A big thank-you

Two years, 56 posts, and my adventure in ascii gaming continues.

On this very happy anniversary, I get to pause, poke my head out of the sand, and begin the flagellation.

First off, I’d like to extend a welcome to many new readers, and thank some old ones. For your great patience as you’ve slogged through lengthy articles over these two years… a sincere thank-you!! I really appreciate it.

To me, it’s the comments and feedback that make this effort worthwhile. While I could easily write an essay of appreciation to all, I would be remiss not to single out Justin Johnson of RSA Security for his constant feedback, editorship and support. He’s made his presence known behind the scenes, and I’ve taken his criticism (sometimes in the mouth) in an effort to continue the hard work of providing quality material. Thank-you.

covert.zeitgeist

Total visitors since September : 276,604
Going strong. Proof that you can have a lot of visitors, and relatively few comments. One post appearing on digg got over 10,000 views and not a single comment.

Average daily readership : 870
Many from RSS. Tons from Google. Hello!
(edit : this is closer to 300 daily, but the big ones throw off the average)

Most widely read post : MMORPGs, Security, and the Grand Promise of Middleware
Got some good traction, thanks to Steve Davis and the good folks at IBM.

My favourite post : Immersion, anywhere
I was really pleased to have made the “December Carnival of Gamers”. Thanks also go to Michael for his support.

Funniest search term : “fuck insane vanguard tradeskills”
I don’t hate Vanguard, but lots do.

Most popular search term : “narbacular drop”
This is a huge one. I should email Valve.

Funniest comment :
“Believe me, the mods that do play “hide the penis” are WAY better than the “find the penis” variety.” - Headcrash
On “It’s the tools, stupid”. Thanks for the LOL.

Good trends :
more readers, better quality (imho), better graphics (I hope), more industry interest

Bad trends :
longer posts, horribly infrequent, dry content

Event Horizon

Feedback.

Today is also your chance to really let me have it. Tell me what you like, tell me what you don’t, and tell me what you hate.

I invite your comment below (or in my forums). If you’re a new reader, I’d love to hear from you, too.

This day also marks an inflection point for this site, as I will start to make some big changes.

Over two years of game-blogging has shown me that peoples’ time just keeps shrinking. More games, more people, more text. Despite an insane amount of reading (>500 gameblogs) and a ton of participation, I am starting to realise that it’s a big ask to get people to come and read a 1500-word post. It’s doubly hard to expect sustained feedback. There’s just too much out there.

So I’m killing the monolithic, researched, “big post”. It’s a difficult thing, since I love writing them. Unfortunately, not everyone has time to read them!

Volume will now increase, and some enjoyable surprises will appear soon. Expect less ascii, and more adventure.

Wherefore art thou, Web 2.0?

I had hoped to give you a taste of what’s to come right now, but I’ll have to settle for something equally interesting.

My previous post touched on the subject of Web 2.0, and how it can improve gaming communities. If the concept of “Web 2.0″ is new to you, or if your cynicism is too strong to take it all seriously, then I invite you to watch this. Think about how it applies to gaming.

Including this video is also a small hint of what is coming here at covertcreations.

Happy 2 years, everyone!

As mentioned in my previous article, gamers expect a community from the game publisher. In a sense, this demonstrates the unique position of videogames in the landscape of entertainment. Consequentially, feedback and community become a cost of doing business.

I believe we’re quickly reaching the point where publisher-run communities no longer serve their purpose. The communities are too vast. Moreover, the gamers themselves have evolved toward a deeper level of sophistication. Gamers are the reason we’ve come this far, and we simply demand more.

The community problem in MMOs is compounded by three issues:

• The sophistication of the gamers. Community software is becoming prohibitively complex.
• These communities are too large to be managed centrally, so gamers form their own.
• And, the publisher wants to maintain ultimate control over the content in their domain.

MMO providers and their respective forums capability is totally stagnant in the face of this. The key issue is that I don’t believe they can keep up. Since software utilities (ie. middleware) saves the licensee time and effort to develop these features internally, the time has come for official community middleware. Yes, leave it to the experts.

One such middleware solution is MMO Guildsites. Their approach to the community problem is quite unique, not only providing a “guild branding” solution through an extensive theming feature, but they also provide RSS feeds for the guild news page, the usual forums, a calendering service and a loot-tracker (using DKPs). It’s a modern community service at its very best.

