Yeah, the midichlorians really threw the spirituality/mythology themes under the bus.
Actually, now that I think of it, I don't think that having force-related science was really the problem. It's entirely to be expected -- remember, we're talking about a civilization which has lasted tens of thousands of years. There's no reason to think that anything, no matter how mystical, would be left unexplored by science.
No, there are two bigger problems with midichlorians:
First, they sound like mitochondria, and are functionally vaguely similar. It really breaks suspension of disbelief if you know any basic cellular biology, because you can't help but realize that whoever wrote that crap was sort of vaguely remembering their high school biology, and not going back to research it.
And second, they completely change the dynamic of who gets to be a Jedi. It's official, now -- it's nature, not nurture.
The mechanic is somewhat like if some of us were born super-muscular (think Captain Hammer), while some were born weaklings, and no amount of lifting weights and working out would turn a weakling into a musclehead, and no amount of slacking would turn a musclehead into a weakling.
The real world is much kinder. There is some nature, certainly -- there are those who are naturally skinny, and those child geniuses who graduate college at age 12 -- but the rest of us can study hard and work out and make up some of the difference.
In the Star Wars universe, having a high enough midichlorian count to be Force-sensitive is rare, and if yours is low, you're SOL, you'll never be a Jedi.
Games are different from other software in that free software isn't a good development model to make blockbusters like Fallout 3, Diablo 3, or Oblivion
That's got nothing to do with development, and everything to do with content.
I would argue that free software would be an excellent model for game engine development, but this hasn't proven to be true -- the existing open source engines are both fragmented and bad, or at least, have no good demos.
But, for example, if the larger studios decided to share engine code, it would significantly cut costs, if even two studios did this.
Unfortunately, it seems they'd rather try to package up their engine and sell it.
Unless you can change the economics, there's no use appealing to sentiment.
The only way for it to happen is for US law to state that OS API's are national infrastructure and that they have to be opened for the sake of fair competition.
Great theory.
The problem isn't that the Windows APIs are closed -- they aren't; after all, if they were closed, how could anyone but Microsoft write software which runs on Windows?
No, the problem is that Microsoft themselves don't adhere to these APIs, and the published APIs are occasionally vague. So, even if you discount the man-years required to implement the APIs as written, you still have to deal with what software actually expects.
Microsoft has this problem, too -- if you can find it, read the blogs/papers/etc of the Windows backwards compatibility team. It's incredible the amount of work they do -- the sheer number of ugly hacks, backflips, and cartwheels that they go through to force stupidly-written software to work.
I'm talking about things like a piece of software which reads the OS version number into a fixed-length buffer, thus guaranteeing that a version number which is too long will cause a buffer overrun and crash the program.
So what does Windows do? It detects that particular program and lies to it about the version number.
WINE is mostly good for running apps, not games
I'd say that's largely because that's where the focus has been. After all, gamers can learn to dual-boot -- the real challenge is people who need to run things like QuickBooks, or some random domain-specific app written a decade or two ago.
On the other hand, MS could make their own Linux distro and probably displace everyone else on the desktop side fairly easily.
Unlikely, unless they made it a complete replacement for Windows, and the obvious upgrade path. And then they'd be playing catch-up with Ubuntu, rather than the other way around.
And in order to do that, they'd probably screw it up beyond all recognition. So it's unlikely that actual Linux users would be drawn to it -- they'd simply find a way to sandbox it (probably in a chroot jail or similar), so they could run a normal Ubuntu (or Xandros, or whatever), without all the Microsoft crap (until they need it).
I think MS plans to make the entire Windows experience into a portable framework with.NET.
You would think so, and there are interesting rumblings from R&D -- things like Singularity, an entire OS actually built on the.NET CLR.
And yet, both Java and.NET have shown the lie of this -- Java, because people can still call out to native code (with some difficulty!), and because a poor implementation can spoil it for everyone. And.NET, because when people can call out easily to a native DLL, they do so, making non-portable apps -- and many of the strengths in.NET are things like WinForms, which are almost deliberately non-portable.
More platforms, in many different hardware applications means a framework that can be ported easily and entirely via a virtual machine is pretty much the top of the food chain.
Again, you would think so, and it's somewhat true -- Java is big in the mobile world, and it's on Blu-Ray.
And yet... there's no Java on the iPhone, as far as I can tell, but it (and its apps) are selling like hotcakes, despite how non-portable they are. Seems like a reasonably portable C API (POSIX) is beating virtual machines in at least a few places.
Linux does great on the customized hardware side, but the lack of organization of development tools kills Linux and with no central leadership it's really hard to get things done market wise.
This sentence makes me wonder if you're actually trolling, or just clueless.
Yes, let's spend 50% more effort to port an application to another platform
If it takes 50% more effort, you're doing it wrong.
Consider that nvidia, who makes video drivers, share 90% of their code between all the platforms they support. And nvidia has to deal with much lower-level details, like the various windowing systems (X.org, win32, etc), driver models (Linux is always changing, and XP-Vista is a big leap), not to mention graphics libraries (OpenGL, DirectX), EDID (monitor detection), multi-monitors, and SLI.
