Project Exists

[fluxionary]

This project is making a majority of player's and admin's experience of playing minetest much less enjoyable. Please remove this project, or at least make it private.

~flux, admin on BlockySurvival

[KaylebJay]

Agreed with flux. I haven't had any big issues with this on my server yet, but this is just a problem waiting to happen. The client may be useful for debugging & cheat playing, but this should not be a client that is used on actual minetest servers - for reasons which should be obvious - which is what you are asking to happen by making this public.

~CalebJ (admin on Tunnelers' Abyss)

[The32bitguy]

I disagree with taking this project down, you are removing what is exploiting issues with cheat detection in Minetest without solving the problem. Cause and effect.

Additionally, anyone, for example me, could just reupload the source with instructions for compiling to Github or another website again and they probably should to stop things like this happening.

[Bastrabun]

Please do not shoot the messenger.

The problem is not that this project exists, but that MT is so easily exploited.

[Dragonop]

Current action in the forums when related to exploits and such is to wait till the problem/bug is patched before making the exploits public. This happened with CSMs.
I don't think it is alright to delete the project, that would be a diservice to the efforts of the developer, however, I do think making it private, or at least not distributing precompiled executables (which I would say shows some sort of malicious intent), is the right thing to do. If someone wants to get their hands on this fork for "debugging", they could just ask.

[Lanhild]

If it is not removing the project, I think making it private is the best thing to do.
As an ex-admin on a closed server, I have already dealt with users of this client, and I can confirm that it is not pleasant at all and it completely deteriorates the experience of the game. The server on which I had this rank had to close precisely because of this project, things like that shouldn't happen.

~Lanhild, ex-administrator

[fluxionary]

Please do not shoot the messenger.

The problem is not that this project exists, but that MT is so easily exploited.

The fact that MT is "easily" exploited isn't the problem, because that can't realistically be fixed. The problem is that this project is currently making it trivial for anyone to exploit the game if they want to, and that's ruining a lot of player's experience on a lot of servers, as well as the experience of the server operators who don't want cheaters around. Hyperbolically, it could eventually lead to the complete death of the minetest project, because no-one left is playing by the rules.

Yes, hacked clients will absolutely continue to exist. They've been around before, and will be around after. Yes, people can just re-upload the binaries of this project somewhere else if they want to. I'm asking you people, the main developers of what currently seems to be the most popular hacked client by far, to do the right thing and to stop publishing it.

To quote JWZ,

Sometimes a "roadblock" is really just an "entrance exam".

[krypticbit]

Please do not shoot the messenger.

The problem is not that this project exists, but that MT is so easily exploited.

We already knew that MT is easily exploited, people compile their own hacked clients all the time and anyone who is a dev (or even a modder) knows that MT can be easily exploited. The main player base may not know this, but I see no reason why they should. Telling them that MT is easily exploited is basically begging for someone to exploit it, and gives the player base no valuable information.
TL;DR All the people who could do anything about the exploits already know and informing the people who don't know is just asking for trouble.

I disagree with taking this project down, you are removing what is exploiting issues with cheat detection in Minetest without solving the problem. Cause and effect.

So, by the same logic, people should just let trojans, ransomware, and other nasty viruses run loose because the exploits they take advantage of haven't been patched? Just because there's a cause doesn't mean we shouldn't try to mitigate the effect.

Additionally, anyone, for example me, could just reupload the source with instructions for compiling to Github or another website again and they probably should to stop things like this happening.

This is true. However, most trolls aren't that bright or that diligent and probably couldn't compile their way out of a wet paper sack (especially not on windows). Furthermore, the devs don't seem to be particularly concerned with hackers / cheaters since "just ban them" is a "viable" solution. I doubt they would care much even if all the trolls on minetest got hold of this software. So advertising this software just gives server owners a headache without doing anything to fix the issue.
TL;DR Most trolls can't compile and making an exploit publicly available does not necessarily pressure the devs to fix it.

