Should Intrepid offer a bug/exploit bounty system?

Most software devs with a brain offer these. And since the enormous number of exploits have made that other MMO currently unplayable, should Intrepid implement such a system?

I think most of us who have played subscription-based MMO's know that any sort of rampant duping/infinite resource (for instance) often results in irreparable damage to the player base and word of mouth. Suddenly the well becomes poisoned and subs drop off when such exploits are left unfixed for even a few weeks for both of the aforementioned reasons.

Personally? As someone who has found multiple of these sorts of exploits in past MMO's, I always keep them to myself or tell a small number of trusted friends that I know won't tell others. This way we can just sit on the exploit without anyone finding out about it. There's simply no immediate incentive for the player to tell the Devs about it, but if you pay players who report these exploits and glitches before knowledge of them becomes commonplace? Well - that's just being smart, and that's just doing what other types of software companies do to protect their own interests.

Find more posts tagged with

Comments

Noaani

maouw wrote: »

You cannot trust the playerbase to be noble.

Especially in a game where you can get an advantage over the person next to you.

While this is true - it is also why developers need to keep tools like the one outlined above up their sleeve.

Affluent

I'm on board for a bug bounty system!

tautau

Perhaps the bounty could be a couple of free weeks added to your play time?

Ulfbrinter

tautau wrote: »

Mildly off topic, but to the OP who sat on exploits and shared them with friends....hopefully that kind of cheating in AOC will quickly earn you (& trusted friends) permabans.

Further off topic, remember in L2 the 'Seven Secret Emotes' which, if done in the right order, opened the blouse of dark elf ladies?

I want to point out that Steven himself has said on stream that in past MMO's he took advantage of exploits. Such as putting down enough objects prior to PvP engagements that it would crash people's clients.

Zythtyz wrote: »

So you want Intrepid to pay you to not abuse a bug and go against their ToS, or hold them hostage by ruining their in-game economy? You know what this sounds like, right?

No, I want Intrepid to reward players who find bugs. And when I say reward, I mean a genuine reward. Not a skin, not a week of extra playtime. Something actually worth good money, or a genuine reward that clearly incentivizes a player to report on dupes. Otherwise, you end up in New World where YouTubers are just making tutorial videos about exploits for days. Again, Microsoft/Google/Apple, etc. all do this very same thing because it is prudent to do so. If I know of a Day 0 hack, even if it is something I constructed, Microsoft will literally pay me money if I come to them first with it.

Noaani

tautau wrote: »

Perhaps the bounty could be a couple of free weeks added to your play time?

When you compare the profit that can be made from bugs in MMO's, there may as well be no reward if this is the value you are putting on it.

Even in a game as second tier in popularity as EQ2, people that were exploiting bugs were making enough money from selling gold obtained via exploits to buy a house.

A few weeks of game time is not worth anyone's time.

Vhaeyne

Noaani wrote: »

tautau wrote: »

Perhaps the bounty could be a couple of free weeks added to your play time?

When you compare the profit that can be made from bugs in MMO's, there may as well be no reward if this is the value you are putting on it.

Even in a game as second tier in popularity as EQ2, people that were exploiting bugs were making enough money from selling gold obtained via exploits to buy a house.

A few weeks of game time is not worth anyone's time.

I hate agreeing with you on this because it makes the situation seem so hopeless. Until now, I have been thinking about the everyday man's reaction to exploits.

When you consider people who are into RMT already, I don't think you can tempt them with any sort of bounty program.

Still, I think something is better than nothing overall. A bounty program would motivate me to report bugs, a little more. As a human, I know I could be tempted to use an exploit if I found one. Lord knows I have exploited in the past. The severity has always depended on how much I resect the game or If I consider the exploit to be justified.

Ulfbrinter

Vhaeyne wrote: »

When you consider people who are into RMT already, I don't think you can tempt them with any sort of bounty program.

Most of those people have moved onto easier and safer pastures of making money. RMT is nowhere near as prevalent as it used to be for a variety of reasons. What's RMTing to a guy who can make more money just using a GPU to mine shitcoins? Nothing. It's literally a waste of time and electricity to do something other than mining, it's why a lot of NFT proponents want games to include whatever shill coin they're working on this week.