I’m not certain if MMOGuildsites has a licenseable option for their software. If they don’t, then gearing themselves to publishers might be an additional revenue source.

I also think that they could go one step further.

The super-community solution

So we know that managing a guild is a prohibitive task for most people. MMO Guildsites offsets that burden by allowing players to concentrate on the game, rather than trying to run their guild as a mini business (although some uber-guilds actually charge for membership).

We also know that MMO providers/publishers can’t stay abreast of the evolving requirements for their massive communities. So what’s the solution?

In outlining a way out of this, I’m forced to invoke one of the worst marketing buzzwords ever conceived.

“Web 2.0″.

“We can now merge, without merging.“
Google’s CEO, Dr. Eric Schmidt on partnership with Apple.

Historically, content and its container have been indistinguishable. Most online content existed within impenetrable silos. An undisputed aspect of “Web 2.0″ implicitly means aggregation. When you aggregate the content, you willingly create a breach between container and the information. This allows content to float freely, regardless of where it “lives”. Google News is a common example.

So, if MMO communities have fragmented into private guilds, does it not make sense to reel them back? The publisher already segments the community into realms, so further segmentation is inevitable. Guild forums are a natural place for aggregation. Furthermore, guilds could even aggregate each other. In a non-automated sense, they already do.

These super-communities could be formally represented in the game’s official game forums. The community interaction would become more guild-centric, which arguably serves both the publisher and the players.

A guild could “publish” one of their forum areas while leaving the rest as-is. And since the “public channel” for every guild is aggregated into the publisher’s forums, the MMO provider themselves can exert some editorial control over what appears there.

It makes sense to drive massive communities towards guilds, at least to me. It’s a natural arrangement. So what could meta-gaming services like MMO Guildsites do? Build in this capability right now. Let the gamers aggregate each other first, and you can be sure the publishers will follow suit.

In the end, it’s the gamers that drive the market. It’s always been this way.

Technorati tags: WoW forums, virtual communities, mmo middleware

The nature of things

When online gaming was getting started, there was a certain novelty in spending vast swathes of time with the same people on the same game servers, night after night. It seemed inevitable that we’d eventually all team up. And team up we did. Forming groups is the most basic of human qualities, and is certainly no less true in virtual worlds.

Collectively we called ourselves “clans”, and the warlike motif suited us. It reinforced the competitive environment that we found ourselves in. As we slowly emerged from the primordial muck that was online gaming, we coalesced into our small tribal units.

The clan itself was represented online by a simple website. It was the centrepiece of our endeavours, even if used only as a placeholder for the clan logo. It was our identity. Without it, we were nothing at all.

Over time, our intimate, familial world of gaming clans started growing. More games. More people. Forums software sprang up overnight, allowing us the convenience of posting messages to a larger audience.

This became something of a satellite industry, offering meta-gaming services like clan hosting, gameservers and forum software. Community middleware like this made creating greater online concourses so much easier.

As a student back then, but also observer and participant, I was intrigued. These communities were evolving in front of me, and nothing like this had ever existed before. In student mode, I would study and write about this stuff. I recognized myself as somewhat of a rare species, as every night I’d live out the theories I studied by day. I once penned a set of “requirements” for online communities, spurred on by rote observation and experience. I once wrote, “Creating communities isn’t difficult. Keeping them is”.

The so-called requirements for online community:

These ideas don’t just pop into existence. They’re more like a description of existing natural law. It wasn’t until much later, having read the likes of Stewart Brand and others, that I realised how close to the mark these were. Online communities, without benefit of physical proximity, could live or die by these precepts. This, I know from experience.

Now, we’re speeding ahead into a new generation of online games. Communities that rival the size of small countries. This is community growth like we’ve never seen, and it will never stop.

Corporate communities

In the game industry, forums software is emphasized as much as the games. The prevailing wisdom insists, “create your community”, either as a fan-based feedback mechanism, or more. The wisdom says to provide this service. Provide it, or you will fail. It’s a rigid business decision.

Blizzard Entertainment operates forums on behalf of their World of Warcraft community. It provides a mechanism for them to speak with their constituents (or vice versa), and reinforces the game’s content amongst the players. Technologically it’s just forums software, though I suspect that their meta-gaming service is arranged as complexly as something you’d find between NASA and Slashdot. The importance and expense of this should immediately be self-evident.

