EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation • Hacker News Board

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#101

Post by catshirt » Mon, Oct 15, 2012, 1:59 PM UTC

andypants wrote: post #24

Your proposed solution is not that simple. You make it sound like EA simply used the wrong query. > One, if EA is technically incompetent enough to allow such a severe bug to exist, they won’t have the technical skills to discern who used the promo code more than once. The bug was not that obvious, and doesn't necessarily imply lack of technical skill. On the other hand, finding out who used a promo code more than on…

what then, in your opinion, is an "obvious" bug? this is really about as obvious as it gets, from a development and qa perspective.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#102

Post by Tyrannosaurs » Mon, Oct 15, 2012, 2:08 PM UTC

dkokelley wrote: post #51

Can this really be considered lost revenue? It's unlikely that all 1,000's of the "free" games were going to be purchased at the current price. You run in to the same questions with piracy. Were the pirates really going to pay if they couldn't pirate? The lost revenue should really only come from customers who would have paid the asking price but managed to get an illegitimate deal, plus whatever support and overhead…

Someone needs to come up with a term for this, "hypothetical maximum lost revenue" or something.

I don't have an issue with anyone quoting this sort of number (retail cost x lost units) but they need to make clear exactly what it is, which isn't actual revenue or profit.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#103

Post by Tipzntrix » Mon, Oct 15, 2012, 2:47 PM UTC

aero142 wrote: post #34

I don't know what this is going to cost EA, but this may end up being a good thing. People hate Origin but more importantly, all their games are already on Steam, so they just continue to buy from Valve. This might get a few people to keep Origin installed on their computer and help the Origin network effect out. Up until now, EAs only strategy has been to make their big name franchises Origin exclusive. This will pr…

You ever wonder if this was a strange viral marketing campaign?

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#104

Post by ConceptJunkie » Mon, Oct 15, 2012, 4:12 PM UTC

chrisbennet wrote: post #100

eumenides1 wrote: post #77

Earlier quoted context omitted.

I think the analogy is wrong. EA didn't lose any physical copies. I think a better analogy would be Chapters/Barnes & Noble (A Book Store) had accidentally put in free to use high quality photocopiers inside their store. The photocopiers were intended to be free to use, but not intended to be used on the books in the store. Your argument isn't morally analogous because theft implies EA were deprived of something (EA…

"Your argument isn't morally analogous because theft implies EA were deprived of something (EA still can sell and play their games), when the issue at hand is the EA botched up controlling access to their product. In your argument, Apple can't sell the stolen merchandise any more." This whole "if you still have the physical object, you weren't robbed" is a rationilization. If your school decides not to give you a dip…

But... the fact that the servers honored the code being used multiple times _is_ permission. You can't assume that this wasn't EA's intent, (although it's almost certain it wasn't). Ultimately, the onus is on EA to make their system work right.

I'm not arguing that people who abused the code weren't doing something wrong, but it is not cut-and-dried. However, I definitely disagree with the idea that they were "stealing".

I think a better analogy is when a business accidentally advertises a product at the wrong price. They are required by law to honor the advertisement even if it was a mistake. This is much closer to the situation with EA than the idea that they "left their front door unlocked", etc. Regardless of other circumstances, the transaction was legal, and I think the law might well require EA to honor it... but I don't know the details.

Another analogy would be issuing a coupon and forgetting to include "limit 1 per customer", or even having a salesperson giving out free product, who misunderstands and doesn't limit the product to one per customer.

Would customers in those cases be considered "stealing" if they took advantaqe of these situations? I don't see how that can be argued. Could they be accused of being greedy? Definitely, but as much as people might wish otherwise, being greedy isn't against the law.

FWIW, I didn't use this code, and wouldn't have exploited it even if I had. I have too much great stuff already from GOG, Steam and Humble Bundle, etc... that I don't have time to play it all. I have no need nor interest in exploiting anyone in this way.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#105

Post by ConceptJunkie » Mon, Oct 15, 2012, 4:19 PM UTC

tantalor wrote: post #29

IANAL, but it's possible that these users are now liable to pay for the extra games. They knew that the code was only usable once, yet used it multiple times. EA might ask for the games back or charge the users. (I'm not taking EA's side, I'm just pointing out some possible consequences.)

I would think that the transaction was perfectly legal, and that EA could in no way force people to pay for the games. I wouldn't however, be opposed to the idea that EA could revoke ownership of any subsequent free games obtained once the code had been successfully used, but it would be a PR nightmare if they did.

EA's only reasonable option is to eat the loss and write the cost down as a "lesson learned".

Isn't there precedence to this? For example, cases where Amazon priced something wrong and people bought at that price, even through the the price was almost certainly unintentional. I would think Amazon would have been obligated to honor the bad price until they discovered and changed it just like companies are on the hook for honoring mistakes in ads (although I think they might be covered by disclaimers these days).

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#106

Post by dkokelley » Mon, Oct 15, 2012, 4:28 PM UTC

milfot wrote: post #79

dkokelley wrote: post #69

Earlier quoted context omitted.

