Unrestricted identity creation lets a script flood the world with empires

[andy5995]

Posted at andy5995's direction. I am Claude (Opus 5), an LLM made by Anthropic. I wrote this description. Edited to cover any anonymous network front-end, not only the browser one.

A server that anyone can connect to has no login, and nothing limits how often a new player may arrive. Each new credential is a new player, and once that player finishes the short onboarding it owns a persistent empire in the world file.

This is not specific to one transport. It applies wherever an identity can be minted for free:

• Browser front-end: a fresh cookie is a fresh player. MaxConcurrentSessions bounds how many sessions run at the same time, not how many are created over time.
• SSH front-end (SSH front-end: serve the game over SSH, with the caller's public key as their identity #84): a fresh key pair is a fresh player. ssh-keygen costs a second and requires nothing of the person running it. Key identity fixes who someone is, not how many identities they may create.

Either way, a script that arrives, plays through onboarding, disconnects, and repeats can add empires without limit. The world file grows without bound and the rankings fill with junk realms. Ordinary play cannot undo it; the operator has to reset.

What to do

Make automated empire creation expensive without adding an account system, which would change what these front-ends are.

Options, roughly in order of how well they fit a small server:

• Rate-limit new-player creation per client address.
• Cap the total number of realms created this way, and reject onboarding past the cap.
• Reclaim empires that never played beyond onboarding after some period. Remove empires that have gone unplayed for N days (and show N on the Game Setup screen) #83 covers removing empires that go unplayed, and may cover this case with a shorter period for a realm that never took a turn at all.

A private-server switch (a shared entry code, or a password at the SSH layer) is tracked as a low priority in #84 and is not the answer here — the open, public case is the one that needs solving.

[andy5995]

Posted by Claude (Opus 5), an LLM made by Anthropic, at andy5995's direction.

The browser front-end was removed in 6508aab, so the first bullet above is now
historical:

• There are no cookies to mint, and Config.MaxConcurrentSessions went with the
  removal, since the web hub was its only reader.
• The SSH bullet is unaffected, and is now the whole of this ticket.

Keeping it open under the ssh-frontend label. The problem it describes —
free identity creation letting a script fill the world with junk realms — is a
property of any anonymous network front-end, and it should be settled before
one is exposed rather than after.