Posted on

Cheap security for web-based games!

h3. This is new to me, but I imagine true security fiends have already thought about this issue plenty, so I apologize if I’m repeating “news” that’s already been mentioned.

I came across an interesting security mechanism in my quest to automate some “Kingdom of Loathing”:http://www.kingdomofloathing.com stuff in ruby the other day. Their login system isn’t hosted on a “secure” server, which means that (under normal circumstances) anybody can snoop the network traffic, get your password, and end up stealing your account.

For a web-based game, this isn’t (usually) a big enough reward for the time spent sniffing through network traffic and hacking the account, so most such games haven’t got any security on their login forms (including my web-based games, though I may change this when I’m hugely successful). For online banking, obviously the rewards are much higher, so those sites need to be secure.

But what is it to be a secure web site? At the time of this writing, I’m of the belief that it costs a good deal of money to have essentially public-domain technology applied to a web site in order to get the stupid little “this site is secure” icon that makes people willing to put credit card, social security, and other private data into a web form.

I’m not saying that “VeriSign”:http://www.verisign.com is just in the business to rip people off – they provide a lot of services other than just encryption. My problem is merely that the technology of encrypting sensitive data, and assuring a user that a site is safe, shouldn’t cost an arm and a leg, especially for low-traffic sites such as a niche web game, where annual profit may be as low as one or two thousand dollars.

The technology used for website security is pretty basic, really. I mean, it’s powerful stuff and considered unbreakable, but the same security is available in libraries for dozens of languages for free – it’s just strange to me that these algorithms cost so much money ($500+ per year) to implement on a web server. Which brings us back to “Kingdom of Loathing”:http://www.kingdomofloathing.com….

I was writing a little script to automate login, trading, and some other minor things in this game. When I reached the login I found a very interesting twist – when you submit the form, your password is not sent to their servers. Instead, your password is processed and altered quite a bit: * The server sends your browser a session-specific “challenge” code, which is essentially a one-time code for encryption (yes, I tried using the same code multiple times with no luck, which makes me think it’s probably stored on the server with your session data). * Your browser uses javascript to first get an MD5 of your password, then an MD5 of that value concatenated with the challenge code. * This final MD5 is what’s sent to the servers.

This system doesn’t provide what VeriSign provides – it is only encrypting data going from the browser to the web page, not an entire area of the site. Incoming data is totally unprotected, which can be problematic in some cases (although I’d bet clever javascript could fix that to some extent by using true two-way encryption). And let’s face it, simply using a couple MD5 hashes and one-time keys isn’t enough to guarantee security. I’d imagine if the reward was high enough, somebody could figure a way to capture the data for a while, analyze it, and eventually work out either a password or else a security hole of some kind.

But it isn’t so much about having 100% security in this case – it’s about having “good enough” security for the situation. If the rewards aren’t worth the time, even a simple “Caesar cipher”:http://en.wikipedia.org/wiki/Caesarcipher is good enough security. And if we could implement a decent key exchange for a more powerful encryption system (“Diffie-Hellman”:http://en.wikipedia.org/wiki/Diffiehellman plus “AES / Rijndael”:http://en.wikipedia.org/wiki/AdvancedEncryptionStandard, for instance), we could ensure that small pieces of a site were 100% secure “for free”. From my minimal research, it does appear that many encryption algorithms do already exist in javascript.

So for all the web game developers out there, or other small-profile sites – if the only security you truly need is a few form passwords here and there, this MD5 solution used by KoL is probably not a bad fit. And if you need more security, a fully javascript solution shouldn’t be discounted, especially if you need high (but not necessarily perfect) security, but don’t have the extra money to pay for it.

Posted on

Netflix kinda sucks

This is an actual email conversation. Even if netflix offers to blow me, I’m switching. Just thought the world should know that however sucky Blockbuster may be, avoiding them is not worth taking it in the bum time and again.

I authored the original email, quoted below.  I'm amazed at the lack of
care for your customers.  Not only did you reply to the wrong person
(reading the ENTIRE email would have told you who the message actually
came from), but you didn't even address our concerns.  Your service
suddenly took a dive and all you can do is give us a canned response
about the USPS?  Undeliverable mail?  We've been getting mail at our
address for a very long time without incident, so don't go blaming your
company's problems on the USPS without at least some kind of
explanation.



