Depreciated builds connecting to server and posting

[MikeDev101]

Discussed in https://github.com/meower-media-co/Meower/discussions/70

^{Originally posted by TermOfficial November 24, 2021}
This could potentially cause meower to be a train wreck if we make a bug in a previous release and let the old releases connect to the server. If the bug was severe and did something bad, the server is a goner.

[williamhorning]

Wouldn't it be possible for the Cloudlink Server to send a message containing a version number, and have the client check to see if it is an older build?

[Rix565]

I have an idea.
We implement a system with a secret key.
Each server has its own Secret Key and when a client connect to it, the server ask for the secret key.
The client sends the right prod key ; the server accept the connection and the client (so the latest production one) can continue.
On a modded client or an older client, that doesn't have the right key, gets literally kicked out of the server with an error code like E:WRONG_KEY.
On the client & server source code, of course make the secret key a dummy one like default and indicate in the readme to change the secret key for a prod server.

[MikeDev101]

More or less CLTLS, a project yet to be implemented. Keep it simple for now, we'll just do a number check.

[TermOfficial]

More or less CLTLS, a project yet to be implemented. Keep it simple for now, we'll just do a number check.

CLTLS can be utilized in a special way, sorta.
If the decryption signature key (In ACE) does not decrypt the correct cert, it just says "screw you im not gonna do anything"
I forgot to add it into ACE, but it's in osu!js.

[MikeDev101]

CLTLS can be utilized in a special way, sorta.

Please contact me in Discord as we still have to discuss CLTLS.

[TermOfficial]

CLTLS can be utilized in a special way, sorta.

Please contact me in Discord as we still have to discuss CLTLS.

I can try, but I can't for too long.

[TermOfficial]

Nevermind! I can't. Sorry! I'll just try this weekend.

[MikeDev101]

ok.

[MikeDev101]

Because of improvements to CloudLink and the addition of Trusted Access, we can simply assign a unique key for a new build of Meower and put that key into the compiled HTML page, without sharing the key in public access source code. For every new build, we destroy the old keys, which will prevent older builds of Meower from gaining trust on the server.

[williamhorning]

@MikeDev101 what would happen with meowerplus, would we get our own keys?

[MikeDev101]

keys will be provided when needed

[MikeDev101]

Fixed as of latest build, with both trust keys and IP blocking