From: behrends@arctecws-12.dfki.uni-kl.de (Karl Reimer Behrends)
Subject: The horrors of native mode (Was: Re: Gamedriver survey [LONG])
Reply-To: behrends@dfki.uni-kl.de (Karl Reimer Behrends)
Organization: University of Kaiserslautern, Germany
Date: Tue, 13 Oct 1992 04:31:37 GMT

In article <14928@chalmers.se>, d8andjo@dtek.chalmers.se (Johan Andersson) writes:
|> In article <1992Oct4.161059.22188@rhrk.uni-kl.de> behrends@arctecserv-1.dfki.uni-kl.de (Karl Reimer Behrends) writes:
|> 
|> Some more CDdriver/mudlib specifics:
|> 
|> 
|> > I remember clearly the time when PaderMUD was converting to the CD driver
|> > and mudlib. Data did as suggested in the docs and renamed the Standard 
|> > domain to Padermud. The effect was that creation of new characters was 
|> > impossible (or was it the conversion of old ones?).
|> >
|> > Spending a couple of hours leafing through dozens of include files and
|> > program code, I finally discovered the reason was that Padermud was not
|> > in the list of open domains which caused a file_size() to fail due to the
|> > uid not having read access to /d/Padermud. Sigh. Never again
|> > try telling me what unreadable code is.
|> >
|> That we now and then fail to make our code understandable is hardly an
|> excuse to accept it generally. Only an indication that we at CD are not
|> perfect, big surprise...

Of course not. I just wanted to point out that difficult code isn't solely
written by Amylaar. And the CDlib suffers heavily from overmodularization.

|> > [... security ...]
|> >
|> > I will give two examples from the CDlib 0.25 to illustrate
|> > this. First, consider a domain which has an archwizard in it who's not the
|> > domainlord.
|> >
|> Apart from the fact that the Lord can not be an Arch, this is a security
|> hole. IF an Arch joins a domain the Lord is given all the capabilities of
|> an Arch. What matters here is that the Arch trusts his Lord. If not he
|> could easily work within the domain without being a member.

Sure, I didn't intend to post any security leaks that were really dangerous.
My intention was to show why uids are too weak a concept for security, given
this code as an example.

|> > Another example is the trust command. If
|> > used with ids (i.e. trust me:sometool) the following code is quite
|> > dangerous:

[Deleted my own code about how to abuse trust]

|> The 'trust' command is dangerous. The above code is not really a security
|> hole, just an indication that the wizard using 'trust' must be aware of
|> what can happen. The recommendation is of course not to use 'trust' but
|> instead make your own object that inherits the tool you need to use.

Again, I just wanted to demonstrate that export_uid() is inherently
dangerous. The security of the CDlib isn't the point under discussion
(although I could probably find some nice security leaks ;-).

|> As for the debate on compat-mode etc:
|> 
|> > I strongly believe in what Popper calls piecemeal engineering,
|> > i.e. not making changes which are
|> > too radical and only let everything collapse.
|> >
|> I think this sums up the difference in our opinions nicely.

It doesn't. It doesn't at all. My main concern lies with key concepts of native
mode, namely the design flaws in create()/reset(), move() and uids. Considering
them to be a step backwards and showing that we don't need to switch to native
mode to use its presumed benefits I just asked: Why have native mode at all if
there are essentially only drawbacks associated with it?

|> I think that
|> all projects benefits from a total overhaul and redesign, especially if
|> done by the original designers.
|> 
|> I firmly believe in the statement: 'No software is good software until
|> 				    rewritten at least twice'.

Surprisingly our opinions don't necessarily clash. I also think that a total
overhaul can help cleaning up the code and removing unnecessary kludges due to
design problems. But the specifications and the interface shouldn't be altered
radically. Just consider what would happen if some manufacturer of UNIX made
the argument of malloc() the number of ints instead of the number of chars to
be allocated. He wouldn't be able to sell a single copy. Changing specifications
radically just doesn't work in the real world - especially if you've got a user
base to support.

					Reimer Behrends
Newsgroups: rec.games.mud.lp