Security: Prevent or Mitigate Denial-Of-Service Attacks via plug-in code

[scalatron]

Time Estimate: a few hours.

Difficulty: Medium

Motivation: Any bot can simply use a while(true) {} to hang the tournament loop. This is acceptable in (relatively) trusted environments, such as hack-a-thons. Less ideal for systems that students are supposed to hack on at universities or schools. Completely unacceptable for a future web-hostable version of Scalatron.

How to Implement:

• introduce a timeout on Akka Futures
• Disable plug-in on timeout violation
• Experiment with Thread.stop() to kill the plug-ins

[scalatron]

As a temporary solution, there is now a global timeout across all bots in 1.0.0.2 if the server is run with "-secure yes", but this is insufficient: we need per-bot timeouts, subsequent disabling of bots AND Thread.stop() on the culprit thread(s). Question is pending on the Akka mailing list.