G4W Top - free self-service server list with live status and honest voting (feedback welcome)

[loveslips]

Hi everyone,

We run a few shards (ModernUO, a ServUO one and a Sphere one) and put together our own server list, free and self-service: top.game4world.com

What it does:

- Every listing is checked every 5 minutes. For Ultima Online the shard's own status request is used, so the player count comes from the server itself. For other games the check is a connection test.
- Voting: one vote per server per 12 hours, proof of work instead of a picture captcha, limits per IP and per browser. If you want votes tied to a real character, there is a signed postback your shard can check on its side.
- Free listing, no paid placement. New games go through a short approval queue.
- For shard owners: a live banner image for your site, a vote postback, an API to check whether a player voted, and several worlds under one listing - one entry means one vote, so it only fits worlds behind a single login.

It is new and rough in places. Tell me what is broken or what looks like it can be gamed, and I will fix it.

 

[PyrO]

Ok, I wonder what you are trying to solve (this way)

"player counts that are typed in by hand and never change"
How would your / the AI's solution help you? You are still getting the player count from the server.
If I wanted to I could still feed you whatever number I like

Voting once per X hours is also a default thing, and it comes with the same limits, stated by the AI, as any other. You are basing it on the IP and cookies from the browser, so someone can just use a vpn and use the privacy windows of the browser and already bypasses the limit.

"if your game is not in the catalogue you can add it yourself"
Uhh idk about that, nefarious intend can add bad things with that option

I also don't think having several worlds / shards grouped into one is a good idea.
Why? Because if one shard is good, and the others are not to their liking, you will not display that correctly with the votes, nor the online count.
And if you play on more than 1 shard of the group you can still only vote once, and get only 1 reward even though you play more servers.

"ownership verification by meta tag or DNS"
No idea what a DNS has to do with verfication?


Thats just direct feedback, wish you luck with the project though

 

[loveslips]

Thanks. You are right.

The online number. A connection test only proves the port answers, and a status JSON is whatever the owner puts in it, so calling all of that measured was wrong of me. For UO we now ask the shard itself - Sphere, ServUO and ModernUO all answer a status request without adding anything on their side, and that is where the number comes from now. Where there is nothing to ask, no number is shown.

Votes. You are right, and I should not have written that a forged vote gets rejected. A VPN and a private window get around IP and cookie limits. The limits make you spend time, that is all they do. Anything more serious has to be checked by the shard through the postback.

Letting anyone add a game was a bad idea, it goes through a queue now.

Grouped worlds. One entry is one vote and one reward, however many worlds sit under it, so it only fits worlds behind a single login. Worth working on.

DNS had no business being there. Removed.

I have rewritten the first post so it matches what this thing does. Still plenty to fix.

 

[PyrO]

The online number. A connection test only proves the port answers, and a status JSON is whatever the owner puts in it, so calling all of that measured was wrong of me. For UO we now ask the shard itself - Sphere, ServUO and ModernUO all answer a status request without adding anything on their side, and that is where the number comes from now. Where there is nothing to ask, no number is shown.

Can you elaborate that? What you said, to me, sounds like it is still the same?

You are asking the server for the number, how would that be in any way not forgeable?

Example, I own a server, your portal, in whatever way you want to connect to the server. From an api or portal, or maybe even an mini ingame client get the number, that my server provides, you would then request the number. What would stop me to send you random numbers?

My point here is, you can't prove nor prevent that behavior. For that you would need to have access to the server files itself to be able to check that it wasn't tampered with.

 

[loveslips]

Can you elaborate that? What you said, to me, sounds like it is still the same?

You are asking the server for the number, how would that be in any way not forgeable?

Example, I own a server, your portal, in whatever way you want to connect to the server. From an api or portal, or maybe even an mini ingame client get the number, that my server provides, you would then request the number. What would stop me to send you random numbers?

My point here is, you can't prove nor prevent that behavior. For that you would need to have access to the server files itself to be able to check that it wasn't tampered with.

That's exactly the mistake I admitted.
On my side, there's no way to do this without access to the server files.
In any case, you're right there are many ways to inflate the online count, from simple to more sophisticated ones, and we're not just talking about UO.
And so far I have no ideas on how this could be controlled on my side like how to cut off just the number, or alts, or bots.
The only way out, probably, is to just show an online/offline status.