return to table of content

When Random Isn't

Vvector
57 replies
19h2m

I wrote an AH script. It would scan every auction, buy under-priced items, and relist. If someone undercut me, it could cancel and relist just below them. I basically had unlimited gold.

benreesman
25 replies
15h1m

When I explained how money works to my younger brother after having it explained to me by actual drunk guys who work at Goldman (it’s basically impossible to get the truth any other way as far as I know), his reply was:

“You mean to tell me that the IRS is a gold sink?!”

“Well, actually that’s a pretty good analogy, the difference is… well… that’s a pretty good analogy!”

wodenokoto
16 replies
11h59m

Maybe I don't understand what a gold sink is well enough, but I don't see how IRS can be considered a gold sink. Gold spend with NPCs are not returned to the economy. Taxes are returned to the economy.

benreesman
7 replies
11h9m

Tax receipts are in no sense returned to the economy unless you really overload one of those words.

A modern economy works by running a printing press a little faster than a furnace, with the coefficient being (under honest and competent management) a good estimate of next year being better than this year by such and such, a self-fulfilling prophecy in a good way until you like, burn the planet via carbon emissions or some hard constraint like that.

And it’s a perfectly good system… under honest and competent management. It’s just easier to corrupt than systems with much lower potential (which is the distance between gold bug and ignorant, those folks have a point, they just rarely make it).

This is where all the 1971 stuff comes in: no rich person does anything but advantage their less-capable kid or lover or whatever unless someone is pointing a gun at them. (e.g. Altman has a job let alone unfettered power). The gold standard has a lower maximum potential risk to the extent you can stop there being a de Beers of gold. You likewise accept 50 years from the transistor to a computer in your house even if you’re fucking loaded.

The unanswered question is: can we get competent and honest leadership (after a fashion) back without the bloodshed it has required 100% of the time before?

A lot of us hope so but don’t have an answer just yet, and the clock is ticking.

whage
4 replies
9h58m

This post feels like recent movie trailers. The way you wrote it makes me believe you know what you are talking about but I have no idea. Care to give the curious reader pointers to the topics you mention? I mean the "printing press to furnace" analogy of the economy, or what you mean by 1971 or the gold bug or the 50 year transistor omg what?

benreesman
2 replies
9h49m

I’m just a nerd whose nerd hobbies came to encompass finance when I moved to Manhattan. I was also a party monster back then (please don’t read the book) which for a childless bachelor is a pretty reasonable way to get the most knowledge NYC has to give in a year.

If you have particular questions about the monetary system, I know enough to either answer or know that I don’t know and refer you to someone who does.

dspillett
1 replies
7h15m

> If you have particular questions

There were four fairly direct questions in the post you replied to, to which you might like to give a response:

>> [what do you] mean [by] the "printing press to furnace" analogy of the economy

>> what you mean by 1971

>> or the gold bug

>> or the 50 year transistor

The first of those I'm pretty sure I understand what you are meaning, though if I'm right about that I don't think it is a good analogy, but the others I have no context for.

benreesman
0 replies
1h27m

1971 (and/or 1973) is a year people often point to as when we “went off the gold standard”. Neither year is particularly great as a signal example of the collapse of what is loosely called the “Bretton Woods” monetary system, but either is a pretty good nickname for it.

By “printing press” I mean the set of mechanisms in which fractional reserve deficit spending creates the money supply to notionally value future growth, and by “furnace” I mean the set of mechanisms by which we prevent arbitrary inflation as a result. You can measure the money supply in plenty of ways, but for someone who needs a glossary on my original comment, TLDR you want a number called “M2”.

A “gold bug” is someone who either does or advocates the strategy of holding “precious” metals as a uniquely good asset class (no one turns down a free pile of gold, many of us think the market is pricing gold as well as we are), in particular an asset class uniquely resistant to inflation and/or the “government”. I can assure you from painful experience that “the government” gives no fucks if you have gold in your back yard when they make a clerical error.

