| Author |
Message |
|
| cloudy97 |
 Posted: Sun Nov 26, 2006 8:28 pm |
|
|
Joined: 24 Nov 2006
Posts: 10
|
| I remember that Ryzom's client was originally intended to be open source. Was this idea canceled because of security issues - like botting or such? |
|
|
| Back to top |
|
| Xavier Antoviaque |
| Posted: Sun Nov 26, 2006 11:34 pm |
|
|
Joined: 15 Nov 2006
Posts: 396
|
cloudy97 wrote: I remember that Ryzom's client was originally intended to be open source. Was this idea canceled because of security issues - like botting or such?
No, it was canceled for political and economical reasons ; I can't be more specific, since it's up to Nevrax to explain the exact reasons, but security hasn't played a role here.
However, it is still an interesting question. Most, if not all, MMOs have a security though obscurity approach on this subject, and rely on the fact that it is hard to do reverse engineering on software to find security leaks and exploit the game. But we know this doesn't prevent hackers/crackers to find their way around.
Now, through security by design, you can theorically prevent these exploits - that's the old "never trust the client" motto. But in real life, despite what the designers say, MMOs tend to trust the clients on some parts.
The good thing here, and what makes the good reputation of Free Software regarding security, is the fact that “given enough eyes, all bugs are shallow” (Raymond, 2000), and if somebody can find a way to exploit, another one can even more easily find a way to fix the bug - which means fixes for exploits tend to be ready very quickly in Free Software projects.
Good point though, that's definitely something we will need to keep an eye on. |
_________________
Xavier. |
|
| Back to top |
|
| quim.rovira |
| Posted: Mon Nov 27, 2006 9:40 am |
|
|
Joined: 26 Nov 2006
Posts: 100
Location: Barcelona
|
Noone could have explained this batter :)
I would add an extra silogism, though:
If Ryzom is opensource, anyone can see how it works and modify it. That's the same thing that happens with many other open-source projects.. like Apache, which is an industry-standard web server (and it's known to be secure or at least, get their flaws fixed in a really quick way).
So, in a few words.. Ryzom could be (in)secure as any other open source project. |
_________________
Free as in Freedom - More power to the players |
|
| Back to top |
|
| Zero_tacg |
| Posted: Mon Nov 27, 2006 3:02 pm |
|
|
Joined: 27 Nov 2006
Posts: 17
|
mostly it wouldn't buffer at all cause Ryzom is massivley based server side so most things are checked by the server etc.
the most exploits that will get possible/easier already exist right now |
|
|
| Back to top |
|
| sfb |
| Posted: Tue Nov 28, 2006 4:30 am |
|
|
Joined: 28 Nov 2006
Posts: 46
Location: Minnesota, USA
|
I would like to make one comment about MMO security in Open Source. Every project and application, open-source or closed-source, suffers some security breach. No person or application is perfect. That means there are two ways to measure the security success of a project:
1) Number of vulnerabilities/breaches in the project
2) The time to repair/patch.
Neither of these strike me as the sole domain of a closed-source commercial company. The argument must then be that exploiters have access to the code and therefore they can find vulnerabilities faster (security through obscurity, a largely broken and shunned model in the eyes of most security experts.) But the flip side of this is that because anyone has access to the source code anyone can, conversely, fix the problem.
Linux benefits from this very benefit. Frankly I can't remember the specific issue but there was a problem with the design of the TCP/IP stack in both Linux and Windows. It was a fairly big deal, on the scale of Blaster. It took the Linux less than a day to find the fix and get it into a nightly release of the Linux kernel for affected parties to update to. It took Microsoft several weeks due to the red-tape and lack of eyes.
I do not believe that closed-source projects would be inherently more secure than an open-source one. |
|
|
| Back to top |
|
| Aprak |
| Posted: Sun Dec 03, 2006 12:51 am |
|
|
Joined: 02 Dec 2006
Posts: 60
Location: Stockholm, Sweden
|
cloudy97 wrote: I remember that Ryzom's client was originally intended to be open source. Was this idea canceled because of security issues - like botting or such?
Yea, I remember this too all to well also ;(
Besides, botting was really never a problem with the current client either.
The more eyes the safer - I'd say (too)...
My guess from a laymans 10 cents worth of believe, is that "security" was never the big issue (at least not player security). Protection of the holy "intellectual property" was. (This can however be stolen nevertheless... )
Not that I mind paying, and not that I mind people protecting their right to get payed for their work. It's just that using a crappy OS as an excuse for doing that, it just makes me sad... |
_________________
FREEEEEEEEEEEDOM!
/Aprak
http://cea-history.blogspot.com/
http://kato.homelinux.org/~aprak/ |
|
| Back to top |
|
| sfb |
| Posted: Sun Dec 03, 2006 3:10 pm |
|
|
Joined: 28 Nov 2006
Posts: 46
Location: Minnesota, USA
|
I think Aprak nailed it right on the head. Closing the source has little to do with game security and the integrity of game data/player data/customer data. It almost always has to do with protection of intellectual property and fears that some competitor is going to steal your code and one-up you. This is a claim that GPL largely mitigates (unlike some of the more commercial friendly, liberal licenses) because your competitor is legally obligated to return his one-up to you and vice versa.
Granted, like Planeshift, the competitor could keep game logic (if scripted, for example) and game data (both server database and client content) in a proprietary license. But it stands that often one games models and animations rarely translate nicely to another games look and feel. |
|
|
| Back to top |
|
