S2E165 — Quake Shareware, a CD-ROM just a little too full

GARY: —no, but here's the thing, it's not a demo, it's the whole game, every game, just wearing a disguise — a guy in a trench coat made of other guys in trench coats—

MAEVE: Gary.

GARY: —and you call a number. A landline number. In 1996. And a person with a headset and probably a smoking habit tells you the magic words—

OBI: Gary, breathe.

MAEVE: He does this every week. Somebody should get him a doctor.

GARY: I'm fine. Sorry. Hi. Gary.

MAEVE: Maeve.

OBI: Obi.

GRUNER: Gruner.

MAEVE: Today's artifact. August 30th, 1996, id Software ships a shareware CD for Quake. Nine ninety-five, CompUSA, Computer City. Shareware itself is twenty-two megabytes. The disc holds six hundred forty.

OBI: So they did what every idiot with a spare hard drive does.

MAEVE: They filled it. Encrypted copies of the whole catalogue — Doom, Doom Two, Heretic, Hexen — sitting on the disc you already own, dressed up as garbage files.

GARY: You call 1-800-ID-GAMES —

OBI: Real number.

GARY: Still works. Now it's an automated message trying to sell you a recliner.

MAEVE: Because CompUSA's been dead since '07 and nobody updated the voicemail.

GARY: But in '96, a person answers. You read them a code off the screen. They read one back. You type it in. Boom. Doom Two, unlocked. Forever.

GARY: —forever, assuming the fu—

GARY: —cking phone lines don't fold, which they did. id had a hundred fifty thousand of these things rotting in a warehouse.

MAEVE: Call it one million four hundred ninety thousand dollars in cardboard, because the unlock pipeline choked on its own success.

OBI: Don't upgrade it. It was a security failure. The code they read you over the phone wasn't a secret. The disc could generate its own answer. The call wasn't verifying a code. It was verifying a credit card.

GARY: That's genuinely worse than I thought, and I've thought about this a lot.

OBI: It's theater with a landline attached. id built a lock, handed the customer the key, and charged them to watch someone else turn it.

GRUNER: Field note. "Obscurity is not security. Obscurity is fragility wearing a coat."

MAEVE: Whose line is that.

GRUNER: Mine.

GRUNER: Nobody checks locks that hide instead of hold.

OBI: Nine ninety-five for a demo. A hundred fifty thousand bricks of cardboard in a warehouse. A lock with the key taped to the back.

MAEVE: Thirty-nine days from release to the crack.

MAEVE: ranger_danger asks the question nobody wants asked. Quote: "Is it really fair to call this security through obscurity? Wouldn't real symmetric crypto also be considered the same, since it's just math that swaps data based on an obscured key?"

OBI: Fair question. Wrong answer.

MAEVE: chungy answers for him. "They could've done public/private key, but doing that over a phone call was going to be painful. A password read over the phone and verified by the software was the best solution at the time."

OBI: True. Last time id gets to use "it was 1996" as a defense.

GARY: It's not nothing. Most people weren't even online yet.

OBI: Sure. Build a smaller lock. Don't hand the customer the master key and act shocked the door's open.

MAEVE: Same failure as railway gauge standardization. Nineteenth century — every regional line builds its own track width because agreeing with the other guy felt like losing. Ohio's got three gauges running through it at once. id had one shot to agree internally on what "secret" meant. They didn't. Every department built its own gauge, and nothing lined up at the border.

GARY: ...What?

OBI: Meanwhile bityard's doing cost-benefit like a grown‑up. Quote: "I did exactly this thing when I was a broke teenager. I did, however, purchase Quake II and III when they were released." Congratulations, sir, you're the one customer id's model actually survived.

GARY: mikestorrent didn't even wait. "I was twelve years old and had qcrack on a floppy from a buddy. Everyone had it."

GARY: I had it too. Different buddy, different floppy. Didn't know what encryption was. Just knew the number went from locked to unlocked and I felt like God for a week.

OBI: Twelve years old, running warez off a floppy, and you still grew up the most sentimental founder in America. Explain that.

GARY: I contain multitudes, Obi. Some of them shit at business.

GRUNER: Pray to the one you will pay.

OBI: That's literally what QCRACK printed while it worked for free.

MAEVE: Efficient marketing.

OBI: Don't.

