Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[ednever]

...the huge, gaping lack of security. Which is why I'm going to steer clear of the thing for a long time, at least.

This is very telling.  I don't know much about internet security, but if WW won't play Dominion on Goko due to security issues, that is enough to scare me off.  That's like if a bakery comes out with a new cookie, and Cookie Monster himself comes out and says, "This cookie is not safe to eat, so I'm not eating it."  No way am I going anywhere near that cookie.

Had to come out of lurker mode to say this post made my day.  I'm a sucker for Cookie Monster analogies.

How much security do you need to play dominion? If you are really concerned use a different email address. You aren't giving them credit card data. Worse case scenario someone steals the deck designs you built? Or plays games under your name?

Maybe I'm not paranoid enough, but I'm pretty sure the incentive is limited to break into accounts without money attached to them.

If someone breaks into my amazon account, that's bad, but if they break into my Economist account and start reading articles and extending my subscription for me I think I'll be ok...

Ed

[syzygy]

Now I can get to the site, but it seems to not like my password. 

[Tdog]

Goko dominion looks really nice, and I think will eventually be a nice way to play. After a month or two, most of the kinks will be sorted out. But, this launch is a disaster. There is no reason that the page is still unplayable.

[LastFootnote]

How much security do you need to play dominion? If you are really concerned use a different email address. You aren't giving them credit card data. Worse case scenario someone steals the deck designs you built? Or plays games under your name?

Maybe I'm not paranoid enough, but I'm pretty sure the incentive is limited to break into accounts without money attached to them.

If someone breaks into my amazon account, that's bad, but if they break into my Economist account and start reading articles and extending my subscription for me I think I'll be ok...

Ed

Um, if we don't give them credit card info, how are we supposed to purchase the expansions? Do they have some third-party payment system set up?

EDIT: Also, I'm not going to log into a site which allows other users to redirect me to a site filled with malware. Do you actually understand anything about security, or about the complaints people are leveling against Goko?

[Captain_Frisk]

How much security do you need to play dominion? If you are really concerned use a different email address. You aren't giving them credit card data. Worse case scenario someone steals the deck designs you built? Or plays games under your name?

Maybe I'm not paranoid enough, but I'm pretty sure the incentive is limited to break into accounts without money attached to them.

If someone breaks into my amazon account, that's bad, but if they break into my Economist account and start reading articles and extending my subscription for me I think I'll be ok...

Ed

Um, if we don't give them credit card info, how are we supposed to purchase the expansions? Do they have some third-party payment system set up?

EDIT: Also, I'm not going to log into a site which allows other users to redirect me to a site filled with malware. Do you actually understand anything about security, or about the complaints people are leveling against Goko?

I agree with your concerns.  The malware redirect thing is allegedly being fixed today - but frankly with that error and others - I see no way of feeling confident that that's the only place that its a problem.  I'm looking forward to seeing how goko addresses that question on 8/22.

[jamuspsi]

I'm just kind of praying that they don't do something silly like wrap the chat input in quotes or something, in a naive attempt at preventing injection.

It's honestly really strange that that problem even exists.  My suspicion is that they take your chat input, stick it in an object and turn it to json for transport, but at the other end they eval it instead of using JSON.parse.  And that's really just a guess because it's the only reason I can think of that they'd be using eval anyway.

[Not a Cylon]

I'm just kind of praying that they don't do something silly like wrap the chat input in quotes or something, in a naive attempt at preventing injection.

It's honestly really strange that that problem even exists.  My suspicion is that they take your chat input, stick it in an object and turn it to json for transport, but at the other end they eval it instead of using JSON.parse.  And that's really just a guess because it's the only reason I can think of that they'd be using eval anyway.

I don't think it's the JSON parsing; seems more likely to be the way it renders the chat string in the window. Probably creates a new div and then sets its innerHTML to the chat text (which will cause scripts to run).

[Not a Cylon]

I agree with your concerns.  The malware redirect thing is allegedly being fixed today - but frankly with that error and others - I see no way of feeling confident that that's the only place that its a problem.  I'm looking forward to seeing how goko addresses that question on 8/22.

What happens 8/22?

[jamuspsi]

I don't think it's the JSON parsing; seems more likely to be the way it renders the chat string in the window. Probably creates a new div and then sets its innerHTML to the chat text (which will cause scripts to run).

I hadn't been able to get into the game since I heard about it to test.  I JUST posted elsewhere exactly what you just said!  I think that's likely.  A global replace of < to &lt; should prevent the injection, right?  (Of course, full escaping would be nicer.)

[Kirian]

I agree with your concerns.  The malware redirect thing is allegedly being fixed today - but frankly with that error and others - I see no way of feeling confident that that's the only place that its a problem.  I'm looking forward to seeing how goko addresses that question on 8/22.

