[HN Gopher] When Random Isn't
___________________________________________________________________
When Random Isn't
Author : orlp
Score : 348 points
Date : 2024-01-14 21:56 UTC (1 days ago)
(HTM) web link (orlp.net)
(TXT) w3m dump (orlp.net)
| hhh wrote:
| World of Warcraft is what started my interest in programming. I
| was 6 when it came out, and when private servers started popping
| up I became interested in how to make my own npcs, and that's how
| I picked up Lua.
|
| I still have a lot of posts on the forum for that stuff
| (MMOwned), and one of the people that helped me learn then still
| posts semi-actively.
|
| Compiling my own private server core was how I learned about
| compiling things, SVN, and how to apply patches (there was a bug
| related to mage's fireball, can't remember what it was.)
| behnamoh wrote:
| > I still have a lot of posts on the forum for that stuff
| (MMOwned), and one of the people that helped me learn then
| still posts semi-actively.
|
| Man, whenever I am reminded of the old forums I can't help but
| get nostalgic. Nowadays, it's like a good piece of the internet
| is replaced with dopamine-inducing social media apps and gated
| forums (e.g., Reddit).
|
| I don't know why I still hang out here on HN, maybe mainly
| because it reminds me of the old forums...
| acheong08 wrote:
| I do wish more of the younger generation would be willing to
| hang out on forums/irc/etc. I would not install Facebook even
| if it cost me friends
| DeathArrow wrote:
| Newer generation is on TikTok, not Facebook.
| Ns9 wrote:
| These are anything short videos, but not just the youth
| it's almost everyone and I have that damn problem
| IlliOnato wrote:
| So far none in my social circles uses Tik-Tok, thanks
| $deity.
| gumby wrote:
| We don't know how old acheong08 is.
| Buttons840 wrote:
| HN threads die to quickly though. For the true old-forum feel
| we need fewer users with focused interest and threads that
| last for weeks.
| hprotagonist wrote:
| threads can go for multiple years, if you do it right
| behnamoh wrote:
| he's right tho -- lack of notifs on HN means you won't
| know about replies to your comments or new comments in
| fav threads.
| aspenmayer wrote:
| Tell HN: HN Replies is email notifications for comment
| replies, maintained by Dan Grossman.
|
| https://hnreplies.com/
|
| https://news.ycombinator.com/user?id=dangrossman
| DeathArrow wrote:
| You can make a browser add-on or use a script to keep you
| in the loop.
| maxbond wrote:
| Which is to say, always reply within two weeks.
|
| Does anyone know of a thread on HN that survived multiple
| months?
| Buttons840 wrote:
| Also, old forums didn't organize comments in tree
| structures, they were just flat chronological comments.
| This is technically inferior, but it helped keep everyone
| more focused on a single thread, as it were.
| Paul-Craft wrote:
| You don't need to go to an unthreaded format, with all
| the attendant clutter and such, to do that. All you have
| to do is bubble up threads that have had recent messages
| to the top. _That 's_ why HN doesn't (or at least
| shouldn't) try something like that: it wouldn't be
| "Hacker _News_ " anymore, so much as "Hacker Gossip" or
| whatev.
| DeathArrow wrote:
| In most forums, one example being DPReview, the user can
| switch between threaded view and flat view. I choose flat
| view, because I usually read the whole topic if it
| interests me and I usually want to read the last updates
| without having to go trough multiple threads.
|
| Also, flat view, mimics a real discussion between people.
| DeathArrow wrote:
| >For the true old-forum feel we need fewer users with
| focused interest and threads that last for weeks.
|
| There is 4chan.
| Vvector wrote:
| I wrote an AH script. It would scan every auction, buy under-
| priced items, and relist. If someone undercut me, it could cancel
| and relist just below them. I basically had unlimited gold.
| AnthonyMouse wrote:
| This is basically what high frequency trading is in real life.
| eru wrote:
| Only with a lot more regulation, and the competition is very
| sharp.
| Jaygles wrote:
| How did you determine what was under-priced?
| andenacitelli wrote:
| Spent some time with this kind of system in WoW,
| TradeSkillMaster. Figuring out an accurate valuation was
| difficult and one of the biggest differentiators of how
| successful you were.
|
| This would vary by item, but was most commonly some
| combination of recent minimum buyouts (usually over the last
| two weeks) historically value (several months), and much
| more. Common items would usually be mostly recent value
| driven, whereas lower-supply items might have a larger
| component of historical weighed in, as there might be quite a
| bit of fluctuation day to day and you care much more just
| about the general trend.
|
| All sorts of nuance to it. You can do more complex stuff like
| only doing your price estimations off items that actually
| sold, set values based on a percentage of any other value,
| and much, much more. It gets really complex but is really
| cool at scale.
| hinkley wrote:
| Ingredients were always pretty stable.
|
| I think a lot of sales came down to people trading time for
| money. I just hit a critical level and I want some cheap
| blues to power level faster and got shitty drops. Or Buddy
| wants to play and he's laughing at my gear, oh there's a
| reasonable purple.
|
| I found a lot less stress looking for cheap blues and
| greens to disenchant for ingredients. That could suck up an
| hour a day easy. Which is why people just dumped them. Not
| worth their time.
