Login Power~
 

This is a repost from dev/noobs topic becuase from a point of view other than mine, it twists the orignal topic, so i appolize to those parties who beleived this to be a hyjack.


You know i am curious i was talking with someone in irc last night and we debated for a bit, and finally came to an agreement.. so i wanted to put in my 2c.

First off, i have noticed that alot of this thread (not all of it) has to do with the way image was having a "powertrip" here, so i am going to touch on that here, because quite frankly i think its funny that the devs (like wiz wrote "But I really never wanted anything else than getting rid of the powertripping.") think that requiring people to use their login server isn't a "power trip", I mean after all, people can't run their server without a login server, and that gives the devs a feeling of "power" over the project.

First of all, as was put by my friend in irc (and is commented at the top of every single source/header/text file that is in the eqemu source) this project is protected, and follows the rules of the public GNU agreement.

(( Copy of the GPL can be found >>HERE<< ))


And there is a text file called GPL.txt in the source folder. So as such, it should follow the rules, one more important one follows

And ofcourse this doesn't include the Operating system, or compiler etc.., however correct me if i am wrong, but as of 2 or 3 versions ago, (when mini login no longer worked) this program required A Login Server.

The reason i put A in bold is to make the point, that no this project does not infact require YOUR login server. however it requires A login server. But the problem with this fact is that, according to the GNU you must supply all aspects of the project that allow it to work, at compile time, This server source will not run without a login server.

You did infact at one time supply everything that was needed to run a server, (this is when minilogin worked) the problem was, you never released the source to minilogin, or atleast i have never seen one. It could be debated that under the GPL it does state that any code that is not copied or modifed from the program under the GPL, and you could by reading the source say it was written without any direct refrence to the program (hard to believe a server meant to work with another server doesn't have some direct refrence to it but <shrug>,) then it it isn't subject to the GPL and thus it can be closed source.

So now we see that in distributing a working minilogin you are IN A WAY following the rules, however... i just don't see how this can be correct if the minilogin has to directly connect and pipe all the information going into world.exe

And as such i would believe the true login server uses code that directly refrences or corilates with code in the standard eqemu source (Someone prove me wrong), and thus is considered a module of the program and as such, even though it may have be written with clearly identifiable code that has nothing to do with the eqemu server. (I.e. some of the interal workings of the login) it is subject to the following

however you can also see in there if it is part of the whole, then no matter what it does, and who wrote it, it now becomes a part of the main project, and thus anyone should be able to find a copy of the login source at any time, by simply asking..

Now, again someone prove me wrong, but this also means minilogin source should have at anytime been at public grasp, and it was not.

So if this program does infact (which i would believe it does) contain code that is directly linked, or copied/modified from the code in the eqemu server code, its part of the whole ( i think i have said that enough times now).

But let me try to answer a question before any devs ask it.

that question would be of course, what about crypto?

Well there were a few things i was thinking about before i posted this, and i conducted a tiny experiment.

While running the following command in windump.exe (from http://windump.polito.it/install/default.htm )
i the following packet info.

(( Replaced a few things for my own protection )).

The $ represent characters in my password, which in the unmodifed file, is sent in pure plain text. with no encryption what so ever.

however after running windump.exe while running the eqlive version listening on all ports. i found an enourmous amount of server communication between my computer and the eqive login, but i found no evidence of plain text information, but plenty of cases where encryption is evident.

So my question is, where exactly does the eqemu crypto come into effect? My guess would be that the eqlive servers send some sort of command that tells the client what encryption algorithim to use, allowing them to change it from time to time, sadly i don't know the answer to this. but why is it that when using the eqemu login the names/passes are sent in plain text format.

With this, it doesn't seem as if there is any crypto going on at all.

I do not in anyway agree with the fact that they keep the login source to themselves, and that they do control 90% of the eqemu communties servers by making them pipeline all the server information through them first, before anyone can play on any of the servers..

And although i do not agree with it, the alternative is somthing i don't want to see, which ofcourse would be for them to close the project, but in that they would lose the support of the community (which is stated as the only alternative in the GPL, don't follow the rules, close the project).

And trust me there are several ways you could still get people out there to use the eqemu login without keeping the code to yourself.

• 1. You could not realease any binaries, ever, and atleast 30% of the people out there wouldn't have any way, or knowledge of how to compile it, thus they would use the eqemus login.
  
