3 ms·

"The only solution to this is to check words on the server." What problem are you trying to solve? My understanding of the problem being discussed: How can yo

by smarx 14y ago

"The only solution to this is to check words on the server." What problem are you trying to solve? My understanding of the problem being discussed: How can you make sure you aren't being cheated when playing Letterpress? To solve that problem, all I have to do is validate that all your moves are legal. (In the case of Letterpress, that all the words you play are in the dictionary.) There's no need for a server to solve that problem.

evan_ 14y ago
> To solve that problem, all I have to do is validate that all your moves are legal. Fair enough, that keeps me from cheating you by playing an illegal word. Now, what prevents you from cheating me by saying all of the words I play are invalid? (And are you really prepared to wait until my phone is in radio range before you learn if your play is accepted or not?) That this would make for an incredibly boring game isn't relevant.
- smarx 14y ago
  You already know whether your play is legal or not. If you're not cheating, then all your plays will be legal. You don't have to wait for anything. As to your opponent rejecting legal moves, what's the problem? You made a legal move, and then they refused to continue the game. There's no issue here.
  - tolmasky 14y ago
    Well the problem arrises in how such a game with "passive" cheating (your opponent having removed words you might play from their dictionary to thwart you) would be counted. Detecting a mismatch is simple, determining if it was malicious, and thus the next action you take afterward is more complex: 1. You could send back a rejection. This would handle the legitimate mismatch where differing versions of the app could have different dictionaries (there are notable missing words in the 1.0 so I wouldn't be surprised if words are added in newer versions). Receiving something like "could not verify word" is much nicer than the game just ending on you. However, this still allows your opponent to cheat in the manner described above by removing words you want to play from his dictionary. It would thus be frustrating to play against such a person. He knows the word is valid, but cannot play it against you and must play something else. He is forced to decide whether to forfeit or try a different word. 2. The solution you described: simply end the game, no win or loss since you can't know who was at fault. If this game EVER employs a ladder system, then this is the equivalent of pulling the cord in an internet game, you avoid a loss. Not to mention, again, this doesn't deal with the cases of legitimate differing dictionaries. The problem with both these methods is that cheating still has an affect. Whether it be ending the game or volleying back to you, a cheated action changes the state of the game. It is instead preferable to prevent cheating. Prevention really does thus require words to simply get checked on a server. 1. There is a clear trusted source for the words, 2. You don't need to ship an App Store update to update your dictionary. 3. There is simply no such thing as word cheating anymore, short of hacking the server.
    - smarx 14y ago
      You've introduced two new problems, neither of which we were discussing previously: 1. How can you deal with multiple versions of the dictionary? 2. How would a third-party (like a rating system) handle cheaters? I would say that the simplest solution for #1 is to not allow this. Players shouldn't try to play against each other if they don't agree on the dictionary. Whether you update dictionaries by shipping new versions of the app, by having clients download them from a server, or by keeping them on the server (as an oracle) isn't important. For the second problem, I think you have a server by definition. You introduced some sort of rankings, which I assume are held on a server somewhere. So this is considerably off-topic.
      - tolmasky 14y ago
        1. It occurs to me that you may have misunderstood how the server system we are describing would work. Your use of the word "oracle" I believe implies that you think the client is asking the server if the word is fine, then if it is, the client is then sending that word to the other client -- which I agree, is no more secure. However, that is not how it would work. The way it works is you send the word to the server, if the server is happy with it, it sends it to the other player, that way there is a gatekeeper that it is impossible to circumvent. Without a server, the solution of "ensuring" the same dictionary on both sides is no different than our original issue of checking individual words: how can you reliably check if both sides have the same dictionary? One side can always just lie, because it ultimately is communicating directly to the other party. The client can send fake dictionaries, fake checksums, fake app version numbers, fake anything to the other side. All you've done is move the individual word checks currently being done to one-time some-other-value checks. For this reason it has absolutely everything to do with a server. The server has to be the holder of the "truth" and thus bad words simply will be rejected with no issue. If you are always doing checks on the client, there is simply no way to ever be sure of anything. If you want to argue "OK fine but I don't think many people will cheat", then that is an acceptable but very different argument. But saying "I can thwart cheating just fine solely with client-side operations by doing ____" is really just a waste of your time because it just won't work, you might as well just do nothing. 2. Here I was implying the use of the built in Game Center rankings (which I'm not sure why letterpress doesn't currently use). For example you can go on there and see the top X players of Jetpack Joyride (and this requires no server). EDIT: I wanted to add that "multiple versions of the dictionary" is not a new problem, it is in fact just a description of the original problem. The author in fact got away with all this by changing his dictionary. I simply pointed out that there existed legitimate cases where this could happen (and probably likely in the future) as well as illegitimate ones, and why this is probably a good thing to consider if you are trying to solve this issue.

