New World (MMORPG, Amazon Games)

[Trippy]

Nope. They be lying.

https://www.youtube.com/watch?v=lLtLxTahSjo&ab_channel=JoshStrifeHayes

This video was published at about 2130 CT time, and all of the issues are still there.

Your link is not the same exploit. So it's possible they fixed the first exploit linked but not this second one. In the first he is just standing there and is invincible, in the second he has to "pause" during a roll to get the invincibility. The second one also shows that just standing there (no roll) while "holding" the window does queue up the damage ticks which get applied when the window is released.

[Ashamanchill]

No it is not literally the same exploit people are were complaining about, that one involved a hatchet passive, but it is fundamentally the same. It shows the client queues up damage until it can communicate with the user's client, which is why it is used to hold control points. The second exploit he is showing is a "true" invincibility as it were, as the user is always rolling according to the server, it doesn't queue up damage to the user at all.

What's important is what the exploit reflects. Just how much of the information this game processes is done client side.

BTW their "fix" for the issue was to disable bordered windows mode, but not windows mode itself, and the hatchet passive, not the actual tricking the server into the client temporarily being offline.

[Zetor]

This is some prime "client is in the hands of the enemy" shit. Everything old is new again!

The second video shows that DOTs (and other debuffs I assume) are blocked by the infinite iframe as well. Check https://youtu.be/lLtLxTahSjo?t=430 -- 530 hp with a bleed debuff, and after he stops dragging the window, the debuff is gone and he's still at 530 hp.

[Cadaverine]

Apparently, there's been another flaw found, which allows you to inject HTML into the chat.  Doing so, along with a bogus item link, can be used to crash the client of anyone that mouses over the link, as I understand it.   

[HaemishM]

My wife, who plays New World, tells me that it isn't just HTML, it's also Javascript, and not only can it crash your game, but supposedly shut your computer down as well.

Who, in their right fucking mind, would allow customers to put JAVASCRIPT into a chat box, without some insanely-high levels of sanitization? Morons, that's who.

[Ashamanchill]

Also, they did patch in a fix for the dodge rolling invincibility exploit......which fucked up their auction house.

https://www.youtube.com/watch?v=vIw3fT4IF2c&ab_channel=JoshStrifeHayes

[HaemishM]

How in the actual fuck can any development on an online game not start with the very basic and proven ethos of "NEVER TRUST THE FUCKING CLIENT?"

[Ashamanchill]

Why should AGS, a game studio which has put out no real games of note, with all the resources cocaine that Amazon can provide, listen to anyone with experience in the MMO field over the last 20 years?

More seriously, this, if credible, explains why https://www.reddit.com/r/newworldgame/comments/qigb9b/former_ags_employee_explains_issues_with_nws/

[Trippy]

If @cubesos is to be believed that confirms what I speculated on earlier that the game's underlying engine is not designed to handle the large-scale faction-based PvP the game eventually morphed into because it was originally designed for small team-based Rust / Conan-style PvP.

[Falconeer]

How in the actual fuck can any development on an online game not start with the very basic and proven ethos of "NEVER TRUST THE FUCKING CLIENT?"

Apparently it's not really "client authoritative".

https://forums.newworld.com/t/notice-how-serverclient-authority-is-handled-in-new-world/473167

New World is not client authoritative - from a simulation standpoint New World is entirely server based. At a high level the model is this: clients dispatch controller inputs to the server, and the server then checks that input for limits that might invalidate it, then if accepted uses it as an input to a character (“actor” is our internal name) within server memory. Physics and game rules are then run (entirely server side), and the outcome is sent back to the original client. Clients will then draw the outcome determined by the server.

(...)

We did have a bug, in which given certain circumstances we were waiting server side on input from a client before processing through to outcomes. Combined with an intentional weapon effect that allows for brief invulnerability, this created a situation where players could reach an invulnerable state and prolong it by making the client unresponsive, even though the client has no say in damage (both damage the player creates and damage taken by the player are computed server side based on the results of physics simulation plus game rules).

(...)

However at no time are the clients making decisions or “freezing” characters in place - if character are frozen it is because the client is behind on drawing, but the server simulation continues.

Still a mess, but looks like the client doesn't rule. And when it does, it's a fixable bug.