Finally, if the owner of this project really cared and was creating this for non-malicious reasons, he'd dedicate his time to patching the anti-cheat code instead of adding new exploits here.
~krypticbit (AKA BillyS, owner of Blocky Survival)

[ValkyrieStella]

the problem is this project doesn't even go after the developers in the first place. it just hurts the community, damages servers people work hard on, and causes undue pain and headache to moderators who take time out of their day for their server. in the same amount of time, you could have come up with a way to prevent this kind of cheating, either by a mod or by contributing code to minetest. you're killing the community that makes minetest relevant, not making it better.

--Edgy1

[LizzyFleckenstein03]

Excuse me, I am a server admin myself (Elidragon Skyblock, Crafter Dev, Fleckenstein SMP). Just be a bit more chilled about it.

[LizzyFleckenstein03]

Finally, if the owner of this project really cared and was creating this for non-malicious reasons, he'd dedicate his time to patching the anti-cheat code instead of adding new exploits here.

Well, a hackclient is mostly not about exploits. There were some critical exploits, but I made sure that they get fixed (EntitySpeed patched by myself, InventoryExploit patched by appgurueu with my help). It's mostly about bots etc. at the time.

Good server software needs to be prepared for the client to do weird stuff. If you want to know what security gaps exist, contact me on discord or IRC. I'll always be open about helping to patch things; but I will also not stop working on this client. The reason why I have stopped to contribute anticheat fixes to minetest is that I was very dissatisfied with how the core devs handle pull requests. It happened to me that I made a PR with a trivial API addition, easy to test and fully documented and it was just ignored for several weeks. Anyways, if somebody wants to patch things, I'll help, but I'll probably not patch things myself anytime in the near future. Currently I'm busy with MineClone2 development.

[LizzyFleckenstein03]

Also, I find it very funny how people discuss "shutting the project down". Its not gonna happen. A community has developed about the client; and if you are to ignorant to recognize and respect it that's your problem. This is my project, and what people use it for is their decision.

[corarona]

Its open source. We can do with the mt code whatever we want. If you dont want that put it in another license. As for server owners. There are a number of anti cheats mods. If those are not enough for your needs noone is stopping you from making your own.

[corarona]

pls add the "wontfix" label lol

[LizzyFleckenstein03]

I added the invalid label xD

[Minetest-j45]

Can you just close this issue, it is absolutely ridiculous.

[corarona]

Current action in the forums when related to exploits and such is to wait till the problem/bug is patched before making the exploits public. This happened with CSMs.
I don't think it is alright to delete the project, that would be a diservice to the efforts of the developer, however, I do think making it private, or at least not distributing precompiled executables (which I would say shows some sort of malicious intent), is the right thing to do. If someone wants to get their hands on this fork for "debugging", they could just ask.

While i see where this is coming from it completely ignores that there are completely legitimate use cases for hacked clients – anarchy servers. Which is as a matter of fact the reason this project exists.
I fully agree that it sucks that people use it on "normal" servers. But from an anarchy player's perspective I feel like it would be a step back to remove the builds since only the savvy people would be able to use it.

[realOneplustwo]

I agree with removing the precompiled executables. Make them suffer, I always say.

[corarona]

I agree with removing the precompiled executables. Make them suffer, I always say.

Completely proving my earlier point. He's one of those players who would like to have more power because he knows how to compile. no offense 1+ ;)

[anon55555]

Furthermore, the devs don't seem to be particularly concerned with hackers / cheaters since "just ban them" is a "viable" solution.

If it is a viable solution then can't servers that don't allow hacks just ban hackers.

[ValkyrieStella]

that is an overly simplistic thing to say. we have jobs and families. and it causes undue stress on our lives to track them all down. my statement still stands. you are damaging the community, and you think it's cool.

[LizzyFleckenstein03]

As I said earlier, I think that a bit more chill is required. You are damaging my community, have you thought of it that way?

[realOneplustwo]

He's one of those players who would like to have more power because he knows how to compile.

Slander. I would never think of taking away precompiled executables from small children to accumulate power for myself.

However, in all seriousness, I do think it is funny that people are even trying to take down this project at all. I'm not sure if they understand how futile their mission is. It is probably impossible to completely eradicate DF or even stop it from spreading, since others can and probably will still distribute DF.

