Sorry for the offtopic, I just b@w and chimed in in an interesting post.acridiel wrote:Sadly Jakoba, thats what my worst fears for the .org project are too.
This is a good point. I would not be surprised if Ryzom implements several "security by obscurity" mechanisms, since both the client and the server are controlled by the same entity. Two of the premises in these client / server architectures are a) you never trust the client b) you define well-defined, limited interfaces and access/entry points. Not trusting the client means deplying a lot of checks, specially for your inputs and player actions (having the right permissions, etc.) and lots of error checking. The problem is that checking is expensive and may impact performance, but with an open client, these checks need to be added. Having well defined, limited interfaces and at the same time offering advanced tools such as ring scripts using lua interpreters and so on, keeping things under control requires lots of time and manpower which may be neglected to meet deadlines.
Just to give an example, one can easily guess that to execute an action from the toolbar, the client sends a packet containing which toolbar button was pressed, or, in order to craft an item, the client sends a packet to the server specifying the craft pattern (an id) and references to materials in players inventory. With a closed client, it is not possible to e.g. click an action if the client does not allow you to. But, does the server verify that the action is not "grayed out"? does the server verify that the player has learnt the craft pattern for that object? (these are two fictional examples for illustration purposes).
This is not even "considering" the potential Denial of Services that will arise. Can a UDP packet be forged? does the server crash if the craft packet contains references to items not present in the inventory, etc. etc.
I am not saying that the org project cannot address this, but it is something that needs to be indentified and fixed or worked around. And it is a lot of work.