May 2003
- NetGames 2003: CFParticipation Sugih Jamin
- MUD codebases Chris Saik
- MUD codebases Ammon Lauritzen
- MUD codebases Caliban Tiresias Darklock
- MUD codebases Linder Support
- MUD codebases J C Lawrence
- Flow of messages sanxion sanxion
- Flow of messages Ammon Lauritzen
- Flow of messages Ben Chambers
- Flow of messages Travis Casey
- Flow of messages Brian Lindahl
- Flow of messages Ben Chambers
- Flow of messages Brian Lindahl
- Flow of messages sanxion sanxion
- Flow of messages Brian Lindahl
- UDP vs TCP for MUD/MMORPG project. Jason Slaughter
- UDP vs TCP for MUD/MMORPG project. Matt Mihaly
- UDP vs TCP for MUD/MMORPG project. Ryan Arthur
- UDP vs TCP for MUD/MMORPG project. Crosbie Fitch
- UDP vs TCP for MUD/MMORPG project. William
- UDP vs TCP for MUD/MMORPG project. Byron Ellacott
- UDP vs TCP for MUD/MMORPG project. Evan Cortens
- UDP vs TCP for MUD/MMORPG project. J C Lawrence
- UDP vs TCP for MUD/MMORPG project. Amanda Walker
- Customization in games, as a design tool / gameplay element ceo
- Warrior Challenge on PBS Madrona Tree
- Warrior Challenge on PBS Edward Glowacki
- Warrior Challenge on PBS Travis Casey
- Warrior Challenge on PBS Michael Chui
- MudDev FAQ - part 2 Marian Griffith
- MudDev FAQ - part 2 Mats Lidstrom
- MudDev FAQ - part 2 J C Lawrence
- MudDev FAQ - part 2 J C Lawrence
- Storytelling in a PSW from a Player's Persepctive Talanithus HTML
- Storytelling in a PSW from a Player's Persepctive Michael Chui
- Storytelling in a PSW from a Player's Persepctive David Kennerly
- Storytelling in a PSW from a Player's Persepctive Michael Chui
- Storytelling in a PSW from a Player's Persepctive Talanithus HTML
- Storytelling in a PSW from a Player's Persepctive J C Lawrence
- relevance of paper RPGs (was D& D vs. MMORPG "complexity") Travis Casey
- WAP MUD GAME DEVELOP Richard Ruan
- WAP MUD GAME DEVELOP Edouard Kock
- D&D and MMORPGs Michael Tresca
- D&D and MMORPGs Sean Kelly
- D&D and MMORPGs shren
- D&D and MMORPGs Threshold RPG
- D&D and MMORPGs Taylor
- D&D and MMORPGs Chris Holko
- D&D and MMORPGs Daniel James
- D&D and MMORPGs Peter Tyson
- D&D and MMORPGs Jason Murdick
- D&D and MMORPGs Michael Tresca
- D&D and MMORPGs Michael Tresca
- Database vs. Disk Tom
- Database vs. Disk Sean Kelly
- Database vs. Disk Ben Garney
- Database vs. Disk Adam Dray
- Database vs. Disk Hans-Henrik Staerfeldt
- Database vs. Disk Brian Lindahl
- Database vs. Disk Chris Holko
- Database vs. Disk Daniel.Harman@barclayscapital.com
- Database vs. Disk Weston Fryatt
- Database vs. Disk J C Lawrence
- Database vs. Disk Byron Ellacott
- Database vs. Disk Dave Rickey
- Database vs. Disk J C Lawrence
- Database vs. Disk Bruce Mitchener
- Database vs. Disk J C Lawrence
- Database vs. Disk Bruce Mitchener
- Database vs. Disk Jason Gauthier
- Database vs. Disk J C Lawrence
- Database vs. Disk Nicolai Hansen
- Database vs. Disk Zach Collins {Siege}
- Database vs. Disk J C Lawrence
- Database vs. Disk Zach Collins {Siege}
- Database vs. Disk J C Lawrence
- Database vs. Disk Kwon Ekstrom
- Database vs. Disk J C Lawrence
- Database vs. Disk John A. Bertoglio
- Database vs. Disk corrine_123@hotmail.com
- Database vs. Disk Kwon J. Ekstrom