[ValkyrieStella]

As I said earlier, I think that a bit more chill is required. You are damaging my community, have you thought of it that way?

I'm hosting your community. have you thought of it that way?

[LizzyFleckenstein03]

Do you really want to start that kind of power struggle?

[anon55555]

I have a proposal: make it send /banmeifhacksarentallowed on join and servers that don't allow hacks can install a mod to ban anyone who uses that command.

[ValkyrieStella]

I think I'm being reasonable, considering you are likening some critical reviews to a piece of software destroying communities, giving headaches to staff, leading to servers shutting down, people quitting minetest, and overall making this world a darker place

[realOneplustwo]

I have a proposal: make it send /banmeifhacksarentallowed on join and servers that don't allow hacks can install a mod to ban anyone who uses that command.

Might not work. Somebody is going to make a fork that removes it anyway. Of course, if the hackers are dumb enough, they might fall for it.

[ValkyrieStella]

I have a proposal: make it send /banmeifhacksarentallowed on join and servers that don't allow hacks can install a mod to ban anyone who uses that command.

if it can be well hidden in the code, that would be a good idea

[anon55555]

if it was done in c++ people would have to recompile to remove it

[TechDudie]

I’ve read all 116 comments (now 117) several times

[TechDudie]

Ok then

[corarona]

I see. In that case. By all means rehash all the points made before :)

[LizzyFleckenstein03]

@TechDudie I reported you for Spam.

[TechDudie]

minetest/minetest#10835

[TechDudie]

Fine

[LizzyFleckenstein03]

I've made a decision.

I give you the choice between two options.

You can choose peace. If you do, I do not want to hear any insults, comparisons or proposals to delete the repo / make it private. As I said, I will help you with anticheat features and exploit patching, but I will not tolerate any harassment against me or my projects anymore.

You can choose war. This client was not created as a tool for damaging servers, but to be useful in an anarchy environment. However, that can change. If you invade the anarchy scene, the anarchy scene will invade you. If you want the client to evolve this way, fine, but I guarantee for nothing.

Only because you are server admins, that does not mean you can just mess with a group of developers and players in such a way without expecting consequences. I want you to cut it right here and right now, or we will respond in our way, with our weapons. You love your community, and I love mine. And I will fight for it.

I am expecting a response.

this is still important

[TechDudie]

Peace

[anon55555]

Version strings end in -dragonfire now, servers not wanting hackers can block clients with version strings ending with that. Can this issue be closed now?

[ValkyrieStella]

Version strings end in -dragonfire now, servers not wanting hackers can block clients with version strings ending with that. Can this issue be closed now?

that sounds like a good solution

[TechDudie]

hacker comes along hacky hack hack ok there we go now I can use this client for no-anarchy servers

[corarona]

The problem of people cheating on non anarchy servers should not even considered to be solved clientside. This is like complaining to google they should fix chrome because there's an sql injection on some server.

[LoneWolfHT]

If servers are given a way to detect hacked clients it would be appreciated. Don't need to go as far as removing the client

[randomMesh]

We should be grateful that this project exists. Demanding to shut it down is pathetic.

Take the opportunity and fix the bugs in Minetest instead. This client is an excellent tool to be used to harden Minetest.

[ValkyrieStella]

We should be grateful that this project exists. Demanding to shut it down is pathetic.

Take the opportunity and fix the bugs in Minetest instead. This client is an excellent tool to be used to harden Minetest.

to be clear I never called for removal, but for effects on other servers to be taken seriously. custom version string would be a huge improvement

[LizzyFleckenstein03]

to be clear I never called for removal, but for effects on other servers to be taken seriously. custom version string would be a huge improvement

Would be? It's done.

[ValkyrieStella]

to be clear I never called for removal, but for effects on other servers to be taken seriously. custom version string would be a huge improvement

Would be? It's done.

ik, and appreciate that

[rubenwardy]

God, there's a lot of chat here. I haven't read most of it.

Having suitable tools is good for security. The infosec community has a wide range of freely available tools which you can use to test for common vulnerabilities. These tools improve security of applications by making it easier for white hackers to audit systems.