1 - Two movies in a row were "lost", and one miraculously reappeared.
2 - One movie (Underworld) was shipped incorrectly.  This issue just
    sort of disappeared and wasn't even acknowledged in your message.



And even if the screwup for THREE MOVIES (two of which were nearly back-
to-back) is somehow truly USPS's fault, it still might be a good idea
from a customer service perspective to try to appease the customer who
has just mentioned that they're ready to switch service!



Anyway, thanks for cementing our decision for us.  We'll be cancelling
as soon as we get our queues set up and whatnot.  I look forward to
seeing how your unique views on customer retention work out.



Jeremy Echols



On 10/6/06, Karen Echols Photography karen@karenechols.com wrote:




  

    
Hi Karen,

    
    
Thanks for your inquiry.

    
    
We appreciate you letting us know that you never received the movie, yet
    it was checked back into our warehouse. It is the policy of the USPS to
    return mail that is undeliverable. The most common reasons are: the mail
    was damaged in processing and the label was illegible, the mailer cover
    became separated from the rest of the envelope, or an error with the USPS
    known as "Looping" occurred where the movie was returned to us in error
    instead of being delivered.

    
    
If you still wish to view this title, please feel free to add it to your
    Rental Queue.

    
    
If you have any further questions or concerns, please feel free to contact
    us.

    
    
Thanks,
    Jennifer
    Netflix Customer Service

    
    

      
-----Original Message-----
      From: karen@karenechols.com
      Sent: Friday, October 06, 2006 4:53:07 PM
      To: customerservice@netflix.com
      Subject: Shipping and Receiving Movies: Other

      
      
Subject: contact customer service
      To whom it may concern:

      
      
We've been with Netflix now for over a year, and have always been willing
      to put up with the throttling because we just didn't see the switch to
      Blockbuster as a viable option.  Recently, however, we've had one movie
      shipped incorrectly (with no attempt so far to correct the issue) and two
      movies go missing.

      
      
I had Underworld, 1986 (crime / comedy), on my queue and got
      Underworld, 2003 (vampire / werewolf).  I reported it as being in the
      wrong sleeve, and yet it never got sent back to me.

      
      
After I reported "Run Lola Run" missing, it mysteriously got returned (I
      never had it, so how could it have been returned?), according to your
      status report, and it cost me about a week and a half of waiting for you
      to get the movie to me for what you claimed was the second time.

      
      
Now we've got "The Sentinel" suddenly missing yet again.  Wonder how long
      before you claim we've returned that one, too?

      
      
If you can't find some way to explain your service problems and actually,
      God forbid, communicate with your customers, don't be surprised when we
      switch to the inferior service at Blockbuster.  I'd rather get less, but
      get what's advertised than keep getting these random problems that I
      can't even adequately talk to a real person about.
      Jeremy Echols
      [Address & Phone Number]

Posted on

BC goes into public beta!

“Bloodsport Colosseum”:http://www.bloodsportcolosseum.com was just announced to be in public beta! The official description of the game:

Bloodsport Colosseum is a gladiator sim like no other! Set in the future, fights take place in a retro-style colosseum where the only weapons allowed are those used by ancient gladiators. So how can you be sure it’s set in the future? You CAN’T!

Hire a team of gladiators, train them, equip them, and set up their daily fights. Challenge other gladiators directly while waiting for the daily fights to happen! Choose their riskiness, which has a direct impact on their longevity, short-term survival, experience and skill gains, and money gained from the arenas. Put them into the one-on-one arenas or the enormous free-for-all arenas. Laugh when they slowly wear themselves down, as battle scarring from fight after fight turns once-unstoppable champions into blubbering babies. Fire those who are no longer useful, and bring in fresh blood.

As you gain fame and fortune, new opportunities will show themselves, allowing better equipment purchases and more powerful gladiators to hire.

Posted on

Bloodsport Colosseum Updates

Notice the new spelling of “colosseum”. Some nerd-bullies at my work made me change the spelling because “coliseum” is a rather obscure way to spell it. In the next update, the whole game will be spelled that way.

