| 00:00.53 | *** join/#bzflag Shuist (~Shuist@ppp203-122-213-220.static.internode.on.net) |
| 00:41.17 | macsforme | yay! http://www.gcw-zero.com/downloads |
| 01:25.40 | blast007 | "Come play an insecure version of BZFlag without SSL certificate validation, wide open to MITM attacks with self-signed certificates" |
| 01:28.40 | macsforme | ... |
| 01:32.08 | blast007 | could've pointing cURL at a proper CA cert bundle, but instead just disabled verification |
| 01:36.37 | blast007 | https://curl.haxx.se/docs/caextract.html https://curl.haxx.se/libcurl/c/CURLOPT_CAINFO.html |
| 01:40.20 | macsforme | you know, encrypted list server transactions are nice, but now that we finally have them it's a little disingenuous to pretend that the method we used for ten years or more was so awful and bad |
| 01:41.41 | JeffM | no... it was |
| 01:41.43 | macsforme | and anyway, there's a timeout somewhere such that you can hardly authenticate on the thing anyway (unless you join an empty server)... usually you get an authentication failure (and a '-' next to your name) because it's too slow |
| 01:43.01 | macsforme | furthermore, bundling any certificate authority information with the package would have made it obselete once those certificates expire |
| 01:44.25 | macsforme | and you were talking about Let's Encrypt certificates... I don't know exactly how all that stuff works, but it seemed like if we had rolling certificates that expire every three months, that could compound the problem |
| 01:45.44 | JeffM | they are signed by a real CA, so it's fine |
| 01:46.00 | JeffM | I've been using them fine |
| 01:46.53 | blast007 | they don't work with XP though, so I went back to a paid cert |
| 01:50.01 | blast007 | macsforme: and those are CA root certs... so, for instance, one of them (the first in the file maybe?) expires in the year 2028 |
| 01:50.27 | macsforme | and some of them expire in 3-5 years, iirc |
| 01:50.55 | blast007 | probably ones you don't need to care about |
| 01:54.48 | blast007 | there's quite a few that expire in 2020, but they were 10 year certs, so if you just update once they issue replacement, you're probably good for another 10 years |
| 01:55.31 | blast007 | and failing to work is better than pretending that everything is okay |
| 01:58.07 | macsforme | uh... a program that won't do anything is a lot less useful than a program that works but doesn't have all the new security features |
| 01:58.54 | blast007 | but at least then it's *obvious* that something is broken instead of just hiding the breakage |
| 02:02.27 | blast007 | cuz really, does it require too much effort to update a single file in the package every few years? |
| 02:04.16 | macsforme | there's no update mechanism... people download programs from a web site and upload it to their devices manually |
| 02:04.42 | JeffM | for critical systems it is important to produce errors rather then giving false impression that there is no error. at least that's what we do at work. |
| 02:04.45 | blast007 | why does such a horrible device exist in this day and age? |
| 02:05.10 | blast007 | My N800 had a proper update mechanism, why can't that system? |
| 02:05.14 | JeffM | we used to "limp along" with invalid data and no errors. but then a spaceship missed mars |
| 02:05.38 | macsforme | why do you care? you don't have to buy one |
| 02:06.13 | macsforme | but people who bought one (to promote the ideals on which the project was based) can enjoy it more by playing bzflag on it |
| 02:07.56 | macsforme | indie projects don't always pan out the way people envision... but I appreciate that they tried, because I don't want to live in a world where the big manufacturers go unchallenged because nobody bothers to try |
| 02:16.22 | macsforme | really though, I put many, many hours into porting it, and just getting the game to work under OpenGL ES was quite an effort (and an achievement, I think), then laying out the controls to make it playable, tweaking little things, etc., so mocking it for one shortcoming is pretty insensitive... |
| 02:19.46 | JeffM | is it fun to play on the device and can you be competitive with it against PC players? |
