itch.io

Built and live since this morning, so this lands at a good time, and one of your three points found a real bug. The escape hatch: the frame's footer bar already opened rivok.io in a new top-level tab, so that part was covered. But one level down it was not. The sign-in links inside the game itself had no target, so in the frame they would have navigated inside the frame. You would have signed in successfully, into a context the session cookie never leaves. A dead end with no error to show for it, exactly the kind nobody reports.

Fixed: in a frame, every account path now breaks out to the top level, including the sidebar links, which all lead away from the game anyway.

The window.open trap does not hit us, because there is no window.open anywhere in the client, it is all plain anchors with target="_blank", which sidesteps the problem rather than working around it. Your warning is in the code now so nobody refactors into it later. 

Storage partitioning I had not thought about, and you are right. A guest in the itch frame gets a different guest id than the same browser on rivok.io. It costs nothing here because guests keep nothing either way, and for the traffic numbers it is arguably the correct behaviour, but it would have looked like a bug in three months. Written down.

On the ranking argument: that is the part I found most convincing, and it is why the embed exists now rather than staying a maybe. Whether it actually earns anything is measurable, so I will let it run and find out.

Twice now you have made this page better without playing the game. Thanks.

Thanks, this is a more useful read of the page than most people give a game they have played, let alone one they haven't.

You are right about the two metadata points and I have fixed both. Average session was simply wrong: a round is 5-10 minutes, so "A few minutes" is the honest setting, and you are right that it is the filter this game should be sitting in. The three multiplayer tags were lazy, I have dropped two of them for terms that do different work.

On the play button: the launcher is deliberate, not an oversight. The session cookie is SameSite=Lax, so inside a cross-origin frame the browser withholds it,  accounts, rank and clans would silently break for everyone arriving here, with no error to explain why. Sending people to the real origin was the choice that kept those working.

What your comment made me check is whether that reasoning covers the whole case, and it does not. Guest play does not touch the cookie at all,  it runs off a query parameter, so a guest-only embed would work where a full one cannot. That is a genuinely different option than the one I ruled out, and I am looking at what it would take.

Appreciate you spending this much thought on a page you had no stake in.