Server Help :: View topic - Metaspace Suggestions

Server Help

Trash Talk - Metaspace Suggestions

Anonymous - Wed Apr 07, 2004 6:46 am
Post subject: Metaspace Suggestions

You know I am still writing my Metaspace client solution for subgame2 based server systems. I placed this thread into "trash talk" because many people think the project is trash

_
This threads should be a place to suggest new features to my client, which the original subspace or continuum client doesn't have yet.
_
Of course I'll implement a new kind of graphics engine to render wireframes instead of cutting bitmaps together. Even if it's based on blitting. But it'll use opengl hardware acceleration.
_
If you have any other suggestions, at example for graphics, maybe a particle generator, suggest it here and i'll try to implement. I think the graphics of subspace could be much more improved.

Smong - Wed Apr 07, 2004 6:55 am
Post subject:

I think it should try and keep track of the items each player has. So if metaspace thinks XYZ has 3 thors, but they fire 4, then it can use ?cheater on them.

Or if they keep greening brick, when it isn't even in the prizeweight, or there are other things in the prizeweights that you are more likely to pick up.

Or if they pick up a flag/ball when they are no where near it. While I'm at it, also if they don't drop the flags when the time runs out, or don't fire the ball when the time runs out.

I think there should be an option to change screen resolution.

Anonymous - Wed Apr 07, 2004 7:16 am
Post subject:

Hello, Smong. Thanks for your opinion!

Quote:

I think there should be an option to change screen resolution.

Changing screen resolution at the Metaspace Client/Server (Client for CONT, Server for web) will be possible at local. Changing screen resolution for the web-specs... maybe but the project becomes more and more a full client/server system downwards compatible to subgame and not only a spectator service for the web.

Compatiblity to subgame2 will be a problem because of the encryption and the checksum system even if I think checksum will be the bigger problem.
But maybe I keep webspec support as an option in the end. But it seems to become more than just that but a full client on the localhost which runs it.

Qndre

Anonymous - Wed Apr 07, 2004 7:19 am
Post subject:

Addition:

This client/server project should make CONT platform indipendant (at example linux compatible) like ASSS does but not only for the server but also for the client.

Qndre - Sat May 08, 2004 12:39 pm
Post subject:

Report in between:
Metaspace has grown and became a full client (no SPEC service for the browser any more).
_
You're right! It doesn't make any sense without C++. I'm just learning it. Already found a solution to log in to a ContinuumOnly zone with a given "scrty1" file stolen out of the server's directory, but haven't implemented it yet (it's just some pseudo C-code). Since this isn't possible on other servers, I'll need to find a way to generate a valid keystream (which I probably won't find).
_
What client already can do (but only new features):
Chat, display a ship in the center of the map, which no one can kill, download settings, handle a full database of Settings, Ships, Data, etc.!
_
What will be the next step:
User database (lookup names for a given userID), graphics engine.

ExplodyThingy - Sat May 08, 2004 1:04 pm
Post subject:

1. IT can display an invincible ship at the center of the map, but so can bots. Can people actually view the ship local? So far from that list I can see things that bots can do, but no one views the games via bots.

2. Why does a client have a user database?

3. Are you ever going to release this, the prealphas, or teh sources?

Qndre - Sat May 08, 2004 1:57 pm
Post subject:

ExplodyThingy wrote:

The "user database" stores the names for the userIDs and the userIDs for the names, so if I get a message packet at example, I can look into the database, which name the user with userID "..." has and display his name.
_
The "settings database" stores settings in "cells" so you can lookup what the initial energy is (for example).
_
The "central database" stores things which are used in multiple modules, like NRG, etc.
_
Every plugin (there is a plugin interface) can access the database via read/write access if user wants to. With plugins you can modify the behaviour of the client (change everything in the database, send chat messages, send packets, look which packets the client recieved).
_
I'm going to release the client open-source if it's useful for something and if there aren't plenty of bugs in it any more. I'll release it BEFORE I implement the CONT encryption because I don't think I can do it. So you'll get a VIE client in the end (maybe for use by zone MODS, etc.)!

