EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation
minimaxir.com
minimaxir.com
The lost revenue should really only come from customers who would have paid the asking price but managed to get an illegitimate deal, plus whatever support and overhead costs can be applied to the game downloads.
Say a total of 5,000 downloads are from this "free" coupon for any specific game title. Would $500 or $5000 sound closers to the actually hosting/support cost that the publisher has.
It's pretty much a win for EA which is why I expect they let it continue so long.
I don't have an issue with anyone quoting this sort of number (retail cost x lost units) but they need to make clear exactly what it is, which isn't actual revenue or profit.
Surely EA being a "terrible company" has nothing to do with whether it is okay to steal their products? Moreover, just because there was a coding error/oversight, again doesn't mean it is okay to steal their products? If you have a complaint about a company or discover an exploit, surely there are other more ethical channels to pursue the matters?
For the record, I dislike some of EA's conduct as much as the next person.
You could argue that the situation is different with virtual goods, since they have an incredibly low marginal cost, but I think that the situations are morally analogous. The games aren't supposed to be free.
It may still be unethical, my point is just that there are shades of gray here.
But it shouldn't matter. Real loss isn't necessary for it to be a unethical (or worse, a crime).
(I would argue in terms of importance, ethics > crime)
Plagiarize a paper in college, you have caused no real loss but still been unethical. Say you knew the topic very well and could have done the work yourself, you just plagiarized because you were lazy to get around the whole you harmed yourself argument.
The same deprivation occurs here. EA's reward for publishing these games is reduced or removed because people acquired them when the "door was unlocked".
I do not know enough about formal ethics to express my point here, but I would look at http://en.wikipedia.org/wiki/Categorical_imperative under Perfect Duty to show how the concept of piracy doesn't hold up under the Categorical Imperative.
Like stonemetal alluded to, in a pretty esoteric sense you are harming yourself by bringing yourself into disrepute.. but that is just quibbling. Also I guess the 'scientific' method employed in marking papers is as a proof which you have not given. Though you may have done the groundwork it does not automatically follow that you are able to reliably produce the required results. You may also then be bringing the school into disrepute... but, probably not the central issue here.
I don't agree that EA's reward is diminished UNLESS people who would have otherwise bought these games did not (which I would then absolutely regard as stealing) and ASIDE from the very real argument about server time (which I would argue is a separate instance of theft).
I don't think the social contract argument holds much beyond the idea of patronage ie. I have a duty to support the content producer, but no such duty to allow him to profit. That is arbitrage, I may find it worth my while to allow it, but I have no duty to support it. In abstract Kant-ian terms (thanks for the link, jogged my memory of all those philosophy subjects I studied way back when) if all the world rejected arbitrage people would only make things that were really valued (in real terms, some over-production allows for innovation of course.. things are never so simple).
In fact, in the OP, he mentioned that on some boards people were justifying their actions by saying that they were taking back some of the money EA had taken from them over the years. This could be read as taking back the profits, or the arbitrage, which they no longer felt were justified given EA's continued mistreatment of their custom. (or, of course could be read as a petty way to make themselves feel ok about stealing).
From my understanding, the coupon recipients knew that the coupon was supposed to only be for a single $20 discount. The only shade of grey in this case (as far as I am aware) is that there may be a user who used the code and unwittingly received a discount applied to multiple products. I believe that the majority of people in this case knew that it was unethical (and possibly illegal) but rationalized it by saying that EA deserved it.
I think a better analogy would be Chapters/Barnes & Noble (A Book Store) had accidentally put in free to use high quality photocopiers inside their store. The photocopiers were intended to be free to use, but not intended to be used on the books in the store.
Your argument isn't morally analogous because theft implies EA were deprived of something (EA still can sell and play their games), when the issue at hand is the EA botched up controlling access to their product. In your argument, Apple can't sell the stolen merchandise any more.
The more important part for EA would not to be to "punish" or claw back copies. That genie is out of the jar. They should just chalk it up to marketing and move on (fix the technical issue).
