Korruption

[Quotation]

Korruption is a new Online game which I am currently developing on my local computer, with final launch aimed at May 2011.

edit: Well, I guess since this is my first post, I should introduce myself.

My name is Wol Akec, and I'm Southern Sudanese.I was born in England and lived there for 15 years. I'm currently sixteen years old, and I hope to one day develop games, applications, and other non-boring things. My current quest is to learn PHP, JavaScript, C++ and Java by my 18th birthday. I find it much more useful to learn by means of projects, so my first project is Korruption.

What is korruption?

Korruption is game which puts people in the driving seat. Instead of being driven by content, Korruption is driven by politics, money, and power.

Whats unique?

Unlike any other game, players can create business's, organisations, crime families, Mercenary groups, and much more. Ranks are non- existant, only roles  exist, with players being able to create an organisational structure within their business/organisation etc.

Korruption is a rouge-like game, if you die, you need to create a new character. Because I realise that this can lose some of the new generation soft-core players, it will be difficult to procure weapons, learn how to use them effectively, and you will be required to practice often to maintain a high killing skill.

The world of Korruption consists of 5 countries, each containing four cities with 3 districts each. Countries can either be run in various different ways, as dictatorships, or democracies. The choice lies with those in power. Governments receive money from taxes on oil, purchases, imports, and tourism. Tourism is one of the aspects of the game that is not directly affected by players. Unlike oil - which is needs to be drilled by real companies, tourism is calculated based on the crime rate, murder rate, development, pollution level, and much more. Tourism will be a large source of income for countries, but if they have a high crime rate, or murder rate, "tourists" will stop visiting the country so often, which would mean less income for the government. This ensures that although their will be crime families, bank robbers, and hit-men, the government will need to keep them on check.

It will be the government's job to establish police forces, armies, hospitals, and jobs. If they don't do a good job, they will not be voted in again (or overthrown in the case of a dictator). While I realise it will take a large number of players to maintain the game, a large player - base will be obtained by means of advertising, pure persistance, and possible facebook integration.

[Quotation]

Changelog

Register page created:-

Simple random maths question generator:

Code: [Select]

<label><p> To make sure your human -
<?php 
$no1 = rand(1,10);
$no2 = rand(1,10);
$answer = $no1 + $no2;
echo " whats " . $no1 . " + " . $no2 ." ?";
  
?>
<input name="Maths" type="text" />
<a href="http://localhost/Contact.php"> I need help</a></p>
Is it random enough, or should I add subtraction? But subtraction runs the risk of going into negative numbers, which could mean a mathematically challenged potential player to give up with the registration. Or I could create a loop to keep generating more numbers until the answer is positive. Which means making a simple little thing unnecessarily complex  .

[Harkins]

It's not an important part of your game, don't bother until you've got gameplay working. Right now your big risk is not that people will write bots to sign up, it's that you will not finish anything people care enough about to play. Drop in ReCaptcha when you have 50 active players.

And if you must have subtraction, if ($no1 < $no2) list($no1, $no2) = array($no2, $no1);

[Nox]

I'd modify it - drop in reCaptcha *when you encounter serious bot issue*
(or maybe hotcaptcha ... though I haven't really heared much about it)

BTW with your current type of protection you can fill it by JS and hide, therefore the protection will be invisible for people with JS and still working

[Sagefire135]

. . .

And if you must have subtraction, if ($no1 < $no2) list($no1, $no2) = array($no2, $no1);

no need for a big ol' if statement. just use abs($no1 - $no2). If its positive, great. if its negative ... well then there are bigger problems

[Quotation]

Changelog

Register & login pages added

Number thingie removed - not needed atm.

Sorry about being so image intensive, If things get too slow I'll remove the images.




Now it's time to add the account management and new character pages. I suspect It may be a good idea to start uploading things some time soon, so I can get feedback, etc. Does anyone know of a good free host? Before someone utters the "g" word, I value your opinions more. I already have a free domain korruption.co.cc.

Thank you for feedback, tis appreciated me maties.

[SpaceDoG]

you should check out sha1 or something else for the password instead of md5

[Quotation]

Why? because almost every possible password has been cracked?

[Harkins]

no need for a big ol' if statement. just use abs($no1 - $no2). If its positive, great. if its negative ... well then there are bigger problems

He's not trying to solve the problem, he's trying to create the problem.

[SpaceDoG]

Why? because almost every possible password has been cracked?

Not necessarily cracked more like the limitations provided by a 32bit hash can be duplicated via a birthday attack.

