Whitelists instead of Banlists for hosts

[FLOZi]

The real solution is for autohosts to go away and relay-hosting to come back, so that all games have a hoster who can implement their own control.

Just imo.

so... Wild West? How do these hosters protect their games against a flood of "Mandos"?

Set a password and invite people you want to play?

[ThinkSome]

Set a password and invite people you want to play?

Which would result in walled gardens and newbies left to themselves.

[Forboding Angel]

It worked beautifully 10 years ago when we had 300 people playing AA and scads of games going on at once.

AutoHosts gave trolls a crack in the door.

Also not implementing email verification because it's too hard for newbies is idiotic. Literally almost every account on the internet requires verification.

If you wanna make it really secure, only accept Google/Facebook/GitHub logins. Creating a new Google/Facebook/GitHub account takes time.

Like Dansan said, if he can make it so that it takes you some time to backstop a new account but an admin only 5 SE a to ban you, you will lose motivation quickly.

You aren't accomplishing anything if you are easily swatted away.

And if you make a new account and ruin another game, you have to spend a bunch more time to make an account.

At some point you are spending more time making accounts than actually playing.

[MasterBel2]

Set a password and invite people you want to play?

Which would result in walled gardens and newbies left to themselves.

What about the channels? If we encourage conversation in channels, would that help to reduce the impact of that? I know that most newbies tend to pop into channels to say "Hi!" when they get on.

[albator]

It worked beautifully 10 years ago when we had 300 people playing AA and scads of games going on at once.

AutoHosts gave trolls a crack in the door.

Also not implementing email verification because it's too hard for newbies is idiotic. Literally almost every account on the internet requires verification.

If you wanna make it really secure, only accept Google/Facebook/GitHub logins. Creating a new Google/Facebook/GitHub account takes time.

Like Dansan said, if he can make it so that it takes you some time to backstop a new account but an admin only 5 SE a to ban you, you will lose motivation quickly.

You aren't accomplishing anything if you are easily swatted away.

And if you make a new account and ruin another game, you have to spend a bunch more time to make an account.

At some point you are spending more time making accounts than actually playing.

+1 (with at least 1min delay for email sending)

And only email verification looks like a realistic thing to do from what I read here.
Adding the ability to actually register email when SL or other lobby start to avoid that newbies get stuck at the door looks like mandatory though.


But there is another solution. It is maybe a bit easier to implement...at least it is different. Also it is a bit shaky on the tuning and would also require some work (ofc !). It is linked to the SLDB. Let me expand on that:
While true skill system is the commonly admitted system to assess the skill level of a player (and is currently in use now), there have been debates over how to rank more accurately the skills of a player at a shorter time period. I am thinking to things such as the time integrated inverted rank where you are good at something, e.g. most damage. Put it mathematically:

value = int(1/rankAtMostDamageDeal (t) , t, 0, T)

You can also think like metal Worth (unit+building coast (M +60*E)) of someone, etc...
That is ofc mainly relevant in large game. If you want to make it accurate for small game, you need to feed your algo from data gathered from other game on the same map with the same number of player, idieally same mods_version/engine, which requires call to SLDB/replay_website and it begins to look far to complicated, but let me come back to the point.

Let assume this is implemented in a widget and computed real time. It give you an indication of how good a player is. At the same time you have access to SLDB to cross-check with real Data. In other word, checking who is new and who is not according the SLDB! So you can pinpoint who is trying to fake like he is a noob but is not. At this point, you have different things you could do:
1) flag the suspicious player: You can decide to auto-kick them or to simply make a visual warning in the advanced player list telling it is a smurf. Then they can be kicked by admin of vote.
2) When they get auto-kick or kick, you make sure that the person kicked get a message that the reason you were auto-kick or admin kick them was a suspicion of smurfing/trolling. And you give them a way to ask permission to be taken out of the autokick list. There are valuable reasons such as change of ISP, moving to other town, playing with a friend with other account, etc. Eventually people will get aware of that and will be able to add themselves to the list before action is taken (based on talk with admins or after a delay if automation is needed, but automation does not look like the right think to do). At the end you will get a combination of trusted IP+accountID (not IP alone to avoid spoofing ?). I am not aware of the details but I am pretty sure that is already available in the SLDB (with CPU and other info) anyway.

The consequence of that are:
a) The troll will actually have to play like a noob and have shit game until he reveals itself. Of course, it wont prevent them to act, they probably don't mind to suffer.
b) We finally get player to stop smurfing even they are not trolls. And this is very important. If you start behaving like shit, you cannot start fresh again, then you will start paying very slight more attention on how you behave.

There is a flaw in that: the admins judgment that are allowed to wave player from the auto-kick list. The only way to solve that is to help them giving them access to a special filter to cross check from the replay DB all the game where the supposedly in fraud player played and identify the player he played the most with in order that the admin can talk to them and cross check what he said (e.g. PM conversion or random fact for a replay). Then the admin can ask a question to the supposedly in fraud player and he needs to answer right away to get the auto-kick waved. Or he need first to watch all the replays the player he tries to fake the ID played...