When I visit the WoW forums, I’m struck by one thing. The vast community that exists within these hallowed desmesnes isn’t particularly… communal. One topic can easily spawn dozens of pages. As of today, I note that “WoW-General” contains over 1,682 pages of content. It’s not just the volume. I find it hard to gauge the purpose if people don’t even play the game together. And those that do seem to exist just to taunt each other.

Discussing the game is fine. That’s community. Yet, am I alone in thinking something better is missing?

To offset the volume, Blizzard segments the community into topics organized by server realm. This is an adequate solution, since the game itself echoes these constraints. Even with the tenacity of teenage gamer lust, the typical WoW player would be very hard-pressed to keep up with much more. So, does segmentation help make this manageable? I would say, yes. It breaks down noise.

It’s important to note that WoW is not alone in this. By definition, all MMO style games want this.

This is a problem that’s going to get worse, because MMO communities are essentially broken. The developer feedback part works, but the community aspect totally fails. The sheer quantity of unmanaged dialogue prohibits it. My appraisal may seem spurious, but what if every WoW player were actually a “member of the community”? The volume on the forums would be easily multiplied a hundred-fold. A thousand.

All this leaves me with three questions:

• In light of the community requirements I cited earlier, this lack of accessibility/manageability should have imploded the forums and killed the community long ago. But it hasn’t. Why not?
• If busy MMO forums are too impenetrable for the average player, then where is the community, exactly? You know, the one that’s accessible, has a common frame of reference, and a resounding purpose?
• What will happen when the promise of contiguous, un-sharded worlds is fulfilled?

Update: Continue to part two to find the answers to these important questions (and more).

Technorati tags: woW forums, virtual communities, mmo middleware

Is there a point where pure expertise takes you far from the elemental principles of your subject? Such that your perspective actually becomes skewed? It’s an interesting question, and certainly a difficult one. History is replete with experts that get blindsided by innovation or worse, redundancy.

When listening to someone as clearly expert as John Carmack, it’s absolutely clear that there are few that can exceed his knowledge or experience in graphics technology. Every year, John delivers the keynote at his own QuakeCon convention. It’s somewhat of an industry joke that no one really understands what he says there. His whole manner exudes someone totally steeped in technology (more specifically, graphics technology). It’s always interesting, even if you don’t fully grasp every last ounce of his wisdom. He gets up, delivers a clinically fascinating speech, and leaves.

Last August, it seemed different. He was more relaxed, conversational, witty. I enjoyed the talk some time ago, but I realise that most people haven’t caught up to it. It tends to be very technical, and an hour-long oration on computer graphics isn’t how most people spend Friday night. So, I decided to share my attempt at “John Carmack distilled”. I recorded several of what I felt were the most representative clips of his speech and bundled them here. An hour-long talk boiled into five minutes of your time, how efficient! (for you, at least)

Note: I wrote the audio application in openLaszlo, which is unfortunately rather bug-prone. If you have problems, reload the page. I think I’ll wait a few more releases before attempting this framework again. Again, apologies for any bugs you encounter.

This is another familiar chord from the game community, one where Carmack clearly comes on the side of gamers. Yet, it’s a marginal contradiction. At the time of Wolfenstein and Doom, that was the cutting edge graphics in gaming. Furthermore, to pay tribute to the gameplay aesthetic and in the next breath to say, “of course our next project will look totally stunning’ seems somewhat fallacious. It’s true that iD’s games have traditionally blended graphics and gameplay with excellent success, but I know I’m not alone in the thought that as iD’s games start looking better, they actually start playing worse.

!!!!! How deeply into computer graphics do you have to delve in order to emerge from your laboratory and claim that ‘Chicken Little’ and ‘Cars’ are equally good graphically? It’s clear he knows a great many things that I don’t, so I’ll cast that ridiculous statement aside. He continues to say that content is more important than technology, and to me that he is speaking more as a visual technologist than a game designer. See, there are hundreds of things that games are “missing”, and none of them have anything to do with graphics. He’ll repeatedly stress in his presentation that we are near “the end” of advancement in graphics technology. Yet, what of more procedural approaches to content and gamespaces? We’d surely benefit from an enlightened perspective from John, but what’s clear from his speech is that he seems no longer to be thinking outside of the box in these matters.

The tools are obviously becoming more and more critical. Asset-heavy media extravaganzas are totally reliant on a solid pipeline and as much automation as can be flung at the process. My hope is that as we gradually shift to content that is more procedural in nature, the tool-artist relationship might actually change. In other words, it’s the opposite in the long haul than what Carmack is saying. Then again, he lives in the reality of how games are made right now, whereas I… only have my (hopefully) unique point of view.

