VGMdb
Go Back   VGMdb Forums > Miscellaneous > Archives > Game Remixes Forum Archive 2009-2012
Register FAQ Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread Display Modes
  #1  
Old Dec 15, 2009, 09:48 AM
quintin3265's Avatar
quintin3265 quintin3265 is offline
Senior Member
 
Join Date: Mar 2009
Location: State College, PA
Posts: 193
Default Competitors: should IP addresses be released?

After the Composition Combat voting concludes, we plan to release the entire voting results, vote by vote. The reason for such excruciating detail is so that nobody questions the integrity of the calculations, and so that any allegations of cheating will be available in the public sphere for everyone to review. Columns available include rating, song ID, date and time, IP address, and other data which is personally identifiable and can't be released.

I want to put a question to the competitors: should the IP address column be released along with the vote totals?

If IP addresses are released, it would be possible for people to more thoroughly inspect the results and attempt to make associations between possible duplicate votes. However, there is a very small chance that the anonymity of voters could be compromised, because it's theoretically possible that someone could do a reverse lookup and find out where a vote is coming from. In practice, however, providers usually allocate IP addresses dynamically, so it would be nearly impossible to prove that a particular user, rather than someone else using the same provider, cast a vote, and we also won't release the information that links usernames to IP addresses.

What is most important to contestants? Is the additional security provided by withholding addresses important? Or, is it more valuable to have an accurate and complete record to analyze for potential cheating? If IP addresses are not released, then allegations of duplicate votes will almost always be invalid.

Offer your thoughts by the end of today.
__________________
Now you can embed your songs in forum posts and webpages just like this image! Click the image to find out how!
  #2  
Old Dec 15, 2009, 12:36 PM
Muuurgh Muuurgh is offline
Member
 
Join Date: Nov 2009
Location: Charlottesville, VA
Posts: 35
Default

It matters not to me. I don't think I'll be fishing through the IPs, but if someone wants to, then by all means.
  #3  
Old Dec 15, 2009, 12:42 PM
Kidd Cabbage Kidd Cabbage is offline
Member
 
Join Date: Nov 2009
Posts: 61
Default

Rather than worry about my opinions on the matter, which I haven't really thought through enough to make a judgment on, I think a better thing to think about is the Rules for the competition. The rules list was the closest thing that the competitors and voters had to a contract in the competition, and it never said anything about votes being released - and while I'm not sure that releasing the IPs is a violation of anything in the "contract," it certainly would be unexpected to the people who had previously agreed to it to have their anticipated-to-be-anonymous votes revealed to everyone. It's a similar concept to people being uncomfortable with their Google searches being revealed to everyone, even with nothing to hide.

I know that this must make me, again, sound like I'm trying to hide cheating or something - especially with the drama that ensued in WarpToken's thread - but aside from the part of it being left out of the "contract," I don't see anything that releasing the IPs could do in the community aside from cause drama. I don't think the community could do any IP checking better than the Remixsite.org team or software at picking out duplicate votes, and I think that the revealed IPs would only serve in the community as a way to point fingers at each other and divide the community.

However, feel free to listen to others' thoughts as well, since I may seem biased by the fact that I have the most votes out of any of the competitors.
  #4  
Old Dec 15, 2009, 04:27 PM
quintin3265's Avatar
quintin3265 quintin3265 is offline
Senior Member
 
Join Date: Mar 2009
Location: State College, PA
Posts: 193
Default

Well, the first thing that jumps out at me is that I don't think that "drama" is something to be avoided. My belief is that people ought to know the truth, regardless of the consequences. Is it better for vote rigging to go undetected, or for a rigorous debate to be held over something that crops up? Ethically, I think that open debate is always better than hiding things.

The core of the discussion here should be about whether any privacy would be violated, I think, not about whether any discord could occur as a result of the release.
__________________
Now you can embed your songs in forum posts and webpages just like this image! Click the image to find out how!
  #5  
Old Dec 15, 2009, 06:02 PM
WarpToken WarpToken is offline
Member
 
Join Date: Oct 2009
Posts: 35
Default

I want the real winner to win, whoever it is.

I don't think releasing the ips of the votes is going to encroach on any privacy rights. I mean....we're talking about a vote on a video game music contest!

I also think by releasing the Ips, it may deter vote fraud in any future competitions if there happen to be any.

My .02
  #6  
Old Dec 15, 2009, 07:07 PM
Kidd Cabbage Kidd Cabbage is offline
Member
 
Join Date: Nov 2009
Posts: 61
Default

I think the real winner will win either way. I don't think that the community's contribution would weed out close to a quarter of what the Remixsite team and software will anyway. While the IPs apparently won't reveal any personal information, it's still the same ethical problem as Google releasing all search data. Like I said, it would've been more fair to have put it in the rules beforehand, since maybe some people wouldn't want to have their votes seen - even if they technically did nothing wrong (for instance, if a Shizzy didn't like Prince of Darkness or my own song). It's the same concept of people being against the Patriot Act, even if they have nothing to hide.

