If all of this doesn't fit in one post, I'll try to add the rest in the next post.
SOLUTIONS:
First, I believe we need the benefit to be able to “practice” games and also the benefit to have “accurate” scores. Each of the two *benefits* need to be separate from the other.
On the one hand, you want to play those games in which you just want to *learn* the nuances of the game. You want to re-play a turn to discover what *new* strategy you could have used to solve a mistake you made in your strategy. Nothing wrong with that. It helps us to develop our thought processes and strategy. That is the *benefit*.
But on the other hand, I also want a completely separate benefit: to truly test myself against other players. If I were to be allowed to upload scores of such games as above where you can replay turns, then my scores would be high, no doubt. And I suppose that the highest scores in the database might amount to those who have replayed the most turns.
My score being in the upper tier of the database might even for a moment or two give me a *warm and fuzzy* feeling
, yet I will know inside, “Its not a true measure of how I stand with others.” Hence I will not have the true benefit I want.
That may remove my desire to even upload my score. I have a security solution that will allow us to have the separate benefit from both types of games above. I truly want to see how I fit in with other players. I want that *separate* benefit.
Speaking of players who will save and re-play turns, Soulfire777 stated this premise:
"...but scores generated like that (with all the uncertainty taken out of the game) do not accurately reflect any real strategic playing skill."
Yet it was suggested in other posts above that this problem might not effect us too much. But while it is somewhat uncertain *how much* Soulfire’s premise above will detract from obtaining the true measure of a player's skill to obtain a more accurate score; nevertheless, Soulfire's premise is a true statement. And it does appear to be a "significant" factor in my estimation.
I believe that the degree of credibility of the score database is important for several reasons. I have a couple of solutions, though I don’t know how expensive or how easy they will be to implement or to access the technology. Ever heard of PGP? The following scheme would use a **similar** method that PGP employs. One encryption key will encrypt but not decrypt the same info. You must have the separate decrypt key for that. Read on.
To obtain a score which truly reflects an accurate test of player skill, you must isolate out games that “replay” turns. Following, is a way to isolate out these relevant factors in the calibration process and give us significantly more accurate scores. And I think this process can result in relative security, eliminating most hackers.
The essential factors we need to isolate are:
1- whether the player saved the game due to his play schedule constraints
2- or did the player save due to his simply wanting to replay a turn to achieve a better outcome?
So here’s how you do it. (Within the security schemes below, you will see several tricks that would confuse a hacker, even if you didn’t use encription.) Perhaps *some* of the *less* expensive component ideas in the following scheme could be schemed together to at least employ *some* security.
The game creates a “hidden” file for score data factors, and which file is also encrypted as the relevant data is written. The game saves various needed data to this file. The game saves a turn number (or simply increments a stored number), encrypted, each time a turn is generated, and then waits to see if the same turn is played again.
But when the game saves the turn number, it writes several decoys along with the valid one. (The actual or antecedent turn number used to be encrypted, does not have to be the actual turn number, but a number calibrated off from it, and calibrated from a seed number sent from the server from the last upload.) If the same turn is played again, *several* flags are set (encrypted before writing them), but only one of them is the meaningful flag, the one which would prevent uploading the score. The other flags are decoys. When the server queries the players files to check for a valid flag and score, it reads all of the flags including the decoys, so the hacker doesn’t know the exact location of what the server is looking for.
Because the encryption key lies on the player computer, the hacker may also think he needs to decrypt *all* these flags, while not knowing that the encrypt key will not even decrypt. The “one valid flag” decrypted on the server end, contains only one possible valid number among all numbers which a 32 bit computer can physically store, a number which only Brad knows. (But Brad, just remember what the number and decryption key is, and make sure you tell me in case you forget though.
)
Perhaps a cheaper way to provide for security would be to not use separate encryption/decryption keys, but use simpler two-way encryption keys, encryption keys that will also decrypt. Simply store several different encryption keys on the player computer. A different one is used each turn, and the others are decoys. It could be hacked by a few but at least we’d have “some” security. Further, the encryption keys could be changed with each upload from a set of different keys on the server. The score database could have a field which stores the corresponding number of which key was last used if such was needed.
**A scheme which forced a separate hack for every turn would become too cumbersome for the hacker, and not even worth the time.**
Even a less sophisticated, expensive, or time intensive scheme than these might give reasonable security. Perhaps *some* of the less expensive component ideas from among the above could be schemed together to at least employ *some* security, and force a hack for every turn, making it too cumbersome to bother with.
If a security scheme were to be used for uploading scores, this would **take nothing away** from those who want to replay turns for practice sake. You could still have the benefit of playing *practice* games. They just could *not* be uploaded.
Later on, if the Gal Civ programmers get time to employ some security system, the metaverse scores could start from scratch again.
I hope that you can use a combination of some of the above ideas. I hope this is helpful.
Stardock Forums
My score being in the upper tier of the database might even for a moment or two give me a *warm and fuzzy* feeling 