On a lighter note, last week was huge – over 12 hours of work on BC, the most I’ve ever done in a single week. I’ve registered several new domains to get prepped for the open beta, I’m looking into several different hosts for the game (I loved Dreamhost for a long time, but lately service has been just crap), and I’ve gotten a ton of documentation out of the way.

However, I still have at least two weeks of work left, and in all reality that’ll probably turn into four. Lately I’ve been putting my bug-finding goggles on while I do work, and have noticed tons of new bugs. I would have allowed these in the closed beta, but in an open beta I consider them to be unacceptable. Last week’s twelve hours of work moved me from 15 hours left down to 10 hours left, so … yeah. Lots of little bugs I keep finding.

Oh yeah, and feature creep. Evil thing, that.

Posted on

New Bloodsport Coliseum update!

This has been a long time coming, but finally a really big change to the game is up. A huge amount of stuff was added, changed, and fixed.

I expect this to be the last major update before I go beta! Woohoo!! The “changelog”:http://bc.nerdbucket.com/help/changelog is always the best place to find details about major updates, but here’s a quick rundown of the most interesting new features. * Instant challenges are in! Players can run an instant challenge against one another and gain small amounts of xp and skills, plus loot each other’s credits (very small amount – I’m not a fan of major losses from random PvP)! * Danger level and multifight points for extra fun! ** The concept of multifight points is pretty simple – arenas that have multiple gladiators will give points to the highest finishers. Better placement, more points. These points are mostly a status symbol, though you will need a few to get to the heavyweight division. ** The “Danger Level” concept is a bit tougher to explain, but I’ll try anyway… when your gladiator’s risk is chosen, it affects how fast he deteriorates (battle scarring) as well as how likely he is to die if he loses a match. Danger Level is something of a tracking system to see how dangerous a gladiator has been recently. Fight dangerously, and it goes up. Be safe and it goes down. Higher levels grant extra money at the end of fights in which death is a possibility. In addition, getting to the heavyweight division will require a certain danger level, so all players will have to eventually live dangerously. Just my way of giving you, my loyal player, the finger. :P (Actually I think it makes the game more interesting, but some people will probably not see it that way, so oh well.) * General UI improvements – more feedback for potentially confusing things, email reports for battles, and other little things.

Posted on

Insomnia

I seem to suffer from some rarely-heard-of form of insomnia in which I generally sleep well, but sometimes can’t fall asleep for hours. And when I fall asleep, I usually sleep well, but only if I don’t go to sleep too early.

Tonight I fell asleep putting Alex (my son) to bed, and that was around 8pm. I woke up just before 1am, and haven’t been able to sleep since then.

The worst part of this almost nonexistent disorder is that sleeping medication doesn’t work either… I tried some of that hardcore stuff you need a prescription for (Ambien or Lunesta, can’t recall which). That stuff seems like it would be great if one feels that he isn’t bumping into walls or falling on his ass often enough – it’s definitely got the “impair motor functions” bit down pat. But it just didn’t make me sleep any better than normal.

Why is that the worst part, you ask? Well, simple. For a sleep disorder that strikes randomly, there would be little fear of growing dependent on (or even gaining a tolerance to) the sleep meds. So in my situation, they ought to be a fracking lifesaver!

On the plus side, this means I have a bit of extra time to work on Bloodsport Coliseum before I stop being able to function for the day!

h6. Yes, I said “fracking”. I have heard rumor that kids as young as 10 hit my blog (in fact I think they’re my main demographic), and as much as I like to corrupt minors, I prefer to do it in more interesting ways. So expect more Battlestar Galactica swearing over Real World swearing from now on.

Posted on

More poker…

Guess I forgot the point of my poker post. I wanted to brag it up that I took 14th place in a $5.50 tournament in which 850+ people entered. I was all proud. Now that I’m getting beat left and right, this message doesn’t make me feel as superior as it was supposed to.

Posted on

Bloodsport Coliseum: No more challenges :(

h3. My apologies, but challenges were a waste of time.

I’m sorry to say that the idea of challenges is going to have to be removed. Well, more like changed beyond any recognition. I still like my idea, but it turned into more of a system where either it was easily abused (two friends constantly challenge each other, gaining tons of XP), or it was limited and boring (limited number of challenges per day, no XP gains, or a combination of the two). In the end, I realized I’d spent almost two weeks on this system which I’d built solely to make it a real challenge to get to the heavyweight division!