50 years is roughly the period of time it took for at least two separate inventions of “the transistor” by a bunch of Bell Labs people, but overwhelmingly associated to a guy called Shockley, to culminate in a useful computer that a middle class person could afford to have in their living room. I learned to code on an IBM PC my distinctly middle-class grandfather owned, and it is a substantially better computer than no computer, a harder claim to make about the Apple I for example.

shawabawa3
0 replies
2h52m

"printing press to furnace" analogy of the economy

Very roughly modern economies work by printing money in the form of government treasuries (government borrows $ to run the country) and destroys money by charging taxes (taxes go to IRS and are used to pay off the outstanding treasuries)

Workaccount2
1 replies
3h54m

A modern economy works by running a printing press a little faster than a furnace,

I think you are confusing Modern Monetary Theory with modern economics. What you are describing is MMT, not what actually happens (the government collects taxes then spends that money + prints more money)

benreesman
0 replies
2h2m

I’m aware of both Modern Monetary Theory as well as behavioral economics. I’m aware of what bankers say “off tape” or “LDL”, (“let’s discuss live”). I’ve worked places where we said “he was with us at Goldman”, because I’ve worked at places and during times that were so elite that my last name, Reesman, which is Dutch, was overlooked for “sounding too Jewish”, which is an actual thing I’ve been tapped on the shoulder about but still to this day don’t understand. I’m not aware of what social dynamics are in play when sounding too Jewish is an issue. Bet your ass New York bankers say shit like that though.

You sir, like many, imply an academic knowledge of markets that would be tradable. If you know what’s wrong with my comment there’s serious money in it, and no one can buy the education you’re implying because the price would be the arb value of all the misprinted securities, trillions easily.

I’m asserting that actual guys called names like Cavendish, who get the actual spread by virtue of being in jobs where you need a name like that laugh in their beer, I’ve been there and I’ve seen it.

“You’ve never dealt with Harkonnens, I have, they’re not human they’re BRUTAL”.

You’re free to disagree, and free to do so under a pseudonym. But if you know anything I don’t about markets generally and US sovereign debt markets in particular I don’t: fuck this HN shit and go trade it. You’ll own HN by the close of business tomorrow, and I will be the least of your worries.

pests
4 replies
11h35m

Taxes are returned to the economy.

I hope we don't start dropping bombs on our own cities....

wodenokoto
1 replies
10h33m

Paying for the construction of a bomb, is participating in the economy (as opposed to outright burning the money)

taneq
0 replies
5h54m

Kind of a broken window fallacy (the bomb isn’t necessary in the first place) but also kind of not (the tech developed for military hardware does eventually get used for good).

Doxin
1 replies
11h12m

The money isn't stuffed inside the bombs. The money is still returned to the economy for the most part even if the bombs are "spent" elsewhere.

pests
0 replies
10h55m

The money isn't stuffed inside the bombs.

I thought that was the only explanation for their prices.

DeathArrow
2 replies
10h1m

Doesn't matter much when money can be printed by FED (which is owned by banks, not by stste) or just made up out of thin air by banks and financial institutions.

The gold in online games is fabbed the same way.

The only two reasons that makes it hold value is that is the only sanctioned way to exchange goods and services and the players trust it. Once one of the two reasons does not exist, gold will not have any value, just like money in real life.

benreesman
0 replies
9h55m

The Federal Reserve system is a quasi-public, quasi-private system. It’s a public/private partnership, which is actually a pretty sane default for how governments should interact with banks.

Sloppy, leaky Venn diagrams are a fact of real life.

Let’s try to avoid “Jews vote for Likud” or “nine eleven was an inside job” type oversimplification?

It’s complicated but for a good set of reasons.

PeterisP
0 replies
1h0m

As you note, the Fed lending policies do act as a money source (when increasing supply) and also as a money sink (when decreasing supply). That doesn't invalidate the parent point that taxes have nothing in common with a money sink, since that mechanism (unlike Fed) doesn't affect money supply but rather simply moves it to specific purchases/institutions.

DeathArrow
5 replies
10h0m

Can you share with us what you did explain to your brother?

benreesman
4 replies
9h41m

I’ll do my best to be useful, with the caveat that “monetary policy” is like, a PhD at a good school and industry experience and stuff, it’s a big field.

To address the particular point that he was replying to: the government (especially the US government) has only one money problem: does anyone lend them money (buy their bonds) when they’re picky about terms (floor on auction optionally) at an acceptable overall outcome (you still believe I can invade your country if you fuck around on USD).

So it’s simpler and faster and the math is easier to just burn all the checks the IRS gets and make new ones at the Fed.

Which is the same solution as all the games landed on.

DeathArrow
3 replies
8h57m

Well, money printing is taxation.

Workaccount2
1 replies
3h51m

Only if it isn't offset by raw economic growth.

benreesman
0 replies
4m

Technically incorrect in nitpick ways but substantially the best intuition: the job of politicians and regulators rounds to: “match the growth of the money supply to people using skills to generate yet another round of speculative but self-fulfilling growth projections with the least amount of dumb rich kids having important jobs”.

