Sunday, October 19, 2014

[WoW] Just How Much Damage Could a Backdoor in an Addon Do?

Recently it was made known that ElvUI--a very popular UI addon suite--had in it something known as a "backdoor". A large number of people have been pooh-poohing folks over being concerned over this capability: The authors never intended to use it maliciously (for various definitions of malicious), and the code was whitelisted to only specific developers. I want to talk about how the developer's intentions don't matter and how much damage such a backdoor could possibly do to your character.

What is a backdoor?
A backdoor is something that allows someone, sometimes a developer, to issue commands to retrieve information from or execute commands on a client machine. Backdoors are generally malicious, though occasionally a backdoor created for debugging purposes will escape into the wild because the developers forgot to remove it.

Does ElvUI still have this backdoor?
Not as of October 19th, 2014. In ElvUI's case, the backdoor was removed once they were called out on it, but it had existed in the code for almost two years before anyone who cared and were capable of understanding the code apparently noticed. Version 7.0.8 is when it was taken out. ElvUI Shadow and Light took their version out a couple days after. I have not looked into other possible variants of ElvUI.

What could this backdoor do?
As per the image below, ElvUI's backdoor allowed the developers (or anyone who could hijack the addon) to execute any LUA code they wanted in your WoW session. Basically, anything an addon could do, the developer could send a message to your WoW client running this addon to execute, even though the addon had otherwise known/solidifed capabilities. It literally took a message sent by someone, checked if it was the developer, converted it into code at runtime, and executed it, as per the second blue code block below:

Source:; loadstring is a LUA API that takes a string and compiles it, labeling the method as func. Later that block the code is run (func()).
This weekend I decided this was an interesting enough problem and sat down, learned LUA, and built an addon that emulated just the ElvUI backdoor. I won't be releasing the code (unless Blizzard wants it), but the fact that I threw this together in about 7 hours of work (including building attack strings) knowing little to nothing about addon development, frankly it would be trivial to reproduce.

However, I did make a video showing some of the capabilities.

So, to recap, to be potentially affected if someone had a backdoor like the one ElvUI had, you need only be on the same server, raid, or coalesced zone (something that would allow addons to communicate "cross-server"). There's no requirement to be in the same guild, nor the same raid, or the same continent even.

Some of the things that could be done includes, but is not limited to:
  • Dismounting you
  • Disabling your addons on next UI reload (the attacker needs to know the name of the addon)
  • Adding or removing people from your in-game friends list, or ignore list
  • Toggle your At-War factions to make them hostile to you
  • Deleting your macros
  • Creating/Editing macros and binding them to whatever key the attacker wants
  • Forcing you to leave your party (including LFR/LFD, incurring the deserter debuff)
  • Deleting your equipped gear
  • Grabbing your friend data, including tags and associated character
  • Force your WoW client to quit with no confirmation
There's plenty of other functionality that's theoretically possible, but I didn't get around to trying/testing because of the effort involved, but frankly that above list should be sufficient. 

Things that also potentially include (where I think theory is sound but I haven't checked it): kicking characters from guilds; disbanding guilds; forcing other parties to open a trade window, put something in it, and accept; Mail gold away at an open mailbox (to your server only); getting your tag.

I'm sure there's more, but I'll admit that my imagination is sometimes lacking.

Well, someone else told me that it could only do chat commands, so it can't be that bad.
Actually, one of the chat commands you can execute is /script, which--surprise!--lets you run arbitrary LUA code. So even if it could only cause you to perform chat commands--which is incorrect--it doesn't matter, because we're back to square one of someone using the backdoor to execute arbitrary LUA code on your machine.

I trust Elv, he never used it for anything malicious!
There are reports (unsubstantiated but numerous) of events where folks in a raid would /follow one of the devs, or start posting things in chat like, "this is elv". Besides the creep factor of your character moving under someone else's control, even briefly, or the implications of impersonation (imagine if the author had made you say things blatantly offensive, or a bannable offense), different people have different definitions of "malicious" when it comes to character control.

However, even if you trust the authors, if there was a bug in that whitelisting code, someone else could hijack the addon and execute whatever they like. Turns out the code has exactly such a bug.