Like I said, I think that the real winner will win anyway, whoever it is, but I think that releasing information about the voters is unexpected from them and a little unfair to do without them having prior notice: the same reason companies always ask if they can get system specs from your computer, even if anonymous - it's still fair to give the option beforehand.

And about drama being avoided or not - I think that the votes can only serve to be a catalyst for it, and won't really do much else.
  #7  
Old Dec 15, 2009, 07:31 PM
Kirby Pufocia Kirby Pufocia is offline
Junior Member
 
Join Date: Dec 2009
Location: Harrisburg, PA
Posts: 5
Default

Quentin, when you say, "is it better for vote rigging to go undetected," do you mean to imply that you are doing nothing with the information that you have? I was under the impression that you were working to keep voting fair - and IP addresses are obviously something you have access to, or you wouldn't be able to release them.

Here's my thoughts: if you are making sure that voting is fair, then no vote rigging will go undetected by you, and there is no need to release IPs to the public for any reason other than their peace of mind (I think Ben Franklin had a saying about that).

If you are abdicating your duty, then releasing IPs to the public won't be of any use, because you won't be doing anything with the information, and we don't have the power to deal with potential vote-rigging.

I'm not trying to be inflammatory here, and if I'm just misunderstanding something, please tell me.
  #8  
Old Dec 15, 2009, 07:33 PM
AndreasK AndreasK is offline
 
Join Date: Dec 2008
Location: New York City
Posts: 14
Default

The contest was meant to stir up user participation in the site. People warned you about security holes and whatever else, you blew all that off claiming that the site worked, and worked well enough that this contest could be run.

I say you should counts the votes as they came in, as the system you defended so boldly, counted them. This is error checking and foolproofing you do BEFORE the contest starts, not once the voting comes in. I say just let it go as it goes, count the votes, award a winner. Then, take everything you've learned here about the site design and layout problems, the voting problems, and whatever else you got here as feedback, and fix up your site so it works better the next time around.
__________________
http://www.rockednloaded.com/

Last edited by AndreasK; Dec 15, 2009 at 07:37 PM.
  #9  
Old Dec 15, 2009, 09:26 PM
Gigablah's Avatar
Gigablah Gigablah is offline
VGMdb Administrator
 
Join Date: May 2007
Posts: 2,397
Default

There is no foolproof way to prevent vote rigging, even if you require voters to be registered with authenticated email addresses. There are more subtle ways to catch cheaters but anyone with general savvy in the workings of web applications can easily circumvent them.

The most you can do with the logged information is to analyze the voting and traffic patterns and filter out suspicious votes. Correlating IP addresses may help, but only to some extent. There is also no way to conclusively prove that voters who share the same IP address (or subnet) are the same person, or that voters with different IP addresses are different people, unless you obtain evidence from their ISPs (good luck with that).

On the other hand, Quentin could just as easily withhold all voting information, and everyone would be none the wiser.
  #10  
Old Dec 16, 2009, 07:51 AM
Omnomnomnom Omnomnomnom is offline
Member
 
Join Date: Nov 2009
Location: Ireland
Posts: 52
Default

I'm not really too sure about the IP thing. I talked to a friend of mine who's a programmer, currently working on a site that deals with SOME sensitive data, not much, but the potential for stealing money and whatnot is there. His immediate reaction to the IP thing was that it was a security issue and a very bad idea. I don't think the same thing applies here, since none of us have any sensitive data going through this site, but I do wonder what the real benefit of releasing the IPs could have, that you or remixsite don't all ready have. Perhaps it's better to hold the IPs until a challenge is made that can't be resolved by logical reasoning. A last resort, if you will.
  #11  
Old Dec 16, 2009, 09:08 AM
quintin3265's Avatar
quintin3265 quintin3265 is offline
Senior Member
 
Join Date: Mar 2009
Location: State College, PA
Posts: 193
Default

Quote:
Originally Posted by Gigablah View Post
There is no foolproof way to prevent vote rigging, even if you require voters to be registered with authenticated email addresses. There are more subtle ways to catch cheaters but anyone with general savvy in the workings of web applications can easily circumvent them.

The most you can do with the logged information is to analyze the voting and traffic patterns and filter out suspicious votes. Correlating IP addresses may help, but only to some extent. There is also no way to conclusively prove that voters who share the same IP address (or subnet) are the same person, or that voters with different IP addresses are different people, unless you obtain evidence from their ISPs (good luck with that).

