11 ms·
When Random Isn't
- hhh 3y agoWorld of Warcraft is what started my interest in programming. I was 6 when it came out, and when private servers started popping up I became interested in how to make my own npcs, and that’s how I picked up Lua. I still have a lot of posts on the forum for that stuff (MMOwned), and one of the people that helped me learn then still posts semi-actively. Compiling my own private server core was how I learned about compiling things, SVN, and how to apply patches (there was a bug related to mage’s fireball, can’t remember what it was.)
- behnamoh 3y ago> I still have a lot of posts on the forum for that stuff (MMOwned), and one of the people that helped me learn then still posts semi-actively. Man, whenever I am reminded of the old forums I can't help but get nostalgic. Nowadays, it's like a good piece of the internet is replaced with dopamine-inducing social media apps and gated forums (e.g., Reddit). I don't know why I still hang out here on HN, maybe mainly because it reminds me of the old forums...
- _lvbh 3y agoI do wish more of the younger generation would be willing to hang out on forums/irc/etc. I would not install Facebook even if it cost me friends
- DeathArrow 3y agoNewer generation is on TikTok, not Facebook.
- Buttons840 3y agoHN threads die to quickly though. For the true old-forum feel we need fewer users with focused interest and threads that last for weeks.
- hprotagonist 3y agothreads can go for multiple years, if you do it right
- behnamoh 3y agohe's right tho — lack of notifs on HN means you won't know about replies to your comments or new comments in fav threads.
- aspenmayer 3y agoTell HN: HN Replies is email notifications for comment replies, maintained by Dan Grossman. https://hnreplies.com/ https://hnreplies.com/ https://news.ycombinator.com/user?id=dangrossman https://news.ycombinator.com/user?id=dangrossman
- DeathArrow 3y agoYou can make a browser add-on or use a script to keep you in the loop.
- maxbond 3y agoWhich is to say, always reply within two weeks. Does anyone know of a thread on HN that survived multiple months?
- Buttons840 3y agoAlso, old forums didn't organize comments in tree structures, they were just flat chronological comments. This is technically inferior, but it helped keep everyone more focused on a single thread, as it were.
- 3y ago
- Vvector 3y agoI wrote an AH script. It would scan every auction, buy under-priced items, and relist. If someone undercut me, it could cancel and relist just below them. I basically had unlimited gold.
- AnthonyMouse 3y agoThis is basically what high frequency trading is in real life.
- eru 3y agoOnly with a lot more regulation, and the competition is very sharp.
- Jaygles 3y agoHow did you determine what was under-priced?
- deleted 3y ago[deleted]
- andenacitelli 3y agoSpent some time with this kind of system in WoW, TradeSkillMaster. Figuring out an accurate valuation was difficult and one of the biggest differentiators of how successful you were. This would vary by item, but was most commonly some combination of recent minimum buyouts (usually over the last two weeks) historically value (several months), and much more. Common items would usually be mostly recent value driven, whereas lower-supply items might have a larger component of historical weighed in, as there might be quite a bit of fluctuation day to day and you care much more just about the general trend. All sorts of nuance to it. You can do more complex stuff like only doing your price estimations off items that actually sold, set values based on a percentage of any other value, and much, much more. It gets really complex but is really cool at scale.
- hinkley 3y ago
- cowthulhu 3y agoI wonder if there’s any chance that they were using the same RNG on the server. Seems like you could theoretically exploit it if so, given a very low usage server, low ping, ability to get a decently precise window into the current state of the rng, and ability to quickly generate another event with a high economic variance tied to rng.
- plorkyeran 3y agoVanilla WoW used Mersenne Twister on the server, which has a number of problems but isn't so trivially broken. They posted a lot of the details how the server-side RNG worked in a (mostly unsuccessful) attempt at killing the rumors around "loot seeds" and such that superstitious players were utterly convinced were a thing.
- omgmajk 3y agoAh, the days of farming glowing brightwood staff.