Having a cheat client can make it easier to test and fix vulnerabilities. The dragonfire developers have also submitted bug reports and fixes for issues they've found.

You don't make software more secure by limiting these tools, you make it more secure by actually working on cheat prevention and fixes. Getting fly/noclip is as simple as changing a single line of code in Minetest, Dragonfire doesn't really make this much easier.

The primary issue with these tools is making it very easy for "script kiddies" to cheat - people will bad intentions and low technical skill. Dragonfire helps with this by at least identifying itself in its version string. It could even be more obnoxious with this by sending a chat message like /me is using dragonfire or /iusedragonfire. The first is probably spam though.

Cheat clients are inevitable, and it's lucky to have one with developers that have been helpful

[fluxionary]

Cheat clients are inevitable, and it's lucky to have one with developers that have been helpful

I agree, thank you @EliasFleckenstein03, that change change to the version string certainly helps server operators, and I didn't realize at the start of this conversation that you'd submitted a bunch of bug fixes upstream. Thank you for that as well.

[ValkyrieStella]

agreed. as long as they take the effects on other servers seriously, I'm happy

[LordPhyre]

God, there's a lot of chat here. I haven't read most of it.

Having suitable tools is good for security. The infosec community has a wide range of freely available tools which you can use to test for common vulnerabilities. These tools improve security of applications by making it easier for white hackers to audit systems.

Having a cheat client can make it easier to test and fix vulnerabilities. The dragonfire developers have also submitted bug reports and fixes for issues they've found.

You don't make software more secure by limiting these tools, you make it more secure by actually working on cheat prevention and fixes. Getting fly/noclip is as simple as changing a single line of code in Minetest, Dragonfire doesn't really make this much easier.

The primary issue with these tools is making it very easy for "script kiddies" to cheat - people will bad intentions and low technical skill. Dragonfire helps with this by at least identifying itself in its version string. It could even be more obnoxious with this by sending a chat message like /me is using dragonfire or /iusedragonfire. The first is probably spam though.

Cheat clients are inevitable, and it's lucky to have one with developers that have been helpful

Hi do you know how I can use this custom version string in a anticheat mod im coding?
Thanks

[fluxionary]

Hi do you know how I can use this custom version string in a anticheat mod im coding? Thanks

you can't do this with a mod, you need to modify the minetest engine source code, something like this:

diff --git a/src/network/serverpackethandler.cpp b/src/network/serverpackethandler.cpp
index b3008bb50..89507c896 100644
--- a/src/network/serverpackethandler.cpp
+++ b/src/network/serverpackethandler.cpp
@@ -40,6 +40,7 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 #include "util/pointedthing.h"
 #include "util/serialize.h"
 #include "util/srp.h"
+#include "util/string.h"
 
 void Server::handleCommand_Deprecated(NetworkPacket* pkt)
 {
@@ -391,6 +392,15 @@ void Server::handleCommand_ClientReady(NetworkPacket* pkt)
        std::string full_ver;
        *pkt >> major_ver >> minor_ver >> patch_ver >> reserved >> full_ver;
 
+       std::string playername = playersao->getPlayer()->getName();
+       if (str_ends_with(full_ver, "dragonfire")) {
+               warningstream << "Server: " << playername << " tried to connect w/ dragonfire client " << full_ver << std::endl;
+               DisconnectPeer(peer_id);
+               return;
+       } else {
+               actionstream << "Server: " << playername << " connected w/ version " << full_ver << std::endl;
+       }
+
        m_clients.setClientVersion(peer_id, major_ver, minor_ver, patch_ver,
                full_ver);

[LordPhyre]

Why not?

It violates the basic idea of this hackclient - from the begging it has been less about exploits and more about API and bots. The Idea is to actually have freedom when it comes to CSMs and Settings. There are things like enabling CSMs in main menu, a CSM database, settings access from CSMs, CSM access to ClientActiveObjects and InventoryActions, in general it's about freedom. Not exploits, just freedom.

yes but actually no because that would imply you have the freedom to use this client on any server and therefore would make this entire argument hypocritical and retarded.

