When Random Isn't
Programmers and gamers use World of Warcraft as a springboard to explore how weak or predictable random number generators can be exploited, from in-game economies and loot systems to real-world cryptography and online security. Commenters describe how simple linear congruential RNGs enabled prediction of game behavior and even inversion of RNG state, drawing parallels to financial markets, data encryption failures, and past security bugs. Alongside this, they reflect on Blizzard’s relatively early adoption of two-factor authentication and the broader trade-offs between performance, security, and user experience in both games and financial services.
Nostalgia, Forums, and HN Dynamics
- Several comments recall World of Warcraft (WoW) and old forums as gateways into programming (Lua, compiling, patching) and early internet culture.
- Contrast is drawn between old forums/IRC and today’s social media and gated platforms; some see HN as one of the last “old forum–like” places.
- Critiques of HN: threads die quickly, lack notifications, and tree structures fragment discussion compared to flat forums. Others argue bubbling old threads would turn it into “gossip” rather than “news.”
WoW Economy, Automation, and Game Design
- Multiple stories of Auction House (AH) scripting: scanning listings, buying underpriced items, relisting, and manipulating commodity prices, likened to high-frequency trading.
- Pricing strategies described (using recent and historical averages, volume filters, buying under Y% of average) show how simple rules can generate large in‑game profits and even pay subscriptions.
- Discussion of market manipulation on sharded servers, with analogies to real-world commodities and shorting.
- Broader reflection: modern games often feel like jobs or spreadsheet optimization loops; some players deliberately avoid battle passes and cosmetics or quit entirely.
Randomness, Security, and Cryptography
- WoW server reportedly used Mersenne Twister; speculation on whether predictable RNG could be exploited for economic gain.
- Core exploit in the linked article: predicting an LCG-based RNG to influence “secure” actions via carefully timed calls. Clarifications stress that action IDs are known; the key was predicting
random(), not discovering hidden IDs. - Broader point: weak RNGs are acceptable for visuals but dangerous where money or security are at stake (crypto wallets, casinos, encryption products).
- Example of a commercial encryption tool broken because it used a trivial LCG for keys and salts, and a notorious weak RNG incident on HN is referenced.
- Debate over the von Neumann “state of sin” quote: some see it as misleading today, given robust cryptographic RNGs; others say most failures are just bad implementations.
Authentication and Customer Support Economics
- WoW’s early and aggressive rollout of 2FA (hardware tokens, later app-based) is attributed largely to the massive customer-support burden from stolen accounts.
- Incentives like extra bag space and restrictions on group listing are used to push users toward 2FA; some find these restrictions annoying but understandable.
- Comparison with financial services: disagreement over who truly “led” on 2FA, but consensus that Blizzard pushed it much harder than many banks/brokers.
Addon Communication and UI Issues
- Addons commonly use chat channels as an IPC mechanism for version negotiation and coordination, sometimes in invisible channels.
- One buggy addon once spammed the “contact GM” UI, flooding support; Blizzard responded by locking that API behind protections.
- Brief tangent on poor link color choices and dark‑mode transformations making links hard to see.