Gamified captcha services: secure & easy for builders, funny & smooth for users.
Proposal Details
Grant size
Tier
Beneficiary
Description
### Problem We want to solve a problem that has been present since the launch of Decentraland and still today is present. Sometimes this kind of effort is not directly visible to normal users, who see only the surface of an experience. Still, we should take care of the new problems an open metaverse brings when delivering items with limited supply. You can see how I cared about this problem and how it worked when we made a game that provides Mythic wearables but only 2 players could reach these for months. You must be aware that I have never abused a vulnerability, in any case, if I found a problem I have always reported it in private. Therefore, these are the reasons for wanting to contribute to this kind of solution about “gamified captcha service”. ### Solution We bring a solution to solve those problems while also providing a funny or gamified and smooth experience. We should also make it easy for devs and builders while trying to make an easy integration or collaboration with any other Decentraland creator teams. Some use cases where it could have been used are: - Events where a limited supply of wearables were delivered, being abused by bots or scripts. - POAP machines with boring captchas. - Games about fishing, mining, etc. - Pretty sure, many more cases can arise when we want to avoid bots or abuse. The ideation of this service was shortly presented at the Decentraland Summit (see slides 7 to 10): https://docs.google.com/presentation/d/13x6MxcPPBeyIP6wpoIVdanC8ilknYqvG-Uot7K5IBQY/edit#slide=id.g20da81ae725_0_44 ### Project specs The key idea is that the client code never knows the answers, It’s the authoritative server/backend infra who validates the user actions. Examples could be: - A moving bar that the player has to stop at a certain point. This could work for example for a fishing game. - Mining targets the player needs to hit, this could work for example for a mining game. - Balloons move around a 3D space that the player needs to shoot. - Questions about logic, culture, web3 or decentraland knowledge, etc. - Etc. With creativity, a lot of applications using this methodology can be done. It will consist of a backend generating images that will be used on the front-end of the client. Regarding Frontend or client side, the images can be used on different kinds of components: - 2D UI - 2D in 3D plane - 3D dispositions of 2D planes The backend service will be provided as on-premise software at first MVP as the commitment of this proposal. It can be provided as a cloud serverless software though. Also, there is the possibility to use IPFS and have a more decentralized backend infrastructure or even be integrated into catalyst software.
Voting Rationale
I'm voting NO because the platform is lacking in users and having difficulty retaining the few we currently have with this broken client.
Perhaps it's best if you delay this proposal for when the new client releases.
this game being popular now (hamster kombat puzzle), can be implemented with the proposed method. I guess they have probably secured it in a similar way to what I was proposing here (I would need to verify)... anyway... 🤗 
Gamified captcha services: secure & easy for builders, funny & smooth for users. This proposal is now in status: REJECTED. Voting Results: * Yes 47% 828,498 VP (38 votes) * No 52% 905,797 VP (21 votes) * Abstain 1% 3,891 VP (3 votes)
You are not going to fend off **hypothetical** AIs that can navigate bots through game-play by throwing more game-play at them. The claim that AIs that can navigate bots are posing _any_ kind of an issue for DCL gameplay design is still mostly speculation at this point. In my opinion it is science-fiction, and it is inspiring Proposals whose logic is flawed from the outset !
> Ai's that can navigate bots Man quit it with the science-fiction and SMALL REPLIES! (just giving the same energy you gave me) However, you are right, and this is exactly what I was saying too! If you look, I said these same exact words, when making the same exact point. Yet, you're right to critique how I did not say the same thing the same way you would've said it with the same words. Hope that helps! 😇
You are _not_ going to fend off AIs that can navigate bots through game-play by throwing **more** game-play at them.
I don't think scene code being javascript is really a big problem, all webs today have javascript. If we change that part, we can make it more difficult to abuse because debugging will be more difficult, not bad, but only that. So, I was proposing to add little more secure gaming components to be used by other creators that could focus more on other aspects of their games while also having some mechanics already implemented ...
(however AI bots that are able to pretend they are newbies who "feel naked", that is easy enough to do :roll_eyes:)
The _real_ danger is that all scene code is `javascript` that anyone can download, parse, pull out the "win condition" parts, and just call those on their own. The CAPTCHA functionality is there to help prevent that. Requiring a wallet `signature` is another way (alone or in combination). AI bots which are _able_ to play the game ? If someone is able to build that, they won't be wasting their talent on something as speculative as suckling NFTs.
