Cross-platform game development: ease of development and security
I am a member and community of Argentum Online (AO) , the first MMORPG from Argentina that is free software ; which, although not 3D, is indeed addictive and has several tens of thousands of users.
It's really unfortunate that AO was developed in Visual Basic (yes you can laugh), but a former community, so let's say the code not only sucks but has zero portability.
I am planning some friends to rewrite the client and like GNU / Linux insane, want to make it cross platform. Some other people do the same with a server in Java .
So my biggest problem is that we would like to use a rapid development language (like Java, Ruby or Python), but the client would be pretty insecure. The Ruby / Python version will have all the code available, and Java is easily decompiled (yes, we have community crackers)
We've considered embedding a security module in C / C ++ as a dynamic link library, but it can be replaced with a custom one, so it's not very secure.
We are also considering running the main C ++ and GUI application in Ruby / Python. But we have not yet analyzed all the consequences.
But we really don't want to code the whole game in C / C ++, as it doesn't need such high performance (the game plays at 18 frames per second) and we want to develop it as quickly as possible.
So which would you choose in my case?
Thanks!
a source to share
There is an old adage: "security from the unknown is not security."
Don't worry that the available code doesn't matter. Design a network protocol instead, so it is difficult to crack, which means really strong authentication for transactions that matter.
Actually, what I would do is try to port the game to Mono, starting from the VB source that you have, and gradually write new code in C # or IronPython.
a source to share
The client, whether "secure" or not, should ideally not be a problem. If this is a problem, then there is a problem with the architecture of the game.
A customer who is able to do "whatever he wants" does not matter. In a well-designed multiplayer game, the client only has the data it absolutely needs, and all actions are allowed by the server.
Let's say someone hacked into a client to say that their opponent is dead. Okay. They can hack it on their client all day long and maybe even trick the renderer to throw the enemy back. However, they shouldn't have any authority to say if the enemy is dead or not - as for the server. Therefore, the server receives a message that "Adversary X is dead". The server has to be smart enough to go "ummmm, no" and the enemy will happily live on and do whatever they want.
This is ideal, of course, and it is often necessary to make trade-offs for gameplay flexibility and / or server load. However, for important things, everything must be checked by the server. Especially in MMOs.
Treat your game as if your client was open source.
a source to share
I would suggest an upgrade path from VB6 -> VB.NET. Visual Studio will take care of most of the conversion processes for you. After you port it correctly, you can convert it to C # if you like. Then you will have to create workarounds for non-portable (Windows only) features and those that are not supported by Mono.
a source to share
I do not understand. Do you want to rewrite a free program and make it proprietary? I think you can do this if you rewrite everything, but since it is now open, the protocol is also open.
So, even if security through obscurity was great (and it is not), you would not have it, since there is no uncertainty.
- in no case should the client be authoritative about anything more than what it wants to do (and even so, it is the server that decides if it can do it and what the result is).
- in no case should the client know what he should not show
will fail, and nothing else matters.
If the overall design is flawed, fix it or stop worrying: it's pointless to brush your teeth if the tiger ate you.
a source to share
I cannot comment on the last answer.
The fact is that in this game, in particular, there are thoughts that changing them will make the game completely different.
For example, the client knows at every moment where other users are. (his game is tile based) so when the character is invisible one can see him accessing the code (or editing memory or handling packets). Okay, let's say the client doesn't know anything about invisible characters. When a character casts a spell, he has a "Overhead" message, such as "VAX IN TAR" or something like that. So, you can see the position of the character who cast this spell. People often send empty chat (this is true in the game), so whoever can read chats and look for empty chat (full of spaces) knows where the invisible char is ..
Etc. You can do all of these things to put ALL the stuff on the server, but it will be a completely different game.
This game is a very dynamic game, every player does a lot of things, and all this on the server will make it completely unplayable.
Sorry for my bad english. (Im a friend of alcuadrado who cannot comment in another post, sorry if this is not an answer)
a source to share