To me at least, this sounds like a hard job in Athens with the Bundesbank pardon the ECB breathing down your neck, and a trivially easy job in Washington DC where you can physically destroy anyone who disagrees with your assertions about the value of anything.

Unfortunately the actual job has become: “maximize class solidarity at any cost up to and including arbitrary bloodshed”.

benreesman
0 replies
52m

No, a thousand times no.

Inflation wipes out the notional value of debts and therefore favors the 80-90% of people whose finances are dominated by a debt term. At the low end of being lucky that debt term is unsecured dollar-valued debt like a credit card. At the high end misguided boomers acting against their own interest owe that debt as a 30 fixed secured by a home.

The subset of boomers (or wannabe YC insiders) who suffer at the hands of inflation are fucking vocal but statistically irrelevant. The ratio of actual financialization of actual asset classes to people who whinge about “inflation” is maybe the stupidest thing said stupidly constantly.

Cthulhu_
1 replies
9h22m

Pretty good, but not complete because the money is gone in a game's sink, whereas in the economy it's more cyclic. In theory.

That said, video game economics are pretty fascinating. I love reading writeups on Eve Online economics. I play FFXIV myself which isn't as good as Eve when it comes to economy, but interesting in its own rights. I wish it had buy orders and the ability to buy individual items instead of whole stacks, lol.

benreesman
0 replies
25m

I upvoted your comment for being high-value even though I think I disagree with the first half: “Chicago” / “Fama” strong-form EMH economics have had only a few brushes with reality, so N equals “not enough”, but I’m partial to the 100% of the time it’s been a disaster, the best example of which is almost certainly Scholes’ tenure at LTCM (and “When Genius Fails” is a a drop everything, call in sick and read today book), but even that is really just an exclamation point on the whole post-Reagan world, the criminally, well, crime of the Greenspan clique.

How a group of people can be wrong every time about everything in stated ambition while acting in ways completely consistent with Randian Objectivist Naziism in practical terms, and not be hounded out of public life bewilders me. There is probably no moment as simultaneously classist and misogynistic and stupid as when Brinksley Born got knee-capped for being right about everything by Summers, Greenspan, and Ruben with the Ghost of Future Reich (Ayn Rand) looming ominously in the background.

The people running the show around here, the “effective altruism” crowd like SBF and Altman and shit? They still put Atlas Shrugged icons in their Mastodon chats long after everyone without an agenda realized they’re the new version of old fascism.

Jaygles
18 replies
18h26m

How did you determine what was under-priced?

Vvector
11 replies
17h44m

After playing the AH manually for a long time, I'd know that a stack of ore would sell for 20g. I was manually buying when under 20g and relisting. My script just reduced the tedium. I'd manually add in checks for each high-volume item. It was super-hacky, but so effective, I didn't need to improve it.

One script would iterate over every item in my inventory. If it matched a hard-coded list, it would auto-list it at the hard-coded price. Another script would scan every item on the AH, and if matched another hard coded list, it would buy them.

Another story, pre-script. WOW had the inscription update incoming, which used flowers to make glyphs. I correctly assumed the demand for Peacebloom (tier 1 ingredient) would skyrocket once the patch hit. I spent three weeks buying everything on the AH, using multiple characters to store it all. The night before the update, I listed it all for 20x the normal price. The next morning, everything sold out completely. I remember it being 200 stacks @ 5g each, sold for 100g each.

hinkley
10 replies
17h30m

I recall when Pandaria hit there was some resource where you could get only like one a day but they could be sold. The power gamers and the server first people were buying all they could to craft gear to ratchet up the Raid ladder ASAP. I convinced a couple of my friends to sell all theirs at the prevailing price, which was just stupid high, and on about the day we would have been able to craft our first item, the price had crashed so much we bought them back at a lower price. If you waited a few more days, you could buy enough for two items.

Getting 70% of the way to a goal has 0 value. You can often sell your patience to other people in that game.

eru
9 replies
15h3m

Getting 70% of the way to a goal has 0 value.

Well, apart from the fun of playing the game?

pests
8 replies
11h32m

No, games are only fun if you get all the achivements and 100% the game and buy every item ever relased in the shop and complete all battle pass levels because FOMO because gaming is not about having fun anymore, its about reaching artificially set goals and collecting cosmetics.

DeathArrow
5 replies
9h51m

At which point, you rather quit gaming and use your time and energy in the real life. That way you can touch your achievements because they aren't just numbers in a SQL database.

eru
3 replies
8h57m

If you make lots of money, and keep it at the bank, your achievement might very well be recorded as a number in a database.