If they can do it for a video driver, you should easily be able to get much more re-use -- think 95-99% -- for your game.
using a crappier API in the process,
That's a matter of opinion. This release wasn't good news for OpenGL, but some people do still prefer it to DirectX.
and generate a brand new set of bugs on another platform.. in order to maybe fix a bug that occurs for 1% of users on our main platform.
Consider that 1% may well have a larger network than you know -- they may have a blog, or they may tell their friends. Think about it -- if it's a critical bug, and you've got a sizeable market -- let's say it's 10,000 users (numbers pulled out of my rectum) -- that means 100 people just saw their only savegame corrupted, and each lost 30 hours or so of gameplay.
Now consider what you're going to have to do to buy their trust back -- let alone their goodwill.
It may not apply to what you're doing. It may be that you're something like WoW or GTA, for which people will buy a dedicated machine, if they have to.
But one more thing to think about: Many of the indie games I've played lately have been cross-platform. All the Introversion games were Steam, but also Windows, Linux, and Mac. The Penny Arcade game is Windows, Linux, Mac, and Xbox Live Arcade. (The only other game on playgreenhouse.com seems to be at least Windows, Linux, and Mac.)
These are indie developers, which implies that they don't exactly have money or manpower to throw at the problem. Which implies that if they did something, they did it for a reason -- that it was either trivially easy for them to do, or that it was worth the effort.
So what's your excuse? Is it that you suck at porting -- that your code is so poorly abstracted that it's actually tied to one platform?
Which is my point: Porting will make your game better. It will force you to refactor and to think differently, not to simply knock out the quickest thing that can possibly work. And it means that, hopefully, you'll be able to reuse a lot of that for your next project.
Really a great deal considering you might also get access to 3-4% more of the gaming market this way.
Yeah, sounds like it. That, or you're so tiny that 3-4% really wouldn't pay enough for someone to so much as install the other OS and attempt to compile -- but again, fucking Introversion can port their games. Why can't you?
Disclaimer: I haven't actually done game development. I have, however, done web development, and I assert that the web browser (and MSIE in particular) is a much more hostile environment than a real OS.
But otherwise, especially if you're targeting developers of consumer software (games) where smooth going on Windows is the most important thing..
If that's true, you're missing out on another huge market: Consoles.
Just put "192.168.1.5 www.somesite.com" in/etc/hosts, or whatever the Windows equivalent is.
It's actually/etc/hosts, believe it or not.
Well, or something like C:\Windows\System32\etc\hosts. But the format is identical, save for maybe using \r\n instead of \n (and I'm not even sure about that).
Must be all that BSD code in the Windows IP stack.
You've presented two arguments which have been, well, argued to the death: Pascal's wager, and the religion-is-useful argument (as distinct from the religion-is-true argument.)
Let's try the first one: Pascal's Wager. Here, read the criticisms -- no need to read in-depth, just scan the headers and realize the assumptions you've made.
In particular, you fail to account for what happens if the original AC troll is right. If he's right, I'm better off than you -- you'll burn for worshipping God instead of Satan, whereas I might still have a chance.
Now, the second one:
Plus, I will have lived my life respectfully, to its fullest, without bondage to drugs or material things, and I will have hopefully helped people along the way.
If I may be so bold, I have lived my life respectfully, to its fullest (so far), without bondage to drugs (except caffeine) or material things, and I have hopefully helped people along the way.
The difference is, you have probably taught some people to believe something ridiculous on faith alone, which means you've taught them to turn off their rational mind just this once so they can accept God's word without question. (So what is to stop them from turning off their rational mind again, when Sylvia Brown or John Edwards come knocking?)
I, on the other hand, have taught people to think for themselves.
So given that, the only way you will have lived the better life is if you are right -- that God not only exists, but that he punishes independent thought -- which is a circular argument.
Because that would mean you're basically arguing that religion is useful because it's true -- but you're also arguing that you don't know if it's true, but we should believe because it's useful. (Why is it useful again?)
There is overwhelming evidence for evolution in its basic form. It is a requirement for understanding biology.
It also does not claim that non-living proteins come together on their own -- though there is certainly more evidence for that than for your mythical sky-god.
This is simply because the SP must trust the OpenID provider.
Not particularly -- only if the SP is being particularly limited.
It would be somewhat like AOL only accepting email from Microsoft and Yahoo -- maybe there would be less spam (probably not), but it kind of defeats the point of email.
Third, you say it's better to have a single point of failure, please what are the multiple point of failure you speak about?
This was based on the assumption of a user using the same password everywhere.
That is: It's better that a single-point-of-failure be my OpenID provider than that every random website, blog, forum, and MySpace page have the ability to collect my password and use it elsewhere. That's multiple "single-points-of-failure".
How about the creation of a fully operational open source, cross platform, DX10 or DX11 implementation, not created by Microsoft but by the community,
Wine will do this, eventually.
and fully working natively (not through Wine)
That's a bit harder, because it requires driver support.
and supported by NVidia and ATI drivers?
The official ones? Never going to happen. Anyone want to guess how many patents Microsoft has on DirectX tech?
