Top
Best
New

Posted by shdon 14 hours ago

Quake Shareware, a CD-ROM just a little too full(fabiensanglard.net)
379 points | 161 commentspage 3
andai 13 hours ago|
That box art is so cool. They don't make em like they used to!
andai 13 hours ago||
I was wondering how it was economical to burn every CD with a different key. Turns out it was not!
thaumasiotes 11 hours ago||
> Upon contacting the operator, users were to also communicate a "SOURCE CODE". It played no part in generating the Unlock code. It may have been a way for the distributors to claim a transaction fee. Browsing eBay, I found many with names indicative of past/present retailers. 12-BSTBY BestBuy, 24-CCITY Computer City, 22-CUSA CompUSA, 88, 11-1111, 38-EB Electronic Boutique, 44-FTRSP Future Shop (Canada), 34-EGGH Egghead Software, and 56-MCTR Media Play/ Musicland.

Why do we think that CCITY is a code for Computer City and not Circuit City?

mook 9 hours ago|
Presumably MCTR was MicroCenter as well.
kristianp 13 hours ago||
The "incredibly expensive Intel Pentium" image link 404s.
fabiensanglard 12 hours ago|
Thank you for reporting the issue. Fixed.
adventured 8 hours ago||
$55 ($9.95 CD + $45 activation) in August 1996 = $116 today, per the BLS inflation adjustment calculator.

Gold was ~$400 back in 1996. Now it's ~11 times that.

An expensive game however you gib it.

nairboon 2 hours ago|
There was a lot less competition in the digital entertainment industry back then. Nowadays you still have AAA games going for $80 in a much more crowded market.
kolanos 13 hours ago||
This screw up ended up costing id Software millions in sales. With the Doom franchise they only included the first episode in the shareware version. But to save a buck I guess they decided this was better than mailing a second CD with the full game on it. Then doubling down on that greed by putting their entire game library on the disc. This is right about the time John Romero and John Carmack parted ways, can't help but wonder if this debacle played a role. And by all accounts Quake's development was painful, so imagine this happens after going through hell getting a game out the door.
brcmthrowaway 12 hours ago||
If you were to do this today, how could you make it foolproof?
confusedbucket 6 hours ago||
COD:BO7's single-player uses dedicated servers. Terrible, yes, but that's as foolproof as it gets when it comes to piracy. They also probably did this to combat all the 'services' offering to unlock camos/cosmetics that you'd normally have to grind for; players would give someone their credentials (probably stolen later and sold to cheaters) and the person on the other side would then use a hacked client to trick the backend into thinking they completed all the challenges. With a server-side campaign, that probably got much more time consuming, I reckon.
rasz 3 hours ago|||
Every game separately encrypted then compressed into solid archives. Pressed in a way every game lands on different precise height of CD, padded before compression if necessary so it takes enough space on CD. Separate machine burning tiny holes in CD from the back, but not so tiny that CIRC could fixes them. At least one hole per file.

Install locates the damage and gives you code encoding locations. Over the phone You receive ECC code. No more magic keygens, pirates have to distribute whole multi megabyte games.

tetrisgm 3 hours ago||
I respect the creativity, but this was a 22mb game. Nothing arj or rar wouldn’t handle. Or going on irc
shoo 12 hours ago||
there isn't a market for gamers buying games on CDs these days, so it's not really a problem that needs to be solved
charcircuit 9 hours ago|||
The same problem exists with PC games released on DVDs.
merb 8 hours ago||
there isn't a market for gamers buying games on DVDs these days. BlueRay the same.

Of course there are voice that do want real disks but sadly that time is over. Digital sales won.

charcircuit 8 hours ago||
There is, at least for collector's editions. I'll continue to support physical for as long as possible.
merb 2 hours ago||
Some collectors editions do come without a game cd nowadays.
brcmthrowaway 10 hours ago|||
Well how does Steam do DRM?
jamesfinlayson 8 hours ago|||
I think most (all?) Steam games link steam_api.dll (or something like that) which somehow figures out the running Steam process and thus the Steam ID, and then does a HTTP API request to check that you own the title.

Like 15 years ago Steam launched CEG (Custom Executable Generation) - I remember reading a write-up a while ago, but each user had a customer launcher generated on install I think, and I think there was an extra segment put into the .exe file and that was put to use somehow, though I don't know if CEG is still a thing.

select1 8 hours ago||
The ownership check you are referring to is a local check. There is another check (involving EncryptedAppTickets) which is not local, but far fewer games use that.

CEG is long dead/was broken immediately in a pragmatic, automatable way.

wbl 9 hours ago|||
Its easier on a system that doesn't need to do broadcast distribution and with servers available.
ranger_danger 14 hours ago||
Is it really fair to call these such algorithms "security through obscurity"?