(But with the distinction that you can withdraw and spend that money.)

DeathArrow
2 replies
8h49m

When you play a game you trade your time to make other people rich. When you work you trade your time to make you rich. That is the most important distinction.

Would you buy you a Lexus or help someone else buy their second yacht?

pests
1 replies
8h7m

You can play games without committing any sum of money though.

DeathArrow
0 replies
7h42m

But your presence in game attracts others who will do some spending.

pests
0 replies
8h57m

just numbers in a SQL database

This is what breaks most games for me. Once I see the gameplay loop, I know I'm just playing spreadsheet optimizer behind the scenes.

TeMPOraL
1 replies
10h5m

gaming is not about having fun anymore, its about reaching artificially set goals and collecting cosmetics

I.e. it became indistinguishable from normal adult life.

pests
0 replies
8h57m

:(

andenacitelli
5 replies
18h6m

Spent some time with this kind of system in WoW, TradeSkillMaster. Figuring out an accurate valuation was difficult and one of the biggest differentiators of how successful you were.

This would vary by item, but was most commonly some combination of recent minimum buyouts (usually over the last two weeks) historically value (several months), and much more. Common items would usually be mostly recent value driven, whereas lower-supply items might have a larger component of historical weighed in, as there might be quite a bit of fluctuation day to day and you care much more just about the general trend.

All sorts of nuance to it. You can do more complex stuff like only doing your price estimations off items that actually sold, set values based on a percentage of any other value, and much, much more. It gets really complex but is really cool at scale.

hinkley
2 replies
17h41m

Ingredients were always pretty stable.

I think a lot of sales came down to people trading time for money. I just hit a critical level and I want some cheap blues to power level faster and got shitty drops. Or Buddy wants to play and he’s laughing at my gear, oh there’s a reasonable purple.

I found a lot less stress looking for cheap blues and greens to disenchant for ingredients. That could suck up an hour a day easy. Which is why people just dumped them. Not worth their time.

Grimblewald
1 replies
16h23m

Ingrediants can be stable but are still subject to manipulation. I made a killing by having a lot on hand, pushing bids down during busier periods, which would work synergistically with the lil goblins on during this time who list everything they sell at an undercut. This can cause the ass to fall out of pricing. You then buy up the cheap mats as fast as you can, but also alchemists will start making potions for cheap looking to undercut other potion makers with their zero time investment potion making for cheap. You buy those as well when they get cheap. Then you delist the series of sales you made that pushed prices down and buy the undercuts that helped get you there. Suddenly theres a big rift between current price and the bulk of items and most sellers stop undercutting and cheap supply runs out. relist regular small batches at 1s under market and make bank.

DeathArrow
0 replies
9h44m

Just like in real world. But you have to own at least half of the market to pull that. Or some else can short you.

leoff
0 replies
4h36m

I've also spent some time playing with TSM. I would login to WoW multiple times a day only to play on the AH.

I don't quite recall where from, but I had some price data, where I filtered the top X products that made the most volume (price * amount sold).

I then simply did something like "if the price is lower than Y% of the average, buy it. Don't sell the product for less than you bought it for."

Surprisingly this simple formula works very well and I made more gold than I've ever had. It was more than enough to pay for the monthly subscription and I even bought Overwatch using the I credits I got from it.

DeathArrow
0 replies
9h42m

You can learn more about economy from these threads than following a course at Stanford.

Thaxll
3 replies
17h55m

Except that there is a deposit fee in WoW AH.

anonymoushn
1 replies
17h46m

This is correct, but I think for a lot of items the non-refundable listing fee is a trivial amount of currency that you're happy to pay in exchange for faster execution, because it's based on the vendor sale price.

Grimblewald
0 replies
16h20m

Its a multiple of vendor price. So for a few items it is quite hefty. For pets, its always 1s flat so pet pricing can be quite volatile.

hinkley
0 replies
17h46m

The deposits mostly just stop people from overloading the system, and put a tiny bit of friction into the economy.

I always made the most money when I half heartedly farmed on one or two characters and traded about five times as much material as I brought in.

It’s a commodities market. Figure out what the weekly and daily average is, try to anticipate drop off in demand (eg, post launch), if anyone undercuts you by too big a margin, buy them out and relist. If a little, either drop your price or wait.

SeanAnderson
2 replies
18h0m

Wait, did you write Auctioneer? or was this something similar to Auctioneer but you decided to not use the "industry standard" tooling?

bimguy
0 replies
12h37m

I very much doubt it. There's a lot more functionality to Auctioneer then what was mentioned. Also, there are other popular auction add-ons, I think they would have just said it if they created Auctioneer.

