DRM for online functions

[eRe4s3r]

Yaarrrrrrrrrrr...

No, please read my post before yours again, and again, and again. Until you understand what I (and 7 pages of topic) am talking about. I am talking about how the current serial-based DRM is broken it is completely irrelevant why DRM sucks or why it doesn't suck. The current one for AI War is BROKEN.

It does not protect the product or its services. It adds hassle to customers, it gives 0 hassle to pirates. It rewards piracy and punishes customers. and We, the customers, pay for the downloads of pirates.

You add checks to your patches because you do not want pirates to download patches from your servers! Bandwidth costs money. Not fighting this kind of piracy related issue is not just ignoring piracy but supporting it. And small or large issue we can not really quantify yet, because so far Arcengames has not said what the average patch download numbers vs sold copies statistics are Or what the demo conversion to sale stats are. All which would be Interesting to see whether piracy actually is a factor or not. Now granted, I am just speculating on the severity, but I can't believe it is not noticeable. Particularly if you have a time-line and can check the availability of the keygen for an expansion vs the availability of the expansion. And see whether demo conversion rates take a noticeable dive there.

[LaughingThesaurus]

Okay.
What you're asking for is that the server makes sure you only are the one with your CD Key... and if you pass that check you can download the patch? If that would not break things for me, who keeps AI War with my keys on multiple systems fully updated, fine. I agree. If it would cause problems that simple, then I disagree. 'cause I mean, you can just register the same key to any computer you want and download patches all you like. That wouldn't help, because then all pirates need is one CD key, and they can download everything forever. If you limit it to one patch per consumer or something, you hurt people like me.
Am I understanding you about right? I want to at least try.

[eRe4s3r]

No... no, and no.. ;p

Patch checks on install for serial integrity. If no serial is there, it adds the current up-to-date serial check addition to the serial as well as the blacklist for leaked serials.

If you enter a serial in-game, it does not tell you whether it passes all checks, it only tells you it is valid (ie passes the base algo). This means a pirate can download the demo but for each new version of the game he patches with, a key-genned serial would become invalid.

To you, as gamer who didn't read the topic at all *cough* This would be entirely transparent. If you have a legit serial new patches would add checks further confirming it's validity but besides that, you wouldn't even know something was happening. Unless you pirated the game, in which case a patch now puts your game back into demo mode after 3 hours have passed...

So to re-iterate. To proper protect the game, all that's needed is to make sure that
1) Serial has additional checks
2) Game confirms algo match but not validity of the serial with checks. Only valid serial remains valid after 3 hours of play, checked at a random time in-game (somewhere between those 3 hours)

This is not supposed to fail-safe but a way to prevent such easy piracy where it is harder to find the arcengames website than the serial you need to enter to illegally play the game.

[LaughingThesaurus]

But what keeps a pirate from just using a legit key and getting in anyway? That's what I don't understand. I mean yeah, it won't affect me, but if someone had access to the basic algorhythm and happened to generate my key and use it before my most recent install of the software, what would happen? Or, what if all pirates just shared the same legit key in the first place aside from just not being able to play together? They'd still get the full version of the game, would they not?

Because like... if it's not actually worth the effort, I wouldn't want the developers to waste the time on it anyway. Ultimately it'd have to either save them a lot of money or earn them a lot of money relative to the opportunity cost.

Oh... and I did kinda read the thread, but everybody seems to have been talking about everything in their own way of understanding it. I found the whole process not particularly easy to understand so I still need yet more clarification. Sorry about that.

[RCIX]

Yaarrrrrrrrrrr...

No, please read my post before yours again, and again, and again. Until you understand what I (and 7 pages of topic) am talking about. I am talking about how the current serial-based DRM is broken it is completely irrelevant why DRM sucks or why it doesn't suck. The current one for AI War is BROKEN.

It does not protect the product or its services. It adds hassle to customers, it gives 0 hassle to pirates. It rewards piracy and punishes customers. and We, the customers, pay for the downloads of pirates.

