Goblin Squad Member
|
One concept of the game is three parts
the server,
the client ,
the interface between the two.
Exploits (hackers address all three, but the last two are evident on the players machine for reverse engineering).
Consider.
The server is very proprietary, esp. with all the player specific information.
The interface is 'proprietary' but is subject to monitoring the traffic.
Why not publish that and allow the net to point out vulnerabilities. Note this information allows some to send messages faster that the normal client.
Limit messages and use advanced encryption controls to limit messages under other names.
Some time after OE, the hackers, and skanks will have this figured out. Without publishing, this will be a route to hacking system. Publishing earlier world allow community to detect problem. (Sorry I am too far out of S/w dev to really know how to do this. One way or another this will get out to all or to just those most intending to hack the system.]
The client eventually needs to be open source. There will be clients which are not official, but get users advantages from the point of view. Goblin Works can not even imagine hat those interests are. But the server needs to be fixed and controlling of bandwidth of inputs from client.
Open source clients will gain advantages of having a bigger development/testing teams.
Interface will also benefit from same benefits.
Open source can lead to earlier detection and resolution of issues.
I am not sure you r are ready for public servers, but public clients and interfaces can deliver a better product. (with bandwidth limitation on interface, including denial of those exceeding limits.
I would provide better detail, but I am 12 years out of S/W dev.
Lam
|
Goblin Squad Member
|
One concept of the game is three parts
the server,
the client ,
the interface between the two.Exploits (hackers address all three, but the last two are evident on the players machine for reverse engineering).
Consider.
The server is very proprietary, esp. with all the player specific information.
The interface is 'proprietary' but is subject to monitoring the traffic.
Why not publish that and allow the net to point out vulnerabilities. Note this information allows some to send messages faster that the normal client.
Limit messages and use advanced encryption controls to limit messages under other names.
Some time after OE, the hackers, and skanks will have this figured out. Without publishing, this will be a route to hacking system. Publishing earlier world allow community to detect problem. (Sorry I am too far out of S/w dev to really know how to do this. One way or another this will get out to all or to just those most intending to hack the system.]
The client eventually needs to be open source. There will be clients which are not official, but get users advantages from the point of view. Goblin Works can not even imagine hat those interests are. But the server needs to be fixed and controlling of bandwidth of inputs from client.
Open source clients will gain advantages of having a bigger development/testing teams.
Interface will also benefit from same benefits.
Open source can lead to earlier detection and resolution of issues.
I am not sure you r are ready for public servers, but public clients and interfaces can deliver a better product. (with bandwidth limitation on interface, including denial of those exceeding limits.
I would provide better detail, but I am 12 years out of S/W dev.
Lam
The issue with open source in large scale projects like MMORPG's, lies directly in the portion of, no one group is in position to make the decision to make it open source. PFO is a project involving unity, and I'm sure a few other licensed commodities. GW doesn't have the authority to open unity's source code, and I wouldn't be supprised if there were a few other components that they are working on or with in which they also don't have the rights.
Ryan himself is more or less one who understands the benefits of open development. He created the Open gaming license, which basically did to table top RPG books, what open source does for software (IE permits other people to develop using the rules creatures etc... without having to skirt around copyrights). But when it comes to legality, you can't give away what you don't own.
|
Goblin Squad Member
|
GW can not make the game Open Source due to the licensing agreements for use of the Unity Engine, and any Middleware they are using.
They could do Open Source ONLY IF they built the engine from scratch and doing so would take a lot of time, money and resources to make, the same would be applied to all the tools they would need to make.
GW wants to make PFO quickly and cost effective, and in doing so has to make a few sacrifices.
|
Goblin Squad Member
|
The issue with open source in large scale projects like MMORPG's, lies directly in the portion of, no one group is in position to make the decision to make it open source. PFO is a project involving unity, and I'm sure a few other licensed... Ryan ... Open gaming...
Thanks, Onishi. I'd been waiting for a relevant place to link this neat interview I found recently. This post will do nicely.
Threadjack over, nothing to see here.
|
Goblin Squad Member
|
OK,NP.