ExplodyThingy - Sat May 08, 2004 8:46 pm
Post subject:

Qndre wrote:

And youre writing this data to disk instead of storing it in memory why? How completely hackable.

Quote:

The "settings database" stores settings in "cells" so you can lookup what the initial energy is (for example).

So its an array instead of a struct

Quote:

The "central database" stores things which are used in multiple modules, like NRG, etc.

WHy not just have pointers to the aforementioned memory?

Quote:

Every plugin (there is a plugin interface) can access the database via read/write access if user wants to. With plugins you can modify the behaviour of the client (change everything in the database, send chat messages, send packets, look which packets the client recieved).

Again, what I jsut said. Like merv if that helps you.

Quote:

I'm going to release the client open-source if it's useful for something and if there aren't plenty of bugs in it any more. I'll release it BEFORE I implement the CONT encryption because I don't think I can do it. So you'll get a VIE client in the end (maybe for use by zone MODS, etc.)!

Swell.

nintendo64 - Sat May 08, 2004 10:50 pm
Post subject:

Only suggestion for now, SETTINGS SHOULD NOT BE WRITTEN TO A FILE OR SHOWN TO THE USER OR PLUGIN DEVELOPER AT ALL, that alone can get your client not supported everywhere, nobody likes the idea of someone getting access to their settings besides the sysop.

-nintendo64

Qndre - Sun May 09, 2004 10:41 am
Post subject:

ExplodyThingy wrote:

And youre writing this data to disk instead of storing it in memory why? How completely hackable.

So its an array instead of a struct

WHy not just have pointers to the aforementioned memory?

Again, what I jsut said. Like merv if that helps you.

No. I was storing the data in memory, but I've written an interface to give read/write access to this part of the memory. Hackable? Doesn't matter if I'm going to open-source it.

Another thing: Keystreams, keys, passwords, etc. will be stored in memory too and of course not be dumped to harddrive.

Nintendo64 wrote:

Ohhh... I'm a sysop of a zone... And my settings are so confidental...

But guess what? I just took out database-access for plugins because someone could modify client and write a new kind of virus, etc. which makes subspace users go crazy by changing the behaviour of their client. But doesn't matter because plugins can read every packet the client gets and send every packet they want. And if you don't want to use plugins, you can just disable them in your config.
_
And whatsoever the client will only be useful for zone OPs / SMODs / MODs because no one else will allow VIE clients to join. And if you don't trust a person, you shouldn't make him a MOD.

And if you trust a person, it doesn't really matter if he has your settings or not.

Qndre - Mon May 17, 2004 7:42 am
Post subject:

The client has become a very simple administrative tool for subgame2. which could be useful for SysOPs who want to remote-administrate their server from everywhere. There is a very secure (524.288 bit key) encryption, which isn't simple XOR any more (things like "xxxxx" and "xxxxy" encrypt to very different things (the input decides which part of the key to take). Server-side implementation isn't successful yet.
_
User-Database lookup made trouble but another feature has been added:
Peer-to-peer connection between clients without a server is possible: (users are able to PM each other and see the other's name and IP address)
_
This serverless connection is possible over a LAN or over Internet (at the internet you don't have a userlist because it's a too high IP range to scan and some people could worry if they are always pinged

)
_
If you don't scan the LAN, you are also invisible to other users so this is not like "Are you on? [No reply] Are you on? [No reply] Are you on? Yes!" but like "I am on, I am on, I am on, ..." These "online" messages are sent out every 20 seconds.
_
Next step will be the graphics, which will be done through DirectDraw (I know this is not the newest technology). A software graphics engine is already in development.
_
Thanks to all the people and sorry for my sceptical attitude, now I saw everything you told me was right even if I think there might have been a more friendly way of saying it.

But sometimes you really need to shout at someone else if he's just not able to understand or not ready to understand.

Cyan~Fire - Mon May 17, 2004 6:14 pm
Post subject:

No, we don't need to shout.