by smarx 14y ago

evan_ 14y ago

> To solve that problem, all I have to do is validate that all your moves are legal. Fair enough, that keeps me from cheating you by playing an illegal word. Now, what prevents you from cheating me by saying all of the words I play are invalid? (And are you really prepared to wait until my phone is in radio range before you learn if your play is accepted or not?) That this would make for an incredibly boring game isn't relevant.

smarx 14y ago
You already know whether your play is legal or not. If you're not cheating, then all your plays will be legal. You don't have to wait for anything. As to your opponent rejecting legal moves, what's the problem? You made a legal move, and then they refused to continue the game. There's no issue here.
- tolmasky 14y ago
  Well the problem arrises in how such a game with "passive" cheating (your opponent having removed words you might play from their dictionary to thwart you) would be counted. Detecting a mismatch is simple, determining if it was malicious, and thus the next action you take afterward is more complex: 1. You could send back a rejection. This would handle the legitimate mismatch where differing versions of the app could have different dictionaries (there are notable missing words in the 1.0 so I wouldn't be surprised if words are added in newer versions). Receiving something like "could not verify word" is much nicer than the game just ending on you. However, this still allows your opponent to cheat in the manner described above by removing words you want to play from his dictionary. It would thus be frustrating to play against such a person. He knows the word is valid, but cannot play it against you and must play something else. He is forced to decide whether to forfeit or try a different word. 2. The solution you described: simply end the game, no win or loss since you can't know who was at fault. If this game EVER employs a ladder system, then this is the equivalent of pulling the cord in an internet game, you avoid a loss. Not to mention, again, this doesn't deal with the cases of legitimate differing dictionaries. The problem with both these methods is that cheating still has an affect. Whether it be ending the game or volleying back to you, a cheated action changes the state of the game. It is instead preferable to prevent cheating. Prevention really does thus require words to simply get checked on a server. 1. There is a clear trusted source for the words, 2. You don't need to ship an App Store update to update your dictionary. 3. There is simply no such thing as word cheating anymore, short of hacking the server.
  - smarx 14y ago
    You've introduced two new problems, neither of which we were discussing previously: 1. How can you deal with multiple versions of the dictionary? 2. How would a third-party (like a rating system) handle cheaters? I would say that the simplest solution for #1 is to not allow this. Players shouldn't try to play against each other if they don't agree on the dictionary. Whether you update dictionaries by shipping new versions of the app, by having clients download them from a server, or by keeping them on the server (as an oracle) isn't important. For the second problem, I think you have a server by definition. You introduced some sort of rankings, which I assume are held on a server somewhere. So this is considerably off-topic.
    - tolmasky 14y ago
      1. It occurs to me that you may have misunderstood how the server system we are describing would work. Your use of the word "oracle" I believe implies that you think the client is asking the server if the word is fine, then if it is, the client is then sending that word to the other client -- which I agree, is no more secure. However, that is not how it would work. The way it works is you send the word to the server, if the server is happy with it, it sends it to the other player, that way there is a gatekeeper that it is impossible to circumvent. Without a server, the solution of "ensuring" the same dictionary on both sides is no different than our original issue of checking individual words: how can you reliably check if both sides have the same dictionary? One side can always just lie, because it ultimately is communicating directly to the other party. The client can send fake dictionaries, fake checksums, fake app version numbers, fake anything to the other side. All you've done is move the individual word checks currently being done to one-time some-other-value checks. For this reason it has absolutely everything to do with a server. The server has to be the holder of the "truth" and thus bad words simply will be rejected with no issue. If you are always doing checks on the client, there is simply no way to ever be sure of anything. If you want to argue "OK fine but I don't think many people will cheat", then that is an acceptable but very different argument. But saying "I can thwart cheating just fine solely with client-side operations by doing ____" is really just a waste of your time because it just won't work, you might as well just do nothing. 2. Here I was implying the use of the built in Game Center rankings (which I'm not sure why letterpress doesn't currently use). For example you can go on there and see the top X players of Jetpack Joyride (and this requires no server). EDIT: I wanted to add that "multiple versions of the dictionary" is not a new problem, it is in fact just a description of the original problem. The author in fact got away with all this by changing his dictionary. I simply pointed out that there existed legitimate cases where this could happen (and probably likely in the future) as well as illegitimate ones, and why this is probably a good thing to consider if you are trying to solve this issue.