This very last part looks the email verification looks more simple, but if auto-kick is not enable, does it really needs to be taken care of ? Maybe you guys have solutions for that part.

[ThinkSome]

What about the channels? If we encourage conversation in channels, would that help to reduce the impact of that? I know that most newbies tend to pop into channels to say "Hi!" when they get on.

Nope, very few newbies join #s44 even though we have "/join #s44" in room name. Most newbies do not converse in the battle room either. Usually they stick around for 10-60 seconds then leave or they do the same while spamming !start or !map XYZ.

Perhaps new players should first solve an entry challenge... such as a medium level sudoku. Should keep those without patience away and provide for some 20 minute mental exercise.

[abma]

enable rank limits for the host(s)?

[MasterBel2]

The issue is that it would definitely exclude noobs from joining the host, which is something I never intended on. FabriceFABS tried something like that with his hosts, forcing newbies to spec, but people got really upset over that. Not sure why.

[Forboding Angel]

This is fucking idiotic, just fucking implement email verification like every other fucking place on the fucking internet. Jesus Christ.

[abma]

This is fucking idiotic, just fucking implement email verification like every other fucking place on the fucking internet. Jesus Christ.

and this solves what? you know about 10minutemail, etc?

[Forboding Angel]

https://gist.github.com/adamloving/4401361


I linked to this in one of the other threads. There are also free services that do this for you.

More:
https://github.com/andreis/disposable/b ... omains.txt

A wild easy to use API appears:
https://www.validator.pizza

[abma]

there are still hundreds of services where you can create email addresses for free.
i.e. in googlemail you can create aliases:
https://support.google.com/a/answer/33327?hl=en

means: create one gmail account and then you can create 30 fake accounts, possible more as you very likely can delete and re-recreate aliases.

[Jazcash]

This is fucking idiotic, just fucking implement email verification like every other fucking place on the fucking internet. Jesus Christ.

and this solves what? you know about 10minutemail, etc?

I've also been saying email verification would be a good thing for years. Not only for the reason Forb is stating, but also for lost passwords and optional newsletters if you wanted an easy way of promoting recent developments and sparking interest now and then.

Blocking emails from known disposable services is effective too btw. I've given up on services that block them before when I've needed to use a disposable email.

You could even make the email field optional instead of required. Autohosts can choose to make use of it to filter out some of the trolling if they want, but they don't have to. Users that lose their password could still use the old method of asking an admin to reset their password if they didn't fill in their email to have it reset that way.

Yes, there will be workarounds. No, it won't stop trolling entirely. But it'd decrease it a hell of a lot when there's more effort required than simply hitting "create new account" and filling in a username and password....

viewtopic.php?f=71&t=35988
viewtopic.php?p=580587#p580587
viewtopic.php?p=581101#p581101
viewtopic.php?p=581083#p581083
viewtopic.php?p=581077#p581077
viewtopic.php?p=277679#p277679
viewtopic.php?p=293056#p293056
viewtopic.php?p=300485#p300485
viewtopic.php?p=366160#p366160
viewtopic.php?p=366664#p366664
viewtopic.php?p=366680#p366680

[Forboding Angel]

there are still hundreds of services where you can create email addresses for free.
i.e. in googlemail you can create aliases:
https://support.google.com/a/answer/33327?hl=en

means: create one gmail account and then you can create 30 fake accounts, possible more as you very likely can delete and re-recreate aliases.

I use gmail aliases all the time. I'm pretty sure you know how to use regex. Look for the + and filter out anything after it. Even facebook does that for gmail aliases. This is elementary stuff.

[gajop]

Email verification is definitely useful when forgetting passwords, and by having user emails we can inform them of other critical changes.
I don't think it helps against dedicated trolls. The best way to combat them is by introducing level/experience requirements so that they have to spend a significant amount of time to get where they were. This does require a playerbase of a certain size, which I don't think most games have.

[Forboding Angel]

Yes, there will be workarounds. No, it won't stop trolling entirely. But it'd decrease it a hell of a lot when there's more effort required than simply hitting "create new account" and filling in a username and password....

"Dedicated trolls” is just an excuse at this point for complacency. You (generic you) know what really doesn't work? Doing absolutely nothing... For 10 years.

[ThinkSome]

I don't think email verification will stop trolls. However it might turn out great in combination with sending emails to those who had not been seen on the lobby for over two weeks...as a reminder that spring exists and to lure them back in :)

[gajop]

Let's be practical. No one is against email verification I think, so it doesn't really matter why it gets implemented. It should just be done.

[Forboding Angel]

Assuming to leverage an API that checks for temp emails and regex gmail aliases, it will make trolling with account creations much more difficult.

You could tie logins to stream, Google, facebook, Twitter and GitHub. Only allowing logins via those services would make trolling virtually impossible.

Get banned, spend the next 30 minutes making new accounts, etc.

[gajop]

Absolutely not ^
We are an open source community, not about to force people to use proprietary services.