Hacker News Reader

Comment by readyplayernull | Hacker News Reader

They might have well devised the first of its kind "ransom by installations" in the history of software, by making it possible for attackers to fake mass installations and get gamedevs into fatal debts. And they are taking the executioner role.

View on HN

We've been calling it "Install Bombing" after the common abusive practice of review bombing. Unity claims they have anti-fraud systems in place and you can always appeal with their fraud team but I don't have an reason to blindly trust a black box that when fails makes Unity more money and puts the burden on me to prove otherwise.

But even then they’re not going to proactively stop it, it’s up to devs to monitor their bill and go “wait we’re getting bombed”. Their whole approach is terribly sloppy and unprofessional.

> and you can always appeal with their fraud team

ROFL

It is completely impossible to keep track of DRM-free games being distributed illegally on private trackers that they are not members of, and there are surely tons of private trackers that are not mentioned on the public web that no one at Unity is aware of. Short of spying on the entire world (and processing all that info), it's impossible to keep track of people sharing DRM-free games illegally on USB and hard drives with their friends, or on private folders through Google Drive, Dropbox, etc. accounts.

So unless their anti-fraud system is asking Valve, Microsoft, Sony, Nintendo, Apple, Google, Epic, GOG, itch.io, etc. how many downloads have occurred (no chance that they'll all agree to that), then their system is just going to make a guess, which they'll charge you for, and hope that holds up in court.

All it takes is a few botnets over a decently distributed ip range to make this whole thing basically impossible.

This applies to any paid API and is something we check for when we do security audits, definitely not a "first of its kind". It's just not common that APIs that cost 20 cents per invocation are exposed directly to the general public.

Reply on news.ycombinator.com