You add checks to your patches because you do not want pirates to download patches from your servers! Bandwidth costs money. Not fighting this kind of piracy related issue is not just ignoring piracy but supporting it. And small or large issue we can not really quantify yet, because so far Arcengames has not said what the average patch download numbers vs sold copies statistics are Or what the demo conversion to sale stats are. All which would be Interesting to see whether piracy actually is a factor or not. Now granted, I am just speculating on the severity, but I can't believe it is not noticeable. Particularly if you have a time-line and can check the availability of the keygen for an expansion vs the availability of the expansion. And see whether demo conversion rates take a noticeable dive there.

And I'm saying it'e entirely pointless to add in any form of DRM on all-client-side games because pirates can and will crack it, then distribute the cracked game/patch/keygen/whatever. Remember Spore? Absolutely horrible DRM, pretty sure it was cracked and heavily pirated quickly, almost all of the legitimate users bailed for other games or to pirate it.

The beginning and end of it is that DRM isn't anywhere near the effectiveness needed for the cost investment, and the more unreasonable you make it the less legit sales you have. Thinking about a "better lock" is pointless when the bad guys can just cut a hole in the door or smash in a window and get in that way.

Serials are there currently to make and offer a distinction between a demo and a non-demo without having to distribute a bunch of different executables and junk, also secondarily to act as the "locked doors" bit of casual security that would prevent people from just grabbing copies without thinking. That's all. I'm not saying there couldn't be a nicer-for-the-paying-customers system, but...

[eRe4s3r]

@ LaughingThesaurus

Firstly, leaked valid keys could be blacklisted by each new patch within the patch itself (finding them is as easy as using google.. ,p)

Secondly, the basic algorithm is just a ploy, a red herring. The real serial check would include about 30 additional formula based checks to validate a key as valid. Pirates could certainly get working keys for each version, and even make keygens, but they could never tell the difference until the first patch and after the next patch etc.

These additional checks can be stacked on to of each other, so that you simply add a new serial formula check to your already existing algo based check. All the valid keys would be generated with all those checks taken into account. But as you can easily blacklist serials with each new patch pirates would still not be able to play a fully patched full version of the game.

Yes, they can stay at old versions, and we don't mind that. We simply wish that pirates can not simply keep up-to-date and have better service than customers without some serious hassle of finding a new working keygen or serial. Also if people leak serials we now know who they are, because valid serial -> purchase

and I'm saying it'e entirely pointless to add in any form of DRM on all-client-side games because pirates can and will crack it

Currently they do not have to even do that. Which is too little in my oppinion ;P

[doctorfrog]

And your opinion alone.

For someone who just asked someone else to re-read several of your posts, you are ignoring the posts of other people who do not want, and do not believe in, the efficacy of the DRM schemes you are arguing for.

[keith.lamothe]

In fairness to eRe4s3r, I do think he's figured out a scheme that would make it a royal pain in the behind to pirate the game, solely due to the fact that we update the game so often and thus can put the screws to someone trying to stay up-to-date without a valid key.

He's just frustrated because we don't want to do it

The main reason I don't want to is that between code modifications, proper testing (which would be quite mandatory; it's one thing for a beta release to have a crash bug, it's another for it to have a bug that causes a legitimate customer to be treated like a pirate), and vigilance to catch and block leaked keys, it would occupy at least half the time I normally have available for AIW updates, and I'm not willing to sacrifice half of the value added by that time in order to make the game hard to pirate.

There are other reasons the whole idea doesn't appeal to me, but that's the clincher: whatever extra value the system would contribute to legitimate customers would be more than offset by the value lost in time unavailable for actual improvement of the game.

[LaughingThesaurus]

So as I understand it, pirates wouldn't be able to patch, assuming this is completely foolproof.

Then the question becomes, is it just your opinion that this would be a great idea? If it would take a lot of time or money to get a system like this working, to the point that it's not worth it, it should not be done. That is a plain fact. Obviously, a waste of time and money is not by any means good. But, beyond that, nothing is ever foolproof, and if any legit user is wrongly perceived as a pirate and can no longer update, you bet that will cause negative feelings for Arcen and at least one lost customer... but thank God they made pirates slow down slightly.

I totally admit I don't know enough to know whether it's actually worth it, but I know that I wouldn't go through the hassle, and I certainly doubt that it would actually be worth the money spent. I don't agree. Maybe, if updates were given through steam or something, but even then I like my offline access to these games.