| Grimblewald wrote:
| Ingrediants can be stable but are still subject to
| manipulation. I made a killing by having a lot on hand,
| pushing bids down during busier periods, which would work
| synergistically with the lil goblins on during this time
| who list everything they sell at an undercut. This can
| cause the ass to fall out of pricing. You then buy up the
| cheap mats as fast as you can, but also alchemists will
| start making potions for cheap looking to undercut other
| potion makers with their zero time investment potion
| making for cheap. You buy those as well when they get
| cheap. Then you delist the series of sales you made that
| pushed prices down and buy the undercuts that helped get
| you there. Suddenly theres a big rift between current
| price and the bulk of items and most sellers stop
| undercutting and cheap supply runs out. relist regular
| small batches at 1s under market and make bank.
| DeathArrow wrote:
| Just like in real world. But you have to own at least
| half of the market to pull that. Or some else can short
| you.
| hinkley wrote:
| WoW was fully sharded at the time, so you had to control
| a fraction of a fraction in order to use these
| strategies. And you generally became expert in one or two
| and ignored the rest except for slow days.
|
| Probably more like a third, or the plurality instead of a
| simple majority. The price most players saw was slightly
| above what the market would bear. During peak times
| everything else would disappear.
| DeathArrow wrote:
| You can learn more about economy from these threads than
| following a course at Stanford.
| leoff wrote:
| I've also spent some time playing with TSM. I would login
| to WoW multiple times a day only to play on the AH.
|
| I don't quite recall where from, but I had some price data,
| where I filtered the top X products that made the most
| volume (price * amount sold).
|
| I then simply did something like "if the price is lower
| than Y% of the average, buy it. Don't sell the product for
| less than you bought it for."
|
| Surprisingly this simple formula works very well and I made
| more gold than I've ever had. It was more than enough to
| pay for the monthly subscription and I even bought
| Overwatch using the I credits I got from it.
| Vvector wrote:
| After playing the AH manually for a long time, I'd know that
| a stack of ore would sell for 20g. I was manually buying when
| under 20g and relisting. My script just reduced the tedium.
| I'd manually add in checks for each high-volume item. It was
| super-hacky, but so effective, I didn't need to improve it.
|
| One script would iterate over every item in my inventory. If
| it matched a hard-coded list, it would auto-list it at the
| hard-coded price. Another script would scan every item on the
| AH, and if matched another hard coded list, it would buy
| them.
|
| Another story, pre-script. WOW had the inscription update
| incoming, which used flowers to make glyphs. I correctly
| assumed the demand for Peacebloom (tier 1 ingredient) would
| skyrocket once the patch hit. I spent three weeks buying
| everything on the AH, using multiple characters to store it
| all. The night before the update, I listed it all for 20x the
| normal price. The next morning, everything sold out
| completely. I remember it being 200 stacks @ 5g each, sold
| for 100g each.
| hinkley wrote:
| I recall when Pandaria hit there was some resource where
| you could get only like one a day but they could be sold.
| The power gamers and the server first people were buying
| all they could to craft gear to ratchet up the Raid ladder
| ASAP. I convinced a couple of my friends to sell all theirs
| at the prevailing price, which was just stupid high, and on
| about the day we would have been able to craft our first
| item, the price had crashed so much we bought them back at
| a lower price. If you waited a few more days, you could buy
| enough for two items.
|
| Getting 70% of the way to a goal has 0 value. You can often
| sell your patience to other people in that game.
| eru wrote:
| > Getting 70% of the way to a goal has 0 value.
|
| Well, apart from the fun of playing the game?
| pests wrote:
| No, games are only fun if you get all the achivements and
| 100% the game and buy every item ever relased in the shop
| and complete all battle pass levels because FOMO because
| gaming is not about having fun anymore, its about
| reaching artificially set goals and collecting cosmetics.
| TeMPOraL wrote:
| > _gaming is not about having fun anymore, its about
| reaching artificially set goals and collecting cosmetics_
|
| I.e. it became indistinguishable from normal adult life.
| pests wrote:
| :(
| DeathArrow wrote:
| At which point, you rather quit gaming and use your time
| and energy in the real life. That way you can touch your
| achievements because they aren't just numbers in a SQL
| database.
| eru wrote:
| If you make lots of money, and keep it at the bank, your
| achievement might very well be recorded as a number in a
| database.
|
| (But with the distinction that you can withdraw and spend
| that money.)
| DeathArrow wrote:
| When you play a game you trade your time to make other
| people rich. When you work you trade your time to make
| you rich. That is the most important distinction.
|
| Would you buy you a Lexus or help someone else buy their
| second yacht?
| pests wrote:
| You can play games without committing any sum of money
| though.
| DeathArrow wrote:
| But your presence in game attracts others who will do
| some spending.
| pests wrote:
| > just numbers in a SQL database
|
| This is what breaks most games for me. Once I see the
| gameplay loop, I know I'm just playing spreadsheet
| optimizer behind the scenes.
| hinkley wrote:
| I've talked friends out of getting back into WowW because
| I know if they start I'll start, and I always take it
| more seriously until it turns into a part time job, which
| I will continue after they quit again. Touching grass is
| much more enjoyable.
|
| Gamification has gone too far, circled back onto games
| themselves and made them into chores. Everything is gacha
| or tamagotchi or both now.
| hinkley wrote:
| You don't get the shiny or the achievement until you hit
| that milestone. If I wasn't clear, I wasn't meaning
| "completionism" by 100%, I just meant the milestone.
