Hacker News Reader

As it's hidden at the very end

>Except not, because I reported this vulnerability to them and it has been patched. Shoutout to the WotC security and engineering teams for being lovely to work with and patching this bug in a timely manner!

A fun writeup on a bug they properly reported. I hope WotC reimbursed them in some way though.

View on HN

On reddit, they coyly suggested[0] that their account may have kept its spoils.

[0] - https://reddit.com/r/MagicArena/comments/1385b90/_/jiwp6jk/?...

If I was running the backend for a game like MTGA, I would definitely find value in having a few of those kinds of accounts hanging around. As long as they don't terribly break things, you can use them to discover performance and scalability issues. If anything, I'd probably pull additional telemetry just for those accounts specifically.

I'm generally a proponent of soft limits on almost everything. It's better to hit some artificial cap than to end up chewing away on a transaction forever or crashing some service that can't allocate the memory to deal with it. In this case a limit on gems in an account, packs in a transaction, packs in an account, etc.

Reply on news.ycombinator.com