What happens 8/22?

Iso disappears, and they have a shitstorm of hardcore Dominion players with nowhere else to go...

[rbruba]

I agree with your concerns.  The malware redirect thing is allegedly being fixed today - but frankly with that error and others - I see no way of feeling confident that that's the only place that its a problem.  I'm looking forward to seeing how goko addresses that question on 8/22.

What happens 8/22?

Iso disappears, and they have a shitstorm of hardcore Dominion players with nowhere else to go...

actually I think he meant when the questions are answered from the 'Ask FunSockets anything' thread http://forum.dominionstrategy.com/index.php?topic=4080.0

[Captain_Frisk]

I agree with your concerns.  The malware redirect thing is allegedly being fixed today - but frankly with that error and others - I see no way of feeling confident that that's the only place that its a problem.  I'm looking forward to seeing how goko addresses that question on 8/22.

What happens 8/22?

Iso disappears, and they have a shitstorm of hardcore Dominion players with nowhere else to go...

actually I think he meant when the questions are answered from the 'Ask FunSockets anything' thread http://forum.dominionstrategy.com/index.php?topic=4080.0

Bingo!

[werothegreat]

Query - why is the beta still working, but not the actual site?

[LastFootnote]

Query - why is the beta still working, but not the actual site?

Probably it's running on its own server.

[Captain_Frisk]

Query - why is the beta still working, but not the actual site?

My guess is different servers.  I suspect the beta is on a dev server - and can handle the load of 20 people hitting it. 

I suspect that on the production side - they are having performance problems - things don't respond within the time that clients are expecting - and then the whole thing falls apart.

Sounds like some combination of the below

1: Their marketing was successful and way more people are hitting it than they tested / planned for and their hardware is buckling.
2: They didn't performance test for load - probably because its expensive and hard and they didn't have time - and its just dying under normal load
3: Their hoster isn't up to handling this kindof load / doesn't have enough bandwidth

Based on the other issues I've seen - my guess is #2.  I know everyone wants to compare this to Diablo3 - but the scale of problem here is way different.  Diablo sold in the high millions the first week.  I'd love to hear from goko as to how many unique users are nailing it right now, but I doubt its above 10 thousand or so. 

That's more than your average web developer is probably prepared to deal with, but far from "OMG we need a farm"

I've seen a variety of behaviors when I log in (sometimes i have my 10 coins, sometimes I don't, sometimes I have my 3 stars, sometimes I don't, sometimes I can see the map of adventures, sometimes its locked) - which makes me think that there is some kindof load balancing at play here behind the scenes - and perhaps its getting mixed up.

[Captain_Frisk]

Oh - and I forgot #4 - which is the conspiracy theory at all MMO launches - they knew it was going to fail - but they launched it anyway - because paying for the hardware to support peak launch is stupid when traffic inevitably dies down after a week.

[polonkus]

Oh - and I forgot #4 - which is the conspiracy theory at all MMO launches - they knew it was going to fail - but they launched it anyway - because paying for the hardware to support peak launch is stupid when traffic inevitably dies down after a week.

I really don't think it's a load issue.
It was dog slow within a minute of the "It's up!" post this morning.
Even at peak yesterday there were only a couple hundred people watching the forum, and I doubt there are hordes of non F.DSers out there constantly refreshing.

[agrajag]

Oh - and I forgot #4 - which is the conspiracy theory at all MMO launches - they knew it was going to fail - but they launched it anyway - because paying for the hardware to support peak launch is stupid when traffic inevitably dies down after a week.

This is why you use virtual instances on a cloud hosting site like Rackspace or EC2. Just make more instances when demand is high and kill them when traffic slows. Just having it completely fail is a terrible solution.

I gotta be honest, everything I've been hearing about the game on these forums make me think it's complete amateur hour over at Goko (and also that they're going for a Zynga-like cash grab). When I heard there was gonna be an official website/app I got really excited because I was expecting something along the lines of the Ticket to Ride iPad app quality-wise, but what I've seen and heard so far is hugely disappointing.

[polonkus]

Oh - and I forgot #4 - which is the conspiracy theory at all MMO launches - they knew it was going to fail - but they launched it anyway - because paying for the hardware to support peak launch is stupid when traffic inevitably dies down after a week.

This is why you use virtual instances on a cloud hosting site like Rackspace or EC2. Just make more instances when demand is high and kill them when traffic slows. Just having it completely fail is a terrible solution.

I gotta be honest, everything I've been hearing about the game on these forums make me think it's complete amateur hour over at Goko (and also that they're going for a Zynga-like cash grab). When I heard there was gonna be an official website/app I got really excited because I was expecting something along the lines of the Ticket to Ride iPad app quality-wise, but what I've seen and heard so far is hugely disappointing.

