• 0 Posts
  • 427 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle





  • I’m a huge retro board game fan (we just called them board games back in my day) but computer games have been implementing far more complex systems, and far more systems, than board games for decades.

    The Campaign for North Africa, for the board game example, isn’t exactly complicated as most of the rules are referenced as you get to the mechanic or scenario. People talk of the 200 page manual like it’s scary but D&D has more pages of rules across the PHB, DMG, and MM alone.

    The “complexity” you’re talking of is basically the admin that a computer game does for you in the blink of an eye, without you needing to think about it.

    Europa Universalis was a very complex board game that required 6 players and was turn based yet when it became a computer game, the complexity increased, it was made real-time, the number of events taking place across the map increased, and you could finally play it solo (sure, you can play the board game solo but you spend more time doing admin than playing). And the game has been built upon for years, the 5th one just came out.

    If it spun out into a board game again, mechanics would need to be paired back again as, without the computer to ease the implementation of mechanics so the player doesn’t have to do it themselves, it’d be the most baffling rule book ever.

    Again, I’m a huge fan of board games. But computer games have offered way more complexity since the 90s and Civilization.













  • Have you had anyone with experience with security look at this thing? There’s a lot of really questionable practices in your schedule shell scripts. I especially find how you’re handling VPN secrets kinda worrying. And the backup_challenge_clients.sh script isn’t robust at all. Your nginx config has a few bad choices like lack of try_files, the regex \.php$. It’s definitely not hardened so I hope people don’t put this Internet facing.

    I’ve spent like 5min in the GitHub to get a feel for the project maturity. Personally, I don’t think this is suitable for actual use yet.

    If you’ve not done any security assessments on your project yet, you might not want to (a) call it “Safe”box and (b) might not want to start charging money for it until you do.

    I worry you’re setting yourself up for a hard-to-shake-off embarrassment should a nasty vuln be found. Maybe a name like “selfbox” etc that drops the connotation of security would be safer.

    Edit: Kudos on the project website though! Looks fricking gorgeous.