2 ms·

Well the problem arrises in how such a game with "passive" cheating (your opponent having removed words you might play from their dictionary to thwart you) woul

Well the problem arrises in how such a game with "passive" cheating (your opponent having removed words you might play from their dictionary to thwart you) would be counted. Detecting a mismatch is simple, determining if it was malicious, and thus the next action you take afterward is more complex: 1. You could send back a rejection. This would handle the legitimate mismatch where differing versions of the app could have different dictionaries (there are notable missing words in the 1.0 so I wouldn't be surprised if words are added in newer versions). Receiving something like "could not verify word" is much nicer than the game just ending on you. However, this still allows your opponent to cheat in the manner described above by removing words you want to play from his dictionary. It would thus be frustrating to play against such a person. He knows the word is valid, but cannot play it against you and must play something else. He is forced to decide whether to forfeit or try a different word. 2. The solution you described: simply end the game, no win or loss since you can't know who was at fault. If this game EVER employs a ladder system, then this is the equivalent of pulling the cord in an internet game, you avoid a loss. Not to mention, again, this doesn't deal with the cases of legitimate differing dictionaries. The problem with both these methods is that cheating still has an affect. Whether it be ending the game or volleying back to you, a cheated action changes the state of the game. It is instead preferable to prevent cheating. Prevention really does thus require words to simply get checked on a server. 1. There is a clear trusted source for the words, 2. You don't need to ship an App Store update to update your dictionary. 3. There is simply no such thing as word cheating anymore, short of hacking the server.

smarx 14y ago
You've introduced two new problems, neither of which we were discussing previously: 1. How can you deal with multiple versions of the dictionary? 2. How would a third-party (like a rating system) handle cheaters? I would say that the simplest solution for #1 is to not allow this. Players shouldn't try to play against each other if they don't agree on the dictionary. Whether you update dictionaries by shipping new versions of the app, by having clients download them from a server, or by keeping them on the server (as an oracle) isn't important. For the second problem, I think you have a server by definition. You introduced some sort of rankings, which I assume are held on a server somewhere. So this is considerably off-topic.
- tolmasky 14y ago
  1. It occurs to me that you may have misunderstood how the server system we are describing would work. Your use of the word "oracle" I believe implies that you think the client is asking the server if the word is fine, then if it is, the client is then sending that word to the other client -- which I agree, is no more secure. However, that is not how it would work. The way it works is you send the word to the server, if the server is happy with it, it sends it to the other player, that way there is a gatekeeper that it is impossible to circumvent. Without a server, the solution of "ensuring" the same dictionary on both sides is no different than our original issue of checking individual words: how can you reliably check if both sides have the same dictionary? One side can always just lie, because it ultimately is communicating directly to the other party. The client can send fake dictionaries, fake checksums, fake app version numbers, fake anything to the other side. All you've done is move the individual word checks currently being done to one-time some-other-value checks. For this reason it has absolutely everything to do with a server. The server has to be the holder of the "truth" and thus bad words simply will be rejected with no issue. If you are always doing checks on the client, there is simply no way to ever be sure of anything. If you want to argue "OK fine but I don't think many people will cheat", then that is an acceptable but very different argument. But saying "I can thwart cheating just fine solely with client-side operations by doing ____" is really just a waste of your time because it just won't work, you might as well just do nothing. 2. Here I was implying the use of the built in Game Center rankings (which I'm not sure why letterpress doesn't currently use). For example you can go on there and see the top X players of Jetpack Joyride (and this requires no server). EDIT: I wanted to add that "multiple versions of the dictionary" is not a new problem, it is in fact just a description of the original problem. The author in fact got away with all this by changing his dictionary. I simply pointed out that there existed legitimate cases where this could happen (and probably likely in the future) as well as illegitimate ones, and why this is probably a good thing to consider if you are trying to solve this issue.
  - smarx 14y ago
    1. Both players can just give their version numbers at the beginning of the match (or checksum if that's easier). Don't start a game with someone who doesn't have the same dictionary as you, because that's not fair. Your opponent has no incentive to lie here, but they can if they want. If they try to play a word not in the agreed-upon dictionary, you'll immediately notice and see that they're cheating. (No need for a server!) 2. When you say "This requires no server," you mean "Game Center provides the server." I don't know how this works, but it seems like it would allow cheating. If you want to actually know who beat whom in what game, you'll need them to submit their moves to a trusted third-party (and of course you'll need to validate that their moves were legal). I'm not disagreeing with that; it's just off-topic. (Okay, to be pedantic, I believe asymmetric keys and the right protocol would allow two players to play such that they could later disprove any false claims about the sequence of moves. But now I'm veering way off topic.) EDIT: Just to sum up the only point I'm trying to make on this thread: Letterpress is currently a game of perfect information with only two interested parties, namely the two players. Ignoring external rules like "You shouldn't let someone else (i.e. a computer) help you," there's no way to cheat undetected in a game of perfect information. E.g. When two people sit down to play chess on a physical board, there's no need for a referee. Either player can tell if the other player "cheats."

