Tuesday, December 02, 2003
 
Today's Object Lessons

Courtesy of the Everquest players who killed Kerafyrm, The Sleeper, an "unkillable" monster designed to be the end of the EverQuest world or something. Players should not have been able to kill it, you see. Seems that the Sony development team gave the beast 10 billion hit points, a bunch of invulnerabilities, and an unbelieveable regeneration rate, and 200 players teamed up to do the impossible. Much to Sony's chagrin.

Lessons to be learned:
  • Developers:
    Don't even tell me about "Functions As Designed." Just because you think that no user would do what you believe is improbable doesn't mean he or she will not. If you need something to be impossible to kill, make it impossible to kill. If I tell you it's possible to enter bad data into the database, don't tell me that a user wouldn't enter bad data. He or she will, and your faulty application allowed it.

  • Everyone:
    Out there on the Internet, there are a lot of patient people with lots of time that they can spend probing, prodding, and investigating vulnerabilities. They have more infinity than you do. Close your ports, and good luck to you.

- posted by Brian J. @ 7:01 PM
Comments: Post a Comment

<< Home
 
To say Noggle, one first must be able to say the "Nah."