  2. People don't have the kind of internet connection or computer resources that are required to support both a world server, sql server and login server, and as such they would want someone who could handle the workload needed and would use the eqemu login.
  
  3. Release a working copy of minilogin source (yea that means it would have to be fixed), and then the community could update it as needed, and they could host their own privite server again. And if they wanted to host a public server they would have to use the eqemu login. This is a very viable solution, which would allow you to once again follow the rules of the GPL.

So ask yourself, as of right now, 99% of the servers based on eqemu use the public eqemu login servers, the devs have never offered the source to the login, as they should under the GNU GPL, call me stupid, but thats sounds alot like project control to me. I understand the devs don't want people going off and just taking the source as they see fit, and as such they require people to use their login so they will keep comming back, otherwise many people would possibly deadlock their client version, and never have to get new source code to work with the newer eqemu login server.

This in my book, could be defined as a "power trip" They sure seem to like having control over the project, (not managment over it, managing a project, and controling it are very different), and as such i think they would enjoy the power it gives them.

If anyone out there that has somthing meaningful to say other than, Shut the fuck up your stupid. Then i want to hear it, but don't make it all sum up to somthing stupid, and show me a funny picture that shows me how stupid you are.

I KNOW the reason the mini-login source wasnt given out was because it was written by someone else not afiliated with the EMU and they wants it closed source, the EMU Devs had nothing to do with its creation and didnt have permition from its creator to give it out. ( they still dont FYI ) They included and kept mini-login up to be nice to people, I am not sure why they stopped, lack of time, lack of interest, or got sick of people asking for the source so they say'd screw it, or some other reason.

As to them giving out the source to there login server well I dont know so Ill let a Dev answer that.
----------------------Repost from other thread-------------------------

Now I dont KNOW who updated the mini-loin in the past I asume it was the Devs with the understanding from the original coder that the source would never be given out.


There has been discussion of this in the past and the original coder still says No to giving it out. Whether this is a violation or not I dont know, however it is what the original creator wanted and what they agreed to, just to let the community have it to use.

I know little about minilogin or, indeed, much of the GPL spiel, but I am with Charmy in the belief that the release of code for a login server would be a wise move.

I personally am not comfortable with the fact that this project hinges upon one specific group of people. You might be the ones releasing CVS's and letting all of us play the game in the fashion we want to, but some of us (not necessarily me, but various "non-devs") have put in a lot of work as well.

With that in mind, I believe we all have equal stake in the furthered existance of the project. And that, I believe, can only be guaranteed with none other than the release of a login server we can all use and adapt as we see fit.

- Bryan

Please note this is just my opinion. Some may agree or disagree, but I personally believe this to be the best course of action at this point (or any point, for that matter).

I've have always believed that the reason there isn't SOME sort of open source login program is for control. That is the one of the main reasons I stopped following and messing with the EMU. (The others being an obvious "devs > all teenage club mentality", lack of effective source control, multiple "private" unsynced source trees and a general lack of any observable project management. )

I'm am fairly sure that if there were a concerted effort to find a way to have a PD/OSS login server, it would happen...however, I don't see that the dev's (at least not in the past) have ever had great concern for the concerns of the users.

I've heard over the last couple of years the story about the encryption subroutines being the issue and find it a tired story. Why not .DLL it? How was the .EXE distributed in the first place?

The idea that an entire project is basically owned by the 2-3 people who have access to the crypt code is a huge turn-off to many with over a 17yr old "club member" mentality.

Imagine having a copy of Linux but that all the crypt functions were only distributed in binary form by Linus and a couple others...yea, that'd fly. But then again, Linux would have never become anything but a little club if that had been the case.

The only sane thing I've seen come out of the EMU is the work being done by the world buliders. I support them as much as possible, even now. They are reasonable, smart, helpful and actually seem to want to get something done besides measuring their e-penis.

im not even a dev and that offended me.

If someone had the encrypt/decrypt functions said person could easily write a little sniffer that decodes the passwords from players logging into EQLive. That's the reason they weren't published. Putting them into a DLL doesn't help, since anyone (well, not really anyone ...) could link and use it for the same purpose mentioned above.
Although I admit that someone who's able work with an "unknown" DLL is probably also capable enough to crack the encryption himself.