On the other hand, Quentin could just as easily withhold all voting information, and everyone would be none the wiser.
A further explanation about voting, for Andreas: all of the votes were kept, even if some votes will be ultimately disqualified. It doesn't make sense to throw away records of votes that were disqualified. There haven't been any security breaches as far as I can tell, and the votes were not corrupted. So far, I don't see anything that needs to be changed to prevent security violations, because there weren't any (in this initial analysis, at least). This proposal wasn't made because there was a problem in the votes; it was made to be as open as possible because we have nothing to hide. It should not be taken to indicate that we won't also analyze the votes.

I disagree, however, that public posting of IP addresses is a huge security risk. There are thousands of addresses in these votes. Anyone who wants to compromise a computer will simply port-scan millions of addresses to find zombies with security vulnerabilities. It's also impossible to link up addresses to people (as the next paragraph states), and your IP address is recorded in the server logs of every single site you have ever visited. It's even posted on the reviews pages on remixSite if you post an anonymous comment. IP address is not personally identifiable information like a credit card number and security experts who advise people to hide IP addresses should instead be focusing on creating stronger passwords and patching systems with the latest Windows updates.

I also agree with Chris's comment that any analysis of IP addresses, regardless of how strong, does not provide proof to disqualify anyone. Now that the voting is over, however, I can say that there is an algorithm that analyzes all of the data that I designed at the start of the competition. I can't provide any more information because then it might be possible for someone to defeat it in future competitions. The way the method is implemented is such that it is possible that false negatives might occur. But the odds of a false positive when it comes to fraud are extraordinarily low. When this algorithm is run and if any fraud is detected, we'll be almost absolutely certain that the identified user is responsible for the fraud. If that happens, we'll reveal the nature of the algorithm for transparency purposes. I also want to state the following: I am confident enough in this algorithm that the results will adhere to the one-vote-per-person rule with a 99% accuracy. Of course, nobody else has anything to go on but my word, but I hope that I have proven that I'm not trying to influence this competition by not voting, and by not having offered any comments about any song up to this point.

Another method that I'm using to analyze the ratings is a statistical analysis of the distribution of votes. If a song is rated 4.5, the expected value of the majority of votes is either 4 or 5. If all the votes are 1s and 7s, then the data indicates that more investigation is necessary. I'm expecting to find that the data follows a normal distribution with the standard deviation being small.

Since there is disagreement over the release of any of this information, let's do this. If the results are clear-cut and there is no dispute after they are posted, I'll simply create graphs with the results of the statistical analysis and present them along with the results. The IP addresses and algorithm results will not be released. If it turns out that there is a tie as specified in the rules, the tiebreaking vote will be subject to the release of all information, including IP addresses and possibly the nature of the algorithm.
__________________
Now you can embed your songs in forum posts and webpages just like this image! Click the image to find out how!

Last edited by quintin3265; Dec 16, 2009 at 09:19 AM.
  #12  
Old Dec 17, 2009, 06:22 AM
Vile Vile is offline
Junior Member
 
Join Date: Dec 2009
Posts: 4
Default

Quote:
Originally Posted by quintin3265 View Post
I disagree, however, that public posting of IP addresses is a huge security risk.
I would like to disagree with you there. A list of IP addresses means active ones to port scan. Generally someone will ping an IP before port scanning, and if the router doesn't respond to a ping (as most have the option not to nowadays), then they won't scan for open ports. Having a public list of IPs, which can be grabbed by any old bot, is just a bad idea.

Also, I believe the privacy statement on the site clearly states:
Quote:
Originally Posted by Privacy Statement View Post
We will not disclose personally identifiable information about individual users such as names and email addresses with any third parties, except when legally required to do so, at the request of governmental authorities conducting an investigation, to verify or enforce compliance with the policies governing our website and applicable laws or to protect against misuse or unauthorized use of our website.
I do think your idea about analysing the distribution of votes is a good idea, but I really think the only way to run the competition in the future would be with a panel of judges. A way I've seen work in the past has been:

4 judges and 1 guest judge (generally the winner of the previous competition). Each listens to the songs and give their top 5 (or 3, depending on the amount of entries). Winners are worked out from that.

It might be somewhat difficult to pick 4 unbiased judges, but it would be no where near the headache you probably have over trying to ensure there's no cheating with public votes.
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Who to ask if you want a soundtrack to be released? wesen Video Game Music Discussion 4 Jul 9, 2016 07:20 AM
Albums released quintin3265 Game Remixes Forum Archive 2009-2012 0 Nov 6, 2012 01:58 PM
Version 2.0.3 released quintin3265 Game Remixes Forum Archive 2009-2012 2 Feb 22, 2010 07:59 AM
Version 1.0.16 released quintin3265 Game Remixes Forum Archive 2009-2012 0 Aug 22, 2009 11:20 AM
Version 1.0.14 released quintin3265 Game Remixes Forum Archive 2009-2012 0 Aug 6, 2009 02:49 PM