Yeah, my guess is that they were trying to do something like that, but are completely incompetent at network engineering and various parts of  their systems are not communicating / activating properly.
I really don't think this is a simple load issue.

[cactus]

You know, I was going to do a recap of all the bullshit, but most of it's above in this thread.

But I'm not.  It's not worth it.  Goko has suckered game companies into buying ~150 licenses for an undetermined amount of time.  Most of those licenses aren't going to ever be seen as playable games.  Dominion may not be a playable game, or at least not one with a significant player base, due to the launch failure and the monetization method.  But Iso will go down, nonetheless, due to the exclusivity agreements.

Those game companies already have their money.  RGG, Mayfair, whoever else--they already have their cash.  How much, Jay?  And for how long did you give away your exclusive license?  Two years?  More?  Perpetuity?  I hope you and Pete Fenlon have your lawyers ready; maybe you'll be able to pry those licenses back.

I don't think it's an entirely pessimistic view to think it possible that online Dominion--and other online games--are dead due to this royal fuck-up.

So.  Until Goko is running, running well, and people are using it, I now extend my (personal) boycott to any and all companies who have contracts with Goko.  I'd love to know exactly which companies they are--obviously Mayfair and RGG, and obviously not Asmadi (was there another company who said "no thanks" in that thread?  I don't remember).

I thought I'd be proven wrong about this whole thing.  I'd still be happy to be proven wrong.  But this... this is the very definition of pathetic.

Until now Keiran I had been thinking that your concerns & boycott calls etc. were a bit.... over the top. But I wake up this morning (Australian time) and it looks like all of the worst case scenarios are coming true despite assurances to the contrary. I regret that I now find myself in complete agreement with you.... looks like you (despite being slapped down by Donald X. a few times) have been the most clear sighted of any of us.

[IamOBESE]

Anyone else notice that goko.com now links to the Dominion BETA application? I guess they figured out its not ready..

[blueblimp]

Anyone else notice that goko.com now links to the Dominion BETA application? I guess they figured out its not ready..

Huh. Yes it does. It appears they have reverted it back to private beta.

[Kirian]

Until now Keiran I had been thinking that your concerns & boycott calls etc. were a bit.... over the top. But I wake up this morning (Australian time) and it looks like all of the worst case scenarios are coming true despite assurances to the contrary. I regret that I now find myself in complete agreement with you.... looks like you (despite being slapped down by Donald X. a few times) have been the most clear sighted of any of us.

Eh, I wouldn't call myself "clear-sighted" exactly.  I'm a pragmatist, and I try to work on evidence.  In this case, given the evidence, the most optimistic viewpoint was that we would have something pretty but, in many ways, worse than isotropic.  The long-term optimistic view was that things would improve as we moved forward.

New evidence has come to light.  Major venture capital, huge amounts spent on gobbling up exclusive game licenses, and monetization schemes... and on the flip side a bungled launch, gaping security flaws, and a massive PR disaster.  This is not even judgment on my part, this is just the basic evidence.

And that evidence not only makes things look bad for the future of online Dominion, but also for the future of online board gaming in general.  We have a bunch of licenses locked up by a company that makes amateurs look good in comparison.  Right now the optimistic view is that, in a few days, things will be cobbled back together, and we'll have something still worse than isotropic, but run by a company that failed at its most critical moment, and lost a huge number of potential customers in less than two days.  And that assumes they'll take care of the security problems, etc., ASAP.

The pessimistic viewpoint has two paths.  One is extremely dark, as it involves Goko locking up these licenses and not developing them properly, and that lasting for who knows how long.  That effectively kills online play for major RGG and Mayfair titles for N years.  The other is actually brighter; it involves Goko folding completely, the licenses reverting to the manufacturers, a bunch of venture capitalists getting shafted, and going back to amateurs developing the online implementations again.

That last path might even involve RGG, Mayfair, and the like, waiting for someone to actually show them a working product, then licensing it.

Perhaps that last is actually the optimistic scenario, actually.

I have a feeling Jay Tummelson, Pete Fenlon, Larry Roznai, and the other game execs are feeling a bit blindsided right now.  I would guess Donald is too; I don't think this was his expectation either.

[werothegreat]

Anyone else notice that goko.com now links to the Dominion BETA application? I guess they figured out its not ready..

Huh. Yes it does. It appears they have reverted it back to private beta.

Bitches better put Dark Ages in the beta.

[Kirian]

Anyone else notice that goko.com now links to the Dominion BETA application? I guess they figured out its not ready..

Huh. Yes it does. It appears they have reverted it back to private beta.

A decision I can get behind!