And the unofficial ones haven't even gotten GL right, yet, and you're proposing they try to support another interface?
More importantly, you're assuming this is a good idea -- that we should be working to clone a Microsoft technology, instead of improving on one which has been open from the start (GL).
Jumping ship to DX10 would be nice, if it were cross-platform. (No, Xbox + PC does not count as "cross-platform".)
Unfortunately for those of us on Linux/Mac, a lot of Windows developers don't care.
Unfortunately for those of you who think you don't care about this, consider that porting an app generally improves it, and can shake out bugs which aren't as apparent on the other platform -- which means potentially less reliable games, even if you're only on Windows.
And unfortunately for those of us who hate Vista, that's kind of a requirement for DirectX 10. At least with OpenGL, those in charge have no agenda to push Vista -- so an OpenGL 3.0 game should run on XP, if it runs on anything.
Trust me GP, if you went to the library, photocopied a book there and THEN started handing it out
Well, teachers do this -- just not of the whole book, and only for 20 or 30 students, and the copy would likely be thrown away after that class.
And no one cares.
I suspect they would start caring, though, if teachers could hand out full, perfect copies which they made for free.
The problem here is, again, one of magnitude (copying a whole book, possibly thousands of times) and of commercial interest (profiting from the book, via adwords, even if you make it available for free).
Thanks for the note. I have received similar notes from others who wish to back off of any claim that OpenID should be tied to any particular authentication methodology. That sure doesn't come across in the message that OpenID presents to the curious user.
I've pasted this here because I saw nothing in his reply that suggested he wanted confidentiality -- or even that it was directed at me, given that he addressed very little of what was in my email. (The mention of "similar notes from others" suggests a form letter.)
Yet, curiously, I see no updates about this in the article, nor any mention of this outside a private email -- no blog posts, no followup articles, nothing.
Apparently, it's enough that "OpenID" somehow misrepresents itself -- wait, how? Googling for "OpenID password" lists other forms of authentication in the Google summary, no more than the fifth link or so.
But assuming that this has happened, it's good enough that there is confusion -- never mind that you're contributing to it? After all, who cares about the truth, as long as this lie is inflammatory enough to drive traffic?
Again, what about all this makes it more secure than something you keep in your mind?
Go back and read, then. The password that you "keep in your mind" is also a password that I keep in my keylogger, if you use it on a public terminal. That won't work with a physical token.
I can't lose my password as if it's a physical entity; physical security tokens can be.
Losing it isn't the security hazard. The fact that someone else could recover it is.
And you can, easily, "lose" -- or rather, neglectfully expose -- your password.
You keep talking about diligence -- is it really that much easier for you to remember a semi-random string of alphanumeric digits than it is for you to remember where your physical keys are?
As someone working with computers for longer than most so-called "experts" have been alive...
...you qualify for a "Get Off My Lawn" award.
I question their motivations and their common sense to go against a proven security method just because uneducated users that use "password" as their passwords are being taken advantage of.
I would say that the fact that uneducated users are using "password" as their password is proof of a flaw in this security method.
It's like finding radical new methods of home security for people who leave their door unlocked.
If a significant percentage of people left their door unlocked, yes, we would have such systems.
An important point to realize is that most of the technical problems of security have been solved. Security on a large scale is really about economics and sociology, far more than it is about technology and "common sense".
But while we're at it, how do you feel about home security? Certainly, locking the door works, just as passwords work? All those people buying these complex home security systems are wasting their money, right? Just one more component to fail?
Before you answer that, it's not entirely rhetorical. Read my sig.
And yes, that's the idea behind posting AC instead of a user to protect one's karma. It doesn't take a genius to understand that...
...nor does it take a genius to understand relativity.
It does, however, take a little bit less ambiguity in your use of language, if you wish to be understood.
And are you that unsure of your opinions that you aren't willing to stand behind them, even with an alias? I make AC posts when I may be exposing myself to legal liability with a post -- not just because I'm afraid of hurting my karma. And I do get modded to -1, troll, sometimes.
which sort of calls into question the wisdom of the rest of your post.
Actually, no, it doesn't. That's called an ad hominem argument, and I'm flattered that you feel my arguments are so strong that you need to attack me as a person to make your point.
Now, it does still have the implication that you've authenticated the local terminal for whatever length of time until your session expires. So it's still better to have a trusted terminal.
However, it does mean that even if they lift every single keystroke, they won't be able to predict the next pseudorandom number that your physical token will come up with, so once your session ends, the window of opportunity is gone.
It's much simpler just to use a password, which can also be easily changed, than having to carry a physical key
Given you're not suggesting that I carry a physical password, it seems like you're saying that it's easier to memorize a key -- and then change it, and memorize the new one -- than it is to carry a physical key which, quite literally, fits on your keychain.
But then some method can be invented to pull private keys via malware or some security hole. Same thing.
No, this requires them to compromise the local machine.
The phishing attack I described does not.
And who is to say that the site can't fool the browser itself to make it think it's legitimate?
Actually, I just said it: They can't fool the browser itself, short of finding a bug in the browser.
