BASHING IN

With over 238 million copies sold, according to publisher Microsoft, Minecraft is the best-selling game of all time. It’s a huge hit with younger players and their friends who can work together in its virtual worlds made up of blocky, colorful 3D graphics and easy-to-learn gameplay. 

But one new web-based gaming service that allows you to play Minecraft right through your browser — Bash.gg — is crying foul after being banned from Widefield School District 3’s computers. The service says they were notified by WSD3 students that the district had held a “handbook assembly” to tell students not to use their service and that Bash.gg were “hackers” who were “trying to find [out their] account passwords.”

Bash.gg was originally founded to work on blockchain-related projects, but founder and CEO Kyle Zappitell says they’ve dropped blockchain entirely as the company changed strategies. A May 2022 press release reveals that Bash.gg pivoted to compete with “monopolistic” digital storefronts like Steam, Apple’s App Store and the Google Play app store by offering developers more revenue share than those marketplaces (Bash.gg says they take 15 percent of a game’s purchase price versus the others’ 30 percent.) Their team is small — a distributed group of five — and Zappitell says they all wear many hats in their early startup phase.

As a software engineer at Microsoft, Zappitell worked on the company’s PC and mobile Xbox apps. He was inspired to make video gaming more accessible via customers’ phones or Chromebooks without the need for a full-sized computer or dedicated gaming hardware. He left Microsoft to found Bash.gg, a portal that offers simpler, web-based games, similar to sites like Newgrounds, Kongregate and Miniclip, with ambitions of offering gamers the ability to play Fortnite and Call of Duty: Warzone.

Zappitell is very clear about why their gaming service targets young students — citing Snapchat’s initial popularity among middle schoolers and the desirability of games like Minecraft, Fortnite and Roblox — and he’s excited to see so many young gamers use their service. “The way I look at it, any big technological shift, especially social-technological or even software, seemingly starts with middle schoolers and high schoolers.” He says traffic on the service spikes around students’ lunch time and then in the afternoon as they get home.

But did Widefield’s school district really tell students that Bash.gg were hackers trying to steal their passwords? And did they hold assemblies dissuading them from using their service? Sixty35 got in touch with Carlos Lopez, the district’s director of technology services, who explained that the district did ban the site from school computers, but they held no assemblies and conducted no information campaigns about the site otherwise.

“Our department really is technology-friendly,” Lopez says. “It would be difficult to staff [this] department with individuals who are anti-technology. Many of our staff members and team members probably go home and take an active role in gaming as well.” Lopez points out that the district even supports eSports programs in two of their schools — and hopes to add more in the future. “I want to be really clear: We have nothing against gaming or any platform for gaming,” he says. “We are not organizing assemblies throughout our district to say use this or don’t use the other.”

So what led to the ban? Lopez says that a student in an unspecified WSD3 school was using Bash.gg to play games in class, which bypassed both the school’s web filters and the teacher’s remote screen monitoring program. This alerted the teacher and the issue escalated. The district implements web filters to screen out inappropriate content like pornography, gambling and violence, but also to ensure the safety and security of its students.

Bash.gg seems to have built a reputation as a means to bypass school security programs to play games like Minecraft. A YouTube video with the title “How to play Minecraft On a chromebook 2023 (WORKING)” has over 6,000 views and features a user signing into Bash.gg to play the game. Commenters ask if it’ll work on school Chromebooks and proclaim their success (or failure) in getting the game to work with the prescribed method. 

Lopez points out a neon pink banner along the top of Bash.gg’s site that reads “bash.gg blocked at your school? Try this fresh, unblocked domain” followed by another web address that allows students to continue to access the site, bypassing school filters. WSD3 opted to ban not just Bash.gg, but all of its subsequent proxy URLs as they’re discovered. Zappitell’s version of events correlates with this. 

“My inkling is that they tried to ban us, and then we changed out the domain so that the kids could still access it and I think [WSD3] got upset with that,” he says.

When the district held an assembly about digital citizenship and the danger of circumventing school filters, Lopez believes that a group of student gamers went to Bash.gg about it, who then reached out to the media. Lopez was not at the assembly but doesn’t believe the site was brought up specifically.

The site’s privacy policy explicitly states that they “do not knowingly allow anyone under eighteen (18) to provide any personally identifying information to us without the express permission of a parent or guardian,” but as Lopez points out, this speaks contrary to Bash.gg’s encouraging students to subvert school filters to access it. The site does not warn users to consult an adult if they are underage, nor does the service verify the user’s age.

Zappitell describes Bash.gg’s site as an “aggregator” and a glance at Bash.gg’s offerings reveals a small collection of demos, casual games Snake and 2048, and then Minecraft, all of which are free to play through the site. He explains they have direct relationships with developers who asked to be on the site, so there are a pair of games available for purchase as of the time of this writing.

Bash.gg’s collection of games includes errors and distorted graphics and lacks content warnings for its games, such as industry-standard ESRB ratings for applicable titles. Their description for the popular action game Vampire Survivors, whose title is misspelled on their site, reads “This is the demo version. The full version can be purchased on steam,” which is a rival platform, but not through Bash.gg.

But logging into the service and playing Bash.gg’s Minecraft, which only requires e-mail verification, reveals more. Alongside a clearly misspelled title graphic (it reads “Mincerat” instead of “Minecraft”), the main menu reveals that this is the “eaglercraft” version — an unauthorized, cracked version designed to bypass the game’s digital rights management and work in web browsers. The version number is 1.5.2, which was originally released in May 2013, meaning it lacks a decade’s worth of improvements and added features compared to the legitimate game. In our interview, Zappitell explained that in the case of games like Minecraft, they “find it on another site and display it on [Bash.gg’s] site.”

When asked if Bash.gg had any direct relationships with school districts in Colorado, Texas or Michigan, where Zappitell says they’re experiencing growth, he says they haven’t, but that they have reached out to five unspecified schools directly. Told WSD3’s position, Zappitell says he understands the district’s perspective.

“At this point, we feel fairly confident that the kids love our site,” he says. “And then, of course, we have to make both parents and faculty members feel confident that this is a great site for kids to learn and socialize and grow [as well].”

But Zappitell was also agitated that multiple attempts to reach the individual WSD3 school where the initial incident occurred went unreturned and Bash.gg had not been provided instructions to contact the school district directly.

“Rather than talking to us about it, they decided to go the route of spreading misinformation to these kids, which I thought was honestly really shocking because they’re a government-funded institution that shouldn’t be lying to kids,” he says. “It was very frustrating for us, especially because they were unwilling to actually talk to us about it.”

As of this writing, Lopez has not heard from Zappitell nor has Bash.gg taken down its pink banner redirecting students to unfiltered domains.

Lopez says WSD3 has policies in place when adding technological services for its users and that the district regularly receive unsolicited offers and promotions it may investigate. While he says WSD3 would normally have no issue engaging in a conversation with a games portal like Bash.gg — the district can’t police every website that its students can engage with, gaming or otherwise — it seems clear that won’t be possible now.

Lopez says, “I would not support any vendor who demonstrates the practices and argumentative style I am experiencing from Bash.gg.”