Notice that the whitelist contains the server and author, but notice that it does NOT mention what continent. So if the authors are from the North America servers, someone could create characters with the same name on EU servers and hijack the code. Or if they're EU, vice versa.

The authors could also end up renaming their characters, moving to another server, deleting their characters, etc. and if someone else grabbed those names on those servers, they could also hijack the addon capability. They could also get hacked, and have their account no longer under their control.

The important thing here is that even if you trust the author, the fact the capability exists at all is potentially harmful.

It was put in as a developer tool, it's important for them to get debugging information.
If you want things like telemetry, or the ability to execute specific commands, you should build that code specifically rather than taking what is at best the lazy way out and just opening a giant hole in your program. You should also let the folks installing your product know what capabilities like that exist so they can make an informed decision about whether to install your addon.

Remote arbitrary code execution is the BIGGEST security bug a piece of software could ever have, and to deliberately code it into your addon is extremely irresponsible, if not outright unethical. Granted, in the sandboxed environment that makes up WoW, it's certainly a lot less dangerous than ones you typically hear about. You can't lose your account (though you could potentially end up communicating your BNet tag), and they can't just throw out gold (but they can throw out equipment!). There's a snowball's chance in hell that it could end up breaking out of WoW's addon sandbox--but I'll never say impossible. There are many, many people out there who are far more clever at this than I am.

But any addon could do this!
This is technically true, which is why only installing things that you trust is important. Ostensibly, if you installed ElvUI, you trusted the authors previously. For some folks, the fact that they put in an undisclosed backdoor that allows them to do what they please (and potentially others if they hijack the addon or their character) is the breaking point for their trust.

Responsible developers don't open giant holes on your machine. Addons are software; no different than installing an app on your iPad or a program on your PC. Once you've installed that software, you have to trust that it won't do things like gather and report out valuable information, or screw with your settings.

But the important distinction here is that the backdoor that was in ElvUI could be hijacked by another party to do whatever that party likes within the addon environment. Your trust in the authors of ElvUI becomes immaterial at that point.

I'll be honest, I build my own UI generally by cobbling together addons instead of using addon packs like ElvUI, so the only horse I have in this race is developer integrity. But frankly, as a professional software developer this backdoor absolutely appalls me, and the completely cavalier attitude the authors have around this event scares me. If anyone on my software projects ever created such a backdoor in a released-to-public product intentionally I would fire them so fast their head would spin.

If you still don't think this is a big deal after all of this, well, I'll probably never convince you unless someone actually exercised this functionality on you. But hey, it's your characters and your own risk assessment.
#WoW, #Security

Wednesday, October 15, 2014

[WoW] The Redonkulous Healing Environment at Level 90

I just ran a (new) Heroic Siege of Orgrimmar raid with my guild this evening (11 of us), and I have to say, the healing environment still feels a lot like 5.4 did. Actually, Hamlet of ye olde Elitist Jerks put it better than I: right now healing is more 5.4ish than even 5.4 was. Infinite mana, spamming AoE heals, nothing stopping you as a healer but your raw throughput. 

My Holy Paladin has no Spirit outside a couple gems and an enchant, and yet only on a single fight (Malkorok) did I ever actually run OOM. And that was because I was spamming Holy Shock-Holy Radiance-Holy Radiance-Light of Dawn (Eternal Flame-spec'd no less) effectively non-stop the entire combat.

But I still couldn't keep up with our Disc priest, who was nearly only casting Holy Nova and Power Word: Shield pretty well over and over and over again. And absorbs are as powerful as ever, making up more than 70% of our Disc priest's healing and 40% of my (Holy paladin) healing done.

Iron Juggernaut Discipline Priest Spell Usage

But as someone who's run a fair number of dungeons on the Beta, right now is not indicative whatsoever of what you'll see at level 100. Seriously, not even close.

Actually, if you wanted to see something far closer to what Beta was like, you would have had to have run the leveling dungeons between 85 - 90. I've been duo-ing them with my boyfriend (him as Holy Paladin, myself as Bear Tank), and holy crap they were amazing! But you pretty much needed to be at Challenge Mode levels of competence to not be a complete pancake, which is, frankly, silly for leveling dungeons. At least, they were as of October 14th. the issue was worse at below level 40, when most tanks don't even have Active Mitigation yet. 