- 38 3y agoFYI your link color is almost unrecognizable. its basically a (very) dark blue against black.
- pests 3y agoYou might be using a setting to force dark mode which has no guarantees to be correct. The site has white background with black text in normal and darkmode. Could probably use a better stylesheet for darkmode but disabling whatever you have on would probably also fix it.
- 38 3y ago> link color
- pests 3y agoWhat? If the link colors stay the color they were designed to be, but you automatically convert the foreground and background colors, you're gonna have a bad time. If the site is black on white, with dark links, and you change it to white on dark with dark links, the links are gonna be hard to see. That has nothing to do with the links, the issue is you changed the primary colors without changing the link color!
- 38 3y agoyou keep assuming I am using dark mode, I am not. I am using the default browser settings. WITH THAT, the link color is almost unrecognizable. it almost the exact color of the surrounding text: http://0x0.st/HU7r.png http://0x0.st/HU7r.png compare with Wikipedia: http://0x0.st/HU7s.png http://0x0.st/HU7s.png
- pests 3y agoSorry, I misread your original comment. To me "very dark blue against a black" sounds like you are talking about foreground and background colors.
- hinkley 3y ago>security I will be forever appalled that Blizzard rolled out two factor authentication before stock trading services like E*Trade managed it. Bravo for Blizzard, shame on the rest of ‘em. A game company.
- bee_rider 3y agoIt doesn’t seem that surprising to me. In the olden days, video game companies served a slightly more technical user base, so it makes sense that they’d be more willing to deal with 2FA. Also, I don’t think the legal system will help you recover your SoJs.
- profmonocle 3y agoI worked with someone who was a Blizzard GM around when they rolled this out. Recovering stolen accounts was some absurdly large % of their customer service tickets. People would use the same email & password on WoW as on various shady / insecure sites. Bots would try any stolen credentials en masse in WoW. When they succeeded, not only would customer service need to restore a user's access, they would need to roll back their character to restore lost items and gold. According to my coworker, adding 2FA was primarily about reducing this customer service workload. Eventually they encouraged it by adding in-game benefits, like additional bag space for your character. Not sure they ever went as far as mandating it.
- Paul-Craft 3y agoSo, what happened after they implemented it? Did CS tickets actually go down a lot? Did it save them a ton of money and hassle? You left off the best part of the story :-) As for mandating it, I could see not requiring people who'd already set up accounts to jump through this extra hoop to play the game. I'm sure even a small percentage might not be able to jump through that hoop. I doubt it's a significant percentage, but I could see it becoming a PR hassle, and those are the worst kinds of hassle from the POV of a technical employee lol... But for a new game? If the CS metrics reflected a big drop relative to the number of people using 2FA, then I'd be sold on requiring it.
- paulpauper 3y agoThe economics and incentives of RNGs are interesting. If nothing is materially at stake ,an imperfect RNG, even a bad one, suffices provided people cannot easily tell, such as games. But if money is at stake or security, like crypto wallets or online casinos, suddenly it matters A TON.
- DonHopkins 3y agoWhen Variables Don't and Constants Aren't
- maxbond 3y agoInteresting. Seems to be a meme with a deep history. https://www.theregister.com/2006/07/26/constants_are_not/ https://www.theregister.com/2006/07/26/constants_are_not/ > I first read the lament to the capricity of programming [in the title of this piece, "Variables Won't Constants Aren't"] in Creative Computing, years before C was devised. If there's a particular document you feel is canonical to this meme, I'd be interested to read it.