Another reason for not releasing the login server is make sure that all EQEMu servers are centralized somewhere. If you think of that as "control" then you should really do something about your Big Brother paranoia.

Um, the Login was never under any GPL license, ask any dev that has access to the login source, the license is not included in the top like it is on every open source file the project has. So therefore, that argument is irrelevent.

What I dont understand is, you want an answer but in every question you bash the only people who can gibe the answer. You people are proving that your the jerks, if the Devs are sutch jerks why do you have to sink to there level?


Mrwalsh is the only one who asked and didnt say something bad about / bash / act like a child wile posting.


I mean come on if you are so much better then them then STOP acting like you say they are.

bbum :i think the point here s was not "who does what", or "who did what", but "Why isn't there an open source login server available in the project ? ". Vetoeq's last part was of-topic, so nm.



No matter how pure the intentions would have been, that'd be violation of the GPL.

Now, the login server source is not GPL'ed, granted. So, can EQEMu be considered open source, when u can't use the EMU (GPL'ed) without the LS ? Not under GPL terms, that's Charmy's argument.

That information is not crypted in EQEMu's current logging process.

Actually, there is, afaik, no encryption used in any part of playing EQEMu servers

Often the case in long-since untold questions :). i can read little bashing if any.

p.s. no need to quote it to me, i'll re-read and find out myself :)

Try reading what you quote. I was talking about EQLive, and they are using encryption there. They didn't do it for a while, which is why EQEMu could pick so fast with the new login system.

The "old" en-/decrypt stuff is still used on ... um ... I think pre 0.5.6. servers (like WR ... technically).

It's correct that there's no crypting going on with the current EQEMu 0.5.6.+ servers.

LOL this is for sure, the only truth that was said in those last 2 days of totally BS.

Hypocrite.

Resorting to childish insulting is not the way to raise yourself above 17-year-old mentality, so gg on discrediting yourself.

Hmm that's not really true.. i had a typo once and it couldnt connect to the login server, but the source ran fine, the zones connected to my world, etc... just nobody could log on.

Technically the program doesn't REQUIRE a login server to run, u just need it to utilitize it.

Hmm this is interesting, first off all LE you still didn't answer my closing question, it was a simple one that really had almost nothing to do with the login source, and that one is why is my password sent in plain text to your login server. I don't see any data encryption in any packets being sent to the login server. other than that atleast you gave me a relativley simple answer which was Shut the fuck up we don't want to deal with it, which is fine.

Mongrel i hope you didn't mean to tell more than you wanted to.

Wait wait wait, EQLive? no on ever said Anything about the crypto in login, having anything to do with the crypto in eqemulator. So mongerl are you trying to tell me that encryption algorithiums used in the eqemu are the exact same ones used on eqlive?! Well ofcourse they are, they would have to be, hmm thats interesting... I would like to hear a dev just come out and say it, is it that difficult? I mean after all there reallllly isn't much to hide, you are already doing somthing against the rules, so why is it so hard to tell the truth?

Write a little sniffer hmm? Sniffers usually Collect Packets right? Like a PacketCollector? Before anyone quotes me or you jump ahead of yourself there, i never accused anyone of anything, nor would i ever. I am simply pointing out a fact of what mongrel is saying could be taken the wrong way.

Don't get me wrong LE, I know releasing the algorithiums could be a big mistake, the fact remains you have never, up to this point simply come out and say it. And that i do not understand.

Ok mongrel think about what your saying here. When somthing in centralized, that means there has to be someone or somthing that 'controls' it. Believe me mongrel lol I don't have this strange paranoia that is telling me (( Someone Is Watching You )) (( The devs read everything you say!! )) (( Shit! That means they know about the cybering i was doing!)) No i really don't care what the devs do with the information that is sent over their server, if they enjoy my cyber, then all the better, now 3 people get to enjoy it. Its the fact that the info MUST go through them, that makes me question it all. If the algorithiums are going to be y our only defence then that probably means somthing bad would go down if you released them. So what woudl go down LE? Would you get in big trouble? You can answer me in one word answers if you want, as could dooman.

I am not paranoid, i am jewish, if someone wants to centralize my work i want to know why, if i should have access to somthing that i 'legally' should, but do not, i want to know why.

