XyliGUN wrote on Thu, 03 March 2011 14:38

it's still unclear for me how it can be tested better than it's been tested so far.

The more people / games test it, the better!

Report message to a moderator

XyliGUN wrote on Wed, 02 March 2011 00:20

Well, this one could be done quite easily, but so far I'd concentrate on anti-cheating tools.

Fair enough. But bear in mind that these "simple" infodumpers would also serve to test your core code and get it exposed to a wider variety of cases, besides the significant usefulness they'd have for almost everyone.

Report message to a moderator

BlueTurbit

Except in this case it's the Russian Commander who is hacking the code and contemplating revealing the information.

No, no, I didn't hack it actually, it was done by others, I just found their results and use it as a start point.

Report message to a moderator

[Updated on: Thu, 03 March 2011 21:05]

Report message to a moderator

Eagle of Fire wrote on Fri, 04 March 2011 13:04

Quote: It's time we abandon "security by obscurity" and opt for real security. You don't seem to get it... If this tool get widely available then it will be great. But if the info on how to get the info from the files get widely available, then it will turn everything into chaos outside of AH. The advantage of AH is that it can be automated... But in a duel, even if the host (who should be playing anyways) clean the file he send to his opponent... He can still pretend to do it on his side but use a tool to get the infos he needs. There is no better security than by obscurity in this case. If a tool to find those info get common knowledge then no games outside of AH will be safe from cheating and there will be no way to give the benefit of the doubt because certainty will be gone by proxy.

As I said, such things are already run on honour.

A hacked Stars! exe to bypass password protection has already been done IIRC. That's why SAH has upload passwords.

[Updated on: Thu, 03 March 2011 21:23]

Report message to a moderator

[Updated on: Thu, 03 March 2011 22:51]

Report message to a moderator

[Updated on: Fri, 04 March 2011 02:44]

Report message to a moderator

Btw, I forget to ask, whether you think cleaner and/or verifier itself should be pubilically available?

PS: Details on hidden data of m file was sent to Ron.

[Updated on: Fri, 04 March 2011 12:05]

Report message to a moderator

Eagle of Fire wrote on Fri, 04 March 2011 03:04

There is no better security than by obscurity in this case.

That's never been true, and is of course false here too. We've had to put up with that crappy "security by obscurity" (which actually translates as "ignorance is bliss") because we had no other option.

We now have a better option, one that can potentially crush every cheat, everywhere. Widespread knowledge of the tools will be at least as pervasive as the knowledge of any new cheats, in much the same way monster races became widespread in their day.

When the tool maker claims he can stomp cheats nobody has ever discovered, how can anyone still prefer the old delusion of security? And that's not including the likely improvements that others could add.

Stop cowering in fear and wake up!

Report message to a moderator

XyliGUN wrote on Fri, 04 March 2011 13:32

Btw, I forget to ask, whether you think cleaner and/or verifier itself should be pubilically available?

Available, and with source code, for better scrutiny, testing, and improvement.

Report message to a moderator

Eagle of Fire wrote on Fri, 04 March 2011 03:04

if the host (who should be playing anyways) clean the file he send to his opponent... He can still pretend to do it on his side but use a tool to get the infos he needs.

... and you know this isn't happening already, because... ?

Report message to a moderator

Report message to a moderator

XyliGUN wrote on Fri, 04 March 2011 23:32

Btw, I forget to ask, whether you think cleaner and/or verifier itself should be pubilically available?

Yes, absolutely.

Eagle of Fire wrote on Sat, 05 March 2011 16:20

Quote: We now have a better option, one that can potentially crush every cheat The thread started made a point to say that it was impossible to actually prevent all kind of cheating. All what this does is to clean the turn file in the very unlikely case that someone with enough programming knowledge will bother go check there for hidden information... Look, if we could simply rewrite the code itself so it doesn't do that anymore and force everybody to use the new version because it is less prone to cheats, fine. But to create utilities after utilities hoping everybody will use it? That's wishful thinking. There is another world outside of AH, which everybody here seem to forget too easily.

I... don't see your point.

Of what are you afeard, good sir?

Report message to a moderator

Eagle of Fire wrote on Sat, 05 March 2011 06:20

The thread started made a point to say that it was impossible to actually prevent all kind of cheating. All what this does is to clean the turn file in the very unlikely case that someone with enough programming knowledge will bother go check there for hidden information...