By that logic, wouldn't real symmetric crypto also be considered the same, since it's still just math that similarly swaps the data with other bytes, based on an "obscured" password or key?

_def 13 hours ago||
The obscured part was pretending the unlocker needs external information
chungy 13 hours ago||
I guess they could have done a public/private key pair in 1996, but doing that over a phone call was going to be painful. A simple password read over the phone and verified by the software was the best solution at the time.

Mind, this was also intended for a world where internet connectivity was not to be expected. The majority of PC owners were not online.

ekelsen 13 hours ago|||
How would your scheme work? You use RSA to encrypt the entire thing? Or you use it to get a key for a block cipher and then use that?

I feel like either way, you'd need the key to be different for every CD, otherwise you could just share the shared key. But if the encryption of every CD is different, why not just share the block cipher key directly? They can have a list of CDs and the associated key(s).

What additional security or functionality does an RSA like step add here?

smackeyacky 13 hours ago|||
Which is true, so the distribution of the software cracker would have been fairly limited I would have thought.
chungy 13 hours ago|||
Sneakernet was common also. Say you have a class of 30 kids, and one of them has access to Usenet to grab qcrack.zip. He'll put it on a floppy disk and share ;)
soneil 11 hours ago|||
yeah, software travelled exactly the same way as rumours that such and such had a rib removed - remarkably effectively.

Also the same way we got viruses, long before anyone I knew had the Internet.

edg5000 10 hours ago||
Haha, I remember that rumour being told to me by classmates back in the day. Great example.
mikestorrent 12 hours ago|||
Hells yeah qcrack.zip
edoceo 11 hours ago||||
BBS, zmodem
mikestorrent 12 hours ago|||
I was 12 years old and had qcrack on a floppy from a buddy. Everyone had it. Didn't even have to have internet.
leni536 6 hours ago|||
I think it is fair, as all the released CDs are identical. So all the symmetric keys used to encrypt the data are also necessarily identical.
1970-01-01 13 hours ago|||
I think you right, however they left all the right clues to decrypt it in days. You really don't want to do that.
thaumasiotes 2 hours ago||
If I ask you to pass on a message from me to someone else, and the message is encrypted using a symmetric key known to me, and to the recipient, but not to you, there's no security-by-obscurity in place.

If I ask you to pass on a message to someone, and the message is encrypted using a symmetric key known only to me, and I expect the recipient to be able to decrypt it because he knows that the key is written on the back of the paper, that's security by obscurity. You're just as able to do the decryption as the intended recipient is; I'm just hoping that you won't realize that.

logicallee 13 hours ago||
[comment withdrawn]
fabiensanglard 12 hours ago||
That was an image I found in Google Image search. I should have done a better job to research the provenance and I appreciate being called on it. I have updated the photo.
vunderba 12 hours ago||
Kind of sounds like the low‑background steel [1] problem all over again.

I have a rather badly written tool [2] I made about 5–6 years ago. If you connect it to your Google Custom Search Engine (along with the appropriate CSE keys), you can quickly search, copy, and download images from before 2022. It also has a ban list so you can filter out Shutterstock, Alamy, and other heavily watermarked sources.

The app is a hot circle of garbage code, but it might still be useful as a starting point.

[1] https://en.wikipedia.org/wiki/Low-background_steel

[2] https://github.com/scpedicini/truman-show

ydj 13 hours ago|||
The computers in the photo and the layout of the store and signage are also quite strange.
dennisnedry 13 hours ago||
I fed the image into Gemini and it could not detect that it’s legit or AI, but in addition to the wrong store name, the other banner that’s supposed to day SOFTWARE says TWARE or something like that. It sure seems like AI to me.
ButlerianJihad 13 hours ago|
Okay, I haunted CompUSA in my teen years and I purchased my first 386 system there. So the photograph included in this blog seems bona fide.

Except their logo or name was never "Compu USA". Where in the world did they get a store hung with signs that all say "Compu USA"? Is this some Mandela Effect that has me in its clutches? The business was definitely never named or branded that way. I did my Wikipedia and Bing Images research. There are no serious search hits. Gemini is giving some truly b.s. explanations that I do not believe.

Is this a concrete example of a USA store tolerating mis-branded signage... inside their own store? Or is it some third-world knockoff? The merch on the shelves, the bros shopping for themselves, the tie-wearing salesmen, they all seem totally legit. What kind of big-box computer store lets that happen to their signage?

fabiensanglard 12 hours ago||
I made a mistake when I researched photos for it and found "one" without sources. You are right this photo looks shady. I have replaced it (with source).
dennisnedry 13 hours ago||
It’s not Mandela effect, it’s AI.
More comments...