[Clientmod] Oredetection [oredetect]

[nrz]

Linuxdirk i though like you when joining minetest core team. Maybe we should have a coreside protection, but the exposition layer to mods should be in lua by a mod using this coreside protection

[Linuxdirk]

Maybe we should have a coreside protection, [...]

Preferably before implementing client-side modding makes all other security features useless.

[sofar]

Preferably before implementing client-side modding makes all other security features useless.

CSM hasn't made any features useless. Period. No discussion.

Things like noclip, xray, lag-breaking through protected nodes. All have been possible. All have been done, exploited, hacked, coded, released and sold for money to minetest cheaters.

You're just mad about something you don't understand and don't know how to channel the energy into something good. The result of it is that you're screaming like mad and people are politely trying to point out the same basic facts over and over again. And the facts are that hacking your C++ client to allow noclip is trivial (one line!?). Lagging through doors is trivial (doesn't even need a recompile of the engine, just 1 shell command in Linux!), and xray vision is as simple as turning on client-side map saving (pfffft).

So, again, you stubborn non-flexible piece of khorundum, please, stop claiming that CSM has made new exploits possible. Because it hasn't, and you're just like manure slurry: very unattractive and nobody wants it.

You seem to be under the misunderstanding that "minetest_game" is supposed to be the end-all super duper multiplayer subgame. It's not. It's never meant to be, although some people want it to be, and some people don't want it to be. It'll never get solved, either, at any rate.

So now that you know that (unmodded) minetest_game is unsuited for public multiplayer servers. What again is your problem?

Do you still think that CSM allows all sorts of nasty server hacks? Nope, it doesn't. CSM can't even send anything to the server. It can't dig a node. It can't clip through doors, it can't even lag through protection blocks!

So what does it exactly make useless? Abso kumbaya lutely nothing.

So yeah, this CSM mod allows a player to see things they were already seeing in the engine. No biggie, there's mods that do statistical analysis and can rat out players that use this mod. Are you really that worried? Mining isn't really that hard, and players still have to dig for nodes, and the radius is really small anyway, it's not like they're searching many blocks, and, if they would, it would make their game slow as sluggy mcslugface. They'd get a better ore detector if they wrote some C++ code for it. My bet is that there's at least 10 people that already have.

CSM has the potential to massively offload visual and audio features to the client to make the game much more visually and soundwise appealing (ambiance, particles, special effects) to the players. This is good. Minetest is really bleak without many sounds. More particles will make things like fire and torches nicer. We can finally get better fire sounds and not bring the server down with sound packets. Actual Fog. Better footsteps and water splashing, etc.. A lot of the UI can stop relying on the server and we can make better HUD bars, enhance the minimap, make game screen overlays and score panels.

[Linuxdirk]

What again is your problem?

The lack of communication to the users about CSM.
The lack of any security features regarding CSM.
The lack of proper documentation for CSM.
The lack of a function for server owners to disable CSM.
etc.

CSM can't even send anything to the server. It can't dig a node. It can't clip through doors, it can't even lag through protection blocks!

Can it set inventory slots? Or is the inventory completely server-side? Can it place nodes that somehow will "leak through" to the server?

[bigfoot547]

bigfoot547: Is it acceptable now?

Looks good! Thanks!

[bigfoot547]

What again is your problem?

The lack of communication to the users about CSM.
The lack of any security features regarding CSM.
The lack of proper documentation for CSM.
The lack of a function for server owners to disable CSM.
etc.

Linuxdirk, CSM has not added anything cheating wise. I can whip up fly/fast/noclip by just replaceing everywhere your privs are checked with true in the C++. CSM cannot do this.

[sofar]

The lack of communication to the users about CSM.

We didn't communicate less than normal. All development and discussion is done in the open. Blame yourself instead.

The lack of any security features regarding CSM.

Again, blame yourself. CSM has been heavily reviewed to comply with the security guidelines we all agree on to protect everyone, including players, server owners. It wouldn't be merged if we didn't think it was secure.

The lack of proper documentation for CSM.

Again, blame yourself for not even going to bother to read the code and the documentation.

The lack of a function for server owners to disable CSM.

Wouldn't make a difference since people can just edit their client code and remove that "disable". Again, blame yourself for not thinking for 2 seconds.

CSM can't even send anything to the server. It can't dig a node. It can't clip through doors, it can't even lag through protection blocks!

Can it set inventory slots? Or is the inventory completely server-side? Can it place nodes that somehow will "leak through" to the server?

No, it can't change inventory slots to cooked up items (it can only move them). No, it can't place nodes. The client can't send those items to the server since the protocol does not implement it.

[ExeterDad]

So will server owners be able to prevent this mod from use on their server?

I am very sorry I asked this question. I had no idea it would of caused such a sh*tstorm

[Wuzzy]

To stop this thread to going more off topic, I created this thread: viewtopic.php?f=47&t=17074

[red-001]

What again is your problem?