This was never about server Open source.
At some point some will determine and exploit the interface between client sever (not hacking , but cracking -- please get terminology right).
Once THEY have cracked the interface, they will exploit it. If it is proprietary interface used else where, they have already exploited it. Ask you providers and get them to sign that no product has been cracked --it has.
Open source has problems; it is not a cure all. But it is good at exposing weak points in interfaces and widely distributed executeables.
Keep private code as private as you can.
f you are worried about cracking, the client and the interface defintion are the roads to your server innards.
Your decision on this will not make or break my attendance, by it self. I do not envy your developers (well a little, but I am not there in my life).
Call me Lam d' Cork
Goblinworks Executive Founder
|
Why do you think that it is harder to hack (crack/hack distinction was deprecated a long time ago) an interface that you have the source and full documentation for?
At least a proprietary protocol can implement some obscurity crypto (say things in a format that the attacker has to spend some effort decoding).
|
Goblinworks Executive Founder
|
I understand the way that open source detects more bugs; I'm asking why the expected security contribution from allowing independent white hats to review the code is greater than the security deficit caused by giving grey and black hats direct access; I don't expect the black hats to share the vulnerabilities they find, I expect them to exploit them.
I suspect that the incentive structure is such that more vulnerabilities will be discovered and exploited than are discovered and patched- even considering a bounty system offered for such vulnerabilities.
|
Goblin Squad Member
|
I understand the way that open source detects more bugs; I'm asking why the expected security contribution from allowing independent white hats to review the code is greater than the security deficit caused by giving grey and black hats direct access; I don't expect the black hats to share the vulnerabilities they find, I expect them to exploit them.
I suspect that the incentive structure is such that more vulnerabilities will be discovered and exploited than are discovered and patched- even considering a bounty system offered for such vulnerabilities.
Well in some cases, I would say the black hats having the code and getting exploits in early on isn't a bad thing either. We all know, eventually things are going to get used, exploited etc... and the dev's most likely are going to have a good bunch of them in which they have to re-actively patch. Ignoring the pro-active benefits, which is worse. Black hats taking advantage of 6 key exploits in month 2 of EE, with a roleback and patches in month 3, or exploits being discovered in month 9, 11, 12, 14, 18 and 19 of the games life. In addition to fixing a less finalized code, the sooner the exploit hits, the less code that might be built on top of the exploits (which makes patching them far less difficult and intrusive)
In financial industry, or a widely used operating system, there is the 0 day market, which black hat hackers may make more use of, IE hanging on to the exploit for months or years, either to sell to a high bidding hacker, or waiting for themselves to have the technology to take advantage of to 100% maximize their profit from the exploit. In an MMO though, there's a pretty limited value for exploits. Beyond a gold duping exploit to open an illegal gold selling site, there isn't much profit to be made beyond a short term advantage that may as well be used as soon as you find it. Which once it is being used, that pushes it to the forefront of the developers as well as the white hat hackers who might want to figure out a patch.
Again though, it is all moot. GW couldn't make the game open source if it were all gain and no loss, because at least from my understanding, they only actually own 25% or so of the actual code of what they are using. For the most part, their "code", is tying together different assets of which they have licensed. (not to depreciate the technical feat that is, but it is very little asset to a hobbyist coder).
|
Goblin Squad Member
|
It works for large scale Open Source Software like Linux because you have many thousands of competent programmers looking at the code. You won't get the same coverage on a niche MMO.
I think this is a very valid statement. Even as a software engineer myself, I would have little desire to go hunting down PFO security issues as a hobby when I could instead be playing the game.
I am not against Open Source as a model, but I do not think it will address the problem sets imagined.
Another thing to bear in mind is that many MMOs have a check for edited executable and game data files as part of their security system. Having an open source client to allow people to make changes and customizations is pointless in such cases, as they'd never be able to connect to the server in the first place. Either that, or you'd also have to open-source the software doing the scanning to allow it to submit the correct checksums, making it useless.
Much better to go with customization via an end-user addon/scripting system. Have the community focus on adding value to the client via these, rather than contributing to it directly.