- Database vs. Disk J C Lawrence
- Database vs. Disk Peter "Pietro" Rossmann
- Database vs. Disk Marc Bowden
- Database vs. Disk Kwon J. Ekstrom
- Database vs. Disk Sulka Haro
- Thoughts on a simplified multiplayer game. Jason Slaughter
- Thoughts on a simplified multiplayer game. Edward Glowacki
- Thoughts on a simplified multiplayer game. J C Lawrence
- Thoughts on a simplified multiplayer game. Bruce Mitchener
- Thoughts on a simplified multiplayer game. Edward Glowacki
- Thoughts on a simplified multiplayer game. J C Lawrence
- Thoughts on a simplified multiplayer game. Bruce Mitchener
- Thoughts on a simplified multiplayer game. Christopher Allen
- Thoughts on a simplified multiplayer game. ghfdh fcgdfgdfg
- ADMIN: Untoward unsubscriptions J C Lawrence
- Bringing out the barbaric in each of us David Kennerly
- Horizons Valerio Santinelli
- RP, MMORPGs, and their Evolution Talanithus HTML
- RP, MMORPGs, and their Evolution Brian Lindahl
- RP, MMORPGs, and their Evolution Michael Chui
- RP, MMORPGs, and their Evolution Marian Griffith
- RP, MMORPGs, and their Evolution Paul Schwanz
- RP, MMORPGs, and their Evolution J C Lawrence
- RP, MMORPGs, and their Evolution Matt Mihaly
- Account retention (was: D& D vs. MMORPG "complexity") Byron Ellacott
- Object-Oriented Databases John A. Bertoglio
- Object-Oriented Databases Weston Fryatt
- Object-Oriented Databases Travis Nixon
- Object-Oriented Databases Bruce Mitchener
- Object-Oriented Databases John A. Bertoglio
- Object-Oriented Databases Jeff Bachtel
- Object-Oriented Databases Sean Kelly
- TECH: Application-level branch prediction? ceo
- DID vs. MORAG "complexity" Jeff Cole
- DID vs. MORAG "complexity" Dave Rickey
- DID vs. MORAG "complexity" Matt Mihaly
- Objects Ben Chambers
- Scripting languages Jason Murdick
- Scripting languages Brian Hook
- Scripting languages Jason Gauthier
- Scripting languages Sanvean
- Scripting languages Jason Murdick
- Scripting languages Mark 'Kamikaze' Hughes
- Scripting languages Ling Lo
- Scripting languages Jay Carlson
- Scripting languages Mark 'Kamikaze' Hughes
- Scripting languages Lars Duening
- Scripting languages Mark 'Kamikaze' Hughes
- Scripting languages Lars Duening
- Scripting languages Kwon J. Ekstrom
- Scripting languages Lars Duening
- Scripting languages justice@softhome.net
- Scripting languages MIKE MacMartin
- Scripting languages Kwon J. Ekstrom
- Scripting languages Bruce Mitchener
- Scripting languages Kwon J. Ekstrom
- Scripting languages Dr. Cat
- Scripting languages Jay Carlson
On Sun, 2003-06-29 at 06:11, Mark 'Kamikaze' Hughes wrote:
>>>> While it's working the other way around, using a scripting
>>>> language for the entire MUD, the very badly-named POO (Pythonic
>>>> MOO) is a nice engine, and fairly small--an earlier version I
>>>> have somewhere around here is even smaller, and still provided
>>>> all the necessary MUD services.
>>> Python supplies an awful lot of handy default libraries which
>>> tend to make the code fairly small.
>> ...most of which can't be used without a security audit, if you
>> don't have full trust in people writing code. The mutability of
>> basic Python data types is just the beginning.