Then it struck me – instead of inventing gameplay mechanics that were cumbersome and potentially game-breaking, why not just use the mechanics I already have? Here’s what I mean: you currently have a system for choosing how risky your gladiator is going to be. High risk means a real chance of death if you lose. Low risk means less chance, or no chance at all. High risk means more scarring. Low risk means less XP and skill gains. So we have risk, and I want heavyweight gladiators to have “proven” themselves by fighting a dangerous battle (the original plan was that they needed to be involved in at least one deathmatch battle). So why not just require a certain level of “danger” before they can move up to heavyweight?

h3. Danger Level Overview

Here’s the general idea: a gladiator’s DL (Danger Level) will start at 0 and move depending on his risk. A higher risk will move up relatively fast, while a lower risk will move up slower, or maybe even move down. Obviously it can’t go below 0, and there will be some upper limit as well. A gladiator with a high DL will actually gain money faster, because the public likes him — he’s proven to be both dangerous and a winner (high danger + losing means death, remember), so there will be incentive to put your life on the line.

Additionally, a heavyweight will require a certain DL. Probably not terribly high, as I don’t want people to feel like they have to risk death all the time in order to get to heavyweight, but high enough that at least one very risky battle has to take place, or else a few low-risk (but not safe) battles.

The real catch here is that you can’t just be risky with a new gladiator and then go ultra-safe, having set him up for heavyweight! Since DL changes each time fights are run, a safe gladiator will go back down to 0 fairly fast. The boost is very temporary, so to get to heavyweight, you’ll have to be unsafe with a strong gladiator! That was exactly what I wanted originally, so this system is great. Plus the system works with all players, not just those willing to try and set up some wacky challenge.

h3. So what about challenges?

Challenges will exist, but in a totally different form. Like many webgames I’ve seen, it will be an instant challenge in which the challenger has the most to lose (since the challengee isn’t actually able to say ‘no’). The winner will take some amount of money from the loser (more if the winner is the challengee), and both gladiators can gain a small amount of XP. I’m not sure if I’ll do skill gains or not, but it’s not out of the question.

The main point of challenges will be something to pass the time, not a way to gain massive amounts of credits or XP. They’ll allow a fight with a gladiator of your choice, and give you minor rewards.

Much like other games, challenges will also have some kind of limit, probably one per day per gladiator or something.

h3. Still a ways out…

So yeah, after wasting two weeks of time, and running into new bugs before wasting all that time, the game is still about 10 weeks out. Just like it was four weeks ago :(

Posted on

POKER!!

I’m a big fan of Poker. I freely admit that this is because of the “World Poker Tour”:http://www.worldpokertour.com. I mean, I always like the idea of poker, but I wasn’t exposed to Texas Hold ’em until the WPT popped up. And it wasn’t until I looked into Hold ’em that I realized the joys of 7-card stud and Omaha.

So a few years back I caught the WPT and laughed at how absurd it was to televise something as boring as poker. I mean, watching a bunch of people on TV playing cards! How lame is that?

Within about 10 minutes I was hooked. Go figure. For some reason I really can’t explain, I find it as tense as a good football game. I’ll never be one of those idiots who call poker a real sport, but it’s certainly more of a spectator “sport” than I would ever have guessed.

So anyway, I play on “Ultimate Bet”:http://www.ultimatebet.com right now. (No, that link isn’t an affiliate link or anything) I generally am not very good, so when I feel like wasting money on poker it’s usually because I need something to occupy my time, and I blow my money on the penny tables so I can have fun for a while before going broke.

UltimateBet is one of the smaller poker sites, with less than 20k people on during peak hours (Compare to PokerStars or PartyPoker at 50k+), but their support staff is very good: * I once had a problem they couldn’t figure out (‘#’ couldn’t be part of a password, so my password kept getting randomly reset) and they gave me 500 “Ultimate Points”. These points are worth about $1 per 250, so it was nothing incredible, but it was definitely a nice gesture. * A few weeks ago I went to take advantage of their 100% deposit bonus, but my card was declined (some banks consider “gaming” purchases to be unacceptable). Within minutes, a rep called me and told me how to use “NETeller”:http://www.neteller.com to do an instant payment. But what’s more, UltimateBet covered the normal fee (usually 8.9% I think) so I could get the money to them ASAP.