The lack of communication to the users about CSM.
The lack of any security features regarding CSM.
The lack of proper documentation for CSM.
The lack of a function for server owners to disable CSM.
etc.

CSM can't even send anything to the server. It can't dig a node. It can't clip through doors, it can't even lag through protection blocks!

Can it set inventory slots? Or is the inventory completely server-side? Can it place nodes that somehow will "leak through" to the server?

https://github.com/minetest/minetest/bl ... lua_api.md

[red-001]

So will server owners be able to prevent this mod from use on their server?

I am very sorry I asked this question. I had no idea it would of caused such a sh*tstorm

It's an important question in my option. I understand that making it easier for players to cheat is a concern. Client-sided modding does allow the client to read the map, but only read. Players can't use CSM to edit the map, send messages (could be used by spambots), disable fall damage, etc. In general it's only meant to be able to modify what the player running the mod sees and read some basic data to help it with that.

[Linuxdirk]

What again is your problem?

The lack of communication to the users about CSM.
The lack of any security features regarding CSM.
The lack of proper documentation for CSM.
The lack of a function for server owners to disable CSM.
etc.

CSM can't even send anything to the server. It can't dig a node. It can't clip through doors, it can't even lag through protection blocks!

Can it set inventory slots? Or is the inventory completely server-side? Can it place nodes that somehow will "leak through" to the server?

https://github.com/minetest/minetest/bl ... lua_api.md

The file – like the regular API documentation file – unfortunately is an unmaintainable and unreadable mess. Please point out the exact line numbers that clarify all of my concerns.

[sofar]

Can it set inventory slots? Or is the inventory completely server-side? Can it place nodes that somehow will "leak through" to the server?

CSM can't even send anything to the server. It can't dig a node. It can't clip through doors, it can't even lag through protection blocks!

https://github.com/minetest/minetest/bl ... lua_api.md

The file – like the regular API documentation file – unfortunately is an unmaintainable and unreadable mess. Please point out the exact line numbers that clarify all of my concerns.

I congratulate you. You have just, with this question, scored an amazing achievement.

For years I've told people, colleagues, students, friends, my kids... everyone, that "stupid questions do not exist".

And for the first time, ever, in my life, I am severely doubting that statement.

So, congratulations, that's a serious achievement.

Now, to answer your question, the answer is quite simple.

I can't point to lines that do not exist.

I can't point to lines that describe what CSM does NOT do, since the API documentation documents the things that the API does do.

So I can't point to the non-existance of the CSM API function "set_node" because it does not exist, and we are assuming that you are smart enough to infer (yeah, our mistake, sorry!) that if an interface is not in the documentation, that it does not exist.

And no, there is also no "set_stack" or "take_item" function to the ItemStack class. If you had looked, googled, or even just spend 5 seconds using the "find text in page" functionality in your browser, you would have seen, like everyone else, that the only mention of an itemstack related function is "get_wielded_item", which allows you to write a CSM that can *look* at your empty, useless hand and give yourself a nice, front head slap aka "facepalm".

[Linuxdirk]

[Insulting bullshit]

Is this an official statement endorsed by the whole dev team or is it just you being offensive?

I can't point to lines that do not exist.

That’s what I was asking for: A general description on what CSM is and what it not is. Instead you go around and blatantly insulting your users.

[red-001]

[qoute from sofar]
The lack of communication to the users about CSM.
The lack of any security features regarding CSM.
The lack of proper documentation for CSM.
The lack of a function for server owners to disable CSM.
etc.

...

The file – like the regular API documentation file – unfortunately is an unmaintainable and unreadable mess. Please point out the exact line numbers that clarify all of my concerns.

Is it seriously too hard to read ~800 lines? How long would that take you 5 minutes? You would have to be borderline illiterate for that to be too hard for you. Which I get the impression you are not. So you are either a troll or you are for some unknown reason you are incapable of reading anything longer then a forum post.

[red-001]

[Insulting bullshit]

Is this an official statement endorsed by the whole dev team or is it just you being offensive?

I can't point to lines that do not exist.

That’s what I was asking for: A general description on what CSM is and what it not is. Instead you go around and blatantly insulting your users.

Quite frankly that's what you should expect if you go around being rude and refuse to inform yourself so you know what you are talking about.

[sofar]

[Insulting bullshit]

Is this an official statement endorsed by the whole dev team or is it just you being offensive?

I can't point to lines that do not exist.

That’s what I was asking for: A general description on what CSM is and what it not is. Instead you go around and blatantly insulting your users.

Ohhh, let's go play games with the context of replies! I can do this too!

[juli]

@Linuxdirk look this CSM can't do any damage to a server as the devs said.
It can only get information about some nodes around you,
but for example if u need fly fast and noclip its one line (client.h 551) in
c++ and u have all of them. So CSM doesn't make it more insecure.

[bigfoot547]

Here's the diff by the way: Click for .diff gist!.

EDIT: Not beating a dead horse, just a for reference.