Vvector
0 replies
3h11m

I used Auctioneer, found it very helpful. But it couldn't (at the time) do the things I wanted to do. My scripts didn't have any UI or fancy graphics, just outputting text to the console.

tapland
1 replies
16h55m

A lot of us have been using Auctioneer, which has this functionality, since Vanilla. How was the experience of writing your own?

Vvector
0 replies
2h58m

I used Auctioneer. But it couldn't do what I needed at the time, or maybe I didn't investigate enough (TBC/WoTLK timeframe). My scripts were no UI, no graphics, it would just output console commands. The Blizzard API was very easy to work with. Maybe 20 lines of LUA for iterating over every item listed on the AH.

AnthonyMouse
1 replies
18h58m

This is basically what high frequency trading is in real life.

eru
0 replies
15h4m

Only with a lot more regulation, and the competition is very sharp.

plandis
0 replies
16h36m

You’re the creator of the Auctioneer addon? That’s got to be one of the most popular WoW addons for a decade or more at this point.

hhh
16 replies
19h27m

World of Warcraft is what started my interest in programming. I was 6 when it came out, and when private servers started popping up I became interested in how to make my own npcs, and that’s how I picked up Lua.

I still have a lot of posts on the forum for that stuff (MMOwned), and one of the people that helped me learn then still posts semi-actively.

Compiling my own private server core was how I learned about compiling things, SVN, and how to apply patches (there was a bug related to mage’s fireball, can’t remember what it was.)

behnamoh
15 replies
19h22m

I still have a lot of posts on the forum for that stuff (MMOwned), and one of the people that helped me learn then still posts semi-actively.

Man, whenever I am reminded of the old forums I can't help but get nostalgic. Nowadays, it's like a good piece of the internet is replaced with dopamine-inducing social media apps and gated forums (e.g., Reddit).

I don't know why I still hang out here on HN, maybe mainly because it reminds me of the old forums...

Buttons840
9 replies
18h13m

HN threads die to quickly though. For the true old-forum feel we need fewer users with focused interest and threads that last for weeks.

hprotagonist
7 replies
17h57m

threads can go for multiple years, if you do it right

behnamoh
2 replies
17h17m

he's right tho — lack of notifs on HN means you won't know about replies to your comments or new comments in fav threads.

aspenmayer
0 replies
10h50m

Tell HN: HN Replies is email notifications for comment replies, maintained by Dan Grossman.

https://hnreplies.com/

https://news.ycombinator.com/user?id=dangrossman

DeathArrow
0 replies
10h13m

You can make a browser add-on or use a script to keep you in the loop.

Buttons840
2 replies
15h47m

Also, old forums didn't organize comments in tree structures, they were just flat chronological comments. This is technically inferior, but it helped keep everyone more focused on a single thread, as it were.

Paul-Craft
0 replies
14h58m

You don't need to go to an unthreaded format, with all the attendant clutter and such, to do that. All you have to do is bubble up threads that have had recent messages to the top. That's why HN doesn't (or at least shouldn't) try something like that: it wouldn't be "Hacker News" anymore, so much as "Hacker Gossip" or whatev.

DeathArrow
0 replies
10h9m

In most forums, one example being DPReview, the user can switch between threaded view and flat view. I choose flat view, because I usually read the whole topic if it interests me and I usually want to read the last updates without having to go trough multiple threads.

Also, flat view, mimics a real discussion between people.

maxbond
0 replies
16h10m

Which is to say, always reply within two weeks.

Does anyone know of a thread on HN that survived multiple months?

DeathArrow
0 replies
10h20m

For the true old-forum feel we need fewer users with focused interest and threads that last for weeks.

There is 4chan.

acheong08
4 replies
18h37m

I do wish more of the younger generation would be willing to hang out on forums/irc/etc. I would not install Facebook even if it cost me friends

DeathArrow
3 replies
10h7m

Newer generation is on TikTok, not Facebook.

Ns9
1 replies
8h10m

These are anything short videos, but not just the youth it's almost everyone and I have that damn problem

IlliOnato
0 replies
2h44m

So far none in my social circles uses Tik-Tok, thanks $deity.

gumby
0 replies
5h10m

We don’t know how old acheong08 is.

lifthrasiir
10 replies
16h15m

While I never played WoW, I have heard that many addons used a private chat as a means of inter-... whatever communication. If there is a way, people will eventually find and use it.

maxbond
4 replies
13h23m

I don't recall the name of the company but I read about a startup who's product added chat features to a client's website. They noticed a developer using it for IPC, and ended up pivoting into making a product to enable IPC for web apps. (Or inter-something, like you point out it's not an OS process, it's an application-level process. Intertask communication if your prefer.)

chupapimunyenyo
1 replies
11h0m

Whose*

maxbond
0 replies
7h44m

You're right, and I do appreciate it, I ought to know that.