How can I dispute the master of graphics? He wins technically - he can back up what he’s saying in such detail that I could spend a week dissecting a single sentence. But one thing I have on my side (yes, I disagree with him) is history. I’ve seen proclamations of the end before, of inherent limitations, of exhausted avenues. But we always seem to persevere and progress. It’s just how the world seems to operate (at least to me). Dimishing returns, sure. But I also say, innovation can come from the strangest places. One way or another, either through more “active worlds” or procedural methods, in five years we will look back at today’s graphics and scoff. It just makes sense to me. What do you think?

	I can relate to this topic more directly. I’ve been on both sides of the argument, and I do agree wtih what he’s saying, but there is one aspect that he failed to address. Releasing the sourcecode is also an invitation to develop exploits and unleash them on existing communities. For a griefer or cheater, the more active the community, the sweeter the reward.

I detected a certain resigned commitment in Carmack’s words. He says, “hope” to take advantage of the Cell… while we go back and refactor all our code”. From what I’ve read, the Cell is a monumental challenge for programmers. One aspect is the tools. Foremostly, Sony is not adequately providing for the needs of the programmer. The very architecture in VLIW-hybrid systems like the cell explicitly put the burden on both the compiler and the programmer to take branch-heavy code and optimize it for execution. Without adequate support, a difficult situation becomes much, much more difficult. There are clearly no easy wins with respect to creating highly parallel code for games. It just doesn’t suit how humans think about problems. This is not the sole contributing factor to the problem or it’s solution, but I think it’s an important barrier for entry into a system that contains 8 separate processing cores (actually, 7) and how they can be explicitly managed by the programmer.

The Xbox360’s tools are far better as well, leveraging Microsoft’s considerable expertise in development environments. But also remember, the Xbox 360 and PS3 have been architected such that their very innards are bent, understandably, towards the greater realisation of streaming and dynamic graphics. A lot of Carmack’s talk centers on the easy benefits of parallelization on the GPU-level of smaller packages of graphics tasks (like tesselation). That’s what the Xenon and the Cell SPE’s are totally designed to do. What is most surprising however, is that the multithreaded advancements have been done literally at the expense of other things like larger cache area. The chip configuration enhances the processor’s ability to “write-stream” visual info into this somewhat limited cache. When this is happening on an architecture that has already made other sacrifices, that doesn’t leave a lot of leeway for more dynamic, non-parallelizable code like A.I. or physics. This is the interactive stuff! The “gameplay”! All of that comes from highly branchy, meandering skeins of code, which is brazenly handed off to the deftness of the programmers and the compiler. Left to cram all of the unravelled decision code into a limited storage region, we can easily see where the 360’s and PS3’s emphasis lay. Graphics, graphics, graphics.

Carmack clearly sees the world through the eyes of a graphics card. I won’t dispute his expertise on the diminishing returns of graphics innovation, I firmly believe that the major leap forward won’t be in graphics at all!

Despite focussing on my misgivings on aspects of the speech, I feel that his wisdom on these matters still clearly shines. In some ways, I hope that innovation will jolt a surprise or two his way. But, if any can take advantage of great leaps in tech, it’s the master innovator himself.

The actual video is available here. Totally worthwhile if you’re interested.

Technorati tags: john carmack, quakecon, cell processor

Quiz. What do these three things have in common?

a) Hockey
b) Artillery
c) MMORPG Design

Give up?

The answer : it’s where you aim your shot.

In the immediacy of hockey, players don’t pass to where their teammate is, but where they’ll be in the next 0.5 seconds. In artillery, shots follow a ballistic trajectory. In sum, the game isn’t won by playing the current game. It’s won by anticipation.

This is no less true in MMORPG design. And as Darniaq so eloquently put it, don’t design based on what’s here. Predict it.

Easy to say, awesomely hard to do. Game development overflows with risk and difficulty. MMORPG’s, even more so. That’s why the expert game creators get the budgets, limousines and caviar : because they’ve got that “magical inductive instinct”. They’re the type that can sustain the fires of consumer entertainment. What’s fun, what’s not. What’s incoming. What’s out.

Depending on your point of view, this is someone like Brad McQuaid.

