4 ms·

Install bombing is still a problem. Unity, for all its "clarifications," keeps promising it won't be a problem and then refusing to be transparent about any of

Install bombing is still a problem. Unity, for all its "clarifications," keeps promising it won't be a problem and then refusing to be transparent about any of the ways it could possibly be less of a problem. Either they backtrack on this whole lifetime install count scheme or this blows up even more spectacularly when January rolls around.

gambiting 3y ago
I don't understand why this is a worry - they will do it the same way Valve/Microsoft/Epic/Blizzard identify how many machines you have their product installed on - with a unique hardware ID that will make sure you aren't charged twice for installing the game on the same machine. It's not rocket science, it's been used in the industry for ages.
- Ekaros 3y ago
  I'm not sure that really fits well with GDPR... Or it has to be quite far removed from any actual identifier. I certainly believe that tracking number of game installs to bill someone else isn't legitimate reason to store any identifying data about my systems...
- bitvoid 3y ago
  Are you sure? As far as I'm aware, I'm able to install a game I own on multiple machines for all of these platforms. I figured that the game is tied to my account, not some hardware ID. Why would they need to make sure I'm not charged twice based on installing the game to a machine rather than just seeing if my account owns it? I have never been charged more than once for a game I own that I have installed on both my desktop and my laptop, even after replacing those machines.
  - gambiting 3y ago
    Microsoft will stop you from downloading the game if it's installed on too many devices - it will tell you to deauthorize it on another device or sign it out entirely. >> I figured that the game is tied to my account, not some hardware ID Because it is. These platforms still use hardware ID matching for account bans and other functionality.
- LMYahooTFY 3y ago
  Can you provide examples where this has been used in then industry? With the examples you listed doesn't it require an account to authenticate first before achieving this? Furthermore, is this not easy enough to spoof? Without account based authentication (which as far as I know Unity does not use/require?) what stops me from spinning up VMs or emulators repeatedly to attempt to install bomb?
  - gambiting 3y ago
    >>Can you provide examples where this has been used in then industry? Microsoft tells you if you install the game on too many devices. >>With the examples you listed doesn't it require an account to authenticate first before achieving this? Uhm, no, that's how it's implemented but it isn't required. >> what stops me from spinning up VMs or emulators repeatedly to attempt to install bomb? Nothing, but it would be very time consuming and very easy to detect.
    - anonymousab 3y ago
      Install count and hardware based DRM in games is notoriously bad. Reports of "I changed a graphics card and now the game is locking me out" are as old as time. It is a solution that can be done more, or less, correctly or fairly. But the problem is that it is easy to get it wrong, it is easy to implement this incorrectly. Given how slipshod and slapdash these announcements and responses and walkbacks have been, you can't really have any faith that they will fall into the "right" side of things.
- ZeWaka 3y ago
  > unique hardware ID This is vastly more difficult than you think. For example, if you try to use the standard method, which is hard drive serial numbers, it's incredibly easy to spoof AND all prebuilt computers from Walmart share the same serials. Non-starter.
  - gambiting 3y ago
    I have no idea why you think it's difficult at all. On windows Microsoft provides you directly with functionality to query the device ID, that's good enough but in reality if you pair it with some kind of online login system it's pretty much all you need. https://stackoverflow.com/questions/47603786/where-do-windows-product-id-and-device-id-values-come-from-are-they-useful https://stackoverflow.com/questions/47603786/where-do-window...
    - anonymousab 3y ago
      That is trivial to spoof for a malicious user, as are the Android ones. > if you pair it with some kind of online login system Unity does not have that and there is no way in hell that they will be able to force all players of all games made in unity to sign up for one.
    - ZeWaka 3y ago
      > I have no idea why you think it's difficult at all. Because I help develop a game engine / platform that deals with this problem and therefore done extensive research? All of those Microsoft device ID variants are trivial to spoof or collide. If you're talking about GetSystemIdForPublisher() and friends like 'Product ID', you get the Walmart collision problems. https://github.com/topics/hwid-changer https://github.com/topics/hwid-changer Furthermore, if you rely on an easy-to-spoof hardware ID system, if someone gets ahold of someone else's HWID (see: database breach, phishing), you can trivially mess with the data. Valve/Microsoft/Epic get around this by spending tons of developer time on this problem and using techniques like fingerprinting and behavior analysis.
- Hemospectrum 3y ago
  They're repurposing an existing telemetry system that already counts installs and cannot distinguish between a new install and a reinstall. They've been using it for at least five years. I only know this because they specifically pointed it out when announcing the new pricing plan.
  - gambiting 3y ago
    >>and cannot distinguish between a new install and a reinstall And they've also specifically said they will not charge twice for a reinstall on the same device. So I guess we'll have to see.
    - anonymousab 3y ago
      They initially said the exact opposite. They changed their mind after being shouted at about all of the above concerns. They're clearly flying by the seat of their pants with this. There is no reason to give them any rope, any benefit of the doubt. There is no reason to believe that they will be able to do this right.
- anonymousab 3y ago
  > I don't understand why this is a worry It's a massive new change and requirement coming into force in only a few months, with basically every single report coming out of Unity internal engineering being that they don't have any systems in place to figure this out and have no idea how they will actually make it work while also still being GDPR compliant. "Just trust us bro" and "you can file a support ticket if we get the numbers wrong" are not acceptable and are each reasons enough to worry about the potential for (or rather, guaranteed) abuse of this system. One must assume the worst about any implementation with a system like this, in the same way that once must assume the worst about any implementation of telemetry or of DRM. You'll be right far more often than wrong.
- LocalH 3y ago
  They have literally said they're not going to do this because their install tracking does not give them any personally identifiable information.

gambiting 3y ago

I don't understand why this is a worry - they will do it the same way Valve/Microsoft/Epic/Blizzard identify how many machines you have their product installed on - with a unique hardware ID that will make sure you aren't charged twice for installing the game on the same machine. It's not rocket science, it's been used in the industry for ages.

