MAJOR security hazard

greenspun.com : LUSENET : MARP Editors : One Thread

As some of you may know, Mark has released win37b9tg1. Unfortunately, by simply examining an .inp made with it, it is extremely easy to figure out the encryption used. MUCH easier than 35tg3. This is because every frame appears twice in the .inp, once unencrypted and once encrypted.

And what's worse, is that that knowledge can then be used to hack 35tg3 as well, since the encryption is basically the same.

So... please do not distribute or use win37b9tg1 and immediately delete any .inps uploaded using that version. Like I said, any win37b9tg1 .inp can be used to hack 35tg3 as well.

Cheers, Ben Jos.

-- Anonymous, April 03, 2001

Answers

I really don't want to support either version and furthermore do not want to see it as an INP option here at MARP. These releases have just added confusion which is very unnecesary, and above all it is very late for that matter. Again, I prefer to wait for m37final and don't want to get into supporting intermediate beta releases. Also, in the future I don't want to see BOTH m37tg and m37te, so Ben Jos and Mark have to get on the same page and develop one final version for testing. Sorry for the negative append, but I don't like the fact that a new verision of MAME appears out of nowhere. It is disturbing to not have proper version control and real testing done first!!

-- Anonymous, April 04, 2001

I agree with you, Pat.

Mark's knowledge on encryption doesn't cut it.

But I don't want to share TE with anyone for reasons outlined earlier. Even if that means I can't play any tournaments from now on.

Mark didn't even ask me to give this new version a test ride this time.

Sure, maybe win37b9tg2 is more secure than regular MAME, but anyone with a little bit of experience hacking programs can hack it. It's not any more secure than 35tg3. It's time to move on. I know... that's intended for me.

The only possible argument for accepting win37b9tg2 would be that it supports a lot more games...

To be honest... the fact that the encryption has slightly changed in tg2 compared to tg1 and 35tg3, might even make it easier for a smart hacker. Aren't all hackers smart, though?

Well, that's my opinion anyway.

And I am well aware that it all rests on my shoulders now...

Cheers, Ben Jos.

-- Anonymous, April 04, 2001


mark is clearly portraying a Mr. Lame aura. I'm very glad Pat is recommending (hopefully deciding) to not accept versions of 37b7tg1, a very good choice, m35tg3 versions (also a potential candidate for not accepting any more versions of once TE is out) can easily be hacked (I believe No Mercy has hacked his gunsmoke upload.)

I've seen maybe one or two win35tg3 recordings that are all 100 speed's, is this common? It's certainly a avenue to acuse the hacking of a tg3 recording but it can't be proven.

-- Anonymous, April 04, 2001


I am glad you feel the same way, Chad. I thought I was the only one. Even on my 1 GHz machine, I have yet to find a game (no matter how old) on which I get 100% on every single F... frame...

Cheers, Ben Jos.

-- Anonymous, April 04, 2001


I have said I thought that Bubble might be NoMercy. If so, he won't have any trouble hacking tg3. Especially win35tg3.

'nuff said. Both on Bubble and myself. I'm still waiting to catch a "notorious cheater". Only then, I'll reveal whatever other knowledge I have on TG3 versions...

And I failed on catching Lamat lots of times...

Cheers, Ben Jos.

-- Anonymous, April 04, 2001



So what are we saying? Should we be starting not allowing MAME 35 TG 3 recordings like we've been doing? I do agree that as soon as a TE MAME gets released, that's it for MAME 35 TG 3... any recording using that gets deleted... or something like that. I think what we're looking at is it's becoming more and more important that a TE MAME begins testing as soon as possible. That's my opinion however... :) GB9

-- Anonymous, April 05, 2001

The sad thing is that Mark released win37tgb9 ONLY because he accidentally recorded a game of Columns with it and he wanted people able to play it back because "He hates unconfirmed recordings". Boo hoo, I've had a lot of recordings that have been unconfirmed for a pretty long time (some for over two years, some of those 1st place scores). So what? Now the integrity of MARP may suffer because of HIS mistake...

Regarding NoMercy. I just went back and looked through a bunch of .inps that I've had to check for Deca 2K1. ONE person had an .inp that was a constant 100% for the entire game, and that was a 21,000 frame Mr. Do game. The fact that NoMercy maintained a constant 100% speed for over 100,000 frames (Gunsmoke is a pretty long shooter) is indeed incredibly suspicious, and I think you may be right about him being Bubble now, BenJos. But what the heck is his motive, that still eludes me....

-BBH

-- Anonymous, April 05, 2001


Just to clarify: when I said I wouldn't accept both types of recordings I was refering to m37b9tg1 & m37b9tg2 (both of Mark's SNAFU's). Of course in the meantime we'll continue to accept m35tg3 INPs, but as soon as m37 final comes out I would like to have mameTE tested and ready for general release.

-- Anonymous, April 05, 2001

OK... let me clarify something...

Analinp only says something like "50000 good frames (average speed: 100%)". In most cases, this really means that the speed of the frames varies between, say, 97% and 103%. But NoMercy's recordings really has every single frame be 100%. I don't even get this on my computer, no matter how old (and fast) the game is, no matter if I play without sound.

Cheers, Ben Jos.

-- Anonymous, April 05, 2001


Yeah, 100% for every single frame is not impossible for valid recordings, but VERY improbable. Ben Jos, could it be you have something on the task bar that may take a smidgeon of CPU and dropping the frame rate for a few frames?

I think we need to stop asking people to submit a tg3 recording and just wait for TE, it will be a long and painfull process (oh wait it's already that way :) It would suck having to ask people to give a tg3 recording THEN ask them again to give a TE recording for the same game, but we're probably going to do that for at least Nomercy and probably Hisa if he ends up using win35tg3 with his playstation joystick.

I think we need to be public about this distaste of Marks new version, since it seems some players are rejoicing the new tg version. But it would be fruitfull to accompany this distaste with with a date when MAMETE is to be expected.

-- Anonymous, April 05, 2001



I concur with Chad's suggestion. If we did that, realisticly, we should set a release date of June 30. In my opinion. The reason is T6 MAY(may mind you), MAY start July 1. If we want to commit to that release date - for MAME 36 anyway, then we should announce it either on the board or on the news page. MAME 37 should be out by July 1. I don't know yet - just some thoughts. Pete

-- Anonymous, April 05, 2001

Moderation questions? read the FAQ