And also, don't sysops already have a remote admin tool? *putfile basically covers all bases.

Qndre - Thu May 20, 2004 3:01 pm
Post subject:

Just tried out some assembly. I wrote a program to read data out of the stack in hope to get the call "subgame2" does to get keystream from CONT but there doesn't seem to be any security hole like that!

_
Also wrote some MacID and PermID spoofing code but it doesn't work. Neither for CONT nor vor VIE Subspace.
_
This software can be downloaded as Source-Code, Objectcode or Binary distribution on my download-centre:http://www.subspace-addicted.de.vu/downloads/
_
PS: I haven't stolen the code from anywhere - I've written it on my own.

Qndre - Tue Jun 08, 2004 4:29 pm
Post subject:

The server-side implementation of the METAenc encryption (the encryption of my client) is ready to be used, but not finished at all. If you want to see some data encrypted with it, click here:
http://www.subspace-addicted.de.vu/downloads/packets3.txt
S2C doesn't use METAenc but VIEenc, but C2S uses METAenc and server is able to decrypt the data sent by the client. This is ONE key example while METAenc supports 16,777,216 different keys (24-bit seed). The keystream generator is a very modified version of the S.I.G.M.A. algorithm (the original S.I.G.M.A. encryption only encrypts 256-bit keys and no keystreams without any seeds, etc.). The keystream is 524,288 bits long (while only the first 262,144 bits are used for encryption). The key offset is generated out of a 16-bit checksum of the leftshifted input data, so it cannot be spoofed client-side because server is able to check that offset after decryption. The offset is hidden within the data and can be seperated from the data with the first 16-bit of the encrypted packet. Of course the algorithm also uses feedback.

Mr Ekted - Tue Jun 08, 2004 5:37 pm
Post subject:

Once again you are wrong. A seed is a key. A 24 bit seed (key) can create 16 million streams. Thus, an attack on data takes a maximum of 16 million iterations, and an average of 8 million--something any reasonable desktop system could do in hours.

Do you understand that if the algorithm is known, then it is useless in a client to prevent client-side tampering? Publishing your algorithm destroys it.

Mr Ekted - Tue Jun 08, 2004 5:39 pm
Post subject:

Qndre wrote:

Um. So you wrote a bunch of ASM that doesn't work. Clap clap. Let me know how many people download it.

You could save yourself the time and trouble, and just get yourself netbanned right now. You seem to be intent on hacking into Cont and causing trouble. I don't really understand your motives.

Anonymous - Tue Jun 08, 2004 5:56 pm
Post subject:

packets3.txt wrote:

C2S 0000 34 97 97 5C AF B3 69 AB
C2S 0000 74 D7 D0 91 12 37 6F B3
C2S 0000 14 B7 70 7A F4 8D FE 9A
C2S 0000 54 F7 FC 3A 10 FF 99 78

k0zy - Wed Jun 09, 2004 3:58 am
Post subject:

Mr Ekted wrote:

You should post it here so we can see how secure it is.

Mr Ekted wrote:

Do you understand that if the algorithm is known, then it is useless in a client to prevent client-side tampering? Publishing your algorithm destroys it.

Qndre - Wed Jun 09, 2004 5:11 am
Post subject:

Quote:

You seem to be intent on hacking into Cont and causing trouble. I don't really understand your motives.

I want to prevent CONT from being closed by publishing my own client/server system, which could continue CONT of PriitK gives it up (why should he do?). I see how many games go permission-only - require seperate registration for each game (even if it's against license agreement) - it's an indicator for me that it will be closed soon (or that it goes back to the pay-per-month-play-for-a-month system like it was in VIE times). If even the famous TrenchWars closed (and it did till june - I got a permission-only message whenever I joined - this started in may or so)... That shows me that they aren't really interested in having much people playing it - they take one game down, put it up again, make it permission-only, make it public again, just like they want. If NOTHING (except the nick) is unique any more (MachineID, PermissionID, etc.) because there are randomizers, etc. for it, this system will be destroyed. One person can register, publish his MachineID and PermissionID he uses to play and everyone can play and it seems like it's on his machine. So the permission-only system becomes useless.