Humans can be fooled as well, but it is much harder to fool a diligent person than it is a mindless automated process, no matter how well designed.
Well, actually, I did trivially fool you here, into assuming something about the physical token.
And I notice, also, that you went out of your way to make it black and white -- you claim that passwords are the single most secure form of authentication. I'm not sure there's any single form of authentication more secure than two-factor authentication.
First rule of software development: "Never trust the client application."
Problem: This will never work for gaming.
Maybe if... No. NEVER.
I don't get to sue people who browse my webpages with software I haven't specifically authorized.
Your webpages very likely are simply pages, not actual games.
Instead, I have to make sure that my stuff won't break, regardless of what software is accessing it.
And indeed, the server didn't break. It did exactly what it was designed to do.
But do you realize what Glider is?
Glider is a program which auto-plays WoW for you. It is, in other words, doing perfectly acceptable things, and not breaking any security, server-side -- except for the part where a human is supposed to be playing, and a bot is, instead.
The only way to prevent this from happening would be for the server to be able to detect whether the game is being played by a bot or a human. And that's the CAPTCHA problem all over again.
And by the way, this problem has existed for a long time -- look at aimbots, or better, wallhacks. The only way to prevent a wallhack (make all walls appear as translucent, so you can see players through them) is to send as little information as possible -- but there's still going to be a case where this doesn't help; where the person without the wallhack would simply hear footsteps behind the door, and the person with the wallhack can see a full body.
The only way to avoid wallhacks, absolutely, is to do all the rendering server-side. And that wouldn't prevent aimbots, it would just make them much harder.
The only way to prevent this kind of cheat is to make a game which gains nothing from computer augmentation -- or which a human will always play better than a computer. Good luck with that -- even chess barely qualifies.
That, or give up trying to make a real game, and let everyone play Progress Quest.
I think often the copy protection is like a bicycle lock. It's enough of a deterrent to keep the average Joe from just taking the bicycle, or just copying the CD and giving it to his friend...
I think that's the mentality, and I think that's why there's such a problem here.
You see, if I buy a bicycle, I choose whether or not it comes with a lock. If I got a lock, that means I'm trading a little of my own convenience for a little of my own added security.
That's a fair trade, and one which I fully consent to. If I don't like it, I can just not buy a lock -- I still get the bike.
Oh, and one more thing: It's considerably easier for me to unlock my own bike than it would be for a bike thief to break the lock.
Copy protection, on the other hand, trades more than a little of my convenience for someone else's security. Which is pretty fucking rude and presumptuous. Tell me again, as a paying customer, why is it my problem that other people are pirating from you?
On top of that, it's considerably easier for a pirate to download a cracked version for free than it is for me to use a legit copy.
And if I don't like it, I really have no option but to pirate, or to not buy the game. That's like saying you're not allowed to have a bike unless you lock it.
They present you with some pictures - you pick out the ones that fall into the catagories that you picked earlier
How is this relevant?
Oh wait, I know: If Vidoop was smart, they'd become an OpenID provider. (Maybe they have already?)
That was the point: If OpenID is widely adopted, then you can use things like Vidoop anywhere you want, so long as they support OpenID. The sites you're trying to authenticate with don't even have to know about Vidoop, much less go out of their way to implement it.
when the central authority is compromised, all my sign-ons could be compromised.
You're missing the point.
I am saying that one single-point-of-failure is better than N single-points-of-failure.
If you use the same password everywhere, then everywhere you use that password is every bit as much a single-point-of-failure as your central authority.
Personally, I like the fact that I can control everything and I do use super-strong passwords (if that's not an oxymoron) for my 'important' accounts.
So, you could use a throwaway OpenID account for unimportant accounts, and a super-strong OpenID account (or more than one! Imagine that!) for your important accounts.
That's not to say that my stuff couldn't be compromised, but personally, I am more comfortable with controlling it myself.
Then you should be, not walking, but running to get OpenID implemented as many places as you can.
Because, you see, you have exactly as much control as you want -- up to and including running your own OpenID provider. That's not something you can have with passwords.
Slashdot Mirror
Yeah, the midichlorians really threw the spirituality/mythology themes under the bus.
Actually, now that I think of it, I don't think that having force-related science was really the problem. It's entirely to be expected -- remember, we're talking about a civilization which has lasted tens of thousands of years. There's no reason to think that anything, no matter how mystical, would be left unexplored by science.
No, there are two bigger problems with midichlorians:
First, they sound like mitochondria, and are functionally vaguely similar. It really breaks suspension of disbelief if you know any basic cellular biology, because you can't help but realize that whoever wrote that crap was sort of vaguely remembering their high school biology, and not going back to research it.
And second, they completely change the dynamic of who gets to be a Jedi. It's official, now -- it's nature, not nurture.
The mechanic is somewhat like if some of us were born super-muscular (think Captain Hammer), while some were born weaklings, and no amount of lifting weights and working out would turn a weakling into a musclehead, and no amount of slacking would turn a musclehead into a weakling.
The real world is much kinder. There is some nature, certainly -- there are those who are naturally skinny, and those child geniuses who graduate college at age 12 -- but the rest of us can study hard and work out and make up some of the difference.