| 02:21.40 | macsforme | people who have tried it said it was fun... by default you get an alternative list with servers just for that device |
| 02:21.47 | blast007 | "there's a timeout somewhere such that you can hardly authenticate on the thing anyway (unless you join an empty server)... usually you get an authentication failure (and a '-' next to your name) because it's too slow" |
| 02:22.14 | blast007 | so why not just remove authentication? |
| 02:22.41 | JeffM | how hard is it for them to join real servers? |
| 02:22.49 | macsforme | you can play against PC users, but I would say having a keyboard or mouse would be an advantage (and the framerate is low on some maps with more geometry) |
| 02:23.09 | macsforme | it's just a toggle I added to the join game menu |
| 02:23.56 | macsforme | blast007: because I'm hoping the problem can be fixed? |
| 02:24.28 | macsforme | is there a timeout in the list server between the authentication and the checktoken? |
| 02:24.35 | blast007 | so if you can fix that kind of problem, why can't you periodically push out a new version with an updated cacert.pem? |
| 02:24.48 | JeffM | would you call it a viable platform for long term gaming or more of a curiosity? |
| 02:25.06 | macsforme | it would be fixed in our infrastructure, not on the device |
| 02:25.32 | blast007 | so your device is so slow it can't send a complete HTTP request in 5 seconds? |
| 02:26.07 | JeffM | threads! |
| 02:26.52 | macsforme | of course it could, if that was all it was doing... our game determines the order of stuff, though... the overall process is apparently too slow |
| 02:27.56 | blast007 | you're saying that authentication is failing because the device is too slow |
| 02:28.05 | macsforme | JeffM: more of a curiosity/experiment... I probably wouldn't do it again (a lot of software support on the device is incomplete/broken) |
| 02:28.23 | blast007 | the only timeout that it should be hitting is that 5 second one |
| 02:28.46 | macsforme | that's the actual limit? |
| 02:28.53 | *** join/#bzflag I_Died_Once (~I_Died_On@unaffiliated/idiedonce/x-1828535) |
| 02:28.56 | blast007 | yeah |
| 02:29.14 | JeffM | you can access curl in async mode |
| 02:29.14 | macsforme | yeah, that's probably the issue |
| 02:29.59 | blast007 | so again, your device can't send a complete HTTP request in 5 seconds? |
| 02:30.43 | blast007 | probably not even 1KB of data that it needs to send.. it's just the headers |
| 02:31.29 | macsforme | that's not an accurate description of the authentication process |
| 02:31.41 | JeffM | problem may be that you are using async mode and the device doesn't thread well, could make it blocking and it'd go faster |
| 02:32.02 | blast007 | it's an HTTP request, so yes, it is an accurate description of the process |
| 02:32.06 | macsforme | the device does the auth request, receives the response, then connects to the game server, and the game server has to check the token |
| 02:32.06 | JeffM | authentication from the client is a single HTTP hit |
| 02:32.19 | JeffM | the timeout is on a single connection |
| 02:32.23 | JeffM | the token is good for 5 min |
| 02:32.36 | blast007 | so, you said that authentication was failing, but it's actually working? |
| 02:32.47 | allejo | congrats, none the less, macsforme |
| 02:32.49 | allejo | :D |
| 02:32.57 | JeffM | so yes, if you hit the 5 second timeout, then it's only a single hop |
| 02:33.07 | macsforme | well, there's no error on the device for the authentication attempt |
| 02:33.13 | macsforme | thanks, allejo :) |
| 02:33.58 | macsforme | so is it 5 seconds or 5 minutes? |
| 02:34.14 | JeffM | depends what you are talking about |
| 02:34.25 | JeffM | it's 5 seconds to complete a single HTTP request |
| 02:34.28 | JeffM | to get a token or check a token |
| 02:34.39 | JeffM | if you are talking client, then it's getting a token |
| 02:34.53 | JeffM | that token is valid for 5 min |
| 02:35.02 | JeffM | you as a client have 5 min to send that token to a game server |
| 02:35.06 | JeffM | then it auths it |