Philpax
1 replies
11h17m

Sounds like the story of Firebase? https://en.wikipedia.org/wiki/Firebase

maxbond
0 replies
7h41m

I didn't find that specific story after searching for a few minutes with Firebase as a keyword, but it does seem plausible based on the summary on Wikipedia, at least if I misremembered some details (which could well be).

robobro
2 replies
16h0m

As a means of what?

taspeotis
0 replies
15h56m

Interprocess communication?

lifthrasiir
0 replies
15h57m

Like, sockets. (Addon instances are not processes, so it is not exactly interprocess communication...)

onetoo
0 replies
8h20m

Not just private chat, almost any chat channel can be used[1]. It's quite common for certain addons to quietly share their versions upon e.g. joining a group, so that you get a notification if a new version is out. It's a bit of a longer explanation, but another fun example of out-of-band privileged information in World of Warcraft:

The "fight" between Blizzard's boss design and addon creators trivializing said encounters is long and not worth going deeply into. But, for example, if the strategy of a boss is "if you get a glowing glyph over your head, run over there and stand in a square formation with the other guys with glowing glyphs", an addon could use hard-to-ignore sounds and visuals to tell you that a) you have to run now, and b) exactly which corner of the square formation to run to.

I believe that in the latest raid, the developers tried restricted certain information from the API (e.g. "there is a glyph over the player's head") in an attempt to reduce that kind of strategy automation. The players then proceeded to manually feed this information (e.g. "i have a glyph over my head") into their addons using buttons mapped to API calls like this, allowing for partial automation (e.g. "your corner in the formation is top-left"). This stirred quite the drama, but the that's besides the point.

[1] https://wowpedia.fandom.com/wiki/API_C_ChatInfo.SendAddonMes...

Hamuko
0 replies
12h37m

I think a lot of roleplaying addons exchanged information by just having a public chat channel that just wasn't made visible in the user interface. You could actually make it visible and see the addon sending information to other users there.

hinkley
10 replies
17h19m

security

I will be forever appalled that Blizzard rolled out two factor authentication before stock trading services like E*Trade managed it.

Bravo for Blizzard, shame on the rest of ‘em. A game company.

profmonocle
6 replies
15h54m

I worked with someone who was a Blizzard GM around when they rolled this out. Recovering stolen accounts was some absurdly large % of their customer service tickets. People would use the same email & password on WoW as on various shady / insecure sites. Bots would try any stolen credentials en masse in WoW. When they succeeded, not only would customer service need to restore a user's access, they would need to roll back their character to restore lost items and gold.

According to my coworker, adding 2FA was primarily about reducing this customer service workload. Eventually they encouraged it by adding in-game benefits, like additional bag space for your character. Not sure they ever went as far as mandating it.

Paul-Craft
2 replies
15h3m

So, what happened after they implemented it? Did CS tickets actually go down a lot? Did it save them a ton of money and hassle? You left off the best part of the story :-)

As for mandating it, I could see not requiring people who'd already set up accounts to jump through this extra hoop to play the game. I'm sure even a small percentage might not be able to jump through that hoop. I doubt it's a significant percentage, but I could see it becoming a PR hassle, and those are the worst kinds of hassle from the POV of a technical employee lol...

But for a new game? If the CS metrics reflected a big drop relative to the number of people using 2FA, then I'd be sold on requiring it.

jonathanlydall
0 replies
6h58m

As a former GM, as at the time I left in 2012 I had never encountered a case of a 2FA secured account getting hacked and account compromises were easily >50% of our workload.

The problem had become that most players wouldn't add 2FA to their accounts until AFTER they got hacked, so any in-game incentive to add it was in our eyes a good one.

hinkley
0 replies
11h50m

From what I understand it went down for a long time, but what people did was if they managed to get into your account the first thing they would do is remove the authenticator. That involved entering a couple sequential values. But if you set up the keylogger right, you could trick users into failing the credential check 3 times at login and get their account.

anonymoushn
1 replies
13h3m

Currently you cannot customize your group in group finder without 2FA, so you cannot list a group for your friend's keystone or specify what sorts of characters you would like to join. It's quite annoying!

jonathanlydall
0 replies
7h2m

As a former Blizzard CS rep (I left in 2012), I can see why they'd do things like this to convince people to add 2FA to their accounts as most people wouldn't do so until AFTER they were hacked for the first time.