In the Star Wars universe, having a high enough midichlorian count to be Force-sensitive is rare, and if yours is low, you're SOL, you'll never be a Jedi.
Actually, I realize -- I was a bit harsh. I didn't read your subject line before responding.
Games are different from other software in that free software isn't a good development model to make blockbusters like Fallout 3, Diablo 3, or Oblivion
That's got nothing to do with development, and everything to do with content.
I would argue that free software would be an excellent model for game engine development, but this hasn't proven to be true -- the existing open source engines are both fragmented and bad, or at least, have no good demos.
But, for example, if the larger studios decided to share engine code, it would significantly cut costs, if even two studios did this.
Unfortunately, it seems they'd rather try to package up their engine and sell it.
Unless you can change the economics, there's no use appealing to sentiment.
I wasn't. Read the next paragraph of that post.
My point wasn't that Wine would do it anytime soon.
My point was that his idea wasn't particularly new or interesting -- and that if anyone is going to do it independently, Wine is the place to do it.
Of course, if nVidia and ATI want to actually provide driver-level support, that'd be a different matter, but I'm not sure they're allowed to.
Do you REALLY think it's the actual developers that make these decisions?
Sorry, I keep forgetting that PHBs actually exist. I've been spoiled by management who actually listens to (and is often driven by) development.
The only way for it to happen is for US law to state that OS API's are national infrastructure and that they have to be opened for the sake of fair competition.
Great theory.
The problem isn't that the Windows APIs are closed -- they aren't; after all, if they were closed, how could anyone but Microsoft write software which runs on Windows?
No, the problem is that Microsoft themselves don't adhere to these APIs, and the published APIs are occasionally vague. So, even if you discount the man-years required to implement the APIs as written, you still have to deal with what software actually expects.
Microsoft has this problem, too -- if you can find it, read the blogs/papers/etc of the Windows backwards compatibility team. It's incredible the amount of work they do -- the sheer number of ugly hacks, backflips, and cartwheels that they go through to force stupidly-written software to work.
I'm talking about things like a piece of software which reads the OS version number into a fixed-length buffer, thus guaranteeing that a version number which is too long will cause a buffer overrun and crash the program.
So what does Windows do? It detects that particular program and lies to it about the version number.
WINE is mostly good for running apps, not games
I'd say that's largely because that's where the focus has been. After all, gamers can learn to dual-boot -- the real challenge is people who need to run things like QuickBooks, or some random domain-specific app written a decade or two ago.
On the other hand, MS could make their own Linux distro and probably displace everyone else on the desktop side fairly easily.
Unlikely, unless they made it a complete replacement for Windows, and the obvious upgrade path. And then they'd be playing catch-up with Ubuntu, rather than the other way around.
And in order to do that, they'd probably screw it up beyond all recognition. So it's unlikely that actual Linux users would be drawn to it -- they'd simply find a way to sandbox it (probably in a chroot jail or similar), so they could run a normal Ubuntu (or Xandros, or whatever), without all the Microsoft crap (until they need it).
I think MS plans to make the entire Windows experience into a portable framework with .NET.
You would think so, and there are interesting rumblings from R&D -- things like Singularity, an entire OS actually built on the .NET CLR.
And yet, both Java and .NET have shown the lie of this -- Java, because people can still call out to native code (with some difficulty!), and because a poor implementation can spoil it for everyone. And .NET, because when people can call out easily to a native DLL, they do so, making non-portable apps -- and many of the strengths in .NET are things like WinForms, which are almost deliberately non-portable.
More platforms, in many different hardware applications means a framework that can be ported easily and entirely via a virtual machine is pretty much the top of the food chain.
Again, you would think so, and it's somewhat true -- Java is big in the mobile world, and it's on Blu-Ray.
And yet... there's no Java on the iPhone, as far as I can tell, but it (and its apps) are selling like hotcakes, despite how non-portable they are. Seems like a reasonably portable C API (POSIX) is beating virtual machines in at least a few places.
Linux does great on the customized hardware side, but the lack of organization of development tools kills Linux and with no central leadership it's really hard to get things done market wise.
This sentence makes me wonder if you're actually trolling, or just clueless.
No central leadership? *cough* LINUS *cough*
Development tools... Ever use Eclipse?
Yes, let's spend 50% more effort to port an application to another platform
If it takes 50% more effort, you're doing it wrong.
Consider that nvidia, who makes video drivers, share 90% of their code between all the platforms they support. And nvidia has to deal with much lower-level details, like the various windowing systems (X.org, win32, etc), driver models (Linux is always changing, and XP-Vista is a big leap), not to mention graphics libraries (OpenGL, DirectX), EDID (monitor detection), multi-monitors, and SLI.
If they can do it for a video driver, you should easily be able to get much more re-use -- think 95-99% -- for your game.
using a crappier API in the process,
That's a matter of opinion. This release wasn't good news for OpenGL, but some people do still prefer it to DirectX.
and generate a brand new set of bugs on another platform.. in order to maybe fix a bug that occurs for 1% of users on our main platform.