Sadly/Happily, they've been fixed. Not quite the cakewalk it used to be, but definitely not Challenge Mode hard anymore. Still, the leveling dungeons provide a preview that cleaves closer to the 100 experience than content at 90 does now.

So, anyways, healing right now is about as hard/easy as it was before the patch in a raid environment, and totally not indicative of what we'll see come level 100, for better or worse.
#WoW, #Healing

Monday, October 13, 2014

[WoW] Challenge Modes: The Race to the Finish

With 6.0 imminent, many, many folks decided that, oh crap, I need to finish Challenge Modes before they go away! Frankly, I wasn't really any different there myself. One of those things where you need to organize a group of people, and the rewards are all cosmetic, so it wasn't until there was nothing else to do and the fact that they were going away that people started really digging into them.

Now, for anyone who is currently struggling to get them done, I feel badly but at the same time we did have literally two years to accomplish them, so I'm not really that sympathetic to folks saying they didn't have time. I am sympathetic, however, to folks who couldn't throw together a group of people. Sure you need fewer than a raid, but Challenge Modes are, well, challenging, and you can't just outgear them. If you're stuck with friends who are sub-par players, you might well just be hosed unless you find other people.

For our group, we ended up only going for silvers, because we were pretty much only super interested in the mounts. All in all, I admit, it was a complete blast doing that content at the difficulty level it was intended to be completed at. Our comp was Frost Mage, Enhancement Shaman, Unholy DK, Protection Warrior, and Disc Priest; we used all of our many tools at our disposal. Defensive cooldowns, chain group stuns between Ring of Frost, Remorseless Winter, Capacitor Totem, and Shockwave, massive amounts of off-healing from myself, along with healer DPS. Picking and choosing specific talents and glyphs that we'd never normally pick. It was the perfect example of how difficult WoW can be, if you do the optional content.

Random really late pro-tip: if you're running Enhancement, you can bring all five players from about 20% to full health on a large group of mobs if you already have a bunch of Flame Shocks up by using Ancestral Guidance->Fire Nova. One of my favourite tricks when we were struggling with healing large groups of mobs.

We ended up getting all 9 silvers in 4.5 hours. We actually even one-shot gold Scholomance, which was a pleasant surprise. Siege and Brewery we were within 44 and 23 seconds of gold, respectively. Most of these we one-shot, or in a couple cases with a false start, two-shot. The worst three for us were Stormstout Brewery, Scarlet Monastery, and Siege.

Not too shabby for most of us never having walked into CMs before.
The brewery was our second one, and we were still coming to terms with some of the mechanics that previously in normal/heroic modes we could ignore. Especially the boss' self-healing. Got to the end and had to reboot that one. The practice helped our time get really close to gold though.

Siege, those bombs, ugh. Seriously, the beginning of that dungeon is nasty. The rest was relatively easy, however.

And Scarlet Monastery, so many inadvertent pulls, face pulls, a couple of wipes. It was our last one to do, and definitely the hardest in my opinion. I've heard people say Mogu'shan Palace is the hardest, but ehhhh, I dunno about that.

Overall, having competent players in all roles is a must. All five of us are in the same raid, so we're already pretty in sync with each other in terms of play style, personality, and our classes. It also helps that our tank had done them before; having a guide probably shaved off a good 4 or 5 hours worth of attempts. So while we got silver quite handily, I wouldn't say they were easy. Quite the contrary, they were difficult, and we had to play at our relative best to nail them as quickly as we could.

With the WoW populace finally getting exposed to Challenge Modes, I'm happy that Blizzard didn't look at participation previously and axe them for WoD. I know we came out thinking they were a blast, and will quite probably end up doing them earlier next expansion instead of waiting until the last minute. I'd bet there's a number of other folks in the same situation/mindset. Having that extra challenging content is wonderful, and frankly, even though we had to effectively be bribed to try them with the Phoenix mounts, I'd be totally willing to run them regardless.

