JakobFel: Oh sorry, did I sound defensive? I didn't mean it that way, I was just trying to give a serious answer haha. But yeah, Galaxy 2.0 is basically a rewrite of Galaxy, at least as far as we know. Because of that, developing 1 and 2 concurrently would require a lot more resources. Shoot, it'd probably require two separate teams, given the fact that the 2.0 team would get used to its code and functionality after a while, making it harder for them to transition between the two if they didn't have two separate teams.

I agree that you have the freedom to not use 2.0. However, at some point, you will have to switch over and it's better to get used to it now, or at least start learning it, so that you know its full functionality by the time that you have to fully switch over.

The thing is, you can't hope for 2.0 to improve if you don't offer constructive criticism and feature requests. I mean, I don't do it very often myself, but I still occasionally submit bug reports, offer feedback and suggestions, etc. It doesn't take too much time. I know first-hand that GOG's team does pay attention to feedback. I mean, I had one of the devs on the 2.0 team PM me on Facebook after seeing a comment I made about how 2.0 still has a few kinks to work out. They asked me what problems I was having and if I had any particular, major bugs that I could report. They didn't have to do that, but they did. I feel like that says quite a bit as to how they view feedback.

Just because they're silent on the forums, that doesn't mean they're not seeing our feedback.

jhAtgog: I agree that G2 looks like a re-write from scratch, with all the problems that usually come with this approach: new bugs, missing features, and so on, you name it.

You are right, at some time i will probably switch over, just not at this early stage.

After all G2 (like G1) is a commercial product from a company that hopes to increase profit by providing convenience and ease-of-use. For me, that sounds like a fair deal for both sides, so i'm ok with that.
If this two-way deal gets out of balance, like in the G2 case where the user has to spend additional time and effort (bug-reporting and testing is usually something you get paid for), then the system is flawed and the deal is no longer fair and i won't play. Until GOG re-balances this (or until GOG has used enough of their customers time resource to have a product), i prefer to not use G2.

Yet i still hope that G2 improves, just not at my expense. You imply that this won't happen without my (well, our) feedback, i can't agree here. I assume what you meant is that i cannot _expect_ that G2 improves in a way I would prefer, and yes, you have a point there. But i'm confident that bugs will get fixed eventually and lost feature will get restored in one way or the other, after all, G2 is important for GOG, so they can't afford to not get it into release state.

They have my sympathy for providing DRM free games, that's why i buy stuff here after all, but i won't provide unpaid work on top of that.

JakobFel: Okay, to be fair, I meant that bugs won't get fixed very quickly without our feedback. It is still in open beta (not sure why they're trying to go for a full release yet), so yeah, technically we're still the beta testers. However, as far as betas go, I've found Galaxy to be one of the smoother ones, especially nowadays. The only major issues I've had have either been related to the security software I use to lock down my Windows 7 PC, or they're annoying bugs like integrations crashing. I admit, that bug gets on my nerves a lot more than I should have to deal with it.

However, it takes a few minutes of my time to report bugs and offer feedback so I, personally, have no issue with that. I also have no issue with them keeping 1.2 available until 2.0 is out of beta and I still think it needs more time in beta. You do still have the option to use 2.0 or the offline installers, though, and 2.0 is fully functional aside from its handful of irritating bugs so I think it's a pretty good deal. At least GOG isn't like Microsoft and isn't trying to force an objectively concerning OS onto all of its users via a variety of shifty schemes.

jhAtgog: So we seem to agree that G2 is still beta and it will still need some time until it is in release state. The only difference we seem to have is about the amount of our personal involvement in the process of bringing G2 from beta to release. :)

JakobFel: You don't need the documentation to know that leaving a piece of legacy software which receives no updates, yet still connects to your databases is a major security risk. Someone is bound to eventually find a hole in the system and that could compromise not just YOUR account, but all of our accounts, mine included. I'm not cool with that.

jconde: The reason I won't just "suck it up" is that unlike some other people I actually know what I'm talking about.

jconde: So you've apparently never heard of the GOG downloader which existed before either Galaxy. Gog stopped *all* development on Downloader in 2014 but they allowed people to download and continue using it until March of this year.

https://www.gog.com/forum/general/we_say_goodbye_to_gog_downloader/page1

So without spending a single dime on development they allowed people to keep using it for 6 more years, and this introduced no security holes or any other problems.

There is *no* reason that the same could not be done with Galaxy 1. Or as I've said before no good reason.

I still think that simply open sourcing Galaxy 1 is the best solution. They would never need to touch it again, and everyone would be happy.

And yes Gog already has open source software "accessing their databases"

https://github.com/eddie3/gogrepo

Why not just give the people what they want?

JakobFel: The fact that they shut down the downloader was probably for the same security reasons that 1.2 would present if they ceased development. As for the open source software, it may access their databases but I'm certain it does so in a restricted way so as to avoid exploitation of potential vulnerabilities.

JakobFel: Oh sorry, did I sound defensive? I didn't mean it that way, I was just trying to give a serious answer haha. But yeah, Galaxy 2.0 is basically a rewrite of Galaxy, at least as far as we know. Because of that, developing 1 and 2 concurrently would require a lot more resources. Shoot, it'd probably require two separate teams, given the fact that the 2.0 team would get used to its code and functionality after a while, making it harder for them to transition between the two if they didn't have two separate teams.

I agree that you have the freedom to not use 2.0. However, at some point, you will have to switch over and it's better to get used to it now, or at least start learning it, so that you know its full functionality by the time that you have to fully switch over.

jhAtgog: The python script uses https to access GOG, same as your browser, and I am pretty sure same as G1 and G2.

You can't really restrict access here (your browser still has to be able to use gog), and it wouldn't be a valid security concept at all. You have to secure your server. Reducing the number of different clients accessing your service won't help in any way: if your server has security-holes, they are accessible from anybody anytime, and all the script kiddies in the world could use possible exploits.

That is not a valid argument against having more than one client.

jconde: I'm glad somebody gets it.

Security problems, if they exist, absolutely have to be fixed on the server side. In fact good security practice demands that the server team assume that *all* clients will attempt to act maliciously. Even if the client in question is developed by the same company. If the server team does their job right it doesn't matter what clients access it. And if the server team doesn't do their job right trying to hide that fact by limiting client choice isn't going to work for long. That practice is known as "security by obscurity" and it always fails in the long term.