Sure, but I don't think that's relevant to the discussion. It's hard to quantify, but there is some set of those downloaders who at some point in the future would probably have bought one of the EA titles they received, so there is some actual lost revenue. I suppose that's their lesson for pushing bad code into production. But it shouldn't matter. Real loss isn't necessary for it to be a unethical (or worse, a crime…

Is it actually true that real loss isn't necessary to be unethical? You couldn't possibly provide an example? I am having trouble imagining such a situation. (I would argue in terms of importance, ethics > crime)

stonemetal's point about plagiarization is excellent. I had in mind something along the lines of media piracy, except in EA's case there is an actual cost (since their bandwidth provided the content, and their servers will have to support it when they go online). I think the majority of people accept the fact that piracy is ethically wrong, even if there is no cost to the producer. When you pirate, you are enjoying content that someone else produced with their finances, time, and talents. The social contract is that in return for that enjoyment, you support the content producer by purchasing a licensed copy so they can be rewarded for their efforts. When you pirate, you deprive the producer of that reward.

The same deprivation occurs here. EA's reward for publishing these games is reduced or removed because people acquired them when the "door was unlocked".

I do not know enough about formal ethics to express my point here, but I would look at http://en.wikipedia.org/wiki/Categorical_imperative under Perfect Duty to show how the concept of piracy doesn't hold up under the Categorical Imperative.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#107

Post by Havoc » Mon, Oct 15, 2012, 4:51 PM UTC

xsmasher wrote: post #73

Havoc wrote: post #58

Earlier quoted context omitted.

>EA might ask for the games back Given the new trend of not actually "owning" the games, I think this might prove difficult from a legal perspective.

How so? EA can flip a switch to remove the games, and claim there was never a valid license. As long as EA honors the orginal terms of the coupon, I don't see how the "cheaters" were wronged.

My point was simply that the legal situation differs significantly from the standard "You stole it give it back". Pretty sure most of it would be uncharted waters, so EA removing it with a flip of a switch is essentially a throw of the dice. EA would probably win as you say, but I suspect they'll let it slide because its too much hassle & bad PR.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#108

Post by dkokelley » Mon, Oct 15, 2012, 4:56 PM UTC

ConceptJunkie wrote: post #104

chrisbennet wrote: post #100

Earlier quoted context omitted.

"Your argument isn't morally analogous because theft implies EA were deprived of something (EA still can sell and play their games), when the issue at hand is the EA botched up controlling access to their product. In your argument, Apple can't sell the stolen merchandise any more." This whole "if you still have the physical object, you weren't robbed" is a rationilization. If your school decides not to give you a dip…

But... the fact that the servers honored the code being used multiple times _is_ permission. You can't assume that this wasn't EA's intent, (although it's almost certain it wasn't). Ultimately, the onus is on EA to make their system work right. I'm not arguing that people who abused the code weren't doing something wrong, but it is not cut-and-dried. However, I definitely disagree with the idea that they were "steali…

But... the fact that the servers honored the code being used multiple times _is_ permission.

I'm not sure. It's my understanding that the intent (and legal TOS) of the code was "limit 1 per customer. Non-transferrable." The fact that the server allowed it doesn't change the fact that the intent was for it to be used once.

Imagine a bowl of candy out during Halloween. There is a sign that says "Take only one". The fact that this house failed to implement a means of controlling how many people take doesn't make it OK to take two handfuls.

The important distinction in this case is what the legal language of acceptable use was, and not what was possible through the (broken) server. If you fail to print "limit one per customer" on your coupons, that's a lesson learned. If you DO print "limit one per customer" but fail to validate that at the self-checkout lane, and people abuse it, that's fraud.

*This all predicates on whether the actual language stipulates that the code really is only good for a single, non-transferrable use.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#109

Post by quotemstr » Mon, Oct 15, 2012, 7:49 PM UTC

Zr40 wrote: post #88

quotemstr wrote: post #70

Earlier quoted context omitted.

The "bad person" here is whoever decided to let websites turn off mobile zoom. My web browser on my device is mine , dammit, and it'll render websites the way I want. Web site creators have no right to control my user experience.

There are valid reasons to be able to turn off the ability to zoom -- web apps with a touch UI, for example.

Then let the user turn it back on. It's my device, not yours.

Re: EA “Gives Away” 1000s Of Free Games Due To No Server-Side Validation

#110

Post by mesozoic » Mon, Oct 15, 2012, 10:03 PM UTC

Tyrannosaurs wrote: post #102

dkokelley wrote: post #51

Can this really be considered lost revenue? It's unlikely that all 1,000's of the "free" games were going to be purchased at the current price. You run in to the same questions with piracy. Were the pirates really going to pay if they couldn't pirate? The lost revenue should really only come from customers who would have paid the asking price but managed to get an illegitimate deal, plus whatever support and overhead…

Someone needs to come up with a term for this, "hypothetical maximum lost revenue" or something. I don't have an issue with anyone quoting this sort of number (retail cost x lost units) but they need to make clear exactly what it is, which isn't actual revenue or profit.

How about "Completely Unrealistic Projection of Revenues Arbitrarily Indexed as Lost" CUPRAIL