So, to Blizzard: Challenge Modes, awesome and thanks!

#WoW, #Challenge

Thursday, October 9, 2014

[WoW] Holy Paladin Changes for 6.0

Keeping this as short and sweet as I can, here's a quick set of things you need to know for Holy Paladins in 6.0. Note that this doesn't include full changes in Warlords, just info for level 90. We have a slightly ridiculous number of changes, so even the short version of this is pretty long. If you're just interested in high level playstyle changes, check out the Conclusion section at the bottom.

Stat Changes
  • Item Squish is in. All your numbers are going to go down. Don't panic!
  • Intellect no longer increases your Crit with spells.
  • Sanctified Light was added, increasing the amount of Crit we get from things like gear and buffs by 5% (so if you'd normally get 100 crit rating from a piece of gear, Holy Paladins get 105).
  • There are no more Haste breakpoints. If you like Haste, stack it without worrying about your HoT ticks.
  • Spirit should be a lot more powerful, but you should need a lot less of it. However, this is not as apparent at level 90 and kicks in much more at 100.
  • Health with respect to healing throughput should be much higher, so people will be at less than 100% health more often. Your heals, however, will also do a much smaller percentage of your target's health. This should be okay! Admittedly I am unsure as to how much SoO changes with this.

Ability Removals

Talent Changes
  • Eternal Flame once again procs our Mastery, but the length of the HoT is now proportional to Holy Power spent, up to 30 seconds for 3 Holy Power. So no more spamming small HoTs everywhere; it's just not efficient.
  • Stay of Execution is a bit more powerful and the burst of healing is now at the beginning rather than at the end, making it easier to use.
  • Selfless Healer no longer affects Holy Radiance, and Judgment doesn't generate Holy Power. However, it buffs Flash of Light (now our primary throughput spell) a fair bit more than it did previously, by nearly twice as much.
 Ability Changes
  • Holy Light is our "efficient" heal, whereas Flash of Light is our throughput heal. They actually heal for identical amounts, but Flash is 66.7% faster to cast.
  • Avenging Wrath is now the mother of all throughput cooldowns, boosting healing by 100%, and Haste, Crit, and damage by 20%.
  • Beacon of Light now transfers multistrikes (of which for now the only thing that this affects are the multistrike SoO trinkets). Casting spells directly on the Beacon no longer generates Holy Power; however, casting Holy Light or Flash of Light on the Beacon will refund 40% of the mana cost, making direct Beacon healing extremely efficient. It also now has a small mana cost to keep people from macroing the ability to every spell cast.
  • Our area heals, like Daybreak and Holy Radiance, now only affect up to 6 injured targets instead of all targets in the area. (Note Light of Dawn always had this effect).
  • Holy Shock has twice the chance to Crit, rather than having a static +25%. This should help make Crit more attractive.
  • Mastery: Illuminated Healing is now applied by multistrikes (for now, only the SoO trinkets, same with Beacon).
  • Denounce now has a 40 yard range, up from 30. (hooray!)
  • All healers had most of their instant cast heals gain a 1.5 second cast time. For Paladins, Word of Glory, Eternal Flame, and Light of Dawn all have a cast time now, leaving us with only Holy Shock which is still instant.
  • Redemption no longer costs excruciatingly large amounts of mana.
  • Seal of Insight no longer increases our spell haste by 10%. Instead, that was rolled into Infusion of Light, a baseline Holy passive (and increases all Haste instead of just spell). This means if you want to do less healing but more damage, you can switch your seal without losing the haste, just 5% healing.
  Glyph Changes

Not listing every glyph change. Many of them are just numbers tweaks. But here's the major playstyle-altering changes.
  • Glyph of Divine Wrath now reduces mana costs by 25% while Avenging Wrath is active, but halves the healing bonus of the cooldown.
  • Glyph of Cleanse now grants Cleanse 2 charges, but increases the cooldown to 12 seconds.


Overall, the biggest changes to our playstyle is a much slower generation of Holy Power, and a lot less mobility with Holy Shock and our 90 talents being the only instant cast heals we have left. With less holy power, it makes Eternal Flame much less attractive, so I expect that whole tier to balance out a bit with all of them being viable choices.