| 02:35.15 | macsforme | oh |
| 02:35.24 | macsforme | weird, then |
| 02:35.33 | JeffM | so client problems mean that your client sends a single HTTP request, with your credentials to the list server |
| 02:35.38 | JeffM | that responce has the token |
| 02:35.46 | JeffM | that's it for client side auth |
| 02:35.58 | JeffM | so that is the entire process as far as you are concerned |
| 02:36.11 | JeffM | the token is sent over BZF protocol |
| 02:36.14 | JeffM | the validation is server side |
| 02:36.42 | JeffM | so yes, your client can't finish a HTTP request of less thank 1k in 5 seconds |
| 02:36.55 | JeffM | it has no body |
| 02:37.02 | JeffM | just a header and fields |
| 02:37.26 | JeffM | username and pass |
| 02:38.03 | JeffM | is it an arm processor? |
| 02:38.11 | macsforme | mips |
| 02:38.16 | JeffM | ooofff |
| 02:38.31 | JeffM | kernel probalby doens't tread well |
| 02:38.33 | macsforme | why would it make a difference whether the server has many players or only a few? I got no failures on empty servers |
| 02:38.57 | JeffM | what is the exact mode of failure? |
| 02:40.09 | macsforme | I connect to the game, and I get a message that this callsign is registered, use global auth |
| 02:40.20 | macsforme | but no local error |
| 02:41.13 | JeffM | there could be many causes for that |
| 02:41.21 | JeffM | are you sure you are sending a token? |
| 02:41.30 | JeffM | is the token sent after getting the list of players? |
| 02:41.36 | blast007 | bzfs -dddd would show the actual HTTP requests |
| 02:41.56 | JeffM | is the packet size large enough to handle our packages? |
| 02:42.56 | macsforme | everything else works... I would imagine the packets for downloading map data and textures are bigger than header-only HTTP requests |
| 02:43.34 | JeffM | well are you sure the problem is HTTP? |
| 02:43.54 | JeffM | curl knows how to handle small packet sizes |
| 02:43.57 | JeffM | bzflag.... not so much |
| 02:44.22 | JeffM | I'd validate that the token going out is ok |
| 02:44.40 | JeffM | and set up a debug server to validate that it's getting that token |
| 02:44.45 | macsforme | isn't it sent over TCP to the bzfs server? |
| 02:44.54 | JeffM | if the token you get is bullcrap then you know it's HTTP |
| 02:45.02 | JeffM | if the token is valid, it'll be something else |
| 02:45.17 | JeffM | I belive it is |
| 02:45.58 | JeffM | you can manualy validate tokens to test |
| 02:47.15 | JeffM | one thing to check, does it work if you conect shortly after getting a list? |
| 02:47.23 | JeffM | the client should get a token at list time |
| 02:47.40 | JeffM | it should only need to re-get the token if it's deaded |
| 02:48.00 | macsforme | not sure I've tried that |
| 02:48.18 | macsforme | sometimes the list doesn't come back... when it does, it usually takes 5-20 seconds to show up |
| 02:48.30 | JeffM | that is a bigger message |
| 02:48.46 | JeffM | and there is some unpacking of the data |
| 02:48.58 | JeffM | if the CPU is slow that can take some time |
| 02:49.12 | macsforme | the MOTD also doesn't show up for about 15 seconds after launch |
| 02:49.28 | blast007 | but hey, it compiles! |
| 02:49.38 | JeffM | yeah you may have transport time issues |
| 02:49.55 | JeffM | throw some clock checks around it |
| 02:50.07 | JeffM | but it sounds like the device isn't really up to snuff for that kind of gaming |
| 02:50.16 | macsforme | blast... |
| 02:50.33 | JeffM | it's nice you put the work into it, but that doesn't change the fact that the platform kinda sucks |
| 02:50.55 | JeffM | road to hell and all :) |
| 02:54.06 | macsforme | oh I agree the platform has many shortcomings |
| 02:55.29 | macsforme | inferring that I got it to compile and then just thew it on there and released it is an insult to the many hours I spent tailoring it to this device and polishing it as much as I reasonably could, though |
| 02:56.22 | macsforme | this was the "hey, it compiles" moment: http://fairserve.net/~josh/bzflag/embedded/gcwzero1.mov |
| 02:56.28 | macsforme | :) |
| 02:57.03 | JeffM | it's just a little hard to see the point when it doesn't seem to be a viable platform. I'm happy you are proud of it, just from a personal achivement standpoint |