Not so unlikely. It's happened before. It's likely it'll be happening again.

And please read the rest of the thread. We are talking about an x-file checker/sanitizer too. That's the real security needed to stomp all kinds of cheating.

Quote:

to create utilities after utilities hoping everybody will use it? That's wishful thinking. There is another world outside of AH, which everybody here seem to forget too easily.

And the big flaw in your logic is again that the "outside" world will either ignore our doings or take good note of them and use our tools. The one or the other, not the unlikely halfway that worries you so much.

Report message to a moderator

m.a@stars wrote on Sat, 05 March 2011 21:04

Quote: to create utilities after utilities hoping everybody will use it? That's wishful thinking. There is another world outside of AH, which everybody here seem to forget too easily. And the big flaw in your logic is again that the "outside" world will either ignore our doings or take good note of them and use our tools. The one or the other, not the unlikely halfway that worries you so much.

Or use the tool, but not bother to figure out how to cheat, since the former will likely be stickied. That works too.

Report message to a moderator

Report message to a moderator

Report message to a moderator

Report message to a moderator

Quote:

Or use the tool, but not bother to figure out how to cheat, since the former will likely be stickied. That works too.

That's exactly my point.

If others who think I am not reading the thread would read the thread themselves, they'd understand I have no issue with the sanitizer being used by AH. In fact, we are not even talking about that anymore since about a page and a half?

Report message to a moderator

Eagle of Fire wrote on Sun, 06 March 2011 07:45

Quote: Or use the tool, but not bother to figure out how to cheat, since the former will likely be stickied. That works too. That's exactly my point. If others who think I am not reading the thread would read the thread themselves, they'd understand I have no issue with the sanitizer being used by AH. In fact, we are not even talking about that anymore since about a page and a half?

Um... I'm not talking about AH either.

Report message to a moderator

Report message to a moderator

Report message to a moderator

XyliGUN wrote on Sat, 05 March 2011 08:01

nmid So when is it going to be released? Cleaner is completed and already shipped to Ron with all details on what does it zeroed, but I'm not sure whether he going to ever deploy it on SAH, so may be Ron can comment on this. As of verifier - it's not ready yet. There is nothing impossible, but there are about 20 actions (with different subactions), which needs to be verified and it will take some time to make verifier ready enough. So, sorry, but don't expect a quick results here.

XyliGUN has sent me an email detailing what cleaner does and I'm surprised by the amount of stuff stored in the .m files that is not shown to the user. I'm also confused as to why Stars! would put that info in there anyway.

I'm working with XyliGUN and do intend to use the cleaner utility on games on Stars! AutoHost. At the moment, I think I'll make it an option for the game host to decide for his/her game's files to be cleaned or not. Or do you think it should be mandatory for all games?

Personally, I wish that we knew the exact format of all the Stars! files. As for them being encrypted, I wish the game host could decide if they wanted them to be encrypted or not.

If a third-party host created the game based on a .def file, and the actual game host didn't have access to the .hst or player's .m / .x files, and if the game's .m files were run through Cleaner before players downloaded them,then it seems to me that that would be the best way to ensure that cheating would be as minimized as possible. The Verifier util would, I hope, just about stop cheating cold.

I understand completely that some players don't like Stars! AutoHost and prefer to run their own games outside of SAH. I don't like the idea that utilities of this sort, if only deployed on SAH would force players to use SAH, perhaps against their will. Everyone should have a choice, and I would not like to take away someone's choice.

If these tools and/or their source code was released to the public, then only on a setup like SAH could players rest assured that cheating was not possible, or at least as minimized as we can make it. It all comes down to trust. Even now, without these tools out in public, players in non-SAH hosted games have to trust their game hosts, especially if the game host is playing in the game.

It sure seems like a fine line to me. But since some have figured out Stars! file encryption, I guess these type of utilities should be released to the world (after Verifier is working)and let players and hosts decide where they want to have their games hosted.

Report message to a moderator

Report message to a moderator

XyliGUN wrote on Sat, 05 March 2011 14:01

As of verifier - it's not ready yet. There is nothing impossible, but there are about 20 actions (with different subactions), which needs to be verified and it will take some time to make verifier ready enough. So, sorry, but don't expect a quick results here.

If you need help with that, of any kind, I'll be glad to lend what experience I have in building/debugging similar tools.

From PaulCr's attempts, I gather most of these actions aren't that hard to detect.

Report message to a moderator