With Divine Light gone, get used to using Flash of Light as our throughput heal. Note that unless you have stacks of Selfless Healer banked, Word of Glory at 2 Holy Power is still significantly stronger than a Flash of Light/Holy Light (and at 3 HP is a full 150% more powerful in a single cast).

Holy Radiance should be harder to spam, and only really worth casting if it'll hit two or more injured players, whereas today on live I use it almost exclusively over Divine Light because it hits nearly as hard on the tank after Beacon transfer is taken into account.

I'm not sure if at level 90 we'll see players sitting at less than 100% health much, but if that's the case, we should see Crit become a bit more valuable than it has been in the past, and it should also naturally make our Mastery a little less potent, because throughput will be a bit more important than bubbles.

I raid on Wednesday after the patch, so we'll see how this plays out in practice. I imagine SoO has been nerfed through the floor in anticipation of these changes, so I wouldn't panic about current content.

#WoW, #WarlordsOfDraenor

Monday, October 6, 2014

How Do You Measure a Year?

In blog posts, in retweets
In comments, in to-tal rewrites
In searches, in sources, in keywords, in spam
Five hundred twenty-five thousand six hundred minutes
How do you measure a year in the life?
~Seasons of Love - RENT (filked by yours truly)
Hooray! Gamer by Design turns 1 year old today! I started this blog October 6th, 2013, in response to the Newbie Blogger Initiative. Well, I've wanted to write my own game design blog for years, but the NBI provided me with the perfect opportunity to get off my butt, because it made networking my blog so much easier. After the first month, I was graciously awarded the Promising Star, which according to the website is described as, "This is awarded to the overall most outstanding Newbie Blogger and is the NBI’s highest honor. Your blog has been acknowledged for its style and content."

I can only hope I've lived up to that expectation, but the ride has definitely been fun, and I plan to continue it. Since I've started I've quit my previous job, became a game dev, gone to GaymerX, PAX East, PAX Prime, made a tonne of new friends, and managed to both get things off my chest and talk about what topics I think are interesting--and a few others think were interesting as well.

So stealing a page from The Ancient Gaming Noob's book, I'm going to talk a little bit about the stats on my blog for the year, because as we've already established, I love numbers. Now, I've been using Google Analytics only since mid-November last year, so the first month and a half's worth of data is missing, so this isn't a perfect look.

Who's Sending Me Traffic?

There's a fair bit of data there, exported raw from Google Analytics. Clearly the top dog is Google, sending me tonnes of traffic. But based on the average time folks spend, plus the sheer number of new sessions, the majority of users are likely just stopping by to grab an image and then moving on. Looking at the keywords via Google Analytics, literally almost nobody sticks around, making Google a great way to have folks strip images from your blog. I'm not really complaining, but I don't really think people use Google these days to find information they want to read, rather, they use other people's recommendations via social media for that. Or I'm just bad at Google.

Next is direct traffic, which would be either no tracking info on the URL or typing the value directly into their browser. Maybe someone shared a link (likely me) that didn't have a tracking parameter on it. There are a fair number of new sessions, and returning folks as well, so link sharing is still handy.

Blessing Of Kings, a great blog and a fixture of the WoW blogging community. Rohan's blog roll is, for many people, a replacement for RSS feeds (myself included for a very long time). No other blog roll compares to his for traffic redirects, or at least, not one that I'm on. And based on other metrics (average session duration, average pages hit), those users come back time and time again. So, thanks Rohan!

Twitter and Facebook are 4 and 5 respectively, showing the value in being active on social media. Well, except for Google Plus, which is way lower on the list.

The Blogger referral is likely my own clicks going through from editing pages, especially with only 3.82% new sessions, so I wouldn't look too hard at that figure.

Then, outside of different languages for Rohan's blog, we have other blogs. Balkoth's Word, Herding Cats, MMOGypsy, Bio Break, Me vs Myself And I, and Murf Versus. It's important to interact with others in the blogosphere, and frankly, they're all friends that I've met through blogging, so it's nice to see we have some back and forth.