> That's partially true, but hasn't been a significant problem with
> Zope, for instance. Zope's restricted sandbox environment is,
> AFAIK, completely secure; there have been security alerts and
> fixes, but no major exploitation of them. There's also currently
> work on a new general sandbox environment for Python, since rexec
> had problems.
Sandboxing is OK, but is not really comparable to what you get with
MOO and related systems. What you really want is a system that
allows multiple authors with differing degrees of trust in each
other to write code that can interact safely with each other.
(OK, that may not be what *you* really want, but it's what I really
want.)
Sandboxing does well in situations where there are clearly defined
"high" and "low" sides. The fun starts when you have lots of "low"
sides that should interact.
Also, it would be nice if I didn't have to think about security
every time I wrote a line of code. I can do that, but it's no fun.
It's very hard to write large systems under that kind of pressure.
> There are security and malware questions in using *any*
> general-purpose programming language for scripting; if you can't
> violate security or create an infinite loop within the language
> proper, you can overrun buffers, or find some other abuse. There
> have been known security holes in Lua, as well.
I don't believe the situation is hopeless, nor do I think that all
of these should be lumped together. There hasn't been a known priv
elevation attack on the MOO server for many years, much less a
native code exploit. This leaves the core (mudlib) and some of the
cores have been audited in some detail.
The remaining attacks are DoS; the biggest one is memory exhaustion,
but it leaves a giant arrow pointing at the perp. Infinite loops
aren't a problem, as MOO enforces tick limits; overrunning network
output buffers results in the server dropping them on the floor and
warning you.
Which Lua security holes are you thinking of? The only one I
remember involves creating malformed bytecode, and I think a
mud-like system is unlikely to accept remote bytecode anyway.
However, the creation of something MOO-like in Lua would involve the
creation of new security infrastructure written in Lua, and that
would have to be carefully examined. No free lunch.
> And on the gripping hand, it doesn't matter, because the only
> people you'll normally allow to write full scripting code *are*
> trusted admins. The MUDs where this is not the case are fairly
> unusual, and already have their own scripting languages.
Do you trust them to merely mess up the game, or to take over the
machine?
--
Jay Carlson <nop@mitre.org>
- Scripting languages David H. Loeser Jr.
- Scripting languages Shu-yu Guo
- Scripting languages Lars Duening
- Scripting languages David H. Loeser Jr.
- Scripting languages criscal@gmx.de
- Scripting languages eric
- Scripting languages Smith, David {Lynchburg}
- Scripting languages John Buehler
- Scripting languages Mike Shaver
- Scripting languages sanxion sanxion
- Scripting languages Mark 'Kamikaze' Hughes
- Scripting languages Mike Shaver
- Scripting languages sanxion sanxion
- Scripting languages Mark 'Kamikaze' Hughes
- When marketroids attack! Tess Snider
- Moo mailing list issue _DESPARATE FOR HELP! Ms Leigh Canny
- Moo mailing list issue _DESPARATE FOR HELP! David Clifton
- When Player Communities Rebel / Fanbois Gone Rogue vladimir cole
- When Player Communities Rebel / Fanbois Gone Rogue Andrew Barratt {MIS}
- NWN player modules (was: D&D and MMORPGs) Lars Duening
- NWN player modules (was: D&D and MMORPGs) Jonathan Grant
- Simpsons player types Matt Mihaly
- Dealing with cloned NPCs Thomas Sullivan
- Dealing with cloned NPCs Sasha Hart
- Dealing with cloned NPCs Mark 'Kamikaze' Hughes
- Dealing with cloned NPCs Kristen Koster
- Dealing with cloned NPCs Marc Bowden
- Dealing with cloned NPCs Kristen Koster
- Dealing with cloned NPCs Thomas Sullivan
- Dealing with cloned NPCs Owen Matt
- Dealing with cloned NPCs John Buehler
- Dealing with cloned NPCs Owen Matt
- Dealing with cloned NPCs Thomas Sullivan
- Dealing with cloned NPCs Vincent Archer
- The Laws of the Virtual Worlds Tamzen Cannoy