Based on many players saying to me "I don't know why they chose me", it seems that a lot of people don't realize that account compromising is a drag-net operation, it's like a fish thinking that there's no reason for them to be targeted specifically by a fisher, without realizing that fishing is such a large scale and impersonal activity.

jonathanlydall
0 replies
7h1m

As a former GM myself, can confirm all the above.

toast0
0 replies
13h25m

Did they?

I found an article from March 2005 stating that ETrade will soon launch 2fa [1]. And a similar article about Blizzard launching 2fa from July 2008 [2]. Maaaybe ETrade took 3 years from anouncement to launch, but I'm pretty sure I saw ETrade branded RSA tokens around 2005, and Blizzard tokens later.

[1] https://www.computerworld.com/article/2569503/etrade-touts-t...

[2] https://www.zdnet.com/article/blizzard-introducing-two-facto...

saghm
0 replies
11h23m

Not only that, but they had dedicated hardware for it since smartphones weren't ubiquitous yet. I still remember the first time I saw a friend use one, and how mystified I was by this mysterious "authenticator". It's still absolutely wild to me to think about how ahead of the game Blizzard was on the 2FA front.

They only recently replaced their dedicated smartphone app for 2FA by rolling it into the existing Battle.net app. The 2FA codes they use are longer than 6 digits, which I assume is why they don't support something that can be used by more "mainstream" 2FA apps; by the time those become established enough to support third parties, I suspect their infrastructure had been around long enough that it just wouldn't be worth rewriting it. I do sometimes wonder if someday apps like Google Authenticator will support a wider variety of TOTP configurations; I think Steam also uses something non-standard, which means the only mobile option is a dedicated app, and I'd much rather not have to install extra apps just for 2FA support.

bee_rider
0 replies
16h25m

It doesn’t seem that surprising to me. In the olden days, video game companies served a slightly more technical user base, so it makes sense that they’d be more willing to deal with 2FA. Also, I don’t think the legal system will help you recover your SoJs.

DonHopkins
4 replies
16h25m

When Variables Don't and Constants Aren't

maxbond
3 replies
16h17m

Interesting. Seems to be a meme with a deep history.

https://www.theregister.com/2006/07/26/constants_are_not/

I first read the lament to the capricity of programming [in the title of this piece, "Variables Won't Constants Aren't"] in Creative Computing, years before C was devised.

If there's a particular document you feel is canonical to this meme, I'd be interested to read it.

anonymoushn
2 replies
10h49m

I suspect it's a math thing, because in math it actually describes the normal state of affairs. Anyway, here it is in a compilation of such sayings dated 1979: https://www.cse.unr.edu/~sushil/quotes.html

maxbond
1 replies
7h28m

That document is a gem worth it's own submission. I'm sure many of it's constituents have been on HN but I took a glance and don't think it's ever been on HN[1], though it appears a dead mirror was once posted with 0 interaction [2].

Feel free to submit it if you want, otherwise I'd like to.

[1a] https://news.ycombinator.com/from?site=www.cse.unr.edu

[1b] https://news.ycombinator.com/from?site=unr.edu

[1c] https://hn.algolia.com/?query=Murphy%27s%20laws%20and%20coro...

[2] https://news.ycombinator.com/item?id=2863516

anonymoushn
0 replies
5h49m

Go ahead.

xenonite
2 replies
9h37m

Even worse, the given linear congruential RNG yields only 12445 distinct numbers, then repeats itself. It would be sensible to simply use better parameters for this algorithm.

smallstepforman
1 replies
6h16m

Engineering is a compromise, for simple tasks (eg motion of particle is smoke trail exhaust), you need a simple yet FAST rng. For cryptography, casino gaming etc, not only do you use a better Rng with at least 32 byte state, you also cycle the engine at random intervals to further prevent predicting the outcome.

loeg
0 replies
56m

An LCG with better parameters would be just as fast.

aatd86
2 replies
6h39m

Summary in simpler terms?

So it's just because the actions in game where functions which were assigned an id and callable by id.

Then because OP was able to reverse engineer that id generator, OP was able to call whatever he wanted once he tested what id was doing what.

Didn't read the math in the middle, I could get it but takes too much time at my age nowadays.

nkrisc
1 replies
5h47m

The IDs are arbitrary and chosen by the author.