*edit to add further dev explanations

[HaemishM]

It's a fixable bug... that breaks transactions in the auction house.

https://www.youtube.com/watch?v=vIw3fT4IF2c&t=285s

https://twitter.com/mcclure111/status/1454202432976732167

[Hoax]

Like I said after trying the open beta. There doesn't appear to be much talent on this dev team and this game is not worth touching unless its first 3 major patches are large slam dunks of fixes, QoL and improvements.

None of that has happened. This game doesn't deserve to live. On to the next one.

[Trippy]

Next MMO Design 101 (which these devs apparently all skipped) issue: gold is leaving the game much faster than it's coming in.

This sort of problem is conceptually and mechanically easy to fix but I wouldn't be surprised if things swing towards hyper-inflation rather than the current hyper-deflation before settling down to semi-equilibrium.

This is the earliest post I've been able to find so far that talks about and accurately predicts the issue: https://forums.newworld.com/t/in-game-gold-economy-is-about-to-crash-immediate-attention-required/362228

And the last week or so gaming sites started reporting on the issue:

https://blog.playerauctions.com/mmorpg/currency-crisis-in-new-world/

https://kotaku.com/new-worlds-economy-is-so-busted-players-are-bartering-1847904272

[Falconeer]

They addressed this a few days ago:

https://forums.newworld.com/t/fix-the-economy-money-created-vs-money-destroyed/425748/346

[Ashamanchill]

They also said they didn't have an automated ban system, but that turned out to be a lie, or functionally one.

[Trippy]

Gold dup: https://forums.newworld.com/t/extremely-critical-duplication-exploit-methods-to-replicate-inside/485341/147

[Soulflame]

Doesn't that just fix the gold deflation?

 

[Zetor]

To be fair, I seem to remember FFXIV 2.0 struggling with similar deflation problems (there were no good gil generators at level cap once done with quests, except for levequests which suuuuucked), but iirc they addressed it in a subsequent patch.

That said, the stopgap solution AGS applied to fix the dupe bug enabled another dupe bug: if you tried to upgrade some building in town, the transaction wouldn't go through, but it'd also 'refund' the cost of the upgrade (which was never paid in the first place).

So yeah, big clownshoe-ception energy here... though I assume anyone exploiting this will be relatively easy to track down and permaban (I hope/assume that AGS is keeping logs of all failed transactions)

[Trippy]

While checking up on the status of the dup issues I ran across another one that's apparently been around since Alpha where boss (all?) mobs will instantly respawn if there are no players within rendering distance. So if you are by yourself in an area or with some people you can coordinate with you can move far enough away to get it to respawn "on demand" rather than waiting for the normal respawn timer.

https://forums.newworld.com/t/reekwater-named-elite-respawn-exploit/346348/8

[slog]

While checking up on the status of the dup issues I ran across another one that's apparently been around since Alpha where boss (all?) mobs will instantly respawn if there are no players within rendering distance. So if you are by yourself in an area or with some people you can coordinate with you can move far enough away to get it to respawn "on demand" rather than waiting for the normal respawn timer.

https://forums.newworld.com/t/reekwater-named-elite-respawn-exploit/346348/8

I kind of like this mechanic.  Spawn timers kind of suck

[MediumHigh]

Been playing new world for a few days. The lack of actual depth in the combat system makes this the "play when I'm bored game" so far. Its not a bad game just a game with a complexity in mechanics I normally ignore in other games.  I'm starting to doubt lost ark is going to be any different so after years of ignoring the mmo market I guess the genre hasn't changed much.

[Trippy]

Another day, another dupe exploit, another economy (wealth transfer) shutdown:

https://forums.newworld.com/t/notice-temporarily-disabling-wealth-transfers-november-15/544856

https://forums.newworld.com/t/theres-a-trophy-dupe-going-on/542760/16

[slog]

Amazon is starting to feel the like Conglomerate that does 2 things really well (AWS and online retail) and a whole bunch of other stuff not so well (Digital Content creation, video games, space exploration, Grocery). 

[Ashamanchill]

Starting to?

[Draegan]

They should have delayed this again and launched Lost Ark instead.