Nowadays if you offered a few thousand dollars, cash in hand, for just reporting a duping exploit? Yeah, that money would get taken real god damn fast because short-term thinking overrides long-term planning. Or someone in a bind that needs that money who learns of the dupe from someone else will report it. Or someone who just doesn't care that much about the game but could always use a few grand would.

I know this may seem like a lot of money, but do the math. If even 100 players dropped their subs for even just one month, you've already lost 1500 USD that you could avoided losing if you just paid some guy a grand for his bug report. Now though that monetary loss is compounded potentially by years because those 100 guys may never come back. Shoulda just paid a few thousand dollars to avoid all that in the first place.

Nerror

Exploiting people's greed, as per the OP, can be a fairly reliable tool, but there are some downsides as well obviously.

My take on this is:

let's get Alpha 2 underway. Let the testers who actually care about the game do their thing and report bugs and hopefully they'll have fun while testing. I would be ok with a title or cosmetic thingy be awarded to those who find and report serious exploits during this time. No cash prizes yet though.
Once most of the core systems are up and running in A2, hire professionals to "penetration" test the game. There are companies that specialize in black box, grey box and white box testing of games. Hopefully the industry insiders know which companies are good.
After the professionals have done their job and hopefully fixed most remaining exploits, let the unwashed masses at it through a proper bounty system. Cash prizes are fine. People finding and reporting exploits are giving Intrepid something of real world monetary value, and I think it's fine to be compensated for that. Remove the ingame rewards.

I don't think Intrepid should announce if they plan to do step 3 above. We don't want people just hanging on to exploits in hopes of getting cash, but rather they should be incentivized through some ingame rewards, or just through the knowledge that the future of the game is better for it, and thus their future enjoyment is better too.

Once all the planned features are in decently working order, we enter the betas for the final polish, but keeping the bounty system just in case.

Noaani

Vhaeyne wrote: »

I hate agreeing with you on this because it makes the situation seem so hopeless.

While I get what you are saying here, I don't consider the situation to be hopeless at all.

At least, not in regards to no bounty system.

To me, the thing that made me think the situation was hopeless in terms of bugs in the part of the game I care about (the combat system), was the comment of no trackers. Without wanting to sound like a parrot repeating the same thing over and over, combat trackers main actual use from a game developer standpoint are as a tool players use to find bugs in the combat, harvesting and sometimes crafting system

Very few games have game breaking bugs (actual exploitable things, not just balance issues that some people are unhappy with) in their combat system. When you consider that the combat system in most games is the most complex system in the game, and is also the one that players interact with the most, this would seem really strange at first.

The reason there are very few games with game breaking bugs in their combat system is because every game has a core of passionate players armed with tools they use to diagnose that combat system to a degree even some game developers are astonished with.

Passionate players with the right tools will always find bugs and serious issues before anyone else - which is what both players and developers should want.

Then you have the two systems in games that have produced the most game-breaking bugs that I am aware of - game economy and experience game/reward systems.

These two systems do not have players as passionate about them, and do not have tools players could use to diagnose them in the same way a combat system does. As such, most bugs that exist in these systems make it to the live game and are found by who ever happens to come across them first.

Such tools for the games economy and reward systems could be developed, but I am unaware if there is the passion in the player base to put the same effort in to finding bugs in these systems as there is in a combat system.

Vhaeyne

@Ulfbrinter

I have literally seen RMT in every MMORPG I have ever played in my life. So, I am a little skeptical that people will not be RMTing in Ashes for any of the reasons you stated.

RMTers are experienced and skilled at finding, using and hiding exploits in every game they can get their hands on. They see every game as and opportunity to make money. They use account phishing to keep operation costs as low as possible.

If crypto mining was as good as you claim, I would have stopped seeing RMTers in like 2013. It's 2021, and I still see them spamming in town in nearly every game I play. Just spamming away on someone else's account because they clicked the wrong link looking for a newbie guide...

Sathrago

Vhaeyne wrote: »

@Ulfbrinter

I have literally seen RMT in every MMORPG I have ever played in my life. So, I am a little skeptical that people will not be RMTing in Ashes for any of the reasons you stated.

RMTers are experienced and skilled at finding, using and hiding exploits in every game they can get their hands on. They see every game as and opportunity to make money. They use account phishing to keep operation costs as low as possible.

