{"assets":[{"original":"http:\/\/www.ludumdare.com\/compo\/wp-content\/uploads\/2014\/05\/Screen-Shot-2014-05-01-at-3.48.16-PM.png","local":"\/data\/posts\/2014\/05\/77f7f1f55aae3b094303b90f6a0b7bf4.png"}],"author_link":"author\/coinflipgames\/","author_name":"Coin Flip Games","cat":"LD #29","categories":["LD #29"],"comments":[],"epoch":1398957300,"event":"LD29","likes":6,"metadata":{"p_key":"82134","p_author":"Coin Flip Games","p_authorkey":"0","p_urlkey":"292866","p_title":"Bitmite Blitz! A Postmortem of sorts","p_cat":"LD #29","p_event":"LD29","p_time":"1398957300","p_likes":"6","p_comments":"0","p_status":"WAYBACK","us_key":null,"us_name":null,"us_username":null,"event_start":"1398384000","event_key":"22","event_name":"LD29"},"source_url":"2014\/05\/01\/bitmite-blitz-a-postmortem-of-sorts\/","text":"

\"31135-shot0\"Hey, folks. Coin Flip Games here to tell you about our entry for LD29, Bitmite Blitz. We\u2019re incredibly proud of this game and wanted to make sure YOU got a chance to play it. If you\u2019re not convinced, here\u2019s some of our favorite reviews we\u2019ve gotten so far!<\/p>\n

\u201cSuper fun game. I have highscore! for now :P\u201d \u2013\u00a0tehryanx<\/a>\u00a0(Still has the high score, btw)<\/strong><\/span><\/p>\n

\u201cI love games that put me in a perspective I never would have thought to explore. Great game!\u201d \u2013\u00a0greysphere<\/a><\/strong><\/span><\/p>\n

\u201cThis is definitely one of the most polished games I\u2019ve seen in the LD. Having an achievement system is an impressive addition, given the time constraint.\u201d \u2013\u00a0StencylTuo<\/a><\/strong><\/span><\/p>\n

\u201cGood game, it gives me the same feeling as Flappy bird which is a good thing.<\/span>\u201d \u2013\u00a0Sparrow<\/a><\/strong><\/p><\/blockquote>\n

So go give it a shot already!<\/a><\/p>\n

\u00a0<\/p>\n

Back? Okay. I wanted to talk a bit about how we accomplished the global leaderboard. I\u2019d love to see more games with this feature because I think it adds a whole new dimension. \u00a0So, to start, you can implement this in any language or game engine you would already be using. Some (like Unity) will make it easy than others, however. You need 3 things, a server to host the scoreboard api and scores, you game and a communication layer between them. Ideally, you want to have something in place to prevent people from adding fake scores as well.\u00a0\"Screen<\/a><\/p>\n

\u00a0<\/p>\n

Set up a database of some sort. Use whatever you would feel comfortable with and if you\u2019re not comfortable with anything, use MySQL or sqlite. You can get away with, as a bare minimum, a single table: scores, but that\u2019s not so much fun, is it? You can easily use this in a bunch of games if you do it right the first time.<\/p>\n

    \n
  1. Set up your database engine (mysql in our case)<\/li>\n
  2. Add a database and user. Make sure that the user permissions make sense. Don\u2019t give them GRANT access to anything. Ever.<\/li>\n
  3. Add the tables as below:<\/li>\n<\/ol>\n

    \"Screen<\/a><\/p>\n

    Alright! Done with the database for now. Now we need to setup the API. I\u2019m going to leave the actual implementation up to you (as an exercise or something), but the functionality you\u2019ll need is\u2026<\/p>\n

      \n
    1. To receive input from the web in some well defined format. I used PHP to get data as JSON. You could use Ruby, Python or whatever fancy language you want. You could use XML too if that\u2019s what you\u2019re into.<\/li>\n
    2. Check the input to ensure that it\u2019s valid. (Did this come from a legitimate source? Does the input make sense?)<\/li>\n
    3. Sanitize the input. (Can\u2019t stress this one enough)<\/li>\n
    4. Perform some action on the data. (Run the command \u2018getScores\u2019)<\/li>\n
    5. Return results in some well defined format. (Package up the results of the command as JSON and pass it back)<\/li>\n<\/ol>\n

      And on the client-side (game) we need to do the same thing, but in reverse. The client needs to build these requests and be able to parse the responses. Since I used JSON, I\u2019ll show our request as an example.<\/p>\n

      {<\/p>\n

      cmd: \u2018Leaderboard\/getScores\u2019,<\/p>\n

      api_key: \u2018\u2026\u2019, (I\u2019ll get back to these)<\/p>\n

      signature: \u2018\u2026\u2019,<\/p>\n

      time\/token: \u2018\u2026\u2019<\/p>\n

      }<\/p>\n

      And the server would spit back<\/p>\n

      {<\/p>\n

      [\u2018name\u2019: \u2018Awesome Bitmite Blitz Player\u2019, \u2018score\u2019: 100000],<\/p>\n

      [\u2018name\u2019: \u2018Awesome Bitmite Blitz Player 2\u2019, \u2018score\u2019: 10000],<\/p>\n

      \u2026<\/p>\n

      }<\/p>\n

      \u00a0<\/p>\n

      Easy enough. The trickiest part is ensuring that the scoreboard can\u2019t be tricked into allowing scores that aren\u2019t legitimate. That\u2019s where the API key and secret come in. For every game that will use this leaderboard, generate some random string for the API key and some random, hard to guess string for the secret. The database knows what these are and your API can check them out no problem. You\u2019ll also need to let your game know what these are and if you\u2019re lucky enough to have a compiled language, they\u2019ll be safe from curious eyes. (if you release the source code for your game, strip both out).<\/p>\n

      So now the server API and the game both know the API key and secret. Great. Now let\u2019s use them to generate a signature for all the requests that the game client will make.<\/p>\n

      \u00a0<\/p>\n

      \"Screen<\/a><\/p>\n

      So the idea is that both the client and server can construct the signature independently and compare them, but prying eyes cannot. The key, secret and a time\/token are needed so that requests to the same API resource (getScores) won\u2019t always generate the same signature. It\u2019s secure because the secret is\u2026 well\u2026 secret.<\/p>\n

      (There might be some of you that recognize this pattern. It\u2019s basically the same model that Amazon Web Services uses.)<\/p><\/blockquote>\n

      So that\u2019s the basic idea. Here\u2019s some resources to use if you want to implement it yourself:<\/p>\n