| SeanAnderson wrote:
| Wait, did you _write_ Auctioneer? or was this something similar
| to Auctioneer but you decided to not use the "industry
| standard" tooling?
| bimguy wrote:
| I very much doubt it. There's a lot more functionality to
| Auctioneer then what was mentioned. Also, there are other
| popular auction add-ons, I think they would have just said it
| if they created Auctioneer.
| Vvector wrote:
| I used Auctioneer, found it very helpful. But it couldn't (at
| the time) do the things I wanted to do. My scripts didn't
| have any UI or fancy graphics, just outputting text to the
| console.
| Thaxll wrote:
| Except that there is a deposit fee in WoW AH.
| anonymoushn wrote:
| This is correct, but I think for a lot of items the non-
| refundable listing fee is a trivial amount of currency that
| you're happy to pay in exchange for faster execution, because
| it's based on the vendor sale price.
| Grimblewald wrote:
| Its a multiple of vendor price. So for a few items it is
| quite hefty. For pets, its always 1s flat so pet pricing
| can be quite volatile.
| hinkley wrote:
| The deposits mostly just stop people from overloading the
| system, and put a tiny bit of friction into the economy.
|
| I always made the most money when I half heartedly farmed on
| one or two characters and traded about five times as much
| material as I brought in.
|
| It's a commodities market. Figure out what the weekly and
| daily average is, try to anticipate drop off in demand (eg,
| post launch), if anyone undercuts you by too big a margin,
| buy them out and relist. If a little, either drop your price
| or wait.
| tapland wrote:
| A lot of us have been using Auctioneer, which has this
| functionality, since Vanilla. How was the experience of writing
| your own?
| Vvector wrote:
| I used Auctioneer. But it couldn't do what I needed at the
| time, or maybe I didn't investigate enough (TBC/WoTLK
| timeframe). My scripts were no UI, no graphics, it would just
| output console commands. The Blizzard API was very easy to
| work with. Maybe 20 lines of LUA for iterating over every
| item listed on the AH.
| plandis wrote:
| You're the creator of the Auctioneer addon? That's got to be
| one of the most popular WoW addons for a decade or more at this
| point.
| benreesman wrote:
| When I explained how money works to my younger brother after
| having it explained to me by actual drunk guys who work at
| Goldman (it's basically impossible to get the truth any other
| way as far as I know), his reply was:
|
| "You mean to tell me that the IRS is a _gold sink_?!"
|
| "Well, actually that's a pretty good analogy, the difference
| is... well... that's a pretty good analogy!"
| wodenokoto wrote:
| Maybe I don't understand what a gold sink is well enough, but
| I don't see how IRS can be considered a gold sink. Gold spend
| with NPCs are not returned to the economy. Taxes are returned
| to the economy.
| pests wrote:
| > Taxes are returned to the economy.
|
| I hope we don't start dropping bombs on our own cities....
| Doxin wrote:
| The money isn't stuffed inside the bombs. The money is
| still returned to the economy for the most part even if
| the bombs are "spent" elsewhere.
| pests wrote:
| > The money isn't stuffed inside the bombs.
|
| I thought that was the only explanation for their prices.
| wodenokoto wrote:
| Paying for the construction of a bomb, is participating
| in the economy (as opposed to outright burning the money)
| taneq wrote:
| Kind of a broken window fallacy (the bomb isn't necessary
| in the first place) but also kind of not (the tech
| developed for military hardware does eventually get used
| for good).
| benreesman wrote:
| Tax receipts are in no sense returned to the economy unless
| you really overload one of those words.
|
| A modern economy works by running a printing press a
| _little_ faster than a furnace, with the coefficient being
| (under honest and competent management) a good estimate of
| next year being better than this year by such and such, a
| self-fulfilling prophecy in a good way until you like, burn
| the planet via carbon emissions or some hard constraint
| like that.
|
| And it's a perfectly good system... under honest and
| competent management. It's just easier to corrupt than
| systems with much lower potential (which is the distance
| between gold bug and ignorant, those folks have a point,
| they just rarely make it).
|
| This is where all the 1971 stuff comes in: no rich person
| does anything but advantage their less-capable kid or lover
| or whatever unless someone is pointing a gun at them. (e.g.
| Altman has a job let alone unfettered power). The gold
| standard has a lower maximum potential risk to the extent
| you can stop there being a de Beers of gold. You likewise
| accept 50 years from the transistor to a computer in your
| house even if you're fucking loaded.
|
| The unanswered question is: can we get competent and honest
| leadership (after a fashion) back without the bloodshed it
| has required 100% of the time before?
|
| A lot of us hope so but don't have an answer just yet, and
| the clock is ticking.
| whage wrote:
| This post feels like recent movie trailers. The way you
| wrote it makes me believe you know what you are talking
| about but I have no idea. Care to give the curious reader
| pointers to the topics you mention? I mean the "printing
| press to furnace" analogy of the economy, or what you
| mean by 1971 or the gold bug or the 50 year transistor
| omg what?
| benreesman wrote:
| I'm just a nerd whose nerd hobbies came to encompass
| finance when I moved to Manhattan. I was also a party
| monster back then (please don't read the book) which for
| a childless bachelor is a pretty reasonable way to get
| the most knowledge NYC has to give in a year.
|
| If you have particular questions about the monetary
| system, I know enough to either answer or know that I
| don't know and refer you to someone who does.