| 02:57.17 | blast007 | you still shipped a knowingly broken release to a device without an update mechanism |
| 02:58.03 | JeffM | it's a partialy functional port. thankfully the part that is working is fun for a few people, but it's hard to see it as a maintainable platform. |
| 02:58.05 | macsforme | saying something repeatedly doesn't make it true... leave that to the politicians |
| 02:58.43 | JeffM | is this your first published work? |
| 02:58.51 | JeffM | that's always a good thing to see |
| 02:59.04 | blast007 | *you* said that authentication usually doesn't work... that's you knowing that it doesn't work |
| 02:59.08 | macsforme | of its magnitude, yeah |
| 02:59.46 | JeffM | well he also clearly knows the platform isn't great |
| 03:00.04 | JeffM | so it's kinda a port in line with a flaky platform |
| 03:00.28 | JeffM | and he probalby learned a lot from it |
| 03:00.41 | macsforme | yes |
| 03:00.45 | JeffM | so as a personal goal that's good |
| 03:00.55 | JeffM | as something for bzflag to be proud of........ |
| 03:01.58 | macsforme | it's at least a symbolic accomplishment... I'm not aware of bzflag ever being ported to a console (or anything other than PC platforms) before |
| 03:02.04 | JeffM | personaly I'd have slapped "Beta" on something with a number of known flaws |
| 03:02.36 | JeffM | does the device run a desktop environgment like a window manager? |
| 03:03.22 | macsforme | no... it has a launcher type thing with a list of applications |
| 03:03.51 | JeffM | are input , sound, and networking using cusstom APIs or did SDL take care of it all? |
| 03:04.18 | macsforme | SDL took care of it... networking just used the native linux stuff, I think |
| 03:04.34 | macsforme | except I had to map the buttons |
| 03:04.48 | JeffM | yeah, little hard to call it a console port, it's more of a limited system linux port |
| 03:04.56 | JeffM | like a rasbery pi port |
| 03:05.01 | JeffM | but still, took some work |
| 03:05.09 | JeffM | and the openGL ES work is useful |
| 03:05.29 | JeffM | that sounds like a better achivement then getting it to run on that little handheld PC |
| 03:06.06 | macsforme | it does run on the raspberry pi as well... and (kinda) on iOS |
| 03:06.56 | JeffM | does authenticaiton work on the PI? |
| 03:07.03 | macsforme | yes |
| 03:07.32 | JeffM | then yeah it's probalby a platform problem |
| 03:07.54 | JeffM | it sucks that the platform can't propelry implment one of the bzflag requrements |
| 03:21.13 | *** join/#bzflag zuii (~cauchy@BC06BF93.catv.pool.telekom.hu) |
| 05:29.44 | *** join/#bzflag zuii (~cauchy@BC06BF93.catv.pool.telekom.hu) |
| 09:45.16 | *** join/#bzflag luigifridini (~luigifrid@524A4517.cm-4-3b.dynamic.ziggo.nl) |
| 09:53.33 | *** join/#bzflag luigi (~luigifrid@524A4517.cm-4-3b.dynamic.ziggo.nl) |
| 14:10.16 | *** join/#bzflag luigi (~luigifrid@524A4517.cm-4-3b.dynamic.ziggo.nl) |
| 14:24.01 | *** join/#bzflag Void7 (~NULL@205.157.147.198) |
| 15:59.37 | *** join/#bzflag Flak18 (~Flak@2601:58b:c400:4681:65e8:dd06:351e:7cfe) |
| 16:16.06 | *** join/#bzflag BZnotify (~BZnotify@192.30.252.34) |
| 16:16.06 | BZnotify | [13bzflag] 15kongr45gpen pushed 1 new commit to 062.4: 02https://git.io/v6bCO |
| 16:16.06 | BZnotify | 13bzflag/062.4 141e2f61a 15kongr45gpen: Don't crash if a plugin with a pending URL job calls bz_shutdown() |
| 16:16.06 | *** part/#bzflag BZnotify (~BZnotify@192.30.252.34) |
| 16:43.14 | *** join/#bzflag KaadmY (uid135503@gateway/web/irccloud.com/x-fpswkkynexjswatd) |
| 17:35.32 | *** join/#bzflag zuii (~cauchy@BC06BF93.catv.pool.telekom.hu) |
| 18:02.59 | *** join/#bzflag FastLizard4 (fastlizard@wikipedia/pdpc.active.FastLizard4) |
| 18:13.36 | *** join/#bzflag Void7 (~NULL@205.157.147.198) |
| 18:16.24 | *** join/#bzflag zuii (~cauchy@BC06BF93.catv.pool.telekom.hu) |
| 19:32.03 | *** join/#bzflag [Gort] (~gort@unaffiliated/gort/x-9231432) |
| 20:16.06 | *** join/#bzflag the_map (~the_map@unaffiliated/the-map/x-1795707) |
| 23:02.21 | *** join/#bzflag Void7 (~NULL@205.157.147.198) |