Everquest co-creator. An industry veteran. He’s proven, he’s eloquent, and knows what he’s talking about in MMORPGs. With the financial support and experience at Sony Online Entertainment, he and his team at Sigil Games could tear up the genre and spit it back out at us without even trying. They’ve got it all.

It pains me to say, but I fear that the “Vanguard : Saga of Heroes” vision is fatally flawed.

Their mistake? Designing for today. From what I’ve heard so far, it’s feature-for-feature an answer to WoW.

“Well,” you may argue, “there are distinct requirements that exist for fantasy-themed MMORPGs”. True. And Vanguard has them in spades. But if you look at their “official feature list”, you’ll see each element as a clear evolutionary successor to other MMORPG favourites. Delving deeper into the Vanguard story, I can tell you it’s even more so.

Yet, I cannot fault them for doing that. It’s what the players want, right?

RIGHT?

Have we seen this stuff before?

They’ve bet their future on the altar of WoW and EQ (and the rest of the Diku gang). Where’s the innovation here? Or is it missing because their “killer edge” is being kept under wraps?

Unfortunately, I’m not sure that’s the case. This is not the WoW killer that I had hoped. It seems more like a “WoW alternative”.

From this list, I see :

• Tiny, incremental steps in the evolution of the MMORPG genre.
• Tell-tale keywords, “build”, “collect”, and “curry favor”. I detect the vile stench of a hardcore time-axis.
• No prominent story arc.
• A laundry-list of MMORPG fantasy fodder, without anything new at all.

This isn’t so bad, if this is indeed the game that people want to play. Having glimpsed some aspects of Vanguard’s beta… I’m a little worried. What is frustrating for me is that it could have been much, much, much more.

So much more.

Vanguard today, from a secret source :

Tradeskills are insane. I mean just mindboggling insane… I kid you not, but just for mining a “shale deposit” you get different mining moves based on your skill, including fricken’ mining combos which have openers, bridgers and finishers, and flanking bonuses if you have a group member on the other side… It’s nuts.

What??

This is the type of incremental thinking that disappoints me. If Sigil were thinking outside the box, they’d allow the player to dig through the dirt (or something) rather than simply implementing a spot-and-click mining feature. Combat-style interaction for mining??

This direction in design is, to put it bluntly, additive. It is squarely aimed at the present. Why not change how the ore is found and harvested? Give us mine carts and shovels, not icons that we have to “fight with”. My fear is that Vanguard is rife with this type of additive thinking.

As another example, we have the auction house. Buy, sell, bid, view. Easy right? Why can’t we do this via the web, too?

This auction house application was built by WoW players. It is maintained… manually. Hint for McQuaid - when you see something like this done by enterprising players, follow suit. Take it one step further, and you’re interacting with it via your mobile phone. WoW can’t do it, and neither Vanguard.

And that’s essentially my point. I want to play this game. The look of it is beautiful, and I like what McQuaid has to say about things.

With the kickass team at Sigil, with someone as smart as Brad Mcquaid at the helm, with artists, money, servers, and oodles of time to create the perfect MMORPG, we get a… hardcore fantasy grinding game. Yes, another one.

Is innovation really this difficult? Please prove me wrong, Sigil.

Technorati tags: Vanguard, MMORPG, game design, world of warcraft

A big congratulations goes out to Neardeath Studios on the 10th year of Meridian 59. What a fantastic accomplishment. M59 is the first, the longest-running, and most respected MMORPG of them all.

This article is in response to M59 co-creator Brian “Psychochild” Green’s post, “Why middleware will not save us“. He hits pretty hard, and sets his sights on the “middleware market” in the MMORPG space. I’ll say I agree with the bulk of it. Yet, some of the specifics cause me trouble. Thus this post.

His argument noted two levels of the MMORPG industry, the indies and the AAAs (”the blockbuster games”). The gist of his article is that, as a technological cure-all, MMORPG middleware companies fail in their promise. They will make little impact on game development in MMORPG games. A gross-oversimplification on my part, so I’d encourage you go read Psychochild’s post.

First off, how does one define middleware?

There are plenty of types of middleware that provide an invaluable solution to laborious game dev issues, notably asset creation. Take the L-System utilized in SpeedTree (an automated tree creation and placement system). This is a tech solution at its purest. And yes, it’s middleware, and it sells very well. Then there’s PhysX/Havok. Then there’s all number of behind-the-scenes stuff that you’d never hear about. All handily employed in MMORPG production.

