Skip to main content

Indie game storeFree gamesFun gamesHorror games
Game developmentAssetsComics
SalesBundles
Jobs
TagsGame Engines

October updates on indexing

A topic by leafo created 1 day ago Views: 1,061 Replies: 16
Viewing posts 1 to 11
Admin (7 edits) (+19)

Hello everyone! Just wanted to give an update for the indexing issues many have experienced. We know it’s the most frequent pain point new developers have publishing content on itch.io. We’re sorry it’s taken so long to fully address.

Our “needs review” internal flag system was originally designed to be very cautious. We have a series of classifiers and heuristics that run on every published and edited page to see if there’s something about the page that would require a human to review it before it can be eligible for indexing.

We get a lot of scammers and spammers uploading every day. Unfortunately, the way we’ve tuned and maintained the scanner over the years has created a lot of “false positives,” legitimate projects that were stuck waiting for review, and we didn’t have the staff resources to clear out those queues manually.

We’ve spent the past week updating and tweaking our classifier rules substantially, including finding a handful of bugs along the way where pages would unfairly get tagged for review. We’re also changing our philosophy on how games get queued as well. We feel we have better secondary detection mechanisms now for malware, spam, etc. so we’re making our review requirements much less strict.

This is kind of an experiment. We’re hoping opening the floodgates doesn’t lead to a bunch of malicious pages showing up, so we’re keeping a close eye on things and will continue to tweak on a daily basis.

That said, in the past week we’ve released about 215,000 project pages that were previously blocked from being eligible for indexing. That now puts our total number of indexed pages well over 2 million. 🎉 Over the same time period we’ve suspended and banned over 10,000 accounts attempting to distribute malware and spam.

I know the next issue many people have with this system is lack of communication to the developer about their indexing status. I hope to address that soon as well. Once we get a bit more comfortable with the current set of rules, we want to make the specific reasons why a page might not be eligible to be very clear. Unfortunately there will always be a bit of mystery to how the system works, as we have malicious actors every day trying to reverse engineer our systems to figure out how to get their spam and malware to show up in front of real people.

Given the state of the world with AI and LLMs, this type of problem is only going to get harder. Bad actors have access to more resources and more sophisticated systems to circumvent protections. I just wanted to mention this to ask for your patience as we deal with this stuff. Our indexing system is by no means perfect, this is only only step towards trying to make it better. Ever since I created itch.io, it’s always been my goal to ensure that developers can freely publish pages. (Did you know Steam Greenlight was the original motivator?) I know many people discussing the indexing issues online often float around the idea that we should charge for publishing like Steam. We will not be doing this.

Thanks, if you have any feedback feel free to leave it in this thread. Please do not post any requests to review your account for indexing eligibility in this thread, support requests should be sent to support or you can post in Questions & Support.

(+1)

Huzzah!


Indexing requests are by far the biggest complaint I've saw about Itch,  and as a dev I've felt always a bit uneasy with the creation of new projects if there was a chance those might've been more hidden, happy to see more tinkering on that side!

(+1)

Thank you, this is wonderful. Does this mean games won't take weeks to be indexed anymore?

Admin(+2)

Since the total volume of stuff queued for review is much smaller now, humans should be able to get to stuff faster so there hopefully should be less delay for those pages that still need review.

(+2)

very good news

(+2)

i can finally see my projects when searching, i am so happy

(4 edits)

So I have a question about this, based on my past experience with a deindexed game (this update might have fixed it, which is very cool). Specifically, I had a game that was (probably) detected as malware, which I later realized was probably because of two factors: it was embedded pck + was (by default) making requests to the itch API to show a version info box.

I'm wondering if, in the new system, in scenarios like this, is it worth uploading a new version of the game that fixes the suspicious features (i.e. drops the network request, etc)? I hadn't bothered at the time as it didn't seem like there was any reason to expect it to make a difference, but it seems like maybe that will be at least worth a try in the future (even if it doesn't always work out).

Admin(+1)

Making requests to the itch.io api isn’t considered suspicious and it’s very unlikely it had any connection to the restriction on your page.

my game is finally getting the views its deserved but never really gotten thanks!

(1 edit)

flabbergasted that it took this long and that it is even being fixed, the tragedy has ended but I'd much preferred this didn't happen to begin with.
the casually dropped "yeah just 200k yk small mistakes whoopsies", you don't miss this without some intentionality.