Quote:

Do you understand that if the algorithm is known, then it is useless in a client to prevent client-side tampering? Publishing your algorithm destroys it.

Yes. Now I understand why PriitK doesn't release any of his sources. He wants to keep it "secure" - free of cheaters - whatever - but the real thing is that he wants to keep his game under HIS control so HE can permit to play in SSC whenever he wants, and refuse permission if he decides to do so. I don't think that people will play if it goes on this way but he doesn't seem to care if people play his game or not - why would almost every SSC zone get permission-only?

SSCU 17th Parallel, SSCU Trench Wars and SSCX Extreme Games wrote:

You do not have permission to play in the selected zone... blah blah blah ...meanwhile please choose another zone.

Is that a good reason for you?

I don't think so.
_
Result:
I want to make permission-only useless. I want to make everyone registered to Continuum able to play what he wants and whenever he wants (provided the server is online) and not only few "VIP's".
_
This should be a "warning message" to everyone who plays and worrys about "permission-only", BANs or whatever. Just stop playing. If there are 20 player left PriitK may think about it once again - if "permission-only" and BANNING feature shouldn't be taken out of his "subgame2", because too many MODs abuse it.
_
This should also be a message to zone MODs, SMODs, OPs, whatever: If you want to lose a player, BAN him, if you want to lose many players, make your zone "permission-only", if you don't want to lose any players, stop BANning for no reason, and stop "permission-only" forever, because there is no reason for locking unregistered people out.

Anonymous - Wed Jun 09, 2004 5:18 am
Post subject:

Translation: let the anarchy begin!

Qndre - Wed Jun 09, 2004 5:20 am
Post subject:

So you don't think MODs abuse BAN/permission-only? Haven't you ever been banned for no reason? Or worried about permission-only?

Anonymous - Wed Jun 09, 2004 7:40 am
Post subject:

If you think the staff are unreasonable you can either tolerate it or go somewhere else.

There is a black list .txt similar to permit.txt, if you stick someone's name in it they can't enter the zone. I guess this is what staff might have done to keep you out, and let everyone else in. I remember someone said they couldn't get into TW with the name 'analyser' because it contains 'anal'.

Qndre - Wed Jun 09, 2004 11:00 am
Post subject:

-Smong- wrote:

If you think the staff are unreasonable you can either tolerate it or go somewhere else.

I don't think so but there is too much power in the hands of SSC staff. This power has been given to them by PriitK and his server system, which supports functions like "permission-only". Also if you sniff some packets which are sent during your registration, you'll recognize that there is much information given to SSC, you don't permit anywhere to give that information. It's Windows-Registration RealName, Company, it's the device drivers of your control panel, it's the identifier of your NIC card and two values out of registry which are also related to Windows-Registration and the ominous "Local Network Hostname" which is said to be so important for BANs (I think it's the easiest value to change). I don't think that's all information in the hands of SSC. Maybe much more information gets transferred and no one notices it. I don't think that's ok, I think CONTINUUM has become spyware-like. PriitK somehow wants to have monopoly in this game. It's all been much better in VIE times (except that it's become free-of-charge after PriitK stole the game from VIE).
_
Something else: I'm just using Windows operating system because CONTINUUM doesn't let you join from Linux. If Linux was permitted in CONTINUUM, I'd have thrown Windows into the bin. Continuum is the only reason for me to have Windows running on my PC. And that only because great clients like Snrrrubspace aren't permitted to join SSC zones.

-Smong- wrote:

There is a black list .txt similar to permit.txt, if you stick someone's name in it they can't enter the zone. I guess this is what staff might have done to keep you out, and let everyone else in. I remember someone said they couldn't get into TW with the name 'analyser' because it contains 'anal'.