Forget all those. Forget pipeline and asset coordination stuff. Let’s focus on the “client-server mmorpg system”. By implication, I suspect Psychochild means client-based graphics engines, and also client-server engines designed for MMORPG diku-style games.

So in this space, we have a few significant players. BigWorld, Hero, Kaneva, Gamebryo. And there’s a small army on the horizon, getting ready to enter the fray, including Google (but that’s another post). We even have indie-level alternatives : Nevrax, Crystal Space, Ogre and the eminiently popular, GarageGames.

Do these companies cut in terms of MMORPGs? Psychochild believes that it’s unlikely. According to him, their wild claims of solving game development woes is tantamount to fluffy vapour, largely because they’re unproven. It’s true that nobody really knows the real answer yet. Experience counts, but the games are the real proof. I agree.

Yet, I take issue with his minimization of middleware’s value proposition. The claim that these vendors’ “wild promises” seems far-fetched, simply because press release fodder doesn’t emerge when you’re in the throes of selling serious products. From my experiences, at least in the security industry, it’s often quite the the opposite. What I can tell you is that on some levels, at my former company (RSA Security), we were faced with the same types of challenges as the folk in the MMORPG middleware business, which I’ll get into in a moment.

Expectations

In our business, trumpeting any technology as the end-all is, most certainly, a recipe for disaster. We’d often say, “No, don’t buy our stuff for a catch-all solution”. It’s really process that trumps technology every time. So Brian’s definitely bang-on with respect to MMORPG solutions. How could they possibly solve the problems of game development automatically? Well, much like this fictional MMORPG vendor, we did not automatically prescribe tech for all manner of security requirements. Yet, the customers would actually fight us on this. Our team would sell them two products, and then I’d whiteboard twenty things for the process side. They’d install the stuff while paying lip-service to those “other things”. Then, rarely do them. Sometimes it would come back to bite everyone in the ass.

The problem lay partially in customer expectations. The technological quick-fix is what they desperately wanted! In many cases, we had to “down-sell” in order to actually sell. We had to educate on the capabilities, on what was possible. No, our users were not stupid - they were just extremely busy. They were relying on us, the experts.

I wonder, are MMORPG developers busy too?

Sometimes it’s more about education and consultation, long before we even spoke about tech.

Tech Time Savers

The principles that Neardeath Studios applied in creating M59 are golden : good engineering, good process, good creativity. Rolling up the sleeves was not an issue. They knew what they were doing, and very few others did (they couldn’t, Neardeath/3D0 was the first!).

Yet, if we applied the same can-do approach today, it would take years to execute. All of those principals are still good, but there is literally no denying that the space and complexity have blossomed for MMORPGs recently. Even worse on the client graphics engine side. We just don’t have enough time to build the thing. I cannot imagine anyone reflexively shunning a product that helps you get to market faster, even if it’s not perfect.

So, where does security fit in to a conversation about MMOs?

Well, to understand that is to understand a bit of general security. I’ll be brief.

Security is obviously a huge topic, and it’s generally acceptable to distill it into three main areas : Integrity, Availability and Confidentiality. From these three, most software vendors minimize the quick-fix approach (or they should). Yet, again and again, we’d get calls saying “We’ve suffered a [breach | hard down | bug]. It was your fault.” Oft-times, it may have been a deployment issue, something else, or bad system design : all of them having nothing to do with us. Yet, we’d work our analysis with diligence, hopefully solve or rectify the immediate problem and then kick it back to legal should there be any mitigating issues. Yes, we had to cover our asses.

This situation is likely no less true in the MMORPG middleware market. In fact I’d bet it’s worse.

  Marketdroid-speak isn’t going to convince attentive devs.

These middleware companies of which Psychochild speaks likely don’t bill themselves as the “final stop” in the process of game creation. That’s because everyone knows it’s not true. The promises may sound adequate as bullet points on a product page, but when you sit down, face-to-face, with a potential customer, the gloves have to come off. It would actually harm them to promise more than they can deliver.

So, here’s where the gloves come off.

Confidentiality

Take the confidentiality aspects of MMORPG-style games. This means that your data is secured, shielded in transit, hidden from prying eyes, and all that spy stuff. If you could build your own identity management system for your game, would you want to? Or would you go with a vendor that concentrated almost wholly on doing that correctly? Would you design your own protocol like Blizzard did (and a dubious one at that)?