Consider that 1% may well have a larger network than you know -- they may have a blog, or they may tell their friends. Think about it -- if it's a critical bug, and you've got a sizeable market -- let's say it's 10,000 users (numbers pulled out of my rectum) -- that means 100 people just saw their only savegame corrupted, and each lost 30 hours or so of gameplay.
Now consider what you're going to have to do to buy their trust back -- let alone their goodwill.
It may not apply to what you're doing. It may be that you're something like WoW or GTA, for which people will buy a dedicated machine, if they have to.
But one more thing to think about: Many of the indie games I've played lately have been cross-platform. All the Introversion games were Steam, but also Windows, Linux, and Mac. The Penny Arcade game is Windows, Linux, Mac, and Xbox Live Arcade. (The only other game on playgreenhouse.com seems to be at least Windows, Linux, and Mac.)
These are indie developers, which implies that they don't exactly have money or manpower to throw at the problem. Which implies that if they did something, they did it for a reason -- that it was either trivially easy for them to do, or that it was worth the effort.
So what's your excuse? Is it that you suck at porting -- that your code is so poorly abstracted that it's actually tied to one platform?
Which is my point: Porting will make your game better. It will force you to refactor and to think differently, not to simply knock out the quickest thing that can possibly work. And it means that, hopefully, you'll be able to reuse a lot of that for your next project.
Really a great deal considering you might also get access to 3-4% more of the gaming market this way.
Yeah, sounds like it. That, or you're so tiny that 3-4% really wouldn't pay enough for someone to so much as install the other OS and attempt to compile -- but again, fucking Introversion can port their games. Why can't you?
Disclaimer: I haven't actually done game development. I have, however, done web development, and I assert that the web browser (and MSIE in particular) is a much more hostile environment than a real OS.
But otherwise, especially if you're targeting developers of consumer software (games) where smooth going on Windows is the most important thing..
If that's true, you're missing out on another huge market: Consoles.
Just put "192.168.1.5 www.somesite.com" in /etc/hosts, or whatever the Windows equivalent is.
It's actually /etc/hosts, believe it or not.
Well, or something like C:\Windows\System32\etc\hosts. But the format is identical, save for maybe using \r\n instead of \n (and I'm not even sure about that).
Must be all that BSD code in the Windows IP stack.
You've presented two arguments which have been, well, argued to the death: Pascal's wager, and the religion-is-useful argument (as distinct from the religion-is-true argument.)
Let's try the first one: Pascal's Wager. Here, read the criticisms -- no need to read in-depth, just scan the headers and realize the assumptions you've made.
In particular, you fail to account for what happens if the original AC troll is right. If he's right, I'm better off than you -- you'll burn for worshipping God instead of Satan, whereas I might still have a chance.
Now, the second one:
Plus, I will have lived my life respectfully, to its fullest, without bondage to drugs or material things, and I will have hopefully helped people along the way.
If I may be so bold, I have lived my life respectfully, to its fullest (so far), without bondage to drugs (except caffeine) or material things, and I have hopefully helped people along the way.
The difference is, you have probably taught some people to believe something ridiculous on faith alone, which means you've taught them to turn off their rational mind just this once so they can accept God's word without question. (So what is to stop them from turning off their rational mind again, when Sylvia Brown or John Edwards come knocking?)
I, on the other hand, have taught people to think for themselves.
So given that, the only way you will have lived the better life is if you are right -- that God not only exists, but that he punishes independent thought -- which is a circular argument.
Because that would mean you're basically arguing that religion is useful because it's true -- but you're also arguing that you don't know if it's true, but we should believe because it's useful. (Why is it useful again?)
There is overwhelming evidence for evolution in its basic form. It is a requirement for understanding biology.
It also does not claim that non-living proteins come together on their own -- though there is certainly more evidence for that than for your mythical sky-god.
Quoting the article linked to:
Xbox360 cannot run DX10
This is true. Given that there has been no firmware upgrade, the Xbox 360, as sold today, cannot run DX10.
The Xbox360 has unique features including memory export that can enable DX10-class functionality such as stream-out
That kind of hints that it could.
My bad, though, for making that assumption.
This is simply because the SP must trust the OpenID provider.
Not particularly -- only if the SP is being particularly limited.
It would be somewhat like AOL only accepting email from Microsoft and Yahoo -- maybe there would be less spam (probably not), but it kind of defeats the point of email.
Third, you say it's better to have a single point of failure, please what are the multiple point of failure you speak about?
This was based on the assumption of a user using the same password everywhere.
That is: It's better that a single-point-of-failure be my OpenID provider than that every random website, blog, forum, and MySpace page have the ability to collect my password and use it elsewhere. That's multiple "single-points-of-failure".
Wow.
Do they not have black print in their books? I had assumed black text was universal.
Yet another reason to choose a different host country...
Depends very much on the country -- or even the state. A lot of places, 16 is legal.
How about the creation of a fully operational open source, cross platform, DX10 or DX11 implementation, not created by Microsoft but by the community,
Wine will do this, eventually.
and fully working natively (not through Wine)
That's a bit harder, because it requires driver support.
and supported by NVidia and ATI drivers?
