Didn't they own up to this being a mistake? To quote Ciris (post 183, at the top of page ten of this thread, with my settings):
Further, they're apparently getting a GOG-specific build made, as mentioned in the same post:
I find this to be a pretty reassuring response from GOG.

(I'm not sure of what "prenatally fixed" should be taken to mean. Perhaps Ciris meant to say permanently fixed? The fact that a separate build is called for might indicate that the DRM is being stripped entirely for the GOG version, which could well permanently fix the issue--but, as indicated, this could well take some time to do.)

As to the issue itself, while I agree that this was a misstep by GOG, and that it was a bad idea to use a universal key that could be deactivated by the developer, to my mind this issue isn't nearly as alarming as it seems to be to others. Nor does it do much to shake my trust towards GOG. GOG is run by people: mistakes are likely to slip through every so often.

The basic idea of simply denaturing a piece of DRM--such as by providing dummy DLLs that simply report "all's well" to the DRM no matter the circumstances--seems quite sound, and rather more feasible than actually carving the DRM code out of every game. In this case the specific implementation was perhaps poorly thought-out, and backfired, but I have no arguments with the general idea as a means of dealing with DRM, nor with such games being sold as "DRM-free": to my mind, they're effectively DRM free, which is sufficient.

As to GOG having been aware of the potential issue, I agree that they perhaps handled this less well than they might have; I get the feeling that they thought that the problem was solved, and didn't anticipate the developer blacklisting the key again. Additonally, we don't know what discussions went on between them and the developer--perhaps the developer has been resisting any further fix than the "universal key", and had previously reassured the people at GOG that another blacklisting wouldn't happen. (If a further fix involves stripping the DRM code and creating a separate build for GOG, then I could easily see them balking at doing so.) GOG could have refused to carry the game at the time, but now that they have it, pulling the game from the shelves--especially with a temporary fix in place and a (hopefully) better fix coming--seems to me like overkill.

While I agree with most of what you say, this last bit is where I wholeheartedly disagree. Pulling it off the shelves is I think exactly what gog should do, if only to speed on the permanent fix and protecting people from buying the game right now with some timebomb drm whilst advertising a drm free game.

I do not agree.

This is alarming.

Note that this issue has only come to light by one user recently reporting this and it seems that this has been flagged before. It was known to Gog all that time.

You may not find it alarming, what I find alarming is the continual need to justify and defend Gog when they have quite clearly known about this and breached their core principles.

When will people stop defending Gog for this?

It was also EA i think that pulled all their games off steam... and no one was buying them on their service (like maybe 100 were but meh). I really wish i knew which episode (in co-optional) they were talking about that so i could reference it...

Well they certainly aren't acting like Sony/Nintendo and blowing it off as unimportant :P Stupid Japanese hardheadedness...

NEWS FLASH: 90% of commercial software and games probably at one time had DRM in it!

If they are dealing with the problem, then don't worry about it. I'm not saying i'm going to defend them, i'm saying you're blowing it out of proportion.

I don't really find this alarming, more slightly unnerving. A solution that should have held for dealing with it broke down due to an unknown element/code that GoG couldn't have possibly have known since they didn't make it or have access to the sources (and seriously, few companies will share their sources).

Quite often the easiest way to deal with copy protection, CD checks, DRM and other things, is to leave it in place and tip-toe around it. These are usually a function or block of code that's checked once or on a semi-regular basis, does some stuff, and returns GOOD or BAD. Usually dealing with these can simply be forcing it to always say GOOD.

One solution requiring no code is to use a CD-key or something that's valid and pre-enter it. I've seen Nero burning software that did this keeping you from having to look over and enter in 30 digits of random letters. I know Aquanox has a CD key requirement, but if you look it's been pre-entered dealing with that problem.


I also recall there were a couple other people crying foul to GoG over a game having DRM. ToME was one, where the game dev apologized and made a patch to open up features that were once online only (to avoid cheating/game scrubbing type of problem), and Defenders Quest which phoned home since it was originally a tablet game and phoning home is a common practice.

ToME Issue was that item vault was online-only, it had nothing to do with cheating but his intent to make people unlock more vault slots by paying more ($2 per slot or whatever), as his original payment logic was donation/microtransaction based. The game allows mods and the core is opensource, if one wanted to cheat or spawn crap he could've just changed the code to do so. Either way, it was online-only feature that required jumping through hoops to activate, that he had rewritten to be available offline.

Not quite... There was also a limitation that you couldn't transfer more than 1 item per... 30 minutes? The cooldown required the internet (to avoid you changing the clock on your local system) and a deterrent for swapping items.

Honestly i could live without the vault, i have yet to find it or get past level 25...

Still, with his original donation configuration there was nothing wrong with it. I mean you got the main game totally for free. Can't argue with free...

Oh, I didn't know about the time limit. Still, it's easier to memory cheat or write a mod for it than deal with vault IMO.

I'm not particularly complaining about his logic, I'm not looking for free lunch. It's just that online-only stuff like that tends to turn me off on principle. Making the base free and then selling dlcs/classes is perfectly fine with for me, putting features behind online-only wall... not so much. I wouldn't call it DRM tho.

I was playing the early versions of ToME a whiiiile ago, and loved it, but then I lost track of it. Some time after it initially came on Steam a friend showed me the new version, figured there's even free version on his site, and figured what he'd done with payments (or what I could read anyway). The irony is, if vault didn't exist at all, I wouldn't complain and would probably bought whatever it took for complete package.

Then it came to GOG, and he wrote the offline-mode version at 4am, so I had to buy it. The bigger irony perhaps is that I do feel it's cheap to use vault in a roguelike game, I haven't even used it, outside of testing :P The furthest (sp?) I got was I think 41 doombringer, but at the point I'm at stuff ended up quite over my level, so I was debating if I wanted to farm something or go try to finish the game and DIAF... and I went back to rerolling instead.

