opensource world : informative post

[ste]

This is not a duplicated thread of the old "vote to opensource" giant-troll thread. You asked some comments about opensource and how it could be possibly applyed to runuo in the mailing list, and i suppose some informations could help.

First, there are plenty of example of successfull opensource project, and plenty of unsucessfull one. runuo is already successfull, and for most users, it will still be the same (that's why most answer to the pool were just based on prejudice about opensourcre in general). I dont see any reason that could hurt runuo project, i'm not completely expert in the opensource world, but i have observed how it evolved since last few years.

so let's talk about a few fears from some users :
"if runuo goes opensource, they will be plenty of game hackers"
so far i see 3 possible "attack sides" :
Client security: anything that could manupilate the client software, like pressing keys or override the direct draw calls to display extra infos (can be combined with other attacks) Obviously, runuo doesnt give out any information about the client software, it's not related to it and cant be usefull to learn how to send keypress events or thing like that.
Protocol security: if durring the communication, the server and the client communicate with too many info that could lead to give too many info to the client : for example if the client send the exact karma value of an other player (i dont think it's the case, i say that randomly) or if it send exact properties values of object in non-aos servers before any skill is used to check them. Or the oposit : if it trust too much the client and cant check if the action he did are legal (probably the cause of speed hack). If a hack like this is discovered, it's likely to be unfixable for runuo developers. BUT, if a bug like this is discovered, it also affect the osi servers, and it's their responsability to control the protocol.
And what would it change to have runuo opensource for hack programmers, they have plenty of other opensource emulators, no matter if they are worse, a hacker dont need to have an absolutely bugfree server that accept 3k incomming connection with super optimized memory management. The protocol is well known since UOX started.

Server security: If a bug is discovered in the runuo source, that allow for exemple to duplicate an item by exploiting race timeing errors or bad data check in the way the server is programmed, then sure, opensource
will help to discover these errors. but what is better, a fixed bug, or a hidden bug ? And opensource or not how long an hidden bug will stay hidden ? For sure, as soon as the runuo source code would be published, you will have a "critical security update" version, that every shard runner should apply if he want to have a safe shard. But by staying closed source, those vulnerability would be leaked one by one, and the bugs will stay more "underground" and less easy to fix for the runuo staf.

You dont need to be an opensource expert to look at the facts : opensources programs are at least as much secure as proprietary ones. history proved it.


now, let's think about an other critizme : "if runuo would be opensource, the project will fork and fragment like an explosion potion". well, if it fragment, it's not the fault of opensource itself, it means some peoples were unsatisfyed, or wanted to change things in different way that runuo was thinking about it. opensource give the possibility to build fork based on a original project, but if peoples love runou for what it is, then it's stupid to think they will all give up runuo. think about some mainstream programs : apache, php, mozilla, openoffice, all succesfull example, they never had an unwanted fork. the case of mozilla and openoffice is a little special : they are fork over 1 source-version of proprietary programs (netscape and staroffice). I read some guys suggested : "give the old runuo versions as opensource and the new ones as closed source". this is the worse thing to do... the project will fork, and the opensource version might catch up on the official, in this case peoples would lose some interest for the closed source version.

I read elsewhere : "we should take a very restrictive opensource licence to avoid forks". Thinking this way is also wrong in my opinion... well, if you want you can make every user that download the source to sign a paper to swear on their grandmother gravestone that they will never create any derivate projects... but what is better : to force the user to stay on the original project by breaking their freedoom or to satisfy them so they will contribute to runuo and not the possible forked versions ?

an other often-read prejudice : "opensource does not work for mmorpg". A lot of peoples just never tryed to find the examples :
- everquest server emulator : It has some similaritys with the runuo project : it's the main everquest server, with a very active contributor base (12 000 peoples registered in the forum), it's opensource and work with differents operating systems. It's probably not as much "playable" as runuo mainly because of the limited world spawns database and thing like that. but it's definately a good example of opensource project emulator with helpfull contributors. GPL
- planeshift : a full 3D mmorpg, the progress is still alpha (combat system unfinished) but it is in active developpement, it's the first free big attempt of 3d mmorpg free-model developement in my knowledge. The source code is under GPL, the art files are in a special "free distrubution" licence.
- nevrax with rysom : nevrax is a comercial socity that distrubute "NEL" a mmorpg engine under GPL, and use it in their closed source game (the core is opensource but graphics and scripts are proprietary). This project is less famous than the others, but it show that opensource model can be compatible with the comercial world. Rysom is in closed beta test, but you can look about it on their website, it's something serious.

I would like the runuo staff to get aware of something : choosing anything else than a famous licence for the source code is risky. i mean you can put it on GPL, LGPL, bsd-like licence, mozilla Public licence or whatever... but if you just try to invent a licence to try to control everything, and use the world opensource just to look smart, it will reduice a lot of interest for the contributors.

Generaly speaking, going opensource succesfully is not a matter of speaking what is good or bad in opensource, it's a matter of doing the transition correctly. requirements are an anonymous CVS server, a bug repporting system, a good licence choice, informed staff and users, maybe a sourceforge project page, and add anything that could help the comunication to the list... But with some efforts, the project can be more healthy with a better user/open source developpers involvment.


What opensource will not change : opensource will not make the user work instead in the staff place : think it just as a bonnus with some random contributions. You cant demand anything more to the user for an opensource project, but you have to do all you can to wellcome contributions, if you want opensource model to be usefull.

And it's true that going opensource will not get the project to work with mono under 5 minutes but it would be an helpfull step in my opinion. And it will give you an positive point to fight the hundered of peoples asking "does it work on linux ?" -> "we have tryed and it doesnt work, if you think it's easy do it yourself" (no blame-mono-for-everything reply please it would just be off topic)

I hope my knowledge can be usefull to you, sorry if i repeted well known facts but in the overall, i think the post has an informative value. please, keep the rest of the thread like that, comment about it but keep the flame level low.

[ASayre]

Don't try & reopen topics that were closed