[Harkins]

The real problem is rainbow tables, and you solve it by appending a short, secret, random (but always the same one) string called a "salt" every time you create a hash.

PHP folks, there are libraries to handle this kind of log in auth stuff, right?

[Quotation]

Fixed, all passwords are now salted.

[SpaceDoG]

salting it won't fix the restrictive nature of the 32 bit string from md5.

[Harkins]

It doesn't matter that md5 is 32bit, sha1 and md5 are both designed to be as fast as possible so if he's going to suffer from the unlikely scenario that someone swipes his database they'll brute force it just as fast. So the Right Answer is bcrypt, but he's in great shape and it's far more important for him to work on gameplay than defend himself against esoteric attacks that will likely never come.

[Quotation]

Hopefully this will do for now.

Code: [Select]

function enc($text){
$salt = "32D4$ d^&yyt**#h3";//not my real salt
$hash = sha1($salt.md5($text));
return $hash;
}

[SpaceDoG]

Not bad at all. Much better than an MD5 hash.

[lolninja]

Right as Harkins mentioned you need to get the game working before you start spending hours doing all the major tidy up work. But for reference I'll just explain one flaw, though this is not likely to cause a major issue.

Code: [Select]

$hash = sha1($salt.md5($text));
}

Right this is bad, the problem with MD5's is that when you hash a string the resulting hash isn't unique to the input, as multiple encoded values can quite easily result in the same MD5 string.

To exemplify this lets assume for arguments sake that hashing 'hello world' and 1234567890 result in the same MD5 hash. And that the hacker who has access to your database has added a number of accounts, all using a known password, this allows them to start reverse engineering your salt.

This bit just takes time, and once they have your salt they can use a modified rainbow table and gain access to your account, even though the resulting password is not likely to be different to the one you originally used.

By removing the md5 hash your actually making the whole process harder for the hacker, as sha1 has a much higher repeat range, so there are vastly more unique input combinations. So all you need to do is...

Code: [Select]

$hash = sha1($salt.$text);
}
Now if you want a truly obsessive implementation take a look into cyclic salts, which help by lowering the attackers test data pool, and putting them in a postion where they have no idea what the salt is for which record

[Topazan]

What about deriving a unique salt for each password from the username? 

EDIT:  For that matter, what about hashing both the username and password, possibly together?  To solve the problem of collisions, you could have a database of colliding usernames, and when the server encounters one, it adds a salt to it, and if the salted version is also in the database it adds another and so on.  Would that solve the problem?

On topic, the game sounds fun, but be careful not to fall into the trap of adding too much complexity too quickly.  I like the idea of conflicting interests between players who make their money different ways, such as the government and criminals.

[Quotation]

Changelog
Korruption
Signed up for a host, got a domain. I'm not sure if it will work for the rest of ya'll, works for me, but it's probably still propagating.

[Harkins]

Works here, looks like you should rename Index.php to index.php - the caps matter on Linux systems.

[Quotation]

Will do when I can get on. I can no longer log into pyloth.

It doesn't even tell me my password is wrong. I cannot log into the control panel or pyloth.com

[Quotation]

I don't have the time or the patience for pyloth to fix it's self. I'm finding another host.

[Quotation]

I have now switched to a highly proffesional free host. The domain is still pointing to the old host,
as it needs time to adjust.

The account section has been completed, you can now register, login, create a new character,
play on an existing character, or change your password.

The new character creation is highly complex. I will explain in a later post.

[Chris]

Do not waste time on free host, these are nothing but trouble, get cheap shared (Godaddy is good enough and cheap).

Do not talk with people who want to make you into password cracking protections. This is not your problem, your problem is making super ultra playable and cool game

Do not spend effort on captchas if you don't need them. Spend all effort on making super ultra playable and cool game

"if you die, you need to create a new character" and "it will take a large number of players to maintain the game" are contradictory design choices. These two statements make a poor combo. It's as if you ware making a deck for MTG and put a lot of "artifacts" and "bury all artifacts" cards. Such combination can never be an optimal choice by its nature.

[Quotation]

@chris

Thanks for the Input. Sadly though, I can't get a paid host because paypal != like Sudan. My paypal account was disabled the day after I created It. I have no choice but to use a free host.

To answer your design statement. I would like to explain the game mechanics. As I emphasised in my first point, It is very difficult to kill people. It is also difficult to procure weapons, and a good goverment would control the flow of weapons etc, esuring that only those who need weapons can get them. There are also decentives  for the killer. They can be tried by their fellow players, and put in jail for a maximum of four weeks (may be a tad over the top, I will see).