Ekaros 3y ago
I'm not sure that really fits well with GDPR... Or it has to be quite far removed from any actual identifier. I certainly believe that tracking number of game installs to bill someone else isn't legitimate reason to store any identifying data about my systems...
bitvoid 3y ago
Are you sure? As far as I'm aware, I'm able to install a game I own on multiple machines for all of these platforms. I figured that the game is tied to my account, not some hardware ID. Why would they need to make sure I'm not charged twice based on installing the game to a machine rather than just seeing if my account owns it? I have never been charged more than once for a game I own that I have installed on both my desktop and my laptop, even after replacing those machines.
- gambiting 3y ago
  Microsoft will stop you from downloading the game if it's installed on too many devices - it will tell you to deauthorize it on another device or sign it out entirely. >> I figured that the game is tied to my account, not some hardware ID Because it is. These platforms still use hardware ID matching for account bans and other functionality.
LMYahooTFY 3y ago
Can you provide examples where this has been used in then industry? With the examples you listed doesn't it require an account to authenticate first before achieving this? Furthermore, is this not easy enough to spoof? Without account based authentication (which as far as I know Unity does not use/require?) what stops me from spinning up VMs or emulators repeatedly to attempt to install bomb?
- gambiting 3y ago
  >>Can you provide examples where this has been used in then industry? Microsoft tells you if you install the game on too many devices. >>With the examples you listed doesn't it require an account to authenticate first before achieving this? Uhm, no, that's how it's implemented but it isn't required. >> what stops me from spinning up VMs or emulators repeatedly to attempt to install bomb? Nothing, but it would be very time consuming and very easy to detect.
  - anonymousab 3y ago
    Install count and hardware based DRM in games is notoriously bad. Reports of "I changed a graphics card and now the game is locking me out" are as old as time. It is a solution that can be done more, or less, correctly or fairly. But the problem is that it is easy to get it wrong, it is easy to implement this incorrectly. Given how slipshod and slapdash these announcements and responses and walkbacks have been, you can't really have any faith that they will fall into the "right" side of things.
ZeWaka 3y ago
> unique hardware ID This is vastly more difficult than you think. For example, if you try to use the standard method, which is hard drive serial numbers, it's incredibly easy to spoof AND all prebuilt computers from Walmart share the same serials. Non-starter.
- gambiting 3y ago
  I have no idea why you think it's difficult at all. On windows Microsoft provides you directly with functionality to query the device ID, that's good enough but in reality if you pair it with some kind of online login system it's pretty much all you need. https://stackoverflow.com/questions/47603786/where-do-windows-product-id-and-device-id-values-come-from-are-they-useful https://stackoverflow.com/questions/47603786/where-do-window...
  - anonymousab 3y ago
    That is trivial to spoof for a malicious user, as are the Android ones. > if you pair it with some kind of online login system Unity does not have that and there is no way in hell that they will be able to force all players of all games made in unity to sign up for one.
  - ZeWaka 3y ago
    > I have no idea why you think it's difficult at all. Because I help develop a game engine / platform that deals with this problem and therefore done extensive research? All of those Microsoft device ID variants are trivial to spoof or collide. If you're talking about GetSystemIdForPublisher() and friends like 'Product ID', you get the Walmart collision problems. https://github.com/topics/hwid-changer https://github.com/topics/hwid-changer Furthermore, if you rely on an easy-to-spoof hardware ID system, if someone gets ahold of someone else's HWID (see: database breach, phishing), you can trivially mess with the data. Valve/Microsoft/Epic get around this by spending tons of developer time on this problem and using techniques like fingerprinting and behavior analysis.
Hemospectrum 3y ago
They're repurposing an existing telemetry system that already counts installs and cannot distinguish between a new install and a reinstall. They've been using it for at least five years. I only know this because they specifically pointed it out when announcing the new pricing plan.
- gambiting 3y ago
  >>and cannot distinguish between a new install and a reinstall And they've also specifically said they will not charge twice for a reinstall on the same device. So I guess we'll have to see.
  - anonymousab 3y ago
    They initially said the exact opposite. They changed their mind after being shouted at about all of the above concerns. They're clearly flying by the seat of their pants with this. There is no reason to give them any rope, any benefit of the doubt. There is no reason to believe that they will be able to do this right.
anonymousab 3y ago
> I don't understand why this is a worry It's a massive new change and requirement coming into force in only a few months, with basically every single report coming out of Unity internal engineering being that they don't have any systems in place to figure this out and have no idea how they will actually make it work while also still being GDPR compliant. "Just trust us bro" and "you can file a support ticket if we get the numbers wrong" are not acceptable and are each reasons enough to worry about the potential for (or rather, guaranteed) abuse of this system. One must assume the worst about any implementation with a system like this, in the same way that once must assume the worst about any implementation of telemetry or of DRM. You'll be right far more often than wrong.
LocalH 3y ago
They have literally said they're not going to do this because their install tracking does not give them any personally identifiable information.