This whole "if you still have the physical object, you weren't robbed" is a rationilization. If your school decides not to give you a diploma you still have whatever you learned - but now the value of your education in the marketplace has been reduced.
Repeat after me: "Taking something that isn't yours without permission is stealing."
I'm not arguing that people who abused the code weren't doing something wrong, but it is not cut-and-dried. However, I definitely disagree with the idea that they were "stealing".
I think a better analogy is when a business accidentally advertises a product at the wrong price. They are required by law to honor the advertisement even if it was a mistake. This is much closer to the situation with EA than the idea that they "left their front door unlocked", etc. Regardless of other circumstances, the transaction was legal, and I think the law might well require EA to honor it... but I don't know the details.
Another analogy would be issuing a coupon and forgetting to include "limit 1 per customer", or even having a salesperson giving out free product, who misunderstands and doesn't limit the product to one per customer.
Would customers in those cases be considered "stealing" if they took advantaqe of these situations? I don't see how that can be argued. Could they be accused of being greedy? Definitely, but as much as people might wish otherwise, being greedy isn't against the law.
FWIW, I didn't use this code, and wouldn't have exploited it even if I had. I have too much great stuff already from GOG, Steam and Humble Bundle, etc... that I don't have time to play it all. I have no need nor interest in exploiting anyone in this way.
I'm not sure. It's my understanding that the intent (and legal TOS) of the code was "limit 1 per customer. Non-transferrable." The fact that the server allowed it doesn't change the fact that the intent was for it to be used once.
Imagine a bowl of candy out during Halloween. There is a sign that says "Take only one". The fact that this house failed to implement a means of controlling how many people take doesn't make it OK to take two handfuls.
The important distinction in this case is what the legal language of acceptable use was, and not what was possible through the (broken) server. If you fail to print "limit one per customer" on your coupons, that's a lesson learned. If you DO print "limit one per customer" but fail to validate that at the self-checkout lane, and people abuse it, that's fraud.
*This all predicates on whether the actual language stipulates that the code really is only good for a single, non-transferrable use.
As dkokelly points out, this cannot be thought of as lost revenue. The vast majority of games taken here would never have been bought otherwise, and it is unlikely that any of these games will be devalued by having a wider audience. So it is spurious to describe this as simply stealing.
EA has a history of disrespecting their customers' privacy, security, payments, and computers, as well as (as the op mentions) questionable ethics. They don't seem to value their customers except as a cash cow to be milked to death. This is a message, an imperfect, impure, but pretty bloody strong retributive message. To draw a long bow, think LA riots.
But still, does that make it okay? I just think each person needs to assess that for themselves. It certainly has a ring of just desserts about it. Speaking for myself, it would depend on my motives. I would put that if the gamers are more interested in getting a positive response from EA than they are in free games, I would suggest they protest by dumping their EA games in an online equivalent of a big bonfire.. 4chan maybe :|
But I would agree that a more ethically clear-cut channel could be actually more effective - but just not because it is more ethically clear-cut. if they really want a positive response from EA, rather than just to protest (or steal), they need to publicly and loudly stop buying EA games.
For Dragon Age 2 and Mass Effect 3, I agree with their reasoning. Steam doesn't allow in-app purchases that circumvent their distribution system, and that's a load of crap.
The no in-app purchases which don't cut in Steam was introduced when they began allowing free-to-play games on the service (which are usually monetised by microtransactions, and would be a money-loser for Valve if they didn't make a cut from them). I don't know why Steam can't make an exception for EA titles (or those purchased from the store rather than F2P), but that's the reasoning.
The idea there is probably something along the lines of preventing developers from selling their game for $0.99 and "unlocking" it in-app for $59.00.
Thanks for letting me know btw. :)
On individual blog posts, the buttons did not load because the DOM element is not present for that template. However, the parser still ran on mouse-over, which is what caused the flickering. So I just disabled the parser when the user is on an individual blog post.
