[interface]: Separate observers from recording games

[Telcontar]

At this point, any multi-player matches with observers are automatically recorded on the server. I think this may not be obvious to those who don't read the wiki. Some people may be surprised by this and have privacy concerns. Furthermore, there are legitimate use cases to warrant decoupling these two options:

• Allow observers and archive replays (current behavior).
• Allow observers but don't preserve replay. Maybe someone does not want their tactical blunders be preserved forever, even though they don't mind spectators.
• Private game and no replay (current behavior).
• Private game but after the game is over a copy is archived. Maybe some is worried about people using observers to spy through the fog but they want to record the game.

Splitting these two features makes sense to me, and also makes it very clear what happens to those who don't RTFM:

[ ] Allow observers.
[ ] Record game on server.

Opinions/comments?

[iceiceice]

Any time you join the 1.12 server, there is a greeting message which states

You can find replays of all observable games here: http://wesnoth.org/replays/1.12

Additionally there is a link to the code of conduct page you referred to, with the privacy statement. So I don't think there is actually any RTFM trickery going on here.

We have had privacy discussions in the past, and while there is agreement that *client-side* tracking is a sensitive issue, I think basically everyone should expect that *server-side* tracking is taking place, as generally in all cases on the internet it is. I don't think anyone has a reasonable expectation of privacy when playing an online multiplayer game on someone else's server. (That doesn't mean I didn't think it was a good idea to put a list of the logs we make on the wiki, but I don't think this was something that we needed to do, I see it more as just a gesture towards those who really want to know the details. Edit: It might be a good idea to rename that section header from "privacy" to "logging", since it's not really a "privacy policy".) So I don't think there should be any serious privacy concerns.

Finally I just don't think that this option would be very useful. It seems simpler to just have a single "public / private" toggle like we currently have.

Private game but after the game is over a copy is archived. Maybe some is worried about people using observers to spy through the fog but they want to record the game.

I think this scenario doesn't actually make sense. There is no need to use observers to cheat. If you want to spy through the fog, you can just save the game and reload in a different wesnoth client, as is well-known. The game has no real security mechanisms to prevent this kind of cheating, nor can it easily be achieved afaict without seriously impacting the user experience. Instead it is simply part of the design of the game that we don't make a serious effort to stop all forms of cheating.

Spoiler:

The problem is that the wesnoth server is quite slow relatively speaking and most players have high latency connections to it, so it isn't acceptable that when you move a unit and explore the fog of war, that this requires you to send a message to the server and get one back about what things are visible. (Never mind that this would increase server load intolerably if it had to serve vision calculations for each game. And it is not possible that it could e.g. ask the other player to solve the vision requests for it... because then of course you are sending messages to *another client* about exactly where your scout is etc. etc.) Instead, all of the info about what can be explored must be available on your machine.

Now you might think, maybe there's some fancy crypto, maybe some elaborate bit commitment scheme or something so that this information is kept on my machine but I'm not able to read it unless I somehow commit to making a move that would permit me to see it. Unfortunately I'm pretty sure that even this is impossible because of simulation attacks.

So I don't see any reason why someone would want this. Note that in the case you describe, one can simply play a private game and save the replay if you want a replay. It's usually not good to give people options that don't make any sense, since it may confuse them.

Allow observers but don't preserve replay. Maybe someone does not want their tactical blunders be preserved forever, even though they don't mind spectators.

Maybe someone wants this, but if you allow arbitrary spectators, they can of course save a replay and do whatever they want with it. So these privacy concerns can't really be too serious in this case.

In practice private games have some disadvantages:

• Rude observers can be kicked / banned quite easily so "private" doesn't really add very much.
• None of the traffic is really "private" since none of it is encrypted.
• If one of the players disconnects from a game, they cannot rejoin if observers are prohibited, so a reload is the only way to proceed. If someone has intermittent connection problems this can eat up a lot of time, during which others must wait around and cannot move or look at the game.
• In 1.10 if a player would drop, if there are no observers then the host will be forced to assign the side to themselves or droid it before they can select to save the game. If the host assigns to themselves, they immediately get vision, which is problematic. For this reason, assigning dropped sides to a trusted observer is usually preferable. (Also because of related interface bugs, they may suddenly get vision also during the side transfer process, even if they don't give it to themselves. This issue should be mostly fixed in 1.12 with interface fixes and the "drop to idle" feature but perhaps it's not fixed completely.)

I think if you really want to improve the options, it might be better to figure out a way that players can rejoin private games if they lose their connection. But at the same time, I think it's a good thing to encourage people to play public games, so I personally wouldn't work on this.

The server-generated replays are generally pretty buggy, and in 1.12 I think they are still broken -- it is considered a low priority issue since it can be fixed with a server-side patch at any time after the releases, so it's more important to fix bugs that can't be fixed that way.

Edit: Actually, now that I think about it, maybe we should just delete the "observers" option entirely, since it doesn't really work very well, and we already have the "password game" feature so it's pretty much redundant. Using a password instead of "disallow observers" means that you are able to reconnect to the game. It's just more baggage to maintain as it is, it already broke once in 1.12 cycle and I had to fix it...

Edit: Or, we could replace it with a "save server replay" option which only appears for password games.

[Telcontar]

Any time you join the 1.12 server, there is a greeting message which states

You can find replays of all observable games here: http://wesnoth.org/replays/1.12

Additionally there is a link to the code of conduct page you referred to, with the privacy statement. So I don't think there is actually any RTFM trickery going on here.

...

I think if you really want to improve the options, it might be better to figure out a way that players can rejoin private games if they lose their connection. But at the same time, I think it's a good thing to encourage people to play public games, so I personally wouldn't work on this.

The server-generated replays are generally pretty buggy, and in 1.12 I think they are still broken -- it is considered a low priority issue since it can be fixed with a server-side patch at any time after the releases, so it's more important to fix bugs that can't be fixed that way.

Edit: Actually, now that I think about it, maybe we should just delete the "observers" option entirely, since it doesn't really work very well, and we already have the "password game" feature so it's pretty much redundant. Using a password instead of "disallow observers" means that you are able to reconnect to the game. It's just more baggage to maintain as it is, it already broke once in 1.12 cycle and I had to fix it...

Edit: Or, we could replace it with a "save server replay" option which only appears for password games.

Thanks for your comment. It may indeed be better to remove an option rather than add one. One of the use cases I gave seems to have no value so there seems to be indeed no need to decouple observers from saving public matches.

I like the idea of "save server replay" for private games. Maybe we can implement this (and simplify the interface) once replaying is stable in 1.12.