| dspillett wrote:
| _> If you have particular questions_
|
| There were four fairly direct questions in the post you
| replied to, to which you might like to give a response:
|
| _> > [what do you] mean [by] the "printing press to
| furnace" analogy of the economy_
|
| _> > what you mean by 1971_
|
| _> > or the gold bug_
|
| _> > or the 50 year transistor_
|
| The first of those I'm pretty sure I understand what you
| are meaning, though if I'm right about that I don't think
| it is a good analogy, but the others I have no context
| for.
| benreesman wrote:
| 1971 (and/or 1973) is a year people often point to as
| when we "went off the gold standard". Neither year is
| particularly great as a signal example of the collapse of
| what is loosely called the "Bretton Woods" monetary
| system, but either is a pretty good nickname for it.
|
| By "printing press" I mean the set of mechanisms in which
| fractional reserve deficit spending creates the money
| supply to notionally value future growth, and by
| "furnace" I mean the set of mechanisms by which we
| prevent arbitrary inflation as a result. You can measure
| the money supply in plenty of ways, but for someone who
| needs a glossary on my original comment, TLDR you want a
| number called "M2".
|
| A "gold bug" is someone who either does or advocates the
| strategy of holding "precious" metals as a uniquely good
| asset class (no one turns down a free pile of gold, many
| of us think the market is pricing gold as well as we
| are), in particular an asset class uniquely resistant to
| inflation and/or the "government". I can assure you from
| painful experience that "the government" gives no fucks
| if you have gold in your back yard when they make a
| clerical error.
|
| 50 years is roughly the period of time it took for at
| least two separate inventions of "the transistor" by a
| bunch of Bell Labs people, but overwhelmingly associated
| to a guy called Shockley, to culminate in a useful
| computer that a middle class person could afford to have
| in their living room. I learned to code on an IBM PC my
| distinctly middle-class grandfather owned, and it is a
| substantially better computer than no computer, a harder
| claim to make about the Apple I for example.
| shawabawa3 wrote:
| > "printing press to furnace" analogy of the economy
|
| Very roughly modern economies work by printing money in
| the form of government treasuries (government borrows $
| to run the country) and destroys money by charging taxes
| (taxes go to IRS and are used to pay off the outstanding
| treasuries)
| Workaccount2 wrote:
| >A modern economy works by running a printing press a
| little faster than a furnace,
|
| I think you are confusing Modern Monetary Theory with
| modern economics. What you are describing is MMT, not
| what actually happens (the government collects taxes then
| spends that money + prints more money)
| benreesman wrote:
| I'm aware of both Modern Monetary Theory as well as
| behavioral economics. I'm aware of what bankers say "off
| tape" or "LDL", ("let's discuss live"). I've worked
| places where we said "he was with us at Goldman", because
| I've worked at places and during times that were so elite
| that my last name, Reesman, which is Dutch, was
| overlooked for "sounding too Jewish", which is an actual
| thing I've been tapped on the shoulder about but still to
| this day don't understand. I'm not aware of what social
| dynamics are in play when sounding too Jewish is an
| issue. Bet your ass New York bankers say shit like that
| though.
|
| You sir, like many, imply an academic knowledge of
| markets that would be tradable. If you know what's wrong
| with my comment there's serious money in it, and no one
| can buy the education you're implying because the price
| would be the arb value of all the misprinted securities,
| trillions easily.
|
| I'm asserting that actual guys called names like
| Cavendish, who get the actual spread by virtue of being
| in jobs where you need a name like that laugh in their
| beer, I've been there and I've seen it.
|
| "You've never dealt with Harkonnens, I have, they're not
| human they're BRUTAL".
|
| You're free to disagree, and free to do so under a
| pseudonym. But if you know anything I don't about markets
| generally and US sovereign debt markets in particular I
| don't: fuck this HN shit and go trade it. You'll own HN
| by the close of business tomorrow, and I will be the
| least of your worries.
| DeathArrow wrote:
| Doesn't matter much when money can be printed by FED (which
| is owned by banks, not by stste) or just made up out of
| thin air by banks and financial institutions.
|
| The gold in online games is fabbed the same way.
|
| The only two reasons that makes it hold value is that is
| the only sanctioned way to exchange goods and services and
| the players trust it. Once one of the two reasons does not
| exist, gold will not have any value, just like money in
| real life.
| benreesman wrote:
| The Federal Reserve system is a quasi-public, quasi-
| private system. It's a public/private partnership, which
| is actually a pretty sane default for how governments
| should interact with banks.
|
| Sloppy, leaky Venn diagrams are a fact of real life.
|
| Let's try to avoid "Jews vote for Likud" or "nine eleven
| was an inside job" type oversimplification?
|
| It's complicated but for a good set of reasons.
| PeterisP wrote:
| As you note, the Fed lending policies do act as a money
| source (when increasing supply) and also as a money sink
| (when decreasing supply). That doesn't invalidate the
| parent point that _taxes_ have nothing in common with a
| money sink, since that mechanism (unlike Fed) doesn 't
| affect money supply but rather simply moves it to
| specific purchases/institutions.
| DeathArrow wrote:
| Can you share with us what you did explain to your brother?
| benreesman wrote:
| I'll do my best to be useful, with the caveat that
| "monetary policy" is like, a PhD at a good school and
| industry experience and stuff, it's a big field.