- anonymoushn 3y agoI suspect it's a math thing, because in math it actually describes the normal state of affairs. Anyway, here it is in a compilation of such sayings dated 1979: https://www.cse.unr.edu/~sushil/quotes.html https://www.cse.unr.edu/~sushil/quotes.html
- deleted 3y ago[deleted]
- maxbond 3y agoThat document is a gem worth it's own submission. I'm sure many of it's constituents have been on HN but I took a glance and don't think it's ever been on HN[1], though it appears a dead mirror was once posted with 0 interaction [2]. Feel free to submit it if you want, otherwise I'd like to. [1a] https://news.ycombinator.com/from?site=www.cse.unr.edu https://news.ycombinator.com/from?site=www.cse.unr.edu [1b] https://news.ycombinator.com/from?site=unr.edu https://news.ycombinator.com/from?site=unr.edu [1c] https://hn.algolia.com/?query=Murphy%27s%20laws%20and%20corolaries https://hn.algolia.com/?query=Murphy%27s%20laws%20and%20coro... [2] https://news.ycombinator.com/item?id=2863516 https://news.ycombinator.com/item?id=2863516
- anonymoushn 3y ago
- lifthrasiir 3y agoWhile I never played WoW, I have heard that many addons used a private chat as a means of inter-... whatever communication. If there is a way, people will eventually find and use it.
- robobro 3y agoAs a means of what?
- lifthrasiir 3y agoLike, sockets. (Addon instances are not processes, so it is not exactly interprocess communication...)
- taspeotis 3y agoInterprocess communication?
- maxbond 3y agoI don't recall the name of the company but I read about a startup who's product added chat features to a client's website. They noticed a developer using it for IPC, and ended up pivoting into making a product to enable IPC for web apps. (Or inter-something, like you point out it's not an OS process, it's an application-level process. Intertask communication if your prefer.)
- Philpax 3y agoSounds like the story of Firebase? https://en.wikipedia.org/wiki/Firebase https://en.wikipedia.org/wiki/Firebase
- maxbond 3y agoI didn't find that specific story after searching for a few minutes with Firebase as a keyword, but it does seem plausible based on the summary on Wikipedia, at least if I misremembered some details (which could well be).
- hota_mazi 3y agoRelated: https://www.beust.com/weblog/various-ways-to-get-randomness-wrong/ https://www.beust.com/weblog/various-ways-to-get-randomness-...
- smeeth 3y ago"Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin. For, as has been pointed out several times, there is no such thing as a random number — there are only methods to produce random numbers, and a strict arithmetic procedure of course is not such a method." - John von Neumann
- NohatCoder 3y agoAs a cryptographer I can't stand this quote. Nothing against Neumann, but the people who choose to spread it as sage wisdom really only manage to convey misinformation. In context it is a superfluous philosophy quip. We have had fast reliable cryptographic random number generators for decades. They really do work with just a tiny seed and a bunch of arithmetic. The numbers produced are indistinguishable from any other proper random source, and they work for any purpose. Too many people don't understand this, and entire companies are founded on selling snake oil true random.
- NoPicklez 3y agoI have to agree with this. It is a superfluous philosophy quip. It's no secret that random numbers' cannot pop out of nowhere. I see these "When Random Isn't" type articles every year or so. It's just poor implementations where the procedures to produce random numbers have been suboptimal for their intended outcomes.
- gometo 3y ago[dead]
- stevekemp 3y agoSee also that time when hacker news was hacked, due to weak random numbers: How I Hacked Hacker News (with arc security advisory): https://news.ycombinator.com/item?id=639976 https://news.ycombinator.com/item?id=639976
- nneonneo 3y agoWeirdly, I answered almost exactly the same “invert the RNG” question on StackOverflow (https://stackoverflow.com/a/15237585/1204143 https://stackoverflow.com/a/15237585/1204143) just a few months before you posted your question to Crypto.SE, except that I attacked the Java RNG instead of the MSVC RNG. They both use a simple LCG design where outputs are truncations of the internal state, so the attacks are very similar to each other.
- hayley-patton 3y agoI'm not very good at maths so I let Z3 work out some convenient seeds for me, leading to import java.util.Random; public class Hayley { public static void main(String... args) { byte[] b1 = new byte[4], b2 = new byte[2]; (new Random(0x2effe2140e00L)).nextBytes(b1); (new Random(0xc2f0097)).nextBytes(b2); System.out.println(new String(b1) + new String(b2)); } }
- xenonite 3y agoEven worse, the given linear congruential RNG yields only 12445 distinct numbers, then repeats itself. It would be sensible to simply use better parameters for this algorithm.