Even CSMs can be stopped form being used in minetest.conf when setting up a server. Your "freedom" argument is very grand but completely disregards all previous "cooperation" and "this client is for anarchy servers only" arguments.

I'm trying to make a mod to detect dragonfire and ban users that use it, and some silly custom version string doesn't seem to be getting me anywhere.
IF this client actually is anarchy-only, then this command would logically be the best thing that can exist, for all parties involved, since it is up to the server owner to either allow dragonfire, or not. Which is, the desired result for everyone.

Please add this, or something similar, so that server owners can use a simple 10 line mod to stop people from ruining everyone's gaming experience.
Thanks.

[LizzyFleckenstein03]

Please stop the ideology discussion. You're not going to convince me to do something you think is a good idea this way.
I am open to help you, but I'm not open discuss my ethics any further.

It's up to the engine devs to add the API for getting the version string. When the minetest server is compiled in Debug mode, the version strings of clients can already be accessed by the server. I suggest changing this to work with release builds, too.

* `minetest.get_player_information(player_name)`: Table containing information
  about a player. Example return value:

      {
          address = "127.0.0.1",     -- IP address of client
          ip_version = 4,            -- IPv4 / IPv6
          connection_uptime = 200,   -- seconds since client connected
          protocol_version = 32,     -- protocol version used by client
          formspec_version = 2,      -- supported formspec version
          lang_code = "fr"           -- Language code used for translation
          -- the following keys can be missing if no stats have been collected yet
          min_rtt = 0.01,            -- minimum round trip time
          max_rtt = 0.2,             -- maximum round trip time
          avg_rtt = 0.02,            -- average round trip time
          min_jitter = 0.01,         -- minimum packet time jitter
          max_jitter = 0.5,          -- maximum packet time jitter
          avg_jitter = 0.03,         -- average packet time jitter
          -- the following information is available in a debug build only!!!
          -- DO NOT USE IN MODS
          --ser_vers = 26,             -- serialization version used by client
          --major = 0,                 -- major version number
          --minor = 4,                 -- minor version number
          --patch = 10,                -- patch version number
          --vers_string = "0.4.9-git", -- full version string
          --state = "Active"           -- current client state
      }

[LordPhyre]

* `minetest.get_player_information(player_name)`: Table containing information
  about a player. Example return value:

      {
          address = "127.0.0.1",     -- IP address of client
          ip_version = 4,            -- IPv4 / IPv6
          connection_uptime = 200,   -- seconds since client connected
          protocol_version = 32,     -- protocol version used by client
          formspec_version = 2,      -- supported formspec version
          lang_code = "fr"           -- Language code used for translation
          -- the following keys can be missing if no stats have been collected yet
          min_rtt = 0.01,            -- minimum round trip time
          max_rtt = 0.2,             -- maximum round trip time
          avg_rtt = 0.02,            -- average round trip time
          min_jitter = 0.01,         -- minimum packet time jitter
          max_jitter = 0.5,          -- maximum packet time jitter
          avg_jitter = 0.03,         -- average packet time jitter
          -- the following information is available in a debug build only!!!
          -- DO NOT USE IN MODS
          --ser_vers = 26,             -- serialization version used by client
          --major = 0,                 -- major version number
          --minor = 4,                 -- minor version number
          --patch = 10,                -- patch version number
          --vers_string = "0.4.9-git", -- full version string
          --state = "Active"           -- current client state
      }

well thats annoying, because that makes everyone's life harder.
but fine, I promise not to discuss your ethics any further.

However, I don't really get how I can actually blacklist the version strings that indicate a player is using dragonfire.

Like, okay, the server now has access to the version strings, but now what? How can I then selectively ban the players?

[fluxionary]

Like, okay, the server now has access to the version strings, but now what? How can I then selectively ban the players?

I'll answer this question on the forum thread, please stop bothering Elias.

[LordPhyre]

Like, okay, the server now has access to the version strings, but now what? How can I then selectively ban the players?

I'll answer this question on the forum thread, please stop bothering Elias.

To be honest, I don't really care who or where it's answered, but please, someone answer!