Unity, for all its "clarifications," keeps promising it won't be a problem and then refusing to be transparent about any of the ways it could possibly be less of a problem.
Either they backtrack on this whole lifetime install count scheme or this blows up even more spectacularly when January rolls around.
With the examples you listed doesn't it require an account to authenticate first before achieving this?
Furthermore, is this not easy enough to spoof? Without account based authentication (which as far as I know Unity does not use/require?) what stops me from spinning up VMs or emulators repeatedly to attempt to install bomb?
Microsoft tells you if you install the game on too many devices.
>>With the examples you listed doesn't it require an account to authenticate first before achieving this?
Uhm, no, that's how it's implemented but it isn't required.
>> what stops me from spinning up VMs or emulators repeatedly to attempt to install bomb?
Nothing, but it would be very time consuming and very easy to detect.
It is a solution that can be done more, or less, correctly or fairly. But the problem is that it is easy to get it wrong, it is easy to implement this incorrectly.
Given how slipshod and slapdash these announcements and responses and walkbacks have been, you can't really have any faith that they will fall into the "right" side of things.
>> I figured that the game is tied to my account, not some hardware ID
Because it is. These platforms still use hardware ID matching for account bans and other functionality.
This is vastly more difficult than you think. For example, if you try to use the standard method, which is hard drive serial numbers, it's incredibly easy to spoof AND all prebuilt computers from Walmart share the same serials. Non-starter.
https://stackoverflow.com/questions/47603786/where-do-window...
> if you pair it with some kind of online login system
Unity does not have that and there is no way in hell that they will be able to force all players of all games made in unity to sign up for one.
Because I help develop a game engine / platform that deals with this problem and therefore done extensive research?
All of those Microsoft device ID variants are trivial to spoof or collide. If you're talking about GetSystemIdForPublisher() and friends like 'Product ID', you get the Walmart collision problems.
https://github.com/topics/hwid-changer
Furthermore, if you rely on an easy-to-spoof hardware ID system, if someone gets ahold of someone else's HWID (see: database breach, phishing), you can trivially mess with the data.
Valve/Microsoft/Epic get around this by spending tons of developer time on this problem and using techniques like fingerprinting and behavior analysis.
I only know this because they specifically pointed it out when announcing the new pricing plan.
And they've also specifically said they will not charge twice for a reinstall on the same device. So I guess we'll have to see.
They're clearly flying by the seat of their pants with this. There is no reason to give them any rope, any benefit of the doubt. There is no reason to believe that they will be able to do this right.
It's a massive new change and requirement coming into force in only a few months, with basically every single report coming out of Unity internal engineering being that they don't have any systems in place to figure this out and have no idea how they will actually make it work while also still being GDPR compliant.
"Just trust us bro" and "you can file a support ticket if we get the numbers wrong" are not acceptable and are each reasons enough to worry about the potential for (or rather, guaranteed) abuse of this system.
One must assume the worst about any implementation with a system like this, in the same way that once must assume the worst about any implementation of telemetry or of DRM. You'll be right far more often than wrong.