[MediumHigh]

They should have delayed this again and launched Lost Ark instead.

Delayed or scrapped? I mean the original designers of this game really thought that a full loot pvp game for 40 bucks was worth amazons development budget. They've gone through 2-3 iterations of the games core systems before settling on a faction base pvp game with pve content hanging off. The actual combat isn't that great for players who prefer to do anything but swing a pointy stick around and is only passable in PVE because the mobs are designed to charge directly at you. The exploits are a meh concern the core game has a ton of nothing burger beyond being a crafting sim.

[Trippy]

Economy reopened, another dupe found:

https://old.reddit.com/r/newworldgame/comments/qvtoze/dupe_here_we_go_again/

[Ashamanchill]

The dupes are basically fractal at this point. But don't worry,vthe developers showed a graph displaying they have everything under control.

[Trippy]

Yes, there are now reports of a crafting dup and a gold dup involving outpost rush.

Edit: *post not *put

[Trippy]

Apparently some things in the game are indexed by name rather than a unique ID so deleting and reusing that name gets you back the values of original and changing the name effectively resets the values.

https://old.reddit.com/r/newworldgame/comments/qwqy84/bugexploit_change_your_company_name_to_reset/

I'm now picturing the initial game engine meeting going something like:

Game Director: okay who here knows anything about databases?

Dev: Uh, I've written some SQL statements before?

Game Director: Okay you are now our Lead Database Engineer. Good luck!

[01101010]

Apparently some things in the game are indexed by name rather than a unique ID so deleting and reusing that name gets you back the values of original and changing the name effectively resets the values.

https://old.reddit.com/r/newworldgame/comments/qwqy84/bugexploit_change_your_company_name_to_reset/

I'm now picturing the initial game engine meeting going something like:

Game Director: okay who here knows anything about databases?

Dev: Uh, I've written some SQL statements before?

Game Director: Okay you are now our Lead Database Engineer. Good luck!

Whoa hold up, that is how I got my job.

[Trippy]

Next MMO Design 101 (which these devs apparently all skipped) issue: gold is leaving the game much faster than it's coming in.

This sort of problem is conceptually and mechanically easy to fix but I wouldn't be surprised if things swing towards hyper-inflation rather than the current hyper-deflation before settling down to semi-equilibrium.

This is the earliest post I've been able to find so far that talks about and accurately predicts the issue: https://forums.newworld.com/t/in-game-gold-economy-is-about-to-crash-immediate-attention-required/362228

And the last week or so gaming sites started reporting on the issue:

https://blog.playerauctions.com/mmorpg/currency-crisis-in-new-world/

https://kotaku.com/new-worlds-economy-is-so-busted-players-are-bartering-1847904272

So now they’ve gone the opposite direction and have been “semi-randomly” giving out large amounts of gold to some people:

https://forums.newworld.com/t/people-getting-random-50-200k-gold-from-ags/

I say semi-randomly because people have not yet figured out why some people are getting them and why the amounts vary. Speculation revolves around compensation for the myriad of bugs and issues recently but it doesn’t appear to be consistent. And lots of memes are going around now about how AGS misplaced a few decimal points because the amounts given to some people are way out of line if they were meant to be compensation. And auction houses are of course totally ruined as people spend their new found wealth on durable goods.

Edit: looks like they are going to do a rollback: https://forums.newworld.com/t/announcement-emergency-maintenance-for-eu-central-region/592906

Not sure how they will handle people buying out the AHs and then giving the items to other people but I guess we will find out.

[01101010]

Sounds like Amazon is just fucking with things in some kind of performance art piece, pulling and cutting puppet strings and watching the madness.

[Trippy]

I've certainly been entertained by all of this.

[Trippy]

Edit: looks like they are going to do a rollback: https://forums.newworld.com/t/announcement-emergency-maintenance-for-eu-central-region/592906

Not sure how they will handle people buying out the AHs and then giving the items to other people but I guess we will find out.

They handled it by rolling back everybody, not just those that received the gold.

https://forums.newworld.com/t/announcement-emergency-maintenance-for-eu-central-region/592906/4

Note you have to click on the blue "View ignored content" link to see the dev post because their forum software allows members to "vote" (flagging) to "hide" other people's posts, including devs.