busy eating waffles brb

  • 5 Posts
  • 36 Comments
Joined 2 years ago
cake
Cake day: July 19th, 2023

help-circle
  • Shit like this is why people go back and play much older titles and have a great time with them

    “People” as in maybe 5% of players

    That’s the part of the comment I was referring to. It’s factually wrong: only ~15% of playtime is spent on 2024 games

    LoL didn’t release in 2024, neither did Warframe. I’m not arguing that old service games don’t make the most revenue, they obviously do, I’m arguing that a lot of the live service games that are actively comming out are almost all underperforming and failing to get any kind of audience. All that means there’s very little incentive to develop a new live service game unless you already have a big community for it or a brilliant idea

    If you have a lot of money, you’re better off investing in a “Black Myth Wukong” or “Elden Ring” – both of which are outperforming the newest Call of Duty on Steam in revenue – compared to a new random live service game




  • The server might always send a modified script that just uploads the plaintext private key.

    Yeah, you’d need a way to validate the client code before it’s executed to solve that issue

    Section “2. Client application security” of MEGA’s Security Whitepaper discusses this exact problem. Their best solution to that issue is to just cram the whole frontend in a signed web extension and not serve any code to the user when the extension is active, which is not very user friendly but works for those who want an extra layer of protection

    I just can’t find a good user-friendly implementation, sorry for not being of more help. The web just isn’t E2EE-friendly ig :/


  • Yeah, I’m not used to E2EE in the browser either and StackExchange seems to agree that there’s no nice solution :/

    The sanest option in terms of user practicality to me appears to be storing the private key on the server, maybe encrypted with the user’s password, and sending it to the user on successful login where it would be decrypted client side. It seems like it’s more or less what MEGA is doing since they have a similar issue

    If the server having temporary access to the user’s password is an issue maybe the password could be partially pre-hashed before being sent?

    It’s be interesting to talk about it with someone with more experience, especially since implementing all of that will be a pain so it can’t be redone every Thursday
















  • waffletoLemmy Shitpost@lemmy.worldReal committed
    link
    fedilink
    arrow-up
    10
    ·
    edit-2
    1 year ago

    Sorry to butt in but why is my fellow waffle’s demand not possible? :(

    NSFW is how you tag stuff that you don’t want your colleagues to see on your screen at work: it’s not just for porn!

    Included pic of rubber duck of peace as proof of goodwill:

    Close up on a rubber duck's face with its mouth open