|
| To address the particular point that he was replying to:
| the government (especially the US government) has only one
| money problem: does anyone lend them money (buy their
| bonds) when they're picky about terms (floor on auction
| optionally) at an acceptable overall outcome (you still
| believe I can invade your country if you fuck around on
| USD).
|
| So it's simpler and faster and the math is easier to just
| burn all the checks the IRS gets and make new ones at the
| Fed.
|
| Which is the same solution as all the games landed on.
| DeathArrow wrote:
| Well, money printing is taxation.
| Workaccount2 wrote:
| Only if it isn't offset by raw economic growth.
| benreesman wrote:
| Technically incorrect in nitpick ways but substantially
| the best intuition: the job of politicians and regulators
| rounds to: "match the growth of the money supply to
| people using skills to generate yet another round of
| speculative but self-fulfilling growth projections with
| the least amount of dumb rich kids having important
| jobs".
|
| To me at least, this sounds like a hard job in Athens
| with the Bundesbank pardon the ECB breathing down your
| neck, and a trivially easy job in Washington DC where you
| can physically destroy anyone who disagrees with your
| assertions about the value of anything.
|
| Unfortunately the actual job has become: "maximize class
| solidarity at any cost up to and including arbitrary
| bloodshed".
| benreesman wrote:
| No, a thousand times no.
|
| Inflation wipes out the notional value of debts and
| therefore favors the 80-90% of people whose finances are
| dominated by a debt term. At the low end of being lucky
| that debt term is unsecured dollar-valued debt like a
| credit card. At the high end misguided boomers acting
| against their own interest owe that debt as a 30 fixed
| secured by a home.
|
| The subset of boomers (or wannabe YC insiders) who suffer
| at the hands of inflation are fucking vocal but
| statistically irrelevant. The ratio of actual
| financialization of actual asset classes to people who
| whinge about "inflation" is maybe the stupidest thing
| said stupidly constantly.
| Cthulhu_ wrote:
| Pretty good, but not complete because the money is gone in a
| game's sink, whereas in the economy it's more cyclic. In
| theory.
|
| That said, video game economics are pretty fascinating. I
| love reading writeups on Eve Online economics. I play FFXIV
| myself which isn't as good as Eve when it comes to economy,
| but interesting in its own rights. I wish it had buy orders
| and the ability to buy individual items instead of whole
| stacks, lol.
| benreesman wrote:
| I upvoted your comment for being high-value even though I
| _think_ I disagree with the first half: "Chicago" / "Fama"
| strong-form EMH economics have had only a few brushes with
| reality, so N equals "not enough", but I'm partial to the
| 100% of the time it's been a disaster, the best example of
| which is almost certainly Scholes' tenure at LTCM (and
| "When Genius Fails" is a a drop everything, call in sick
| and read today book), but even that is really just an
| exclamation point on the whole post-Reagan world, the
| criminally, well, crime of the Greenspan clique.
|
| How a group of people can be wrong every time about
| everything in stated ambition while acting in ways
| completely consistent with Randian Objectivist Naziism in
| practical terms, and not be hounded out of public life
| bewilders me. There is probably no moment as simultaneously
| classist and misogynistic and stupid as when Brinksley Born
| got knee-capped for _being right about everything_ by
| Summers, Greenspan, and Ruben with the Ghost of Future
| Reich (Ayn Rand) looming ominously in the background.
|
| The people running the show around here, the "effective
| altruism" crowd like SBF and Altman and shit? They still
| put Atlas Shrugged icons in their Mastodon chats long after
| everyone without an agenda realized they're the new version
| of old fascism.
| ezrast wrote:
| Not in all theory - Modern Monetary Theory[1] posits that
| if you control a mint, your money is effectively infinite
| and cannot be meaningfully increased. As such, some
| taxation truly does serve only as a money sink (but a
| necessary one that prevents runaway inflation in the face
| of government spending, as well as being a vehicle for
| incentivization).
|
| [1] https://www.investopedia.com/modern-monetary-theory-
| mmt-4588...
| cowthulhu wrote:
| I wonder if there's any chance that they were using the same RNG
| on the server. Seems like you could theoretically exploit it if
| so, given a very low usage server, low ping, ability to get a
| decently precise window into the current state of the rng, and
| ability to quickly generate another event with a high economic
| variance tied to rng.
| plorkyeran wrote:
| Vanilla WoW used Mersenne Twister on the server, which has a
| number of problems but isn't so trivially broken. They posted a
| lot of the details how the server-side RNG worked in a (mostly
| unsuccessful) attempt at killing the rumors around "loot seeds"
| and such that superstitious players were utterly convinced were
| a thing.
| 38 wrote:
| FYI your link color is almost unrecognizable. its basically a
| (very) dark blue against black.
| pests wrote:
| You might be using a setting to force dark mode which has no
| guarantees to be correct.
|
| The site has white background with black text in normal and
| darkmode. Could probably use a better stylesheet for darkmode
| but disabling whatever you have on would probably also fix it.
| 38 wrote:
| > link color
| pests wrote:
| What?
|
| If the link colors stay the color they were designed to be,
| but you automatically convert the foreground and background
| colors, you're gonna have a bad time.
|
| If the site is black on white, with dark links, and you
| change it to white on dark with dark links, the links are
| gonna be hard to see.
|
| That has nothing to do with the links, the issue is you
| changed the primary colors without changing the link color!