There's a couple of one-offs, though which really show how powerful a single link can be. Tobold's blog linked to me once, and that was a significant spike for my traffic. WoW Insider, I posted a single comment which generated a fair bit of traffic. The Stonewall Family is my guild's website, and I cross-post there on occasion. Finally, Feedly is a new RSS replacement for Google Reader that has gained some traction.

So lessons I've learned? Talk to people; be active on Twitter and Facebook (not just posting links, but participating in the community); get on blog rolls; comment on other people's blogs.

Most Popular Posts

Over the past year, what have been my most popular posts? Sadly, there were a couple before I started using Google Analytics that hit the viral jackpot, specifically one where I initially talk about the game I'm now working on (Eon Altar), which would make spot 2 on the list.

Page Title Pageviews
WoW: Fiction Has a Horde Bias 1226
Dear Blizzard, I'm Not Asking For a Quest About Woman's Suffrage or the Stonewall Riots 758
[WoW] Clueless vs. Jerk, Who is Silver for Heroic 5-Mans Solving For? 449
Cloning, Splicing, and Cross-Breeding. Pokémon Geneticist! 400
Banish(ed) The End Game 379
[WoW Beta] UBRS 5-Man Dungeon as Holy Paladin 349
WoW: Will the Item Squish Quash Our Ability to Solo Earlier Raids? 324
[WoW] Right in the Heals 317
Holy Paladin, Batman! WoD Alpha Patch Note Discussion 286
Complexity and Depth, or Why WoW Devs are Axing Abilities 273

By far, my most popular post is about how and why Horde dominates WoW's story. Then we have Dear Blizzard, which was linked like crazy through Twitter. The third one on the list, Clueless vs. Jerk, was linked by Tobold. The Pokémon Geneticist post is actually from before I started Google Analytics, but it ranks super high on Google searches, so it still gets a couple hits every once in a while even today.

Most of the top 10 are from WoW, which isn't really surprising given how popular the game is. The one that sticks out to me is the post about Banished. Not really sure why that one got a lot of hits, but it did. Perhaps not that many blog reviews out there?

What if we measure by comments instead of pageviews?

Page TitleComments
In Support of Support Classes32
Complexity and Depth, or Why WoW Devs are Axing Abilities28
Dear Blizzard, I'm Not Asking For a Quest About Woman's Suffrage or the Stonewall Riots19
Complexity and Depth Part 2: Conflation Station16
Aw, Do I Have to Replace My +4 Awesome Sword with that +5 Slightly More Awesome Sword?15
[WoW] Clueless vs. Jerk, Who is Silver for Heroic 5-Mans Solving For?15
[WoW] Should Monolithic Expansions be Obsoleted?14
Flexible Raiding by Rigid Numbers13
Purchasing Level 90s in WoW: It's the End of the World As We Know it, and I Feel Fine12
A Tale of Two Raids12
[WoW] Raiding in Warlords: The Good, The (Maybe) Bad, The Strange12
[WoW] Right in the Heals12

Again, mostly WoW posts, but a mostly different list. Actually, when you look at the comments, it is all WoW posts. It's fun to see both my Complexity vs Depth posts up there, because lots of people have lots of differing opinions, which is fun. Most of my most popular posts to comment on happen to be about the cross section of Game Design and World of Warcraft, which I admit are fun to write, even if I haven't written one in a while.

But given that there isn't a tonne of crossover between the two lists, apparently posts that generate discussion don't generate page views, and posts that generate page views don't really generate discussion? I'm not sure that's actually true, but for my year of blogging that seems to be the pattern.

 A Year of Blogging

Unlike Wilhelm I haven't really tracked how many paragraphs or words I've written, so I don't have that data. But I have written a total of 92 posts, so about 1.77 a week, and I'm pretty sure I've never missed a week, though some months I do better than others. February 2014 in particular was a really slow month for me.

But here I am, still blogging, still playing WoW, and am a game developer, so I plan on writing more blog posts and continuing to participate in this lovely blogger community. Here's to another year!


Thursday, October 2, 2014

[Indie Dev] Becoming a Game Developer -- Beyond Bossfights Podcast

Braxwolf Stormchaser of the Beyond Bossfights podcast interviewed me recently about my transition from a developer at Microsoft in Office to becoming an indie game dev at a much, much smaller company (Flying Helmet Games).

