Like many people these days, I use facebook to track what’s going on with friends and family I don’t get to see as often as I would have done in years past. Long work days, large numbers of balls in the air and general “stuff” prevents actual face time far too often, but while it’s not the same as a night spent laughing over a beer, it’s better to note that a friend has a new job or that there’s a new baby en route or whatever over facebook than not at all.

And of course, facebook has games. Which is handy sometimes, for those moments when you have literally six or seven minutes to fill – too much time to sit still and be bored, too little to get anything real started. Personally, I play bejewelled on facebook for those moments. It’s been set up rather nicely there – blitz games of one minute, with scores being tracked so that friends compete in weekly rankings and little medals at various scores and scores being classed as being in the top X% globally and so on. The thing about this is that now you have a large community of people (over five million within six months of its launch according to Popcap, who wrote the game), all competing against one another – so now it’s important that it be fair or it feels like it’s not worth playing. Unfortunately tonight I noticed that someone’s been too clever.

The game’s written in actionscript. I obviously don’t know the source code, but I have a pretty good guess as to what mistake’s been made here. I’m guessing that to set up the initial game board, they used the noise() function to generate a bitmap with the six pieces represented by the values in one channel of the bitmap like so (adopted from the Adobe documentation):

var myBitmap:BitmapData = new BitmapData(8, 8,false, 0xff000000);
myBitmap.noise(<strong><span style="color: #0000ff;"><RANDOM NUMBER HERE></span></strong>, 0, 5, BitmapDataChannel.BLUE,true);
var image:Bitmap = new Bitmap(myBitmap);

So now you just read the bitmap, and for each of the 8×8 pixels, if the value is 0 display a blue diamond, if it’s 1 display a red square, etc, etc. It’s a clean enough way to do it, but it has a flaw, highlighted in light blue there. If the <RANDOM NUMBER HERE> number isn’t actually random, the noise looks the same every single time. And if they’ve used another method that calls Math.random(), I’m guessing they’re not seeding it correctly there either because what I’m seeing in the game is a fairly classic case of a random() function being repeatedly called without reseeding and giving the same sequence each time. In my case, I played three games before noticing that they all opened up like so:

Screenshot1

If I drag a yellow piece up to create a three-in-a-row in the top left corner there, it disappears and three blue pieces fall down from the top to replace them, creating a five-in-a-row (a hypercube in the game’s parlance) like so:

Screenshot2

If I use that hypercube to delete all the blue pieces on the board, a multiplier bonus falls in attached to a red piece in the upper left quadrant of the board like so:

Screenshot3

(You’ll note the timer at the bottom of the game is running out fast here, this is because I’m taking screenshots at leisure). If I now move the white piece in the top left quadrant to create a vertical three-in-a-row, it disappears, the multiplier (X2) piece falls down and a red piece falls behind it, creating a three-in-a-row of red pieces which vanish leaving this:

Screenshot4

And the game progresses on from there. But the point is that this is the same sequence, every time I’ve played. So far I’ve repeated the same board in something like fifteen games (mostly while grabbing screenshots and mucking about). So it’d be perfectly possible for me to spend hours exploring this board’s possible permutations to find the optimum set of moves, or in simpler words, to cheat.

And suddenly the game isn’t fun anymore. Did person X beat my high score because they spent time playing the same game over and over honing their procedure? Is my own high score really valid anymore as a result of this? And yes, there are indeed cheating methods already available to those who are willing to install software to their browser to crack the game, but this is somehow different from that, there’s less effort required to cheat using this bug and less malicious intent as well. So it’s a nice game ruined by someone missing one single step in the setup of the game board – namely, they forgot to seed the random function with an appropriate seed value which changes between sessions.