| 38 wrote:
| you keep assuming I am using dark mode, I am not. I am
| using the default browser settings. WITH THAT, the link
| color is almost unrecognizable. it almost the exact color
| of the surrounding text:
|
| http://0x0.st/HU7r.png
|
| compare with Wikipedia:
|
| http://0x0.st/HU7s.png
| pests wrote:
| Sorry, I misread your original comment.
|
| To me "very dark blue against a black" sounds like you
| are talking about foreground and background colors.
| hinkley wrote:
| >security
|
| I will be forever appalled that Blizzard rolled out two factor
| authentication before stock trading services like E*Trade managed
| it.
|
| Bravo for Blizzard, shame on the rest of 'em. A _game_ company.
| bee_rider wrote:
| It doesn't seem that surprising to me. In the olden days, video
| game companies served a slightly more technical user base, so
| it makes sense that they'd be more willing to deal with 2FA.
| Also, I don't think the legal system will help you recover your
| SoJs.
| profmonocle wrote:
| I worked with someone who was a Blizzard GM around when they
| rolled this out. Recovering stolen accounts was some absurdly
| large % of their customer service tickets. People would use the
| same email & password on WoW as on various shady / insecure
| sites. Bots would try any stolen credentials en masse in WoW.
| When they succeeded, not only would customer service need to
| restore a user's access, they would need to roll back their
| character to restore lost items and gold.
|
| According to my coworker, adding 2FA was primarily about
| reducing this customer service workload. Eventually they
| encouraged it by adding in-game benefits, like additional bag
| space for your character. Not sure they ever went as far as
| mandating it.
| Paul-Craft wrote:
| So, what happened after they implemented it? Did CS tickets
| actually go down a lot? Did it save them a ton of money and
| hassle? You left off the best part of the story :-)
|
| As for mandating it, I could see not requiring people who'd
| already set up accounts to jump through this extra hoop to
| play the game. I'm sure even a small percentage might not be
| _able_ to jump through that hoop. I doubt it 's a significant
| percentage, but I could see it becoming a PR hassle, and
| those are the worst kinds of hassle from the POV of a
| technical employee lol...
|
| But for a new game? If the CS metrics reflected a big drop
| relative to the number of people using 2FA, then I'd be sold
| on requiring it.
| hinkley wrote:
| From what I understand it went down for a long time, but
| what people did was if they managed to get into your
| account the first thing they would do is remove the
| authenticator. That involved entering a couple sequential
| values. But if you set up the keylogger right, you could
| trick users into failing the credential check 3 times at
| login and get their account.
| jonathanlydall wrote:
| As a former GM, as at the time I left in 2012 I had never
| encountered a case of a 2FA secured account getting hacked
| and account compromises were easily >50% of our workload.
|
| The problem had become that most players wouldn't add 2FA
| to their accounts until AFTER they got hacked, so any in-
| game incentive to add it was in our eyes a good one.
| anonymoushn wrote:
| Currently you cannot customize your group in group finder
| without 2FA, so you cannot list a group for your friend's
| keystone or specify what sorts of characters you would like
| to join. It's quite annoying!
| jonathanlydall wrote:
| As a former Blizzard CS rep (I left in 2012), I can see why
| they'd do things like this to convince people to add 2FA to
| their accounts as most people wouldn't do so until AFTER
| they were hacked for the first time.
|
| Based on many players saying to me "I don't know why they
| chose me", it seems that a lot of people don't realize that
| account compromising is a drag-net operation, it's like a
| fish thinking that there's no reason for them to be
| targeted specifically by a fisher, without realizing that
| fishing is such a large scale and impersonal activity.
| jonathanlydall wrote:
| As a former GM myself, can confirm all the above.
| toast0 wrote:
| Did they?
|
| I found an article from March 2005 stating that ETrade will
| soon launch 2fa [1]. And a similar article about Blizzard
| launching 2fa from July 2008 [2]. Maaaybe ETrade took 3 years
| from anouncement to launch, but I'm pretty sure I saw ETrade
| branded RSA tokens around 2005, and Blizzard tokens later.
|
| [1] https://www.computerworld.com/article/2569503/etrade-
| touts-t...
|
| [2] https://www.zdnet.com/article/blizzard-introducing-two-
| facto...
| hinkley wrote:
| Maybe introduced is the wrong word. Pushed might be closer.
|
| At some point Blizzard was trying to make it sound like 2FA
| was mandatory, and ETrade definitely had made a bit more
| noise about them at that point, but Blizzard _campaigned_ to
| get everyone on smart phone 2FA and E*trade did not.
|
| Someone else said it might be demographics and I'm not
| inclined to argue with them. But I think too, a lot of early
| movers had those key fobs, and because they weren't on atomic
| clock time they tended to drift and cause support nightmares.
| I had 2FA at work a little before I had it in WoW and one of
| us was having a problem practically every other week. That
| was only dozens of people.
|
| The smart phone answer was so, so much better. But it you
| invested in fobs, it's like public infrastructure. Boston has
| a shitty sewer system because it got firefighters before
| Chicago and Seattle, which burned down after modern plumbing
| more or less settled. See also Internet service in late
| adopter towns versus early. Ripping out cost more than green
| field.
| saghm wrote:
| Not only that, but they had dedicated hardware for it since
| smartphones weren't ubiquitous yet. I still remember the first
| time I saw a friend use one, and how mystified I was by this
| mysterious "authenticator". It's still absolutely wild to me to
| think about how ahead of the game Blizzard was on the 2FA
| front.