Oh, and on blacklisting every individual key... that's another thing, you're talking a long list of potential keys to have to blacklist. It comes back to what if this affects a legit customer? How many hours are spent to blacklist all of the keys? It's not just a magic fingersnap all the keys are blocked. Every thing that has to be done costs money because it costs an employee's time.

[eRe4s3r]

every key blacklisted is a key pirates had to purchase before.. so, i am not exactly sure how "lots of keys to blacklist" is an issue.. in fact, that'd be the sales pitch. Every key blacklisted is a sale and if finding keys is an issue.. well I heard you have loyal customers who'd probably do it for you. ;p

Also most serials leaked are -1- serial. Pirates gotta buy games to get serials... so that'd hardly be a "million serials" to blacklist. Unless you are like super successful and make a billion sales, at which point.. get rid of DRM!

For someone who just asked someone else to re-read several of your posts, you are ignoring the posts of other people who do not want, and do not believe in, the efficacy of the DRM schemes you are arguing for.

Because those people have no clue about piracy or how pirates think. When I read a claim like that "pirates never buy games anyway" I cringed so badly my face stretched to the moon and back. If you further make a statement like "pirates are not our customers anyway" you can already end your existence in the market. Because those pirates who are reading that, they are 100% not gonna buy anything by you after such a statement, ever. (And with you I am talking about no one in particular). But pirates ARE part of your customer base, pirates CAN be seduced into buying, either when a sale comes and the hassle of keeping up-to-date pushes them to an impulse buy or properly because they are simply annoyed they have to mess around with a game constantly just to play it properly but for free.

@ keith.. well I wouldn't do it quite that hardcore..

you can outsource finding leaked keys to your vigilant gamers and secondly, beta patches would be excluded from adding key-check stuffs. So you are really looking at a first setup and then you could let it sleep until the first real final non-beta patch in the series. That would be even better because pirates sure as hell won't be wanting to stay on a beta patch if they are downloading your beta patches and participate.. just saying

Anyway, keith ye got the point unlike many here which is really quite bedazzling. And I get why you are not doing it, because it can't be done retroactively... but that's no reason to say it's too much work. You would only have to do this work ONCE. Whether you use the checks at some point or not, hell you could throw dices to decide when to implement another one of the validate checks. There could be no false positives because all serials given out would already PASS all checks, you simply are not checking for them until a certain point in time ;p

The system I described is the *best* serial based anti-piracy system there is. There is no better. So there is really no point in saying "it costs money" .. because I can guarantee you, this system would make you money. Whether it would offset implementation costs.. I do not know. Because I have no stats ;p But if done right, you could keep your game for 2 or 3 years so annoying to pirate that you WILL get sales ;P

[Wingflier]

Ereaser, I think you're missing the point.

You still haven't convinced anybody that DOING all this work will actually save Arcen money in the first place.  The effectiveness of DRM is...controversial at best.  MANY indie games do just fine without DRM, even some mainstream games keep it to a minimum.  If you can find some conclusive evidence that shows that online DRM increases sales, then maybe all of this would be worth considering.

However, I personally would not look too fondly upon Arcen if they resorted to something like this.  For example, one of the biggest selling points of the Humble Indie Bundle series is that all the games are DRM free.  I hesitate to believe it would be as successful as it is, if it were the Conceded Indie Bundle

[LaughingThesaurus]

I can guarantee you, this system would make you money. Whether it would offset implementation costs.. I do not know. Because I have no stats ;p But if done right, you could keep your game for 2 or 3 years so annoying to pirate that you WILL get sales ;P

This is exactly the point I've been trying to make though. If it does not make enough money to offset the costs, no matter how cool it is, it will not be worth it. When running a company, you have to look for things that are a tangible benefit for the company. All of these updates and stuff, for instance. If you've read the blogs, you know that constant updates and expansions give you more material with which to market your product. Yeah, we all love the content too, but it helps them out by making their product more appealing. If this DRM did not make them profit, and did not help them market their games, it actually does nothing for them, even if it would deter pirates.
As cool of an idea it is to bring pirates to justice... you have to think it might just not be worth it from a business standpoint. This would have to, to my knowledge, not only bring in more money than it costs, but it would have to be more appealing than the ability to make the game more appealing by making it bigger, shinier, and more content-packed.

[eRe4s3r]

@Wingflier
Yeah, except you said it again.. online DRM.. how is a serial like this online? And how is a broken serial DRM better than an actually working serial DRM ? Maybe ye need to convince me.