The problem is that they didn't do anything of the sort here. Even before the key was disabled, the DRM was deciding if you should be allowed to play or not (if you were connected to the internet, if you weren't then everything was fine).
But it's the fact that the developer could disable the game by blacklisting the key that is the problem. Even if they didn't anticipate the developer blacklisting the key again, they knew the DRM was active and carried on selling the game. DRM is not the act of restricting your usage, it's the means to restrict your usage.

Back then is when they should have pulled it. Sure there's apparently a proper fix coming now, but I feel like now they should temporarily suspend it to show that they understand the seriousness. They've only even acknowledged the problem because I made a fuss. When I wrote to support about it, literally the only thing they said was that I should use the multiplayer key.
They've been knowingly selling a game with DRM for... who knows exactly how long? I need to know that they're taking the false advertising seriously.

There's a big difference between a game that is pre-activated and a game that starts out pre-activated but repeatedly re-activates (or de-activates) itself when given an internet connection, which is what DEFCON was doing. In the former, the DRM is dealt with, but with DEFCON it kept asking the server again and again if you should be allowed to play, until one day the server started saying no. That's when we noticed the problem, but this situation shouldn't have been able to arise because the DRM shouldn't have made it onto GOG in this kind of active way.

Also as a very early buyer of Defender's Quest (way before it was on GOG), I can say it was definitely PC first. Also the phoning home was a check to see if there was an update and an optional 'usage statistics' thing, the game was DRM-free right from the beginning.

Probably a number of tests on and off the internet showed the game was working. It's just another set of things they add to their checkbox list for new games.

I know there's a flash version around, but i don't know it's history or specifics. I'll defer to your experience and knowledge on that.

It's understandable that it slipped through their nets initially, but this is not the first time the key was revoked. It should have become clear that the DRM was still active the first time the key was revoked, but they carried on selling the game anyway. It's taken until now for them to even acknowledge the problem and they're still selling it.

Oh and I'm pretty sure the version of Defender's Quest sold here is Adobe Flash/Air. But yeah, there was at least a browser based demo that used straight up flash.

True. But if most of the users are like me, you buy a dozen older games, or 1-2 new games during heavy sales, and then you download but don't touch the game. There's hundreds of games i haven't played yet, and Defcon is one of them. And there is a way to play it even if it was revoked, namely block it's access to the internet. At the point following this it's just the annoyance of an extra set of steps depending on the system involved.

But yes they should have put more attention to it once it was originally noticed... Unless they already had their hands full (say, heavy sales weeks or the Witcher 3 release), at which point it's just going to have to be put on hold until they catch up.

At least they are fixing it now, Steam is more than happy to sell you a game that is missing vital files (like the exe), while GoG makes sure the game works. It's unfortunate that occasionally something doesn't stay working.

I'm defending them not because I defend them regardless of their actions, but because my perception of this situation, and of the actions of the people at GOG (that we know of), is different to yours.

I'm inclined to echo rtcvb32's feeling: I find this not alarming, but slightly unnerving.

Indeed, and I did say that I considered their specific approach in this case to have been poorly thought-out.

(Of course, it's possible that this resulted from slippage of GOG's principles--but it also seems quite possible to me that it resulted from simple error: the people at GOG are, well, human (I presume :P), and thus are likely to make mistakes sometimes.)

They've had this pointed out, and been told that it's not acceptable, and have indicated that they're attempting to fix the problem. This is enough for me.

I gather that they viewed it as having been neutralised: active but ineffective. They were mistaken, it seems, and this second issue seems to have caused them to realise as much, and--if I interpret Ciris' post correctly--they are now rectifying the issue, having put in a short-term stop-gap while prompting the developer to produce a long-term solution.

Perhaps; for myself, I'm inclined to think that doing then what they're doing now might have been a better approach than pulling the game. They didn't then, but they are doing so now.

This depends on just what they thought, which we don't know. It's entirely plausible, it seems to me, that they thought--mistakenly--that they were selling a game with neutralised DRM (which I find perfectly acceptable).

No wonder GOG can do what they want when only a few "chosen" users protest if they thrw their last principle over board. And to me it makes no difference if that is done deliberately or just because they done exam things enough. In DEFCONs case this might be a small error the first time, but when it came to their attentaion that the author of the game has the power to deactive it and they didn't react accordingly, that made it deliberate for me and than it is a big deal.

But since GOG is trying to become like Steam, almost all users don't give a fuck about such things as principles. They want to download their game and play it, with or without drm is none of their interest. Even if they encouter the "dark" side of DRM, they'll scream like spoiled brats, but next will still buy the game not matter what. I have seen that since the start of Steam.

My thoughts exactly.

I'm heavily reminded of when Sacred 2 Gold came out. You remember when that happened right? They accidentally had two different dates, a 5-day sale at like 50%-75% off, and a specific date that was 2 days later. It was a simple mistake.

However it did have an effect because people saw it was January the 7th (or whatever the day was) and people were waiting for pay checks or money to move accounts or something. When the day rolled around, the sale was over. I recall commenting it was probably human error, and people could wait for the next sale... Although to be right with the community and the people who were waiting for Monday/Tuesday to roll around, they offer them the game at the same discount (paying from their own pockets the differences); And that's what happened. I'm not sure how many coupons for the discount were used (i'd guess 30-100), but it was probably considerably less than during the main sale.

Actually it's refreshing to get reminders that they are human and care. It's when they don't own up to it and act like they are right all along that they burn their fans (Say oh, Sony and their PS3? i could list others :P).