I think it's mainly to stop reporters at Gawker from linking to all their articles though ;)
Be very careful here, it's not as simple as it looks. If you don't do the correct locking it is very easy to have timing attacks which allow keys to be used twice.
We learned this the hard way after posting a one use key for our game on 4chan. A thousand people rushed to try the key and around 100 people managed to get in using it.
I recommend anyone to check it out: http://www.pathofexile.com/passive-skill-tree/. It looks like a star map.
What you're describing is not the result of an "attack," but rather the result of code that wasn't designed to deal with database locking. You weren't hacked, nobody attacked you; you just didn't design your system to deal with tons of people trying to write/read the same thing at the same time. Again, it's a tricky problem, so it's understandable (and a lot of people would consider dealing with such issues to be "premature optimization").
I will also note that the OP needs to stick to his MySQL Cookbook rather than commenting on coding practices for large-scale, heavy-usage web applications. His code suggestion is terribly naive, arrogant, and embarrassing. Yes, EA made a mistake; no, you have no clue what the hell you are talking about.
I'm really curious to see EA's response.
The link to the SlickDeals exclusive deals were removed as well for some reason.
http://store.origin.com/store/ea/en_US/DisplayCategoryProduc...
(I'm not taking EA's side, I'm just pointing out some possible consequences.)
The only sensible options are a) do nothing or b) revoke games purchased with these codes. If I were them I would do nothing and treat it as an unplanned pricing experiment. Since a lot of these games have an online component (network effects!) the "giveaways" might increase real sales overall.
Going after this money would be a PR disaster, a legal quagmire, financially negative in all likelihood, and permanently damage their relationship with their payment processors.
I would instead invest more money in hiring proper architects.
Given the new trend of not actually "owning" the games, I think this might prove difficult from a legal perspective.
EA's only reasonable option is to eat the loss and write the cost down as a "lesson learned".
Isn't there precedence to this? For example, cases where Amazon priced something wrong and people bought at that price, even through the the price was almost certainly unintentional. I would think Amazon would have been obligated to honor the bad price until they discovered and changed it just like companies are on the hook for honoring mistakes in ads (although I think they might be covered by disclaimers these days).
> One, if EA is technically incompetent enough to allow such a severe bug to exist, they won’t have the technical skills to discern who used the promo code more than once.
The bug was not that obvious, and doesn't necessarily imply lack of technical skill. On the other hand, finding out who used a promo code more than once, as long as these things have been logged, should be trivial for any admin.
It's a blanket policy and a reason why I never use Paypal for Steam, use a real or "throw-away" credit card for Steam purchases. Alternatively, you could not buy from Steam at all, I don't anymore but it's too late for me. I already have over 200 games with them and worry about losing access to everything.
I've also heard that Valve will remove games that were acquired through the trade system if the original buyer obtained them fraudulently.
I doubt much revenue was lost. How many of these people were going to buy the game in the first place? None of them were hot new games, were they?
Not necessarily true - we don't have insight in to how their system is setup; and while it may not be tracking redemption of the codes on that level, it could also be attached to any transactional data that they have in place (for reporting purposes etc).
While at the same time trying to claw back the licenses.
This is one kind of problems you get when you start separating different functionality into separate applications that don't known about other parts.
Whoever turned it off in the first place was a bad person, and should feel bad for doing so.
Tablets appear to be a different story though, and zoom might need to be enabled there.
Then fix your goddamn site instead of gimping the user's web browser.
Seems best to let users choose to not zoom if their devices are broken, than to tell devices to turn off features. It is a sad bug that my Browser respects requests from web sites to hobble itself. I would rather pan and scan then stare at tiny text.
Your site works with zoom now, thank you!
TC etc are all websites I don't read on my phone (or at all, generally).
Also, your site disabled zoom even when I requested the Desktop version. If you inherited that bug from Bootstrap, that is awful of bootstrap to do.