To quote myself

at no point since page 1 are we talking about online DRM

And yes @ LaughingThesaurus
There would be a initial development needed. But I think you vastly over-estimate the effort needed to do this. IN fact 1 day or less is what I'd put down as time needed to fully implement a barebone 5 extra check validation solution. Already that would be enough to protect a game for 5 or 6 major patches...

If you still think this is about "deterring" pirates.. well..

[KingIsaacLinksr]

The system I described is the *best* serial based anti-piracy system there is. There is no better. So there is really no point in saying "it costs money" .. because I can guarantee you, this system would make you money. Whether it would offset implementation costs.. I do not know. Because I have no stats ;p But if done right, you could keep your game for 2 or 3 years so annoying to pirate that you WILL get sales ;P

Do you have actual evidence/facts to back this claim up?  And saying pirates will get annoyed (and hence will buy it) is not enough.

On another note. I would not rely on my customer base to scan google/yahoo/whatever search engine all the time to make sure those pirated keys got banned. That's a lot of time to devote to such a thing. Maybe this is just me, but I have a hard time believing all that many people would volunteer to scan for pirated keys. Maybe at first they would, but I have little doubt exhaustion would set in and people would give it up.

[eRe4s3r]

I can only talk about my own view on this and unless you were willing to test it somehow and knew a way where a statistical relevant test could be made I would help. Obviously a true 1:1 test would be impossible as we can not test with 2 identical games that have 2 identical target groups and release at the same time to the same stores....

All it would take to quantify it however, was if Keith or x4000 look in their stats how demo adoption rates vs update download numbers for Tidalis changed after 4th December 2010 (when the keygen was released for that) or how AVWW sales changed (if at all) after 23rd April 2012, which is when the AVWW keygen released. However I have the looming feeling there are no statistics for this because non were kept or properly collected and collated. (Which would be a huge mistake but for an Indy I don't expect this to be a priority)

And by the way, it took me less time to find the exact dates of these releases than to type the post.. so excuse me while I had to giggle at your notion that there is a "exhaustion" that could set in Pirate releases for niche games are VERY rare and small scope in spread and often don't spread far beyond the file hoster share hubs.

The only way I could back my claim up is from my own viewpoint so no.. unless you invent a time travel machine you are just gonna assume that pirates are gamers who not just pirate but also buy games. Because if they weren't they wouldn't be pirating yo games, piracy for established pirates is EASIER than buying games, FAR easier. Only very few have the patience to wait out a 2 or 3 week wait for a new working keygen or leaked serial. Especially when there are sales on Steam or GMG in between. But how would I prove that?

Point being, that is not what I am willing to argue about. Because it'd be pointless. I just know that developers who berate pirates as "not being our customers anyway" have found to regret this very quickly. Because it is wrong. I can guarantee you pirates are reading this and laughing their backsides off. I am ok with that, and hey, if Arcengames doesn't do anything against piracy then I have a hard time condemning pirates for pirating. It is so easy that it is more hassle to buy games than to pirate them, and at that point morals are the only thing in the way.. and not for long.

Or you know, you could just read stuff like this which is, i thought, common knowledge by now...
http://www.techdirt.com/articles/20110727/16233815292/another-day-another-study-that-says-pirates-are-best-customers-this-time-hadopi.shtml

Nevertheless. A better secured serial system is mainly to annoy, not to protect your game against any serious attempt to crack it. And I don't content this. If that is not a viable thing to spend dev time with that's OK. Yet that people are against this mild improvement of serial security is dazzling to me, because I don't understand it.

If you don't believe my opinion on this to be something you take serious that is ok too. After all, i can hardly legally proof that I have a clue about what I am talking about. Apart from the fact that I do have a clue how to code a secure serial check system that has a bit more security, at least in theory. And keith surely will agree that the system described is sound and if done right, transparent. (You would never know it's there). And that alone should imo tell you that I know what I am talking about. That said, I understand when a developer does not want to go that far (which is not really far at all, but for some it may be..).

The reason I am even beating this dead horse is that I am 90% sure that because all games got keygenned with valid steam reggable serials this has pissed Steam off very badly and now they give us the stick with AVWW and registering serials. I am not buying that they are "busy".. previously this was happening within a week.