Outside the secure context they had the information to select which (arbitrary) ID they wanted to pass into the secure context. So they call `random()` until they know the next call to it will produce the desired ID. Then they pass control to the secure context which calls `random()` and uses the result as a the ID to lookup what action to take in the same arbitary ID<->action mapping table.

aatd86
0 replies
2h57m

Ahem, They are only chosen by the author for the goal of reverse engineering and finding valid ids.

But he doesn't assign ids manually when writing the scripts.

As far as I understand.

38
2 replies
17h48m

FYI your link color is almost unrecognizable. its basically a (very) dark blue against black.

pests
1 replies
11h22m

You might be using a setting to force dark mode which has no guarantees to be correct.

The site has white background with black text in normal and darkmode. Could probably use a better stylesheet for darkmode but disabling whatever you have on would probably also fix it.

38
0 replies
6h13m

link color
nneonneo
1 replies
11h56m

Weirdly, I answered almost exactly the same “invert the RNG” question on StackOverflow (https://stackoverflow.com/a/15237585/1204143) just a few months before you posted your question to Crypto.SE, except that I attacked the Java RNG instead of the MSVC RNG. They both use a simple LCG design where outputs are truncations of the internal state, so the attacks are very similar to each other.

hayley-patton
0 replies
8h6m

I'm not very good at maths so I let Z3 work out some convenient seeds for me, leading to

    import java.util.Random;
    public class Hayley {
         public static void main(String... args) {
             byte[] b1 = new byte[4], b2 = new byte[2];
             (new Random(0x2effe2140e00L)).nextBytes(b1);
             (new Random(0xc2f0097)).nextBytes(b2);
             System.out.println(new String(b1) + new String(b2));
         }
    }

jonathanlydall
1 replies
7h16m

A bit tangential, but a related fun story from many years ago during my time as a WoW GM.

There was a popular add-on (Titan Bar I think?) that had a bug in one of its versions where it would always call the API which showed the "write a ticket to a GM UI", if you tried to cancel it, then it would just pop up again, the only way to stop this dialog from being in the way (aside from uninstalling the problematic add-on) was to put something in the text box and press submit.

It was a very bad day or two for the GMs, many players didn't even know about GMs or that that you could submit tickets to them, and trying to explain to a customer that you're a customer service representative who's contacting them because they submitted a ticket likely due their one add-on was more often than not a tricky one.

Because it essentially destroyed the ability to perform reasonable customer service response times the developers put out a hotfix which also put that API call behind protection, making it impossible to be called except from Blizzard's own LUA code.

anonymoose33282
0 replies
49m

Titan Panel I think was the name? It was the one that kinda "unified" a lot of UI elements into one bar (total gold, repair percentage, stuff like that).

cowthulhu
1 replies
18h52m

I wonder if there’s any chance that they were using the same RNG on the server. Seems like you could theoretically exploit it if so, given a very low usage server, low ping, ability to get a decently precise window into the current state of the rng, and ability to quickly generate another event with a high economic variance tied to rng.

plorkyeran
0 replies
12h41m

Vanilla WoW used Mersenne Twister on the server, which has a number of problems but isn't so trivially broken. They posted a lot of the details how the server-side RNG worked in a (mostly unsuccessful) attempt at killing the rumors around "loot seeds" and such that superstitious players were utterly convinced were a thing.

stevekemp
0 replies
14h13m

See also that time when hacker news was hacked, due to weak random numbers:

How I Hacked Hacker News (with arc security advisory):

https://news.ycombinator.com/item?id=639976

smeeth
0 replies
15h13m

"Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin. For, as has been pointed out several times, there is no such thing as a random number — there are only methods to produce random numbers, and a strict arithmetic procedure of course is not such a method." - John von Neumann

paulpauper
0 replies
17h11m

The economics and incentives of RNGs are interesting. If nothing is materially at stake ,an imperfect RNG, even a bad one, suffices provided people cannot easily tell, such as games. But if money is at stake or security, like crypto wallets or online casinos, suddenly it matters A TON.

hota_mazi
0 replies
15h36m
gometo
0 replies
15h2m

Akun vip

Arech
0 replies
5h40m

yep, and I'm aware of a data encryption product that was hacked by utilizing exactly the same technique. As dumb as it could be: they promised billions of years an attacker need to decipher data, but were using a dead simple LCG to make a key and a salt. And the salt was stored in a crypto container in open form (b/c it's a salt). :facepalm: Don't implement data encryption on your own, kids...