Yes. But what I mean with "permission-only" is the possibility to keep track of player's activity with "unique" but hackable things like MachineID, PermissionID, Hostname, etc. and make only people play who registered!

Mr Ekted wrote:

Um. So you wrote a bunch of ASM that doesn't work.

Wrong! With the "STACK.ASM" I found out that you have to call "continuum.exe" with the parameter "S" on the command line to make it generate a keystream:
continuum.exe S
But that doesn't help me much because:
1. I don't know where to put the seed
2. I don't know where to get the keystream after generation
If you want to try it out run CONTINUUM from the command line with parameter uppercase "S":
continuum.exe S
And see that it doesn't run.
Or replace "subspace.exe" in your "./version1/" directory with my "STACK.EXE" and subgame2 will print out a line with only an "S" in it. That's how I found it out.

Dr Brain - Wed Jun 09, 2004 12:40 pm
Post subject:

All I can say to that is: "Wow, you understand a lot less than I thought you did." And trust me, that's really saying something.

I don't mean to be cruel, but honestly, you don't really understand how this game works at any level. From the technical to the social.

Mr Ekted - Wed Jun 09, 2004 12:41 pm
Post subject:

Zones are privately run. Don't you think people should be able to say who can play in their zone or not? Don't you think you should be able to say who can come in your house?

Mr Ekted - Wed Jun 09, 2004 12:41 pm
Post subject:

Kozy, that was intentional. I was showing the irony of what Qndre is doing and saying.

Mr Ekted - Wed Jun 09, 2004 12:42 pm
Post subject:

Qndre, no one will ever use your client. I guarantee it. I also guarantee it will never be finished. Stop wasting everyone's time.

Cyan~Fire - Wed Jun 09, 2004 1:22 pm
Post subject:

I know of no popular zone that has switched to permission-only. It would only hurt themselves anyway. I think just you are being targeted, Qndre.

D1st0rt - Wed Jun 09, 2004 3:04 pm
Post subject:

Stupidity has reached a level I never thought possible

Mr Ekted - Wed Jun 09, 2004 3:32 pm
Post subject:

Cyan~Fire wrote:

I know of no popular zone that has switched to permission-only. It would only hurt themselves anyway. I think just you are being targeted, Qndre.

He was banned. It was intentional, and it was Qndre. This was discussed in some other thread. Qndre denied ever going to the zone in question. The admin who banned him said what he did. Then Qndre magically remembered that he did go there and do those things. Maybe some day, he'll magically remember he can't program, and go back to working the drive-thru.

Dustpuppy - Wed Jun 09, 2004 4:35 pm
Post subject:

Mr Ekted wrote:

Maybe some day, he'll magically remember he can't program, and go back to working the drive-thru.

rofl

Cyan~Fire - Wed Jun 09, 2004 11:27 pm
Post subject:

Does banning on SSC just give you the permission message? I figured it would do something like Catid's "^Banned", but then again, I've never been banned on SSC.

Qndre - Thu Jun 10, 2004 5:14 am
Post subject:

Found something out: If you run "continuum.exe" with the command line parameter "S" it writes you a "scrty" and a "scrty1"-key to disk. That's my key to Continuum encryption. I'm already having some exact information about how the encryption algorithm works but I don't think it can be written in BASIC, so I'll need ASM - so - forget it. My client will turn out as a fucking VIE client that no one wants to use - even not Mods because they could just use Subspace if the wanted to have a VIE client.

Cyan~Fire - Thu Jun 10, 2004 9:27 am
Post subject:

Qndre wrote:

If you run "continuum.exe" with the command line parameter "S" it writes you a "scrty" and a "scrty1"-key to disk.

Not bad, but you could still get them from a server folder anyday.

Qndre wrote:

That's my key to Continuum encryption. I'm already having some exact information about how the encryption algorithm works but I don't think it can be written in BASIC, so I'll need ASM - so - forget it.

And who's giving you this specific information, Priit? After all, he's the only one who could.

Qndre wrote:

My client will turn out as a fucking VIE client that no one wants to use - even not Mods because they could just use Subspace if the wanted to have a VIE client.

