strange games

[robinzig]

I've been lurking and enjoying reading this discussion - genuinely intrigued to hear what this person was up to. Appreciate why you don't want to reveal it until you've fixed the code so it can't be done again - but excited to hear what the issue was

Also, while we all want to see cheats punished, I'd like to think you go a little easier on this person if their exploits have actually helped you to find - and then fix - an unexpected security hole. But of course not my decision

[999IF]

It's clear this player plays very suboptimal, and then winning 2 season in a row that just doesn't happen :p

Please keep the facts straight. She won season 6. Season 7 is ongoing, she is leading at the moment but it's not done, season is only halfway. The second from season 6 is also currently in the top 10 by the way. Should that be impossible too?

Obviously Een is not talking about me. I don't want to say anything about the player in question in this forum. There are sufficient comments elsewhere and it is enough to watch one last move of one specific game. Sorry for that apocryphal statement.
Een might know, how to reach me ; )

[Ranior]

Thanks much for taking this seriously and really digging in to it. Thanks all for a civil thread that helped get us here.

I'm glad someone found the issue and I am very much looking forward to hearing what the vulnerability was--simply because one of the most interesting parts in this whole situation was how Dorte was doing it.

[patrober]

I've been lurking and enjoying reading this discussion - genuinely intrigued to hear what this person was up to. Appreciate why you don't want to reveal it until you've fixed the code so it can't be done again - but excited to hear what the issue was

Also, while we all want to see cheats punished, I'd like to think you go a little easier on this person if their exploits have actually helped you to find - and then fix - an unexpected security hole. But of course not my decision

Ah, the "Can you be lenient on my client for murdering his parents now that he is an orphan" argument!

[wontaketoomuchtime]

To answer some comments, we know that people posting here are not random-deniers or random-complotists, and you make a good case. This is the reason why we looked.

I looked at the game first several weeks ago when I noticed this thread, and saw nothing wrong.
Seeing this thread continued, another team member looked at the code this week (actually, discussing it, most team members have looked at some point), and at this player activity patterns, and saw nothing at first glance.

But reading your extra posts about how unlikely this series was, he decided to continue digging and after spending some extra detective hours found the answer in an unexpected place.

So you don't need to compute any more probabilities: you were right. We are discussing how to fix the issue. Once it has been fixed and deployed, we'll post the solution to the mystery.

I am sad to hear this.

[dschingis27]

RIP Dörte.

Thanks BGA detective team for being persistent!

[Palapapa]

The second from season 6 is also currently in the top 10 by the way. Should that be impossible too?

Canu0n is also a cheater and has been reported several times by different players, a topic was created about it "Cheaters Can't Stop" but moderation chose to ignore it.
https://boardgamearena.com/forum/viewto ... top#p95539


He actually is, contrary to Dörte, a good player and used matchfixing with a friend to go from top 10 to top2/3. His current ranking for season 7 might be legitimate (I did not look at the games for season 7). He said he would not do it again which means that he admitted cheating (see private messages between him and me).

So If you bust Dörte to give the glory and the XP to Canu0n, it really makes no sens.
Would be good to clean the game from obvious cheaters.

That said doing 2 top 10 in a row is not so hard to do for a good player that play a lot. But top 3+ is really tough

[Een]

We have deployed a new release this morning with a patch for this issue.

What it was NOT:
- it was not an issue with the random number generator (RNG)
- it was not a security issue allowing to inject the desired values.

What it was:
- it was a specific use case where a player could prevent an immediate loss, and allow the player to just re-roll.
- it was pretty specific, and has been limited to Can't stop / Dörte; it seems that Dörte was clever enough to notice this use case, understand how it could be exploited, and use it. In a way, it was really intuitive and clever from her. Ironically, she had found a case where she literally... "Couldn't Stop".

[robinzig]

We have deployed a new release this morning with a patch for this issue.

What it was NOT:
- it was not an issue with the random number generator (RNG)
- it was not a security issue allowing to inject the desired values.

What it was:
- it was a specific use case where a player could prevent an immediate loss, and allow the player to just re-roll.
- it was pretty specific, and has been limited to Can't stop / Dörte; it seems that Dörte was clever enough to notice this use case, understand how it could be exploited, and use it. In a way, it was really intuitive and clever from her. Ironically, she had found a case where she literally... "Couldn't Stop".

Thanks for the summary. I'd be very interested to hear more specifics though - in other words *how* was this player able to "prevent an immediate loss" (which I understand to mean they somehow got the server to be able to not send the notification to all players/spectators that they had busted, but to roll again)? I assume there's no reason not to explain the details now, since you've fixed it to no longer be possible.

If nothing else, if this was a specific issue in the code for Can't Stop, it would be useful for developers to see as a warning as to subtle pitfalls to avoid which may inadvertently allow cheating

[beliwan]

We have deployed a new release this morning with a patch for this issue.

What it was NOT:
- it was not an issue with the random number generator (RNG)
- it was not a security issue allowing to inject the desired values.

What it was:
- it was a specific use case where a player could prevent an immediate loss, and allow the player to just re-roll.
- it was pretty specific, and has been limited to Can't stop / Dörte; it seems that Dörte was clever enough to notice this use case, understand how it could be exploited, and use it. In a way, it was really intuitive and clever from her. Ironically, she had found a case where she literally... "Couldn't Stop".

bit of a disappointing response and insight.