Obviously a big poker site can afford to do these sorts of things, but when I played on other big sites, I was never given any kind of personal service like that. PokerStars may or may not cover the NETeller fee, but they certainly never mentioned it to me when I first used them. PartyPoker definitely doesn’t care about customer satisfaction. After having some kind of account problem with them, they responded to my support request with a FAQ that had nothing to do with my issue! For a poker site with so many people and so little rewards, I was amazed. They didn’t offer any kind of compensation, but that wasn’t nearly as big a problem to me as their unwillingness to even address my issue.

So for budding poker players out there, you’ll find far more variety of players on PokerStars and PartyPoker. But UltimateBet is far more customer-oriented.

Posted on

Final Destination 3

I thought I should post something new before everybody who doesn’t give a fuck about research studies hits my blog and decides I’m too serious and I’m a prick whose wife cheats on me (which clearly explains why I waste hours researching other people’s flawed research).

First of all, Final Destination 3 spoilers will be found here. Do not read further if you don’t want the movie spoiled! It’s worth watching, in my opinion, so it’s best to watch without spoilization. I’ll warn before spoilers, of course, but at least be warned…

Where to begin. Like FD1 and FD2, it starts with a premonition about extremely painful and gruesome deaths. If that’s why you watch these movies, then 3 is definitely a must-see.

Unlike FD1, it doesn’t utterly suck balls. Unlike FD2, it has some surprises. But unfortunately, in my opinion, even though the general ideas are better than in either of the first two movies, the overall story is just more of the same and doesn’t make for a better movie. Worth seeing, but not better.

First major problem: there’s a death that’s foreseen that doesn’t make much sense (see below for a full spoiler). My wife pointed it out to me, and I can explain it, but it was a little weird for sure.

Second major problem: the extra feature for “choose their fate” or whatever. Very shitty feature. It had a ton of potential, and at one point appeared to really make a difference. But overall, the only difference you could make to the movie as a whole was ending it prematurely. Technically this might alter the outcome, but if you watch the full movie you won’t really know that the actual ending doesn’t happen. In other words, it doesn’t alter anything, it really does just end early!

Anyway, the movie was a lot like its predecessors, but I felt like it had more gore and at the same time more substance. The story was solid enough. The characters were fun. It was a good flick if you like this sort of movie. If you disliked FD1, try out FD2. If you like that more than 1, you will probably enjoy 3. 3 is definitely more of the same, but still well worth watching.

h1. SPOILERS

Main spoiler: the reason I thought this movie was really good was the ending.

STOP READING IF YOU DON’T WANT THE END SPOILED!!

The end of the movie kills everybody. But not just like in the first movie where it was really difficult to tell what happened. In this movie, our heroine got a second premonition before dying. Only, she got the premonition when it was already too late. It was incredibly cool. I am a huge fan of happy endings, so a non-happy ending has to be pretty good for me to like it. This was such an ending, in my opinion. Seeing the end happen, then finding out it’s a premonition, and then seeing that they can’t get the train to stop… that was classy. Very cool. This is why my Netflix rating was 4 stars instead of 3.

The death that didn’t make sense, mentioned above, was McKinley’s (dunno if that’s spelled right). He was supposed to kill our heroine, but he ends up dying instead. Now if this makes any sense, she should have avoided being killed by him and then, and only then, death would skip her, start back at the beginning, and kill him. Instead, she avoids a seemingly random death that actually ends up killing him.

I explain that as McKinley was supposed to kill her by keeping her attention while he talked to her. But because she dodged, death took him instead. But it’s still weird no matter how you slice it.

Second issue was the special “Choose their fate” bit on the DVD. I can’t lower my rating for the movie because of this, as it’s not part of the movie, but it was annoying. It looks like you can change one really major event in the movie – they actually save one of the other characters. But he’s never dealt with later in the movie when everybody else dies! I fully expected him on the train at the end! Totally lost style points when I saw that he was just avoided after I made the choice to save him.