I had a brief look at Blizzard’s protocol and auth system. It was extremely dismal, and I found 3 clear vulnerabilities within a few minutes of tracing and other little prods. See that nice image of the SecurID token? Lets just say, it is a very good idea.

So are you going to implement your own hashing scheme in the protocol? Should you use a nonce during that interaction? What about secure coding practices? Do you have a lot of time to analyse the thousands of security risks and choose to accept, mitigate or eliminate your exposure to risk?

These are things that have nothing to do with games, they’re aspects of ensuring the integrity of a transactional system. With proper abstraction, the concepts could be applied to any system.

Today, MMORPGs are beginning to deal with real-world currency and micro-transactions. These factors are not something you fuck around with in a garage. No amount of gaming-level expertise will fix things when you realise that your re-authentication packet was vulnerable to replay just because developer #3 didn’t read the spec right. Or becuase some idiot used the system time as a salt for your hash. Been there, fixed that.

Availability

This area concerns itself with providing a reliable and fast system for whatever interaction you require. Performance analysis, tuning and capacity-planning is an entire career for some people. Gonna wing that? What metrics are you defining as reasonably characteristic of your MMORPG? What tools do you have to measure whether you were successful?

So, do you purchase a product that had been vigorously stress-tested, stood up on big-iron, tested again, then tuned from a code level? If you’re a serious developer, you are looking at these things. If you’re a serious developer, you’d like someone else to give you something that you could tweak, rather than starting from scratch. So that you can concentrate on writing your game logic and (secure, haha) SQL procedures.

Sure, there’s no tech quick-fix for this stuff. But, damn, it helps!

Integrity

This is actually a really tough one. The ability of a system’s data not to be changed mid-stream or without authorization is extremely difficult in games. You want to prevent cheating. You want to prevent “gaming the game”. I’ve had a hand in providing a little bit of market research for RSA here (Valve’s VAC, Punkbuster, Quake3, risks, problems, etc.), specifically with regards to the cheating aspect prevalent in online gaming.

We didn’t touch it with a ten foot pole.

There are some tech that can mitigate your risk to these exploitive behaviours, but it really does come down to good design. Some gaming security experts prescribe allowing the client to be somewhat open, because motivated hackers will get into it anyway. It’s classic tit-for-tat. WoW installs a “watcher service” on your computer. You run your hack-bot-cheat in a VM. Or the classic use of OGLE to “see” data about adjacent world or game elements. Don’t get me started on hacking the client. I noted Grimwell posted in your thread. He knows this stuff inside and out. This endless war is a classic security truism (see Bruce Schneier, expert on cryptography and security).

MMORPG middleware is NO more the white knight than say, RSA’s SecurID system. But you are saving yourself time and risk by going with one of these vendors whose sole concentration is working on this stuff and perfecting it. I hope I’ve shown how so many of these client-server issues have nothing to do with games. They exist in payment systems, nuclear waste disposal management… and MMORPGs.

Graphics Engines != Server Engines

He says that graphics engines are a worthy place for purchase because the issues are so specialized and complex. I’ll definitely agree with that. Those guys in garages are becoming less and less these days. They exist, but they’re somewhat of an anomaly and are rightfully celebrated.

Then, extending this same idea into the server space. I’ll agree, there is a distinct advantage to buying tech from an established game-maker versus a relative neophyte. But this is where we part ways. Don’t dismiss middleware entirely! The world has somewhat changed since the days of John Carmack. Risks are inherently greater, time is inherently shorter, and the competition is right beside you. There are reasons why you go to IBM and buy a Blade Server. You’re not going to find your MMO Billing Centre at CompUSA. Likewise, established game-makers may know very little about cryptography, authentication, performance testing or secure network programming. This stuff is middleware’s bread and butter (or should be).

Ahh Finally

I will definitely agree with Psychochild on the tools and experience front. If a vendor doesn’t grok workflow in asset creation/instantiation, then forget it! This is where games essentially get made. He was also correct on the service and consultative approach - if you’re an MMORPG middleware vendor without this sales tack, then you are not going to succeed. Research, good software engineering, not to mention creativity. Yes. A good work ethic. Excellent management. Selectivity in tools. Yes, yes, yes.

All these are good things, both from the developer and the vendor side. But don’t dismiss what middleware can buy. It might not write your game for you, but the time and security payoff is too great to be ignored.

In sum, beware the white knights in any industry.

Technorati tags: security, world of warcraft, middleware, bigworld, kaneva, gamebryo, hero