[quote] bot players in DCL [/quote] Man, quit it with the science-fiction and all the WALLS OF TEXT !
I told you in discord and seems that you are obsessed to don't attend the details of the project, that the project is about "**server authoritative gaming components**". Nothing "**unethical**" like your demagogic comments trying to discredit my ethics, but to value player's time and fun entertainment, something well known in online gaming. try to remember this two words "**server authoritative**". :arrow_backward: You make the wrong statements and therefore expose the wrong conclusions, like "injecting extra authentication" which is completely wrong. So I see you still don't want to attend the details of the project and you want to imagine your own, maybe just for your demagogical mission. I drop here a google search if it can help you to stop making imagined wrong statements and pointing ethics: https://www.google.com/search?q=server+authoritative+game&sca_esv=cc40cfa443a9a9e9&biw=1708&bih=938&ei=boefZsmJKLKjkdUPwai44AM&ved=0ahUKEwjJ-KDC-7yHAxWyUaQEHUEUDjw4ChDh1QMIDw&uact=5&oq=server+authoritative+game&gs_lp=Egxnd3Mtd2l6LXNlcnAiGXNlcnZlciBhdXRob3JpdGF0aXZlIGdhbWUyBxAAGIAEGBMyCBAAGBMYFhgeMggQABiABBiiBEiWHVC4Fli6HHACeAGQAQGYAbwBoAGYBaoBAzAuNLgBA8gBAPgBAZgCBaAC5wPCAgoQABiwAxjWBBhHwgIKEAAYExgWGB4YD5gDAIgGAZAGCJIHAzIuM6AHqA4&sclient=gws-wiz-serp
I wanted to add some of my discussion to this proposal, since I understand that it may feel like you've become endemic of other issues in the DAO, but I think people are rightfully pointing out core concerns. I don't want you to feel targeted, like your proposal wasn't understood, I want you to feel heard while you've been given this feedback. I feel responsible to show that while I was negative to your proposal, I was rather correct about how it would be received when it was originally brought to the Discord. I hope I can unpack some of that here. Mainly, when people are saying 'this isn't what DCL needs right now' I think the thing some of us are trying to say is that injecting extra authentication into existing gameplay would objectively worsen the player experience, and what Decentraland needs right now, is better player experience. Hence the hype for a new client! That being said, you are free to disagree and suggest that *your* implementation would not deter players, but people are right to voice their opinion, vote no, and say why they've done so. I think some of that comes to the fact that parcel ownership is it's own privilege, so some might see a security measure as a given, not an accrued cost. I am not against bot players in DCL but it's a fallacy to act like they don't exist just because one user declares to not have seen them. They exist and are their own meme worth embracing. To @Ozymandias point, you are in an arms race. The people whom have already designed bots exploiting your parcel could simply apply a patch, furthering the divide between you and real players. You may run into an irony that happens in gaming where the right management becomes so much a detriment, the better experience is provided when you tool the game to the player's advantage. My last concern is that you evidently proposed this idea as a way where there would be no consent or awareness to the CAPTCHA mechanism. This is unethical, and dystopian. I shouldn't be constantly playing games to prove my humanity, and comparing anti-cheat to this is apples to oranges. Anti-cheat is applied with consent, without interference, to existing gameplay. This adds gameplay, maybe even replacing it at points, interfering with gameplay, without consent from the player. This ultimately is why I've decided to dissent against this specific proposal, but I am detailed in my feedback since I want to encourage you to take these messages not personally, but with a realization that you've at least caught attention with a good use case for gamified captcha's, *at some point in the future.* Yet at the old adage goes; > Being early is indistinguishable from being wrong. I think this best summarizes the reactions to this proposal, and I hope we can still foster a welcoming environment for like-minded proposals. Cheers! 🌈❤️✨
[quote="pablo, post:21, topic:22746"] giving value to player’s time [/quote] If someone is peppering their gameplay with captchas, they are using the tool wrong.