Given the state of the world with AI and LLMs, this type of problem is only going to get harder.

Oh yes.

There is even bots talking in forum. You might want to make /docs/creators/quality-guidelines#avoid-uploading-excessive-amoun... more clear and also include bot operated accounts specifically. I mean, actually the cloudflare protection asks, if a user is a bot, so ai agents already violate rules when accessing Itch at that point.

Notifying publishers about this rule with a little popup when they upload a lot, might be a good idea to discourage the honest ai enthusiasts from spamming and botting. So that it is easier to detect the bad actors.

There is a bot account with over 500 indexed projects. Now that Itch staff has more time, they could focus more on weeding out bad actors like that - without waiting on reports. Unless of course, this is the type of content creator Itch wants on the platform. Mass uploaders are easily findable and if they do not have a good reason for mass uploading, they are probably a bad actor and should be scrutinized.

We feel we have better secondary detection mechanisms now for malware

Fingers crossed. I saw over 1000 malware uploads. That were malware uploaders that were indexed. It made me sick, and I had to stop.

(2 edits)

I know the next issue many people have with this system is lack of communication to the developer about their indexing status. I hope to address that soon as well. Once we get a bit more comfortable with the current set of rules, we want to make the specific reasons why a page might not be eligible to be very clear. Unfortunately there will always be a bit of mystery to how the system works, as we have malicious actors every day trying to reverse engineer our systems to figure out how to get their spam and malware to show up in front of real people.

I think it would be extremely helpful to have an “indexed / not indexed” status tag on the project page alongside the green “published” tag, along with the reason for non-indexing and steps to resolve it independently. This would reduce a lot of frustration and significantly decrease the volume of support requests and forum posts.

I know many people discussing the indexing issues online often float around the idea that we should charge for publishing like Steam. We will not be doing this.

Does this also apply to the “refundable deposit” model I proposed and discussed in this thread? Just so I know, so I avoid bringing it up again in the future. Thanks!

Admin(+2)

No plans to charge anything for publishing a game, even if it’s refundable.

As I mentioned in the thread linked in my previous post, my proposal isn’t about publishing, but indexing and precisely because I fully understand the desire to keep the core assumptions of the former unchanged. However, I believe these two aspects are different and could therefore be handled differently. Of course, this is just a simple suggestion, but I do think it has some merit.

Admin(+2)

Indexing eligibility comes free with publishing in my mind, assuming the page meets our indexing requirements.

(1 edit)

Believe me, it’s not that I don’t understand your point of view, in fact, I agree with it in principle. The issue is that I believe (and I don’t think I’m the only one, quite the contrary) that it would be appropriate to put up a dam against the tide of slop and shovelware that (unfortunately) manages to get past what should be the checks designed to prevent its indexing (or at least, I assume that’s the intent; I have no reason to assume otherwise, but I could be wrong, and as far as you guys are concerned, the problem might not even exist).

The point would be to create the best possible conditions for developers of high-quality software and to limit slop as much as possible. This would help them and it would help you too, since high-quality products that are easy to find create a good overall impression and, consequently, good sales.

Keep in mind that I’m speaking as an entrepreneur of 35 years, so my perspective is perhaps a bit too business-oriented, whereas you might prefer a more “anarchic” approach (in the best sense of the word, obviously). If that’s the case, then things change, though I’m not sure to what extent being flooded with low-quality products can ever be a competitive advantage, and there’s a real risk of being submerged by the tide, especially today with AI (which, when used thoughtfully, is a great tool, but unfortunately is often used recklessly).

Thanks for the discussion, in any case.

(4 edits)

Fingers crossed. I saw over 1000 malware uploads. That were malware uploaders that were indexed. It made me sick, and I had to stop.

Yes, if I’m not mistaken, I read elsewhere where you brought up this issue, which is undoubtedly one of the most serious and pressing ones to address. In my view, they should tackle this on two fronts:

  • Proactive: by implementing automated checks that are as strict and effective as possible, to nip the upload of compromised files in the bud (whether intentional or not, since sometimes a virus or malware can creep in without any malicious intent from the uploader, but the end result remains the same and should be prevented).

  • Reactive: by creating a privileged, dedicated support channel for these types of reports, as well as for other equally important ones (for instance, I read about a user who repeatedly reported child sexual material “hidden” inside an indexed NSFW program retrievable via search, without success).

I hope this aspect will be addressed as soon as possible.