 0% of nothing.

WTF?  I mean, I understand if they don't want to be doing back-end DB stuff for UI things (honestly, I cheated the system there), but to respond and say it's not possible?  It would have literally been easier to just do the update.

UPDATE collections, users SET console = "Xbox" WHERE console = "XBOX" AND collections.user_id = users.user_id AND users.username = "aspro73";

This wouldn't have even been a problem if they had built a normalized database.  Yes, they are actually storing the text "Xbox" and every other system text thousands of times over, one for every game, instead of a foreign key.

If you bear with me a couple more days here, I'll have an updated PERL script for you to get those remaining games swapped over (honestly I should have done a full test before hand anyway and sorted it out).

Yodariquo said:

This wouldn't have even been a problem if they had built a normalized database.  Yes, they are actually storing the text "Xbox" and every other system text thousands of times over, one for every game, instead of a foreign key.

Yeah, I noticed that too and shook my head. Nuts. That's what I'm saying - they are out of your league and most other thoughtful coders.

No More Heroes Set for PS3, Xbox 360

Original Wii title getting the HD treatment in sexy cherry and sweet mango flavors.

Marvelous said earlier this year that it was looking into releasing PS3 and Xbox 360 versions of some of its Wii properties. It looks like No More Heroes will be the first title to see the HD remake treatment.

This week's Famitsu reveals No More Heroes: Heroes' Paradise, a PS3 and Xbox 360 remake of the original 2007 No More Heroes title. In addition to updated visuals, the remake includes Japanese language voiceovers, selectable alongside the the English voiceovers of the original.

HD gamers also have a new unlockable mode to look forward to. Known as "Very Sweet Mode, this mode changes all the female characters' costumes into sexy form -- skimpy bathing suits, cheerleader outfits, and so-forth. The girls appear in this form during both gameplay and non gameplay sequences.

The game will also see control changes -- expected since there's no more Wiimote. While not providing specifics, Famitsu says to expect a better feel of action. Details will be shared in a future update.

This HD remake of No More Heroes will arrive on February 25, priced at ¥5,800 -- a couple of thousand yen lower than most high profile third party titles.

Marvelous will be including an "Erotica Portrait" bonus item for those who pre-order. This collection of sexy portraits will differ depending on your platform. PS3 owners will get "Sexy Cherry" flavor. Xbox 360 buyers will get "Sweet Mango" flavor.