To prove that you can "AI" it, first it ill need to be developed, the cost is far cheaper for the DAO than what has been spent by DAO and/or foundation and it's a problem still to be improved for the players. This just provides extra tools/components adding utility and giving value to player's time. It always helps to care about it and improve these details because the alternative is to don't even need AI and lose those players. People complain about the number of players leaving but at the same time are against providing value for them, *... although probably the real reason for the negativity is other ...*
[quote="pablo, post:13, topic:22746"] **You cannot add a captcha in a gameplay** [/quote] Why would you even want to ? Captchas are for _after_ the gameplay, when it comes time to claim the reward !
> * A moving bar that the player has to stop at a certain point. This could work for example for a fishing game. > * Mining targets the player needs to hit, this could work for example for a mining game. > * Balloons move around a 3D space that the player needs to shoot. > * Questions about logic, culture, web3 or decentraland knowledge, etc. All of these are actually rather easy for an AI to learn to do :thinking:
No better than 1 person with alt accounts cheating the system.
This is a very good idea, in events or games the bots accounts usually take all the prizes, nft or gifts leaving out real people who are participating and even new players.
No game or contest that allows bots to accumulate prizes has any meaning or respect for its real users. As a player I have avoided participating in events where I feel this way for years and that includes a large part of decentraland. From my perspective, it is mandatory from minute 1 to avoid these unfair situations for real users and these situations where bots monopolize most of the prizes have unfortunately been an unpleasant constant in Decentraland for all those users who have participated. Not only have I felt bothered by these issues, but also all my friends who stopped participating a long time ago, this being one of the reasons that caused the most frustration. The prizes stop having value when you see that the majority are destined for bots!
Hi . Tbh i dont think bots are main issue in dcl at this stage i am active in dcl i dont see bots in dcl. what isee is players with muti accounts . If it was few years ago i would suggested that dcl should limited their activity .but right now consider the number of active users in dcl i think dcl need muti accounts .becuase dcl lost alot of its active users in last year . We all can see this drop effect in the platform and also in the market .the market activity is really low i didnt sell anything for months .not even a offer for my listings even now that price of mana is low , and the price of nfts are keep dropping . So i agree with @ArtReYou and @HPrivakos in this case. But this just my opinion ,so you do what ever you think is right
If it's such a big problem for your game, where you've already received several grants, then I wonder why you don't implement it. It should be in your personal interest to close this “exploit”. Start with your game and if it's really that good, then you should be able to sell it to others.
Hi @HPrivakos , from your comment I can conclude that: - You don't have read the proposal - Or I didn't explain it well apart from if it's worth 18k or 100$ being asked from the owner of the authorship of this idea, if it's worthy or not, let me try to explain it so that we are on the same understanding... Really, **You cannot add a captcha in a gameplay**, have you seen any game with captchas ? This is about having the same or even better security than regular captchas while the players still playing a game without frustrating their gameplay. Let's see if I can explain it better with an image:  (in the example an image is generated by a backend and each time is different, only the backend knows the answer) This can be a too simple example, but to let you understand how it would work, the method can be applied to more complex and gamified experiences. Apart from what I expose here, this service also can be expanded as a service out of Decentraland with de "powered by dao" stamp. If you have any doubt or need more examples just let me know.
[quote="pablo, post:11, topic:22746"] help me understand why it’s a bad moment [/quote] We can use ugly captchas for the moment and save 18k. Captchas already exist in DCL and work well, they just need to be added to more services.
I don't think "as HP said" is an answer to "why". I think it's a problem present since some time ago, since events like Moonshot till today. I think the best moment is yesterday, please try to answer the questions about the reasoning for your statement so that I can understand your position saying why it's not a good moment. Regarding Dual Arena, I have no idea why you are linking that to this proposal, but it could be a good example of why this proposal is necessary, ask those players you mention what they think about bots in games, ... @Gamer? is it important for the players to avoid bots or not? Same for @Tudamoon or @HPrivakos, help me understand why it's a bad moment when it has been a problem always present, since **Moonshot** until today, that can frustrate previous, current, and future players in Decentraland. I think it's important to value the player's time before the new client is released. From the current voting, I think it's pretty clear that the "gamers" (the ones we still have) are supporting this proposal.
This doesn't seem needed at the moment. In the future definitely possible..
These ppl will never engage in DCL anymore, and its not because of the captcha thing https://decentraland.org/governance/proposal/?id=f4b8dba9-db3f-4f3c-a731-bd47141477e1
32 Comments