|
| They only recently replaced their dedicated smartphone app for
| 2FA by rolling it into the existing Battle.net app. The 2FA
| codes they use are longer than 6 digits, which I assume is why
| they don't support something that can be used by more
| "mainstream" 2FA apps; by the time those become established
| enough to support third parties, I suspect their infrastructure
| had been around long enough that it just wouldn't be worth
| rewriting it. I do sometimes wonder if someday apps like Google
| Authenticator will support a wider variety of TOTP
| configurations; I think Steam also uses something non-standard,
| which means the only mobile option is a dedicated app, and I'd
| much rather not have to install extra apps just for 2FA
| support.
| hinkley wrote:
| They handed them out at Blizzcon one year, but only one per
| person, which I think was a mistake. Should have sent people
| home to entice their friends.
| paulpauper wrote:
| The economics and incentives of RNGs are interesting. If nothing
| is materially at stake ,an imperfect RNG, even a bad one,
| suffices provided people cannot easily tell, such as games. But
| if money is at stake or security, like crypto wallets or online
| casinos, suddenly it matters A TON.
| DonHopkins wrote:
| When Variables Don't and Constants Aren't
| maxbond wrote:
| Interesting. Seems to be a meme with a deep history.
|
| https://www.theregister.com/2006/07/26/constants_are_not/
|
| > I first read the lament to the capricity of programming [in
| the title of this piece, "Variables Won't Constants Aren't"] in
| _Creative Computing_ , years before C was devised.
|
| If there's a particular document you feel is canonical to this
| meme, I'd be interested to read it.
| anonymoushn wrote:
| I suspect it's a math thing, because in math it actually
| describes the normal state of affairs. Anyway, here it is in
| a compilation of such sayings dated 1979:
| https://www.cse.unr.edu/~sushil/quotes.html
| maxbond wrote:
| That document is a gem worth it's own submission. I'm sure
| many of it's constituents have been on HN but I took a
| glance and don't think it's ever been on HN[1], though it
| appears a dead mirror was once posted with 0 interaction
| [2].
|
| Feel free to submit it if you want, otherwise I'd like to.
|
| [1a] https://news.ycombinator.com/from?site=www.cse.unr.edu
|
| [1b] https://news.ycombinator.com/from?site=unr.edu
|
| [1c] https://hn.algolia.com/?query=Murphy%27s%20laws%20and%
| 20coro...
|
| [2] https://news.ycombinator.com/item?id=2863516
| anonymoushn wrote:
| Go ahead.
| lifthrasiir wrote:
| While I never played WoW, I have heard that many addons used a
| private chat as a means of inter-... whatever communication. If
| there is a way, people will eventually find and use it.
| robobro wrote:
| As a means of what?
| lifthrasiir wrote:
| Like, sockets. (Addon instances are not processes, so it is
| not exactly interprocess communication...)
| taspeotis wrote:
| Interprocess communication?
| maxbond wrote:
| I don't recall the name of the company but I read about a
| startup who's product added chat features to a client's
| website. They noticed a developer using it for IPC, and ended
| up pivoting into making a product to enable IPC for web apps.
| (Or inter-something, like you point out it's not an OS process,
| it's an application-level process. Intertask communication if
| your prefer.)
| Philpax wrote:
| Sounds like the story of Firebase?
| https://en.wikipedia.org/wiki/Firebase
| maxbond wrote:
| I didn't find that specific story after searching for a few
| minutes with Firebase as a keyword, but it does seem
| plausible based on the summary on Wikipedia, at least if I
| misremembered some details (which could well be).
| chupapimunyenyo wrote:
| Whose*
| maxbond wrote:
| You're right, and I do appreciate it, I ought to know that.
| Hamuko wrote:
| I think a lot of roleplaying addons exchanged information by
| just having a public chat channel that just wasn't made visible
| in the user interface. You could actually make it visible and
| see the addon sending information to other users there.
| onetoo wrote:
| Not just private chat, almost any chat channel can be used[1].
| It's quite common for certain addons to quietly share their
| versions upon e.g. joining a group, so that you get a
| notification if a new version is out. It's a bit of a longer
| explanation, but another fun example of out-of-band privileged
| information in World of Warcraft:
|
| The "fight" between Blizzard's boss design and addon creators
| trivializing said encounters is long and not worth going deeply
| into. But, for example, if the strategy of a boss is "if you
| get a glowing glyph over your head, run over there and stand in
| a square formation with the other guys with glowing glyphs", an
| addon could use hard-to-ignore sounds and visuals to tell you
| that a) you have to run now, and b) exactly which corner of the
| square formation to run to.
|
| I believe that in the latest raid, the developers tried
| restricted certain information from the API (e.g. "there is a
| glyph over the player's head") in an attempt to reduce that
| kind of strategy automation. The players then proceeded to
| manually feed this information (e.g. "i have a glyph over my
| head") into their addons using buttons mapped to API calls like
| this, allowing for partial automation (e.g. "your corner in the
| formation is top-left"). This stirred quite the drama, but the
| that's besides the point.
|
| [1]
| https://wowpedia.fandom.com/wiki/API_C_ChatInfo.SendAddonMes...
| hota_mazi wrote:
| Related: https://www.beust.com/weblog/various-ways-to-get-
| randomness-...
