Post: #31

@Robert, a bit of information about this client would be nice ... right now we only know that it's a custom client ... nothing more, what is working ... what is not ... it looks promising but 0 information is given

BTW: I'm being neutral too, won't vote here.

Post: #32

XuN, UltimaXNA is an opensource client with some improvements:

- Work better on regions with many NPC's (UltimaXNA dont wait server respond the packets of all players to walk, cast spell, etc..)
- Better animation effects (Using XNA, this client is able to run physic particles effects and load different types of files to "show on client"
- Better UI (User Interface) and UX (User Experience) on dialogs, menus and even the screen (its able you to run UO native in screens bigger then 800x600)

And many other improvements... the project thisdays seems a little stoped, but there is 5 or 10 persons updating the code...


Another GOOD one project, that was abbandoned on 2013 is the project from Kevin, the UOjs... a web-based client!
I've participated on this project, but due my job i haven't time to work on it anymore.

This web-client allready does:
- Login on shard
- Character Selection
- Render the map (still need some improvements)
- Chat working

There is a LOT of packets needed to be scripted...

NOTE: The git repository was updated 6 days ago, but only the readme.md

Post: #33

honestly I think RunUO have enough dev/community support to be open source. They have an mature community which is (or was) highly dedicated to "improve" the community source and not just "get" the source to use it alone on their servers. Also RUO is OSI-like, so even going open source, everyone knows what must be done: follow OSI rules exactly as it is, with absolutely no custom changes. So regardless who are developing, they know what must be done and what the final result must be

on sphere unfortunately we can't say the same. Here we got lots of "scripting-kiddies" which get banned from a server and then they create a new amateur server just to harm this other server that they don't like. They will use the source just to themselves, not to improve it or share new things with the community. And since sphere is not OSI-like, ppl would turn the source into a real mess if everyone keep sending personal changes on source. Also I dont know about others countries, but here on brazil there's SO MANY lammers that play UO just to blame everyone and exploit all servers, and if they got access to the source this will leak some serious security problems to all sphere servers on every country

just a quick example: some years ago I released the code of my AOS house system here on sphere forum to share a great system with everyone, and guess what, many ppl of my own server downloaded it just to explore the script and find hidden exploits to bypass house door security access. The same occoured when I released the code of my custom vendor system that many ppl downloaded it just to search exploits, and they found one that allow sell items using invalid prices to make sphere create infinite gold. This is what ppl will do on every server if we release sphere source, we will enter on a new generation full of exploits

I'm a sphere user since 2003 and always wanted an open source sphere, and I understand that many ppl want the same, but I think it's not the best way. Of course maybe there will be a few ppl really helping to improve the source, but certainly there will be much more ppl using it badly

Post: #34

Coruja raises some very good points about the security of servers, even those who do not use these forums and have been happily running their servers would suddenyl be at risk.

I too know a lot about the Brazil players (we had some Portuguese ones too), we had a lot that all they did was try to hack accounts, cheat people out of items, abuse bugs to make loads of money, and even when caught and banned, they attacked the website, shared the hacks with other players who they dont even know, just to screw us over.

That is an important factor of not going open source, security.

Post: #35

Security by obscurity is always a bad idea.

Post: #36

Better than no-security


Jokes a part, the whole security by obscurity argument is not valid because previous source code were already leaked. So attackers have already an idea on how Sphere works.

Post: #37

Better is to have safe code. Obscurity only give you time.

Post: #38

Or code written by "safe people" ?

Anyway, it's an endless discussion, in some way attackers will always find a vulnerability. Open source or not.

Post: #39

Well, that would be the case if updating your sphere server was as simple as dropping a new exe in or running an Update tool, but it isn't. If you don't do monthly incremental changes, updating sphere can be an effort that a lot of people don't want to do, hence people still running 51a when they don't need to be, and 56b from 2012 still. So people would never get security patches unless they upgrade sphere anyway, which even as it is now people don't, having open source code highlighting bugs and keeping a log of unfixed ones, and a log of which version they are fixed in just highlights holes in every server out there. I bet no servers with more than 50 players have updated sphere for 2 years or more.

Just saying, I have arguments for both ways here, so I don't know

Post: #40

(08-04-2015 08:26 PM)darksun84 Wrote:  Better than no-security


Jokes a part, the whole security by obscurity argument is not valid because previous source code were already leaked. So attackers have already an idea on how Sphere works.

not really, this old source leaked is from ~2000 (15 years ago) and have many critical files missing

the current source is completely different from this old code