You can say its not under the GPL all you want, the fact remains it is a module of the main project, and should follow the rules. Just tell us why you aren't following the rules, tell us that the information could be used to malevolent ends, But don't just sit there and say, We don't want to, end of topic. becuase it doesn't work that way myfriend, as it was once put.

Hmm. Right now you haven't told me or any of the other public why you can't or won't release it. Right now it just looks as if your a mean little kid trying to keep the worm squished between his fingers becuase he can.

Charmy, just give up man. you aren't going to leech the login source off of them. They don't want to give it up, they wrote it and have that right.

You're calling everyone a hypocrite today... y'know... I heard something about people calling others what they would least like to be called.

It's not Emu's job to save the SOE devs from their own stupidity. There are plenty of asymmetric encryption algorithms out there, many that have been out for so long their patents have expired or are about to expire. With an asymmetric algorithm, you can know every single piece of math that algorithm does, but no, you're still not gonna be able to decrypt a piece of traffic going across the wire. If SOE chooses not to take advantage of one of these algorithms, the project need not suffer because of their laziness.

That said, I brought this up before, and was told that minilogin is able to be considered a third party program much like the packetcollector or the other stuff various peeps are making in the Third Party Tools forum, and as such they are not required to give the source. At least that's what I made out of 1 or 2 meaningful sentences of Image's response, before he degenerated into his standard "You're a retard and a poo poo face for bringing this up."

To clarify how the login server works in the whole scheme -- the only time you're talking to the login server is while you're authenticating and getting the server select screen. After you pick one of the servers and connect to it, the logon server plays no further role in your communication.

I think we're releasing the new loginserver, anyways, once it's complete.

So then you can pretty much take your conspiracy and club arguments and stuff them.

First of all, the GPL does not state anything about software distributed under it's license has to be "usable".

It means, that if you are give a binary form of something under the GPL you have the right to the source code comprising it. But all portions of said binary code do not have to be under the GPL.

A perfect example are things like, Cedega (aka WineX) from transgaming. They are based on Wine, an opensource/GPL project. But, their Direct3D implementation on linux that is used in Cedega is -NOT- under the GPL.

World/Zone/EMuSharemem are GPL'd. LoginServer and ChanChannels are not GPL'd. End of story.

If you don't like it, take me to court.

I know for me, i am a huge noob when it comes to compliling and all that open source and GPL violation bullsh*t. Many of us just want to play the game to expirence things we mau never get too in EQLive. As with any closed source programs you run the possiblity of putting virus/sniffer like programs on your personal computer. I know, however, that when i program at low levels, even though some of my programs are very smiple, i dont like people looking at my code without my permission. This maybe way off topic, but i like teh idea of everyhting being pre-complied and not having to worry about all that open source jazz.

You can't expierence alot of what you can when you edit and compile your own version of EQEMu Source.

/rant on
first off, GPL is not bulls*t, it's the guarantee to have the freedom to use software if authors have decided so. Would you use a compiler where the the publisher decides what time schedules you can compile, or use the executable ? Take time to read GPL when you want, and you'll see it's not bullsh*t.
/rant off

What keeps EQEmu contributors (devs or others) together, is the possibility to alter and improve EQ, with material (software and content) at maximum freedom. Else, we would play SOE's. It's faster, easier, better quality, and cheaper.

The in-topic is : do closed source loginservers harm this freedom ?

No, loginserver does nothing at all for the play experience so it doesn't do any harm having it closed source.

remember that good ol' play experience ? Sry, i can't agree with that.

Here is a big issue in regards to the minilogin.exe. You publish it as a binary under a SourceForge website that is offered under its own license as only GPL'd. Which means anything you allow on the site at any time past/present that source code is legally attainable by said end-user. Sorry mates but by your publishing a binary under a GPL umbrella'd license you did in fact guarantee that that minilogin.exe file should have had source available.

No need to argue it with me, I been in the business to many years to care about opinion, it is fact though.

Nuff said,
Darkwaters

EQEmu provides an alternative experience to the live EverQuest(tm) servers. It is currently in development and new features are brought to light every day.