If crypto mining was as good as you claim, I would have stopped seeing RMTers in like 2013. It's 2021, and I still see them spamming in town in nearly every game I play. Just spamming away on someone else's account because they clicked the wrong link looking for a newbie guide...

I was kind of laughing when he said most people have moved on to better pastures... Just because some people have started slaving away at crypto mining doesn't mean the players of games suddenly stop farming/buying/selling gold. You bet your butt there will be RMT clowns in Ashes, and it gains value the better/more populated the game gets. Especially in Ashes gold is going to be an extremely useful thing to have. From elections to the player driven economy to bidding groups. RMT will have to be taken on as best as we can muster, but I don't think we currently have a method to get rid of it. People find a way.

Ulfbrinter

I said most; which is demonstrably true. Because those exact same people are using their same hardware on mining which makes them a lot more money than merely trying to sell gold to people in MMO's. Both of these are time-intensive, but one of them makes you less money and on top of that you risk losing your assets far easier simply by having admins ban your accounts. And again, it's these same people who want mining in games. They want to have their RMT to be "legalized".

RMT won't go away, but its hay days are long since over. EQ2 came out 17 years ago, guys.

Vhaeyne

@Noaani

I know it's not actually hopeless. It just seems that way.

You point out that if we had some players incentivized to test other systems as hard as they test combat, we might see better outcomes for preventing exploits. I can agree with that.

@Sathrago
Agreed. In addition to worrying about the guy chilling behind 6 proxies on your 8 year old cousin's stolen account. We also have to worry about things like gallywix. For some people, it's way easier to make money in games than it is trying to stay up to date with the hardware needed to crush hash puzzles.

Vhaeyne

Ulfbrinter wrote: »

I said most; which is demonstrably true. Because those exact same people are using their same hardware on mining which makes them a lot more money than merely trying to sell gold to people in MMO's. Both of these are time-intensive, but one of them makes you less money and on top of that you risk losing your assets far easier simply by having admins ban your accounts. And again, it's these same people who want mining in games. They have their RMT to be "legalized".

RMT won't go away, but its hay days are long since over. EQ2 came out 17 years ago, guys.

That "Same hardware" is not profitable at mining crypto, my friend.

I assure you, I like money. I would redline my rig all night while I sleep if it was worth the more than the electricity to do so.

Sathrago

Ulfbrinter wrote: »

I said most; which is demonstrably true. Because those exact same people are using their same hardware on mining which makes them a lot more money than merely trying to sell gold to people in MMO's. Both of these are time-intensive, but one of them makes you less money and on top of that you risk losing your assets far easier simply by having admins ban your accounts. And again, it's these same people who want mining in games. They want to have their RMT to be "legalized".

RMT won't go away, but its hay days are long since over. EQ2 came out 17 years ago, guys.

Just thought I would show you this very recent situation that was happening in world of warcraft.

https://youtu.be/ybOMK-8EGb4

Noaani

Vhaeyne wrote: »

Noaani

I know it's not actually hopeless. It just seems that way.

You point out that if we had some players incentivized to test other systems as hard as they test combat, we might see better outcomes for preventing exploits. I can agree with that.

based on my experience (first hand, second hand and anecdotal), it isn't so much about an incentive. There are an alarming number of players like myself that actually enjoy working out how the developers have created systems, and seeing if we can find issues with them.

To me, rather than an incentive, all players need are tools.

I do admit that Intrepid would be breaking new ground if they tried to create such a tool for their reward system and economy, two areas that need some real attention in most games.

Vhaeyne

@Noaani

Would be breaking new ground for sure. I am having a hard time imagining what tools Intrepid could even give to players that would not be a security risk when it comes to reward systems or the economy. I know Intrepid is against of having any form of API that interacts with the client.

Maybe having full transparency on loot tables? That could be something useful for testing if the reward system is working correctly.

unknown

This content has been removed.

Ironhope

Look, Intrepid isn't going to re-invent the wheel.
It doens't have to.

All games have bugs, especially early on release.

As long as Intrepid has a decent and dedicated moderator team and takes its time to devliver a polished product, things will be in the limits of the normal and player experience will generally be favorable.

Nagash

I mean we are paying to bug test now with the alphas and betas

Child Item