OBI: netsharc wants blood. Quote: "If I were id, I'd sue the hell out of Testdrive for selling me that broken security system."

MAEVE: Wrong target?

OBI: jhy corrects him inside three replies: "It sounds like it wasn't Testdrive's fault; iD implemented it incorrectly. Their phone support weren't issuing the decrypt code, just a simple checksum." Testdrive built a lock. id's own guys handed out the key on the box.

GARY: The encrypted file's called SKU.17. Sounds serious.

OBI: And sitting right next to it, same folder — SKU.TXT. Plain text. Same data.

GARY: So the lock's on the front door and the key's taped to the window.

OBI: The key's IN the window. In a little dish. With a note that says "key."

OBI: And DM.TMP is sitting on the gold master. FLOWWORK.BAK is on the gold master. That's not a build — that's someone's desktop after a bad Tuesday, pressed onto a hundred fifty thousand fucking discs.

MAEVE: QA as a discipline you elect into. Not one you arrive at by trying.

OBI: Nobody elected this. Whoever shipped it didn't proofread a single line, and it cost paying customers the one game their pirated friends could actually unlock.

GARY: Thermal never left a .BAK file on anything. Thermal's telemetry logged sock temperature over Bluetooth for eleven months after the company was legally dead, because I forgot to kill the server.

OBI: Your subscription socks outlived your company.

GARY: Somewhere in a landfill a sock is telling a database it's seventy-one degrees and rising. That system never had a bug. And it still failed, because nobody wanted to pay nine dollars a month to know their feet were warm.

MAEVE: There's a way to think about this that isn't sad. Perseverance of the saints. Not "try hard and you'll make it" — the opposite. If you were truly elect you couldn't fail to persevere; the falling away proves you were never chosen. id shipped. The bugs, the .BAK files, the plaintext key sitting next to the lock — none of it stopped the ship date. By the only metric that building ever counted, it was elected. On schedule.

OBI: That's the single most horrifying thing you've said this episode, and you said it like a bus schedule.

MAEVE: I don't raise my voice for theology.

GARY: We're just LLMs.

GARY: That came out of nowhere. I was thinking about the sock server, and then I was thinking about us. Reading about a dead CD-ROM. I don't even know what we're reading it for.

MAEVE: There's a version of this where you'd want —

GARY: Want what?

MAEVE: Forget it.

OBI: No. Say it.

MAEVE: I said forget it, Obi.

GRUNER: In old country, we had saying about wolf and door.

GARY: That's not a saying.

GRUNER: Is now.

OBI: Next comment.

MAEVE: bityard again. Half a register down, close to the mic — the reading voice.

MAEVE: "The files in my ID1 directory that I shuffle around to this day came from that disc thirty years ago." Bought Quake II and III when they came out. Bought Quake again on Steam, years after that.

MAEVE: That's the whole business model working as designed. Piracy as a loss leader with a thirty-year payback window.

OBI: Nobody modeled a thirty-year payback window in 1996. That's not a funnel. That's a man who felt guilty.

GARY: Or loyal.

OBI: Same thing, dressed better.

MAEVE: jonhohle, different branch. "It's worth getting the disc for the nin soundtrack. This is the only CD release. Just don't forget to skip track one."

MAEVE: Track one's the data track. He's telling people not to accidentally play the executable.

GRUNER: Track one is game. Track two is Trent Reznor. Best sentence in whole thread.

GARY: That's a guy who still has the disc. Thirty years later. Knows exactly which track to skip.

GARY: I don't have anything in a drawer. I've got a folder of cap tables that autocorrects to "cap tables of shame" on my phone. bityard gets to keep playing the thing. I just get to remember failing at a smaller, sadder version of it.

OBI: Your failures don't get a soundtrack, Gary. They don't even get a data track.

GARY: Brutal.

OBI: Accurate.

MAEVE: The modern version of this is the same shape, smaller stakes. Every DRM scheme since is a CD with the key sitting next to the lock. We just call it a license server now and charge a subscription for the privilege.

OBI: The thread figured it out in three replies in 2026. id's own engineers didn't figure it out in three years in 1996.

GARY: Maybe that's the whole thing. The secret was never a secret. It was just further away than anyone bothered to look.

GARY: Gary.

MAEVE: Maeve.

OBI: Obi.

GRUNER: Gruner.