Hacker News new | ask | show | jobs
by readyplayernull 1004 days ago
They might have well devised the first of its kind "ransom by installations" in the history of software, by making it possible for attackers to fake mass installations and get gamedevs into fatal debts. And they are taking the executioner role.
2 comments
gmjosack 1004 days ago
We've been calling it "Install Bombing" after the common abusive practice of review bombing. Unity claims they have anti-fraud systems in place and you can always appeal with their fraud team but I don't have an reason to blindly trust a black box that when fails makes Unity more money and puts the burden on me to prove otherwise.
link
johnfernow 1004 days ago
It is completely impossible to keep track of DRM-free games being distributed illegally on private trackers that they are not members of, and there are surely tons of private trackers that are not mentioned on the public web that no one at Unity is aware of. Short of spying on the entire world (and processing all that info), it's impossible to keep track of people sharing DRM-free games illegally on USB and hard drives with their friends, or on private folders through Google Drive, Dropbox, etc. accounts.

So unless their anti-fraud system is asking Valve, Microsoft, Sony, Nintendo, Apple, Google, Epic, GOG, itch.io, etc. how many downloads have occurred (no chance that they'll all agree to that), then their system is just going to make a guess, which they'll charge you for, and hope that holds up in court.

link
StopHammoTime 1004 days ago
But even then they’re not going to proactively stop it, it’s up to devs to monitor their bill and go “wait we’re getting bombed”. Their whole approach is terribly sloppy and unprofessional.
link
AceJohnny2 1004 days ago
> and you can always appeal with their fraud team

ROFL

link
p1necone 1004 days ago
All it takes is a few botnets over a decently distributed ip range to make this whole thing basically impossible.
link
lucb1e 1004 days ago
This applies to any paid API and is something we check for when we do security audits, definitely not a "first of its kind". It's just not common that APIs that cost 20 cents per invocation are exposed directly to the general public.
link