unforum

[snorkle256]

Tibits for ARGs (Producing and Playing)

[Dominic1978]

Muchos props for this list.

Greets,

Dominic

[Nighthawk]

Some comments on the above list, from a PM's point of view...

Flash Coding

NEVER have login/password determination in the Flash asset itself. Always post back to the server and await a response. Also, NEVER have the RESULT of said login/password in the Flash asset itself.

In cases when I've done this, I post the login/password to the server and the server returns the URL where the Flash goes. The Flash has no idea what's going to happen after success until the server tells it.

Javascript Coding

[thebruce]

Javascript/Flash/client-side code

To follow up on comments above, never put any 'secret' information on the client-side. Even if it's encrypted or encoded, it's there, and if the browser can decode it, there's always potential for a player to decode it. Even encrypted flash source code can be decrypted (I've actually accomplished it for some of 42's recent games that incorporated flash code that when decompiled was still obfuscated or had encrypted content).

Anything you want to keep secret, as nighthawk said, put on the server to be retrieved only by client request. Even then, the request shouldn't be easily sent. Form submissions can be spoofed. Text entry (like passwords or codes) would be the best/simplest way of making retrieval of said sensitive info difficult, as the only 'hack' is brute force.

It can get more complex than that, but it starts to get into secure communication and highly advanced encryption techniques.

Searching

Players:
Google is your friend. Quotes, names, phrases, acronyms - all easy finds via google. Context is important too. If you have an acronym you're curious about, it may be very common, but include a word with the acronym that's related, and hits can be drasatically reduced and more accurate. Put words in quotes to ensure only that spelling or spacing is found (google will otherwise attempt to provide links that it thinks are relevant, even if slightly different than your query). Don't be afraid of quotes! Always check for a 'Cached' version link, as google's cached version of a page may be different than the live version (which may not even exist any more at all)
A great parameter to use as well is "site:", for example - include site:forums.unfiction.com in the query, and google will only return matches that are located on that domain name. Great for finding pages that google managed to find, hidden or not.

PMs:
Google is your enemy.
If you have a website with content on it that's not ready to deploy - 1) DON'T make it publicly visible (password it, or don't put it up at all), 2) DON'T link to it anywhere that's publicly accessible by a search spider - while the engine might not catalogue the page's content if it's protected, do you want to risk the link itself appearing in search results? If the referring page is spidered, the link may also be googleable. And if you're too late, the search engine may cache its version before you kill the page. Then there's pretty much nothing you can do.

[Rogi Ocnorb]

Two more that seem to be often forgotten by PMs are:

"properties" data in files (Such as "Author" for .pdf, MS Office and OpenOffice).

EXIF data in jpg images.

Either of these can be a quick way to push a hint or to give away the farm.

[thebruce]

[snorkle256]

Just wanted to say thanks to everyone who has posted additions, perhaps I will rewrite a v2 tidbit list soon. (Also thanks for not biting my head off when I posted, was very nervous about doing so.)