Show HN: I'm open-sourcing my game engine • Hacker News Board

Re: Show HN: I'm open-sourcing my game engine

#91

Post by explaininjs » Fri, Dec 22, 2023, 7:59 PM UTC

spencerchubb wrote: post #66

explaininjs wrote: post #59

Earlier quoted context omitted.

Or we could not encourage depending on a constantly-breached centralized “security” authority. https://hn.algolia.com/?q=okta

Is there really a better alternative? Using a centralized service is certainly more secure than every company implementing a bespoke auth system. Also, there are super strong incentives to hack Okta, so naturally more people will try to hack Okta.

> is certainly more secure than every company implementing a bespoke auth system.

That's certainly what they want you to think. But hooking into a system where every support engineer's full contact info (and every other employee besides) is already leaked to hackers to do all the social engineering/extortion they might want, is faaaaarrrrr more insecure than using some trusted crypto primitives to validate a password, or send an email.

If you can get away with it, just email magic links or bog standard username/password that everyone knows and every credential manager can trivially incorporate with. If you need SSO (for your big enterprise contract to go through), the story is a bit different because in all likelihood every other thing they interface with is already using Okta, but that doesn't mean you must use them too.

> Also, there are super strong incentives to hack Okta, so naturally more people will try to hack Okta.

Why would you purposefully pick such a massive target? Especially one that is currently compromised, and can't even be trusted to protect themselves? Just last month hackers got all the personal information of all Okta employees.

Re: Show HN: I'm open-sourcing my game engine

#92

Post by explaininjs » Fri, Dec 22, 2023, 8:04 PM UTC

JonChesterfield wrote: post #85

jwineinger wrote: post #64

Earlier quoted context omitted.

This feels a bit like NIH syndrome to me. Maintaining your own authentication solution is not trivial, especially for small/one-person operation. Edit: Re-reading, I guess this is specifically targeted at Okta, who have had their share of problems.

Yeah it is known that one should use a library for authentication. It's also observed that they keep getting breached. The two sentiments "Best practice is use Okta" and "Okta keeps falling over" are inconsistent but the industry doesn't seem to have worked out what to do about this yet.

> Yeah it is known that one should use a library for authentication.

A library, yes, but a library is not a service. If you self host your auth stack with trusted primitives from a well known crypto library, you're much better off than if you outsource the very security of your platform to a company that has time and time again shown that they are incapable of preserving the security of even their own employee's personal info, much less anyone else's. At this point it would be arguably criminally negligent to rely on them to protect any sort of private information for your customers.

If you self host, someone needs to personally pick you as a target and find a flaw you made to get into your system. With Okta, they in all likelihood already have access. I know this industry loves learned helplessness (especially when the solution is “you don’t have to know the fundamentals, just pay us every month and we’ll do them for you!”), but come on.

Re: Show HN: I'm open-sourcing my game engine

#93

Post by carstenhag » Sat, Dec 23, 2023, 5:42 PM UTC

nathandaly wrote: post #30

The android app sign up page seems to want me to enter my Google username and password _inside the app,_ in what looks like a web form, but as a user I have no way to tell if the app is snooping on my password. It seems like Apps usually navigate away to a sign in, and then navigate back. Is that pattern hard to implement? Is the issue about cross platform support? Thanks

It's not super hard in principle. I work with car manufacturers, we have to let the user login via their OEM account. In theory they say it's all compliant, but then many parts don't work and take ages for them to get fixed.

What you described should really not happen though, I thought Google forbid this already

Re: Show HN: I'm open-sourcing my game engine

#94

Post by nightowl_games » Wed, Dec 27, 2023, 12:30 AM UTC

bcrosby95 wrote: post #63

andai wrote: post #57

Earlier quoted context omitted.

>client side prediction & roll back networking algorithm. I need to look into this! I made a little networked 2D physics thing (just bouncing balls) and I was surprised how well it stays in sync, because of course both machines just simulate the same result. I added some interactivity and simulated lag / packet loss, at that point I added an interpolation function so an entity could have a "target" and gradually slid…

There's an awesome talk by someone in the overwatch team in youtube. It's about ECS but it has a big section on networking that had some useful tips. Edit: here it is - https://www.youtube.com/watch?v=W3aieHjyNvw

This one's good but pretty advanced. We haven't implemented a lot of these techniques in our games. This is a great starting point:

https://gafferongames.com/post/introduction_to_networked_phy...