<story><title>Firebase 404</title><url>https://www.firebase.com/404.html</url></story><parent_chain><item><author>mikelehen</author><text>There was a time when that was true, but these days you can  easily do those sorts of things using Firebase security rules: &lt;a href=&quot;https://www.firebase.com/docs/security/security-rules.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.firebase.com&amp;#x2F;docs&amp;#x2F;security&amp;#x2F;security-rules.html&lt;/a&gt;</text></item><item><author>Rhapso</author><text>well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like &amp;quot;this person should not ask for this value&amp;quot; or &amp;quot;nobody should have a string for a score&amp;quot; because of firebase&amp;#x27;s limitations.</text></item><item><author>Kiro</author><text>I love Firebase but these kind of security holes make me hesitant to use it for anything serious. Is it even possible to prevent without adding an extra server layer?</text></item><item><author>Rhapso</author><text>Yup. You can set your score to a string and it just puts the latest as highest. You can also manually rename yourself. Are all firebase apps this vulnerable?&lt;p&gt;edit* I left a message in the high score box for anybody looking for something proofy</text></item><item><author>AsymetricCom</author><text>The leaderboard is already hacked.</text></item><item><author>jaredsohn</author><text>The 404 page now shows MMO Asteroids.  After the game came out last year, I forked it to create MMO Spacewar (&lt;a href=&quot;http://www.mmospacewar.com&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.mmospacewar.com&lt;/a&gt;) where the rules were adjusted to be more like the iconic game (user now has a single life but also an energy bar, new warp command, and movement, shooting and getting hit costs energy but you regain energy over time) and additional improvements were made (you cannot get killed right after spawning, fixed sound effects, and users can choose the instance via a hashtag URL.)&lt;p&gt;The fork also lets you create asteroids and spaceships (added back from the original one-player version of the game), although at the moment they are not shared among clients so other players may be confused at what you&amp;#x27;re shooting at or is killing you.&lt;p&gt;One interesting aspect of this is that while developing I originally had my client playing on the MMO Asteroids Firebase table which in effect made this a cheat client (it can warp, not instantly killed).  But it is a slightly more ethical cheat client in that the player still can be killed, the total amount of mobility is limited, and you only get one ship so instead of pure cheating it is like adding another spaceship class to MMO Asteroids.&lt;p&gt;Edit: I didn&amp;#x27;t have a lot of people to playtest with, so I&amp;#x27;m not sure how much fun this actually is.  My early observation is that it might be too hard to kill people and that you tend to have the best luck if your opponent moves around a bunch to deplete their energy.</text></item></parent_chain><comment><author>Kiro</author><text>I still don&amp;#x27;t see how setting security rules would prevent cheating. I would love to know how to fix this issue as I&amp;#x27;m making a similar MMO game with Firebase.</text></comment>
<story><title>Firebase 404</title><url>https://www.firebase.com/404.html</url></story><parent_chain><item><author>mikelehen</author><text>There was a time when that was true, but these days you can  easily do those sorts of things using Firebase security rules: &lt;a href=&quot;https://www.firebase.com/docs/security/security-rules.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.firebase.com&amp;#x2F;docs&amp;#x2F;security&amp;#x2F;security-rules.html&lt;/a&gt;</text></item><item><author>Rhapso</author><text>well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like &amp;quot;this person should not ask for this value&amp;quot; or &amp;quot;nobody should have a string for a score&amp;quot; because of firebase&amp;#x27;s limitations.</text></item><item><author>Kiro</author><text>I love Firebase but these kind of security holes make me hesitant to use it for anything serious. Is it even possible to prevent without adding an extra server layer?</text></item><item><author>Rhapso</author><text>Yup. You can set your score to a string and it just puts the latest as highest. You can also manually rename yourself. Are all firebase apps this vulnerable?&lt;p&gt;edit* I left a message in the high score box for anybody looking for something proofy</text></item><item><author>AsymetricCom</author><text>The leaderboard is already hacked.</text></item><item><author>jaredsohn</author><text>The 404 page now shows MMO Asteroids.  After the game came out last year, I forked it to create MMO Spacewar (&lt;a href=&quot;http://www.mmospacewar.com&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.mmospacewar.com&lt;/a&gt;) where the rules were adjusted to be more like the iconic game (user now has a single life but also an energy bar, new warp command, and movement, shooting and getting hit costs energy but you regain energy over time) and additional improvements were made (you cannot get killed right after spawning, fixed sound effects, and users can choose the instance via a hashtag URL.)&lt;p&gt;The fork also lets you create asteroids and spaceships (added back from the original one-player version of the game), although at the moment they are not shared among clients so other players may be confused at what you&amp;#x27;re shooting at or is killing you.&lt;p&gt;One interesting aspect of this is that while developing I originally had my client playing on the MMO Asteroids Firebase table which in effect made this a cheat client (it can warp, not instantly killed).  But it is a slightly more ethical cheat client in that the player still can be killed, the total amount of mobility is limited, and you only get one ship so instead of pure cheating it is like adding another spaceship class to MMO Asteroids.&lt;p&gt;Edit: I didn&amp;#x27;t have a lot of people to playtest with, so I&amp;#x27;m not sure how much fun this actually is.  My early observation is that it might be too hard to kill people and that you tend to have the best luck if your opponent moves around a bunch to deplete their energy.</text></item></parent_chain><comment><author>Rhapso</author><text>Aha! My only use of firebase was writing a chat application for fun back at their launch marketing push. This is good to see, and I think I might go play with it more.</text></comment>