The official ones? Never going to happen. Anyone want to guess how many patents Microsoft has on DirectX tech?
And the unofficial ones haven't even gotten GL right, yet, and you're proposing they try to support another interface?
More importantly, you're assuming this is a good idea -- that we should be working to clone a Microsoft technology, instead of improving on one which has been open from the start (GL).
Jumping ship to DX10 would be nice, if it were cross-platform. (No, Xbox + PC does not count as "cross-platform".)
Unfortunately for those of us on Linux/Mac, a lot of Windows developers don't care.
Unfortunately for those of you who think you don't care about this, consider that porting an app generally improves it, and can shake out bugs which aren't as apparent on the other platform -- which means potentially less reliable games, even if you're only on Windows.
And unfortunately for those of us who hate Vista, that's kind of a requirement for DirectX 10. At least with OpenGL, those in charge have no agenda to push Vista -- so an OpenGL 3.0 game should run on XP, if it runs on anything.
Trust me GP, if you went to the library, photocopied a book there and THEN started handing it out
Well, teachers do this -- just not of the whole book, and only for 20 or 30 students, and the copy would likely be thrown away after that class.
And no one cares.
I suspect they would start caring, though, if teachers could hand out full, perfect copies which they made for free.
The problem here is, again, one of magnitude (copying a whole book, possibly thousands of times) and of commercial interest (profiting from the book, via adwords, even if you make it available for free).
Thanks for the note. I have received similar notes from others who wish to back off of any claim that OpenID should be tied to any particular authentication methodology. That sure doesn't come across in the message that OpenID presents to the curious user.
I've pasted this here because I saw nothing in his reply that suggested he wanted confidentiality -- or even that it was directed at me, given that he addressed very little of what was in my email. (The mention of "similar notes from others" suggests a form letter.)
Yet, curiously, I see no updates about this in the article, nor any mention of this outside a private email -- no blog posts, no followup articles, nothing.
Apparently, it's enough that "OpenID" somehow misrepresents itself -- wait, how? Googling for "OpenID password" lists other forms of authentication in the Google summary, no more than the fifth link or so.
But assuming that this has happened, it's good enough that there is confusion -- never mind that you're contributing to it? After all, who cares about the truth, as long as this lie is inflammatory enough to drive traffic?
He's not quite as bad as Dvorak... yet.
Again, what about all this makes it more secure than something you keep in your mind?
Go back and read, then. The password that you "keep in your mind" is also a password that I keep in my keylogger, if you use it on a public terminal. That won't work with a physical token.
I can't lose my password as if it's a physical entity; physical security tokens can be.
Losing it isn't the security hazard. The fact that someone else could recover it is.
And you can, easily, "lose" -- or rather, neglectfully expose -- your password.
You keep talking about diligence -- is it really that much easier for you to remember a semi-random string of alphanumeric digits than it is for you to remember where your physical keys are?
As someone working with computers for longer than most so-called "experts" have been alive...
...you qualify for a "Get Off My Lawn" award.
I question their motivations and their common sense to go against a proven security method just because uneducated users that use "password" as their passwords are being taken advantage of.
I would say that the fact that uneducated users are using "password" as their password is proof of a flaw in this security method.
It's like finding radical new methods of home security for people who leave their door unlocked.
If a significant percentage of people left their door unlocked, yes, we would have such systems.
An important point to realize is that most of the technical problems of security have been solved. Security on a large scale is really about economics and sociology, far more than it is about technology and "common sense".
But while we're at it, how do you feel about home security? Certainly, locking the door works, just as passwords work? All those people buying these complex home security systems are wasting their money, right? Just one more component to fail?
Before you answer that, it's not entirely rhetorical. Read my sig.
And yes, that's the idea behind posting AC instead of a user to protect one's karma. It doesn't take a genius to understand that...
...nor does it take a genius to understand relativity.
It does, however, take a little bit less ambiguity in your use of language, if you wish to be understood.
And are you that unsure of your opinions that you aren't willing to stand behind them, even with an alias? I make AC posts when I may be exposing myself to legal liability with a post -- not just because I'm afraid of hurting my karma. And I do get modded to -1, troll, sometimes.
which sort of calls into question the wisdom of the rest of your post.
Actually, no, it doesn't. That's called an ad hominem argument, and I'm flattered that you feel my arguments are so strong that you need to attack me as a person to make your point.
Again, one single password allowing access to everything is the fault of the user, not the password authentication system.
Doesn't the same apply to OpenID, then?
But doesn't that defeat the idea of OpenID? Why not just use passwords, then?
Because you still get the ability to choose a provider, and an authentication method, rather than being forced to use whatever the site admin setup.
The point is that OpenID doesn't reduce your security in any way, unless you alter your habits because of it.
You don't understand the difference in posting AC and under a user, where negative moderation affects karma (in this case, unfairly)?
Given that ACs have no karma, no I don't, unless you have an account you're trying to protect.
And how do these magical physical tokens somehow magically directly bypass the physical terminal and go directly to the site in question?
There's nothing magical about it. Here, go read.
