Any chance of a OINC Server extension?

Python and C++ are probably the way to go for performance reasons, but it'd slow down development for me. I'd love to be able to program an OINC server from within MMF, like you could with MooClick.

Any chance of this ever happening?

I'd like that one too... ¬¬

Quote:

---

Originally Posted by Mathias

Okay, here goes...

This is exactly what we're trying to prevent people from doing with OINC. This is exactly why we've provided different server solutions (in contrast to Moo that only had the extension server) so people would never be restricted by MMF.
MMF2 is NOT and never will be feasible for server development, and client-side protection is NOT an option!
Some people might think that their current client-side protected servers work well, but in the end, they hit the stumbling block on various issues-- hackers emerges (trust me, they will), adding server-side features (AI, quests and whatever) is near impossible, and debugging is quite hard.
I've seen it happen multiple times (client-side protection, ask me for references), and the result has always hit a block in the end (this is an especially awful position to be in if the game has actually claimed some kind of notice).

So the overal rule for OINC server development is:

[size:14pt]Use POINC or C++ OINC for server development; I (we?) will not provide much help with servers made in MMF2.[/size]

I'm not sure whether I've mentioned this before, but I would be really happy to help people out with stuff in Poinc (I've done so several times already, actually). Python (in combination with Twisted) is seriously a breeze to work with, and I'm positively sure you guys will love it if you get to open your eyes for it! :)
Add me on MSN (and please, only Poinc things, I'm already severely occupied socially ;) ) and I'll be there.

---

Guess it won't happen then, but isn't providing a stock OINC server executable going against all that? ^

Has anyone actually looked at the Oinc extension? There is a condition to Host and Stop Hosting a server. It can already be done. Right now the server cannot do anything like sending messages or managing its' connections, it just hosts.

Quote:

---

Originally Posted by DizzyDoo

Has anyone actually looked at the Oinc extension? There is a condition to Host and Stop Hosting a server. It can already be done. Right now the server cannot do anything like sending messages or managing its' connections, it just hosts.

---

Thanks, I didn't notice that but it's still not quite what I need. Logic should be handled and enforced server-side, otherwise you're opening up your game to griefers & exploits and it'll inherently be insecure. Hence why I can't use a stock server. Corentins said the same thing, too:

http://www.clickteam.com/epicenter/ubbthreads.php?ubb=showflat&Number=139270&page=2

Yes, but the point is this; it's in development. Just like the rest of Oinc.

That's why I'm asking, I didn't know if this specific feature was coming or not. So it is?

Certainly is. :)

Scheduled for the next Oinc release, but that might be awhile, there's a lot to do for it.

Any updates on the server side of the extension? I think Jamie said in another thread it's still on it's way. Down the road I plan to use Python + OINC for the server but in the meantime I want to program the server logic and checks from within MMF itself and then it port it over once I have it all ironed out.


Also: people need to stop relying on the public KlikFarm server so much unless a) they're aware it's insecure and b) they're OK with opening their game up to exploits and griefers. All one would have to do is take a look at the network traffic with a packet sniffer to figure out what channels are being used for what and then create a dummy client to their advantage/entertainment. It's a regression back to the Moo/Moo2 era.

This online MMF-developed RPG I used to play in 2003 (Smileyhouse) had a community of maybe 10-20 active users. Before it's author enforced server-side checks all over the place, we had griefers who manipulated the client to control the enemy AI/spawn points. If this happened in a community of only 10 people back then, imagine what would happen now?

EDIT: Oh and godforbid someone discovers a way to crash the stock server. All these games that rely on KlikFarm or any other public server would be down until OINC's author could update it.

I'll update it, don't you worry ;)

I can tell from my own experience MOO was really bad to host, very insecure and often unstable. Serverside INI's were of course super insecure. OINC does feature server side security features such as flood control and limiting the amount of connections per IP.

The example of SmileyHouse is more related to the game coding and not the network protocol.

The last point you made applies to all (server) software. Apache, IIS, FTP etc. There are always leaks and developers try to patch them. OINC is no different.

Is KlikFarm totally secure? Probably not but the risks have been limited as far as possible. If you are using the services of gmail, hotmail and software such as FTP clients. You can also use KlikFarm.

You misunderstood all this. I'm not saying there's anything wrong with OINC or KlikFarm. My point was, having your game rely on a public stock server is fine as long as you understand it's an open server. Open as in anyone can connect, set the channel to whatever your game/application uses and wreak havoc. KlikFarm is fine for little examples or games that won't build up much of a community and I thank you for hosting it, but games that feature any sort of moderation (especially ones that try to obfuscate the problem by using security through obscurity) are especially vulnerable.

The post I linked to on the first page explains it a little more. As Coretin said, a user's game client can not be trusted to do what it's told. Without any logic on the server side to verify and enforce (since it's a stock server), it's inherently insecure.

http://www.clickteam.com/epicenter/ubbthreads.php?ubb=showflat&Number=139270&page=2

Quote:

---

Originally Posted by Coretin

Quote:

---

You need to go into more depth - in my game, for example, a maximum of 4 players can be in each game lobby (the host, and 3 joiners) - which makes life easier, as I just send a different message to kick a specific player - i.e "kick2" boots player 2, "kick3" boots player 3, and similar for "kick4".

When subchannel 80 (kick channel) picks up one of those messages, it knows whether you are being kicked, or another player is being kicked.

To do it with infinte players, I guess you could send a message "kick:"+$playername... then, if you receive a "kick:yourname" message, it knows you have been kicked, and can disconnect you.

---

You can't expect a client to do what he's told... The kick should be performed by the server. In fact any important thing should be performed by the server. There is no way to be sure the client will disconnect, even if you ask him very kindly to do so.

that's exactly the point of having the server perform the disconnection : the server is the only reliable thing. If you only want some users to be able to kick others, then you have to set some privileges with a password or something. EDIT : what I mean here is that the server will check if the user has the ability to kick before performing the kick. This has to be server-side

If you're considering hackers, then you just can't expect them to disconnect on a /kick message. It would be just like asking them "would you please leave ?".


Once again you can't control what's happening on a remote machine. The hacker could be using another client, or could have modified yours. This can only be secure using server-side code.

---

Understand what I'm getting at now? Letting clients kick other clients without any verification on the server's end that they have the ability to do so is a bad practice. And yet I'm seeing more and more people build their games off of KlikFarm or the stock OINC server, putting in stuff like this and hoping no one figures it all out. Exactly the problem with Moo/Moo2. There was no way to build in server-logic until MooClick came around. At least with OINC you have the ability to do so in Python, C++ and eventually, MMF.

Side note: the author of Smileyhouse actually found a way to crash the Moo2 server, publicized it here in hopes 3ee would fix the problem and ended up getting banned for it. Go figure.

This clarifies your previous post.
There is indeed an example with admin/moderator/client versions of the OINC client. And I agree with you its a really bad method. On message on subchannel 2 = disconnect player

Users have to accept when using a public server they are limited in certain aspects. Such as the right to kick users.
People could secure their chat traffic by using encryption,
as I know there are companies using my public server for communication. I got Jamie to make the AES object. Meaning you can have your messages encrypted using 256bit AES.

I believe you could crash MOS by sending a blank message at the time, good old days :).

OINC is crying out for a server extension. Well at least I am anyway.

You can run the server from MMF now, by calling the OINC.Server file. You can reload the ini settings and stop the server.

Future updates will include features such as retrieving server stats, like moo.