- smallstepforman 3y agoEngineering is a compromise, for simple tasks (eg motion of particle is smoke trail exhaust), you need a simple yet FAST rng. For cryptography, casino gaming etc, not only do you use a better Rng with at least 32 byte state, you also cycle the engine at random intervals to further prevent predicting the outcome.
- loeg 3y agoAn LCG with better parameters would be just as fast.
- jonathanlydall 3y agoA bit tangential, but a related fun story from many years ago during my time as a WoW GM. There was a popular add-on (Titan Bar I think?) that had a bug in one of its versions where it would always call the API which showed the "write a ticket to a GM UI", if you tried to cancel it, then it would just pop up again, the only way to stop this dialog from being in the way (aside from uninstalling the problematic add-on) was to put something in the text box and press submit. It was a very bad day or two for the GMs, many players didn't even know about GMs or that that you could submit tickets to them, and trying to explain to a customer that you're a customer service representative who's contacting them because they submitted a ticket likely due their one add-on was more often than not a tricky one. Because it essentially destroyed the ability to perform reasonable customer service response times the developers put out a hotfix which also put that API call behind protection, making it impossible to be called except from Blizzard's own LUA code.
- anonymoose33282 3y agoTitan Panel I think was the name? It was the one that kinda "unified" a lot of UI elements into one bar (total gold, repair percentage, stuff like that).
- aatd86 3y agoSummary in simpler terms? So it's just because the actions in game where functions which were assigned an id and callable by id. Then because OP was able to reverse engineer that id generator, OP was able to call whatever he wanted once he tested what id was doing what. Didn't read the math in the middle, I could get it but takes too much time at my age nowadays.
- nkrisc 3y agoThe IDs are arbitrary and chosen by the author. Outside the secure context they had the information to select which (arbitrary) ID they wanted to pass into the secure context. So they call `random()` until they know the next call to it will produce the desired ID. Then they pass control to the secure context which calls `random()` and uses the result as a the ID to lookup what action to take in the same arbitary ID<->action mapping table.
- aatd86 3y agoAhem, They are only chosen by the author for the goal of reverse engineering and finding valid ids. But he doesn't assign ids manually when writing the scripts. As far as I understand.
- nkrisc 3y agoIt doesn’t really make a difference either way. You could wait for a number to come up that would match the game’s ID for the action you want to take, or an arbitrary one from a table you hardcoded in the secure function call. As long as you have a method for knowing the next outcome of the random call, that’s all you need.
- aatd86 3y agoI don't understand what you're saying. The way I understand it, he managed to find a way to retrieve ids assigned to functions that have an action in game. By trial and error and because the ids are generated by a PRNG which he knows. He just needs to retrieve the starting state and then boom. It matters to know whether an in-game action/function is mapped to a given id, contrary to what you're claiming. Otherwise, what's the point? These ones can't not just arbitrary. That's what he is looking for. (Why these unnecessarily complex explanations is my question though.)
- Arech 3y agoyep, and I'm aware of a data encryption product that was hacked by utilizing exactly the same technique. As dumb as it could be: they promised billions of years an attacker need to decipher data, but were using a dead simple LCG to make a key and a salt. And the salt was stored in a crypto container in open form (b/c it's a salt). :facepalm: Don't implement data encryption on your own, kids...
- pcvarmint 3y agox = x * 69069 + 1;
- GuB-42 3y agoA good example of a really terrible RNG is in Monster Hunter 3 Ultimate, and maybe others. Not only it is completely exploitable for better loot, it also gave rise to "charm table". Some items have randomly generated statistics, and depending on your initial seed (stored in the game save!), there is a limited number of items you can get, and if you are unlucky, you may have a "cursed table", which is effectively a RNG with a really short period, meaning you will never get the best rolls. Not game breaking, but bad for high level play.