A leaderboard is only worth chasing if everyone on it got there by riding. That sounds obvious, but a browser game makes it harder than it looks: every line of the game runs on the player's own machine, and anything a machine sends to a server can be written by hand instead of by the game. This week Powderline's leaderboard stopped taking the browser's word for it. Here is what changed, at the level of detail that helps players and not the level that helps cheaters.
Why it came up
In September a handful of scores appeared on the board that no run could have produced: millions of points over a few hundred metres, posted straight to the board without a ride behind them. They were swept the week they appeared. Sweeping fixes the symptom; this week's work fixes the cause. The rule now is simple: the server decides what counts, and the browser only reports what happened.
A score has to come from a ride
When a run ends, the game reports the ride to the server, and the server logs it. Only then can that run go on the board, and only once: a score is accepted when it matches a ride the server has already logged for your account, and a ride can only ever give one board entry.
The server also fills in the parts it should never have trusted a browser with. The name on the entry is the rider name on your account, not whatever a request claims, so nobody can post under someone else's name. The date is the server's own clock, so an entry cannot be dated into the future to sit on the daily board for good. And the run has to be one a person could actually ride: the distance has to fit the time on the snow, the score has to fit the distance, and rides cannot be reported faster than they could be ridden one after another. An honest run never comes near those limits. A forged one now costs as much real time on the mountain as the run it claims, which removes most of the point of forging it.
Board entries are now append-only for riders. Nobody can edit or delete a row on the board from the game, their own or anyone else's.
Accounts, coins and names
The same principle went through the rest of the account. Your profile can now only be changed through the game's own actions: renaming your rider, saving your settings, equipping what you own. Everything else on it, from your best scores to the cosmetics you have unlocked, is written by the server as the result of something that happened in the game, never set directly from the browser.
Coins and quest progress come only from real rides. Run statistics count toward quests together with the logged ride they belong to, and a race win can only be counted at the pace races can actually be won. An old reporting path that predated the quest system, and that nothing in the game used any more, was removed outright rather than patched.
Rider names that read as web addresses are refused, on the server as well as in the game, which put an end to a small wave of advertising names. Share cards, the images you get from SHARE THIS RUN, now only carry numbers a real run could have produced.
Races
A 1v1 race runs directly between two browsers, so in a race the other side is, by definition, someone else's machine. The race code now treats everything from the other browser as untrusted: anything malformed, out of range or arriving at the wrong moment is ignored rather than acted on, and nothing the other player sends is ever displayed as anything but plain text. The invite link you send a friend now carries nothing but the race itself. How races work in general is in Racing a friend down an endless mountain.
The servers
Alongside the game changes went a round of hardening on the servers behind the site. Every page now carries stricter security headers, the admin tools are locked down further, the service that hands out race relay credentials limits how often it can be asked, and those credentials expire quickly.
How it was tested
Every check was first attacked rather than just read. The attacks a cheater would try were run against a local copy of the database, set up the way the live one is, with a throwaway account: posting runs that were never ridden, posting under other names, backdating entries, editing the profile directly, asking for coins that were not earned. Each one had to fail, and every honest run had to keep working. Then the same attempts were made against the development servers, end to end, before the changes went live.
What it means for you
Nothing to do. If you ride, your runs post exactly as before, a moment after the ride is saved. If you had the game open while the update rolled out, one reload brings the new version; an old cached copy may fail to post a run until it is reloaded. The board may lose the odd run that could not have been ridden, and that is the intended outcome.
Your data is handled as the privacy policy describes, and the rules of the board are in the terms. The short summary of the changes is in the changelog, and the rest of the week is in A week on the mountain.
Found something?
If you find a way to put something on the board that should not be there, or any other security problem, please report it privately through the contact page rather than using it or posting it publicly. Say what you did and what happened; that is enough to reproduce and fix it.