Now, it does still have the implication that you've authenticated the local terminal for whatever length of time until your session expires. So it's still better to have a trusted terminal.
However, it does mean that even if they lift every single keystroke, they won't be able to predict the next pseudorandom number that your physical token will come up with, so once your session ends, the window of opportunity is gone.
It's much simpler just to use a password, which can also be easily changed, than having to carry a physical key
Given you're not suggesting that I carry a physical password, it seems like you're saying that it's easier to memorize a key -- and then change it, and memorize the new one -- than it is to carry a physical key which, quite literally, fits on your keychain.
But then some method can be invented to pull private keys via malware or some security hole. Same thing.
No, this requires them to compromise the local machine.
The phishing attack I described does not.
And who is to say that the site can't fool the browser itself to make it think it's legitimate?
Actually, I just said it: They can't fool the browser itself, short of finding a bug in the browser.
Humans can be fooled as well, but it is much harder to fool a diligent person than it is a mindless automated process, no matter how well designed.
Well, actually, I did trivially fool you here, into assuming something about the physical token.
And I notice, also, that you went out of your way to make it black and white -- you claim that passwords are the single most secure form of authentication. I'm not sure there's any single form of authentication more secure than two-factor authentication.
First rule of software development: "Never trust the client application."
Problem: This will never work for gaming.
Maybe if... No. NEVER.
I don't get to sue people who browse my webpages with software I haven't specifically authorized.
Your webpages very likely are simply pages, not actual games.
Instead, I have to make sure that my stuff won't break, regardless of what software is accessing it.
And indeed, the server didn't break. It did exactly what it was designed to do.
But do you realize what Glider is?
Glider is a program which auto-plays WoW for you. It is, in other words, doing perfectly acceptable things, and not breaking any security, server-side -- except for the part where a human is supposed to be playing, and a bot is, instead.
The only way to prevent this from happening would be for the server to be able to detect whether the game is being played by a bot or a human. And that's the CAPTCHA problem all over again.
And by the way, this problem has existed for a long time -- look at aimbots, or better, wallhacks. The only way to prevent a wallhack (make all walls appear as translucent, so you can see players through them) is to send as little information as possible -- but there's still going to be a case where this doesn't help; where the person without the wallhack would simply hear footsteps behind the door, and the person with the wallhack can see a full body.
The only way to avoid wallhacks, absolutely, is to do all the rendering server-side. And that wouldn't prevent aimbots, it would just make them much harder.
The only way to prevent this kind of cheat is to make a game which gains nothing from computer augmentation -- or which a human will always play better than a computer. Good luck with that -- even chess barely qualifies.
That, or give up trying to make a real game, and let everyone play Progress Quest.
All games should have *some* method of trivial protection to stop case 1 because it destroys sales.
Where's your evidence of this?
I would argue that most "trivial" protection used here destroys more sales than the "casual" piracy you're describing would.
I think often the copy protection is like a bicycle lock. It's enough of a deterrent to keep the average Joe from just taking the bicycle, or just copying the CD and giving it to his friend...
I think that's the mentality, and I think that's why there's such a problem here.
You see, if I buy a bicycle, I choose whether or not it comes with a lock. If I got a lock, that means I'm trading a little of my own convenience for a little of my own added security.
That's a fair trade, and one which I fully consent to. If I don't like it, I can just not buy a lock -- I still get the bike.
Oh, and one more thing: It's considerably easier for me to unlock my own bike than it would be for a bike thief to break the lock.
Copy protection, on the other hand, trades more than a little of my convenience for someone else's security. Which is pretty fucking rude and presumptuous. Tell me again, as a paying customer, why is it my problem that other people are pirating from you?
On top of that, it's considerably easier for a pirate to download a cracked version for free than it is for me to use a legit copy.
And if I don't like it, I really have no option but to pirate, or to not buy the game. That's like saying you're not allowed to have a bike unless you lock it.
They present you with some pictures - you pick out the ones that fall into the catagories that you picked earlier
How is this relevant?
Oh wait, I know: If Vidoop was smart, they'd become an OpenID provider. (Maybe they have already?)
That was the point: If OpenID is widely adopted, then you can use things like Vidoop anywhere you want, so long as they support OpenID. The sites you're trying to authenticate with don't even have to know about Vidoop, much less go out of their way to implement it.
when the central authority is compromised, all my sign-ons could be compromised.
You're missing the point.
I am saying that one single-point-of-failure is better than N single-points-of-failure.
If you use the same password everywhere, then everywhere you use that password is every bit as much a single-point-of-failure as your central authority.
Personally, I like the fact that I can control everything and I do use super-strong passwords (if that's not an oxymoron) for my 'important' accounts.
So, you could use a throwaway OpenID account for unimportant accounts, and a super-strong OpenID account (or more than one! Imagine that!) for your important accounts.
That's not to say that my stuff couldn't be compromised, but personally, I am more comfortable with controlling it myself.
Then you should be, not walking, but running to get OpenID implemented as many places as you can.
Because, you see, you have exactly as much control as you want -- up to and including running your own OpenID provider. That's not something you can have with passwords.