smarx 14y ago

You've introduced two new problems, neither of which we were discussing previously: 1. How can you deal with multiple versions of the dictionary? 2. How would a third-party (like a rating system) handle cheaters? I would say that the simplest solution for #1 is to not allow this. Players shouldn't try to play against each other if they don't agree on the dictionary. Whether you update dictionaries by shipping new versions of the app, by having clients download them from a server, or by keeping them on the server (as an oracle) isn't important. For the second problem, I think you have a server by definition. You introduced some sort of rankings, which I assume are held on a server somewhere. So this is considerably off-topic.

tolmasky 14y ago
1. It occurs to me that you may have misunderstood how the server system we are describing would work. Your use of the word "oracle" I believe implies that you think the client is asking the server if the word is fine, then if it is, the client is then sending that word to the other client -- which I agree, is no more secure. However, that is not how it would work. The way it works is you send the word to the server, if the server is happy with it, it sends it to the other player, that way there is a gatekeeper that it is impossible to circumvent. Without a server, the solution of "ensuring" the same dictionary on both sides is no different than our original issue of checking individual words: how can you reliably check if both sides have the same dictionary? One side can always just lie, because it ultimately is communicating directly to the other party. The client can send fake dictionaries, fake checksums, fake app version numbers, fake anything to the other side. All you've done is move the individual word checks currently being done to one-time some-other-value checks. For this reason it has absolutely everything to do with a server. The server has to be the holder of the "truth" and thus bad words simply will be rejected with no issue. If you are always doing checks on the client, there is simply no way to ever be sure of anything. If you want to argue "OK fine but I don't think many people will cheat", then that is an acceptable but very different argument. But saying "I can thwart cheating just fine solely with client-side operations by doing ____" is really just a waste of your time because it just won't work, you might as well just do nothing. 2. Here I was implying the use of the built in Game Center rankings (which I'm not sure why letterpress doesn't currently use). For example you can go on there and see the top X players of Jetpack Joyride (and this requires no server). EDIT: I wanted to add that "multiple versions of the dictionary" is not a new problem, it is in fact just a description of the original problem. The author in fact got away with all this by changing his dictionary. I simply pointed out that there existed legitimate cases where this could happen (and probably likely in the future) as well as illegitimate ones, and why this is probably a good thing to consider if you are trying to solve this issue.
- smarx 14y ago
  1. Both players can just give their version numbers at the beginning of the match (or checksum if that's easier). Don't start a game with someone who doesn't have the same dictionary as you, because that's not fair. Your opponent has no incentive to lie here, but they can if they want. If they try to play a word not in the agreed-upon dictionary, you'll immediately notice and see that they're cheating. (No need for a server!) 2. When you say "This requires no server," you mean "Game Center provides the server." I don't know how this works, but it seems like it would allow cheating. If you want to actually know who beat whom in what game, you'll need them to submit their moves to a trusted third-party (and of course you'll need to validate that their moves were legal). I'm not disagreeing with that; it's just off-topic. (Okay, to be pedantic, I believe asymmetric keys and the right protocol would allow two players to play such that they could later disprove any false claims about the sequence of moves. But now I'm veering way off topic.) EDIT: Just to sum up the only point I'm trying to make on this thread: Letterpress is currently a game of perfect information with only two interested parties, namely the two players. Ignoring external rules like "You shouldn't let someone else (i.e. a computer) help you," there's no way to cheat undetected in a game of perfect information. E.g. When two people sit down to play chess on a physical board, there's no need for a referee. Either player can tell if the other player "cheats."