:Gaming Foundry


Development Status: 4 - Beta

Environment: Console (Text Based)

Intended Audience: End Users/Desktop

License: GNU General Public License (GPL)

Natural Language: English

Operating System: Windows 95/98/2000, FreeBSD, Linux

Programming Language: C++

Topic: Games/Entertainment



here it is in black and white to save you the argument.
Darkwaters

What's your point? EQEmu is under GLP, yes, and is distributed with source as such.

But the loginserver isn't, so your argument is completely irrelevant.

Actually the fact that minilogin was available on an only GPL authorized site denotes that minilogin.exe was also under this license or that you blatantly violated such said license agreement.
I did not mention loginserver as such as you currently use. I did however mention minilogin which is still documented as being available even though it is not in the available list of downloads. I have 2 versions personally that I downloaded from SF. It would only be fair that either I under the fact it was available that its source was available or that this "new loginserver" mentioned by Wiz would be made available for others like myself who like Lan-party's. I mean the EQEmu team did offer this feature under GPL at one point and that one point in times source should still be available to the public.
Darkwaters

Putting minilogin up for download on SF violates SF's rules, not GPL rules.

The author did not want the source distributed and didn't put it under GPL, and thus the source will not be distributed. End of story.

Um it really did violate both and I'm not getting nasty so don't make me go there with the end of story line Melwin. I'm staying on topic and have not violated any Forum Rules. So please do not take a fatherly tone with me when I did nothing wrong as far as rules, ethics, or attitude go.
Secondly, then what can we do to implement something for local servers or is there a piece of the module that would not give out your login authentification that we could build upon ourselves, this is merely a request, I have not demanded anything.
Keeping it real and not upset. No others should take my posts as such, since their not meant to be taken that way.
Darkwaters

I don't mind a PM answer if you'd like to keep it out of forums. But I would appreciate some type of detailed and kind answer not a slam me in the face type, please.
Darkwaters

Putting out a minilogin is low priority right now. That's why there isn't one out. The reason the old one is not released is because the author doesn't want it released. That's all there is to it.

I'm free to put "End of story" at the end of the story, by the way, especially when you decide to throw out assumptuous statements like

It's assumptuous, because there was a need to argue: You were completely mistaken.

From CVS as instructed on this website two files are a portion of the CVS code: Loginserver.ini and Loginserver.h

Now that you happen to have this much available the module associated with it should be obtainable or this portion of the application is useless.

Since this portion of LoginServer.cpp actually connects to another module that does not have available source or under GPL, when is the emulator package becoming OpenSource?

Just questions that again can be answered via PM or just a friendly response in forum.

Darkwaters

I'll give you that Melwin, but its only because it seems to become a natural habit to expect that type of response on this forum. So please disregard that portion.
Again as I stated above I did not state anything rudely, only very curious as it would be a total blast to have a lan party something that I am quite capable of with 6 systems in house on its own network.
I understand that minilogin was and is unavailable but there has to be something made available when the world.exe expects that LoginServer portion of code using LoginServer.ini would have an available "module" to connect too. Since that was minilogin's intent and it was made available why not allow a small team to work on such a project with whatever documentation or code would not harm your own application since we're forced to use something that used to be freely available for Local Usage.
Again I am only curious, you can PM if you'd like and I would stop asking questions if I got that actual answer I am asking for.
When will this be available realistically less than month since it was offered as a free add-on module for local use or can I work with someone to build such a beast, I have the time.
Darkwaters

I'm not sure if anyone currently has any plans to make a working minilogin, so feel free to make one yourself.

You don't need the loginserver to run world.exe and have zone.exe connect to world. This is why it doesn't violate GPL. GPL has no statement about usability.

Thank you for the answer and it was really all I was asking for. You answered about the GPL and you answered Why and you gave me go ahead to work on it. I again appreciate your response and will work on this as soon as I eat.

PS. No hard feelings for repetitive questions, its a natural habit of mine. =)

Darkwaters

Ask SOE, they wrote the Everquest client, I didnt. The version of the client we use does not encrypt information, if you would use the search button it has been stated numerous times. Deal with what exactly? The WHOLE reason why we arent releasing the code is because the original author doesnt want it released. I dont give a damn what you people think your entitled to, I will respect the wishes of the original author.

The software also runs on Windows, why dont you ask Bill Gates for their source. I mean by your logic something isnt GPL unless it only interacts with things that are GPL. That would mean that any GPL software written for windows isnt GPL, right?