| smeeth wrote:
| "Any one who considers arithmetical methods of producing random
| digits is, of course, in a state of sin. For, as has been pointed
| out several times, there is no such thing as a random number --
| there are only methods to produce random numbers, and a strict
| arithmetic procedure of course is not such a method." - John von
| Neumann
| NohatCoder wrote:
| As a cryptographer I can't stand this quote. Nothing against
| Neumann, but the people who choose to spread it as sage wisdom
| really only manage to convey misinformation. In context it is a
| superfluous philosophy quip.
|
| We have had fast reliable cryptographic random number
| generators for decades. They really do work with just a tiny
| seed and a bunch of arithmetic. The numbers produced are
| indistinguishable from any other proper random source, and they
| work for any purpose.
|
| Too many people don't understand this, and entire companies are
| founded on selling snake oil true random.
| gometo wrote:
| Akun vip
| stevekemp wrote:
| See also that time when hacker news was hacked, due to weak
| random numbers:
|
| How I Hacked Hacker News (with arc security advisory):
|
| https://news.ycombinator.com/item?id=639976
| nneonneo wrote:
| Weirdly, I answered almost exactly the same "invert the RNG"
| question on StackOverflow
| (https://stackoverflow.com/a/15237585/1204143) just a few months
| before you posted your question to Crypto.SE, except that I
| attacked the Java RNG instead of the MSVC RNG. They both use a
| simple LCG design where outputs are truncations of the internal
| state, so the attacks are very similar to each other.
| hayley-patton wrote:
| I'm not very good at maths so I let Z3 work out some convenient
| seeds for me, leading to import
| java.util.Random; public class Hayley {
| public static void main(String... args) {
| byte[] b1 = new byte[4], b2 = new byte[2];
| (new Random(0x2effe2140e00L)).nextBytes(b1);
| (new Random(0xc2f0097)).nextBytes(b2);
| System.out.println(new String(b1) + new String(b2));
| } }
| xenonite wrote:
| Even worse, the given linear congruential RNG yields only 12445
| distinct numbers, then repeats itself. It would be sensible to
| simply use better parameters for this algorithm.
| smallstepforman wrote:
| Engineering is a compromise, for simple tasks (eg motion of
| particle is smoke trail exhaust), you need a simple yet FAST
| rng. For cryptography, casino gaming etc, not only do you use a
| better Rng with at least 32 byte state, you also cycle the
| engine at random intervals to further prevent predicting the
| outcome.
| loeg wrote:
| An LCG with better parameters would be just as fast.
| jonathanlydall wrote:
| A bit tangential, but a related fun story from many years ago
| during my time as a WoW GM.
|
| There was a popular add-on (Titan Bar I think?) that had a bug in
| one of its versions where it would always call the API which
| showed the "write a ticket to a GM UI", if you tried to cancel
| it, then it would just pop up again, the only way to stop this
| dialog from being in the way (aside from uninstalling the
| problematic add-on) was to put something in the text box and
| press submit.
|
| It was a very bad day or two for the GMs, many players didn't
| even know about GMs or that that you could submit tickets to
| them, and trying to explain to a customer that you're a customer
| service representative who's contacting them because they
| submitted a ticket likely due their one add-on was more often
| than not a tricky one.
|
| Because it essentially destroyed the ability to perform
| reasonable customer service response times the developers put out
| a hotfix which also put that API call behind protection, making
| it impossible to be called except from Blizzard's own LUA code.
| anonymoose33282 wrote:
| Titan Panel I think was the name? It was the one that kinda
| "unified" a lot of UI elements into one bar (total gold, repair
| percentage, stuff like that).
| aatd86 wrote:
| Summary in simpler terms?
|
| So it's just because the actions in game where functions which
| were assigned an id and callable by id.
|
| Then because OP was able to reverse engineer that id generator,
| OP was able to call whatever he wanted once he tested what id was
| doing what.
|
| Didn't read the math in the middle, I could get it but takes too
| much time at my age nowadays.
| nkrisc wrote:
| The IDs are arbitrary and chosen by the author.
|
| Outside the secure context they had the information to select
| which (arbitrary) ID they wanted to pass into the secure
| context. So they call `random()` until they know the next call
| to it will produce the desired ID. Then they pass control to
| the secure context which calls `random()` and uses the result
| as a the ID to lookup what action to take in the same arbitary
| ID<->action mapping table.
| aatd86 wrote:
| Ahem, They are only chosen by the author for the goal of
| reverse engineering and finding valid ids.
|
| But he doesn't assign ids manually when writing the scripts.
|
| As far as I understand.
| nkrisc wrote:
| It doesn't really make a difference either way. You could
| wait for a number to come up that would match the game's ID
| for the action you want to take, or an arbitrary one from a
| table you hardcoded in the secure function call.
|
| As long as you have a method for knowing the next outcome
| of the random call, that's all you need.
| Arech wrote:
| yep, and I'm aware of a data encryption product that was hacked
| by utilizing exactly the same technique. As dumb as it could be:
| they promised billions of years an attacker need to decipher
| data, but were using a dead simple LCG to make a key and a salt.
| And the salt was stored in a crypto container in open form (b/c
| it's a salt). :facepalm: Don't implement data encryption on your
| own, kids...
___________________________________________________________________
(page generated 2024-01-15 23:02 UTC)