It was a super fun chat, ranging from the bureaucracy of large companies and why some of it exists, to the daily life of a developer in a small company working remotely, to Mojang's decision to sell the company, and talking a bit about our game, Eon Altar. Braxwolf was an amazing host, with lots of interesting questions, and quite the professional sounding show.

You can find the podcast either on Braxwolf's blog, or on iTunes. Take a listen and feel free to ask follow-up questions or feedback here!

#Podcast, #IndieDev

Tuesday, September 30, 2014

Linear versus Exponential Progression

The past few days I've been playing Clicker Heroes. Well, "playing". Like Cookie Clicker before it (or even earlier, Candy Box), the game is entirely about finding the most efficient path to getting bigger numbers. It is literally just progression and nothing but. Buy things to automatically do more DPS, which kills enemies faster, to get more money, to buy more things to automatically do even more DPS. It's totally ridiculous, yet it triggers some number-happy portion of my brain.

According to the legend on the right, I currently have 1,162 Quintillion Gold, or 1,162 x 10^18, or 1,162,000,000,000,000,000,000 gold.
To make the game mechanics work, all of these clicker games use exponential progression. It's pretty similar to how WoW does progression these days as well. The pro of exponential progression means that you absolutely must get the new tier's worth of gear to really make a dent in the next tier of content, allowing developers to easily put a stat/gear cap on progression.

In Clicker Heroes, I can't really wail away at level 97 using heroes that only gives me 1 Million DPS, not when enemies have 350 Quintillion health. That would take me over 31,000 years! Or in WoW, you can't use gear from TBC to defeat bosses from Cataclysm. Heck, it's difficult or impossible these days to hit the next tier of content with gear from the previous (i.e.: jumping straight from Heroic ToT to Heroic SoO and beating it completely without any SoO gear at all)

WoW's power curve, from my own calculations nearly a year ago.
It also means you really feel upgrades. Every upgrade feels weighty and like a huge difference to how powerful your character is. Contrast that with a linear power curve, and upgrades become less noticeable over time.

For example, imagine if you had 50 Strength and you find a set of armor that between all the pieces increases your Strength by 10. That's a 20% increase in power, and you'll feel that. But imagine the second set of armor only increases your Strength by 20, 10 more than previous. That's only a 16% increase in power from the previous set of armor (60 Strength + 10 more, versus 50 Strength + 10). Now imagine 5 tiers later, and you have a set of armor that again only increases your Strength by 10 over the previous tier. That'd only be a 9% increase in power that tier (110 + 10). Basically, the more tiers you have, the less each individual tier actually increases your total power.

But there are cases where a linear power curve is handy. If your system uses small numbers, like Paper Mario, an exponential power curve isn't going to be helpful. Or if you purposefully want the differences to be small. Look at D&D 5th Edition, for example:

The difference between a level 1 character and a level 20 character using a skill they're proficient in is only a difference of about +5 to +7 total once you take into account attribute boosts and proficiency bonus boosts. At best, a level 20 character can be twice as good as a level 1 character. Since everything is rolled on a d20, you're looking at values of 5 - 25 or so for a level 1 character, or 12 - 32 or so for a level 20 character. It allows lower level characters the chance (albeit small) to do really heroic things, and gives the level 20 character the chance to still fail at moderately complex tasks (rather than always succeed).

It also all depends on the scale of what you're building. If you expect a really long power curve--like in an MMO--exponential might be a better choice because of that diminishing returns on linear. But if your curve is relatively short, a linear curve is quite easy to balance and maintain.

Both are useful depending on the scenario, just like any other tool in a game designer's toolkit. Either case, you can balance encounters and enemies around them, and they'll feel relatively similar in the moment, but it's all about how things should feel if you're going backwards (or jumping ahead!) in content. Should a high-level character be defeatable by a mid or low-level character? Should even mid-level enemies potentially provide a challenge? Or should you only be able to be effective/balanced within a given tier of content? That's all up to the designer and how you want your game to play/feel.

#DesignExperiment, #DnD, #WoW