Darnit! We all had no clue this would happen, as shown by us telling you it would all along!

Qndre - Thu Jun 10, 2004 9:54 am
Post subject:

Cyan~Fire wrote:

Darnit! We all had no clue this would happen, as shown by us telling you it would all along!

My client should provide a secure but open-sourced interface to VIE zones. Maybe I'll give up this client and "fix" the VIE Subspace client to support my encryption like I did it with "subgame2" and support S2C encryption too.
Please excuse my absence of cooperation.

Cyan~Fire wrote:

Not bad, but you could still get them from a server folder anyday.

True but should I copy the whole subserver into my client?

Dustpuppy - Thu Jun 10, 2004 10:25 am
Post subject:

Qndre wrote:

[..]
True but should I copy the whole subserver into my client?

So you're just going to copy continuum.exe and run it with S instead?

You also said your client was open sourced, perhaps we could have a look?

Qndre - Thu Jun 10, 2004 11:07 am
Post subject:

Dustpuppy wrote:

So you're just going to copy continuum.exe and run it with S instead?

No because I'm not going to use CONTINUUM encryption but VIE encryption.

Dustpuppy wrote:

You also said your client was open sourced, perhaps we could have a look?

Not yet. There are many bugs which have to be fixed and many things aren't implemented yet (user-name-lookup for chat, etc.), security checksums don't work yet, ... I'll notice you if there is a pre-release.

Mr Ekted - Thu Jun 10, 2004 1:26 pm
Post subject:

Qndre wrote:

Getting scrty and scrty1 files is pointless. They are unique for every zone. The only zone your files would work with is your own. Hosts would be stupid to let their files out since people could do all kinds of crap to their server. Feel free to hack your own server all you like.

Mr Ekted - Thu Jun 10, 2004 1:27 pm
Post subject:

Qndre wrote:

[..]secure but open-sourced

No such thing (in this context).

i88gerbils - Thu Jun 10, 2004 2:14 pm
Post subject:

Yep, no such thing. Just like there's no such thing as close source security either.

We're living in a insecure world! Oh the humanity!

Qndre - Thu Jun 10, 2004 3:29 pm
Post subject:

Mr Ekted wrote:

No such thing (in this context).

I understand that an algorithm, which has been released usually isn't secure any more. The only thing I wondered since I was creating my first 8-bit-text-xor "encryption" was: How can things like SSL be open-sourced AND simultanously secure?
http://www.openssl.org/

Mr Ekted wrote:

Getting scrty and scrty1 files is pointless. They are unique for every zone.

Yeahr. Unique and random.
But if the keystream generator only gives any (random) keystream, how can client and server have the same one (since client sets 32-bit key seed in 0x0001 packet and server has a random key)? Does the client only decide about a kind of "offset" or so (in the 0x0001 packet) and server decides about the actual key (in the 0x0010 packet)? If so, 0x0010 packet should be the same for every client connecting to the same server.

Quote:

Feel free to hack your own server all you like.

I'm already doing or do you think I'm trying my client out on SSC zones or whereever because it's just so funny to get netbanned?

ExplodyThingy - Thu Jun 10, 2004 5:13 pm
Post subject:

Is this kid still around? I think hes some form of recurring nightmare, where I dont kill him in the end. Wish I did though.... Maybe it would end then.

Mr Ekted - Thu Jun 10, 2004 6:11 pm
Post subject:

Qndre wrote:

How can things like SSL be open-sourced AND simultanously secure?

Because in most online situations, the only important thing is that no one who is watching the traffic can decrypt the data. You are protecting the packets from view by a 3rd person. In Continuum, the packets must be protected from view/modification by the person running the client. It is a completely different security issue than most online applications where SSL, VPN, RSA, etc are used.

Qndre - Fri Jun 11, 2004 5:24 am
Post subject:

Mr Ekted wrote:

I understand.

D1st0rt - Fri Jun 11, 2004 3:58 pm
Post subject:

ROFL