I had come across a plugin called GDMaim which attempts to obfuscate a projects GDScript. It has draw backs and requires a large amount of conversion and mitigation on established larger projects.
Additionally, when I had a specific question on implementing GDMaim (confused about RPC implementation), I was told to basically ‘read the docs and stop bothering us’. You can judge for yourself by viewing the included link. This kind of elitist attitude rubs me the wrong way.
So after that rude exchange, I thought I would ask about alternatives to GDMaim. Is there an alternative to GDMaim out there? Does Godot have plans to try something similar? Lastly are there other methods for project obfuscation I might try other than PCK encryption?
Thanks!
edit: There have been some cheerful developments as seen later in the thread:
@tomcat - Ya that script looks to be a compile-and-build script for Godot export templates. This is not what I am looking for as I am moving away from building export templates. But thanks for the tip.
@all
In my view, as a one man studio it’s an unsustainable effort to maintain and build export templates for all the targets I would like to reach. Add to that I won’t use Windows locally at all as it now requires an account to access and is essentially AI slop malware imho.
If I can not find a viable option to obfuscate my code I will try come up with another option. The goal is server client security. I have an authoritative server and the client is basically a slave to the server sending only move data which for a twitch style MMO game is pretty cool. This makes the idea of possibly open-sourcing the client an option.
I would prefer a viable obfuscation method, it’s just looking like the options out there are not a good fit.
I was using W4-Build to make encrypted templates. In fact I suggested it to them and they added the feature. They even featured my game project in their news letter. It was sweet. Then they gave up and went enterprise. That really sucked. I really enjoyed the build service and miss it. As far as I know, no one has picked it up, it’s on GitHub.
So I love of the idea of a build service if its not expensive. I had a free account at W4 Build and could build out any version of Godot with a click. I would love a service like W4-build was. I will checkout your links and see whats up with the paid service.
I appreciate the follow up and if you have any links to a W4 like build service, or, any other build service please pass them on.
Personally when it comes to MMO’s I view obfuscation as a good thing worth the effort. The ‘let it ride’ strategy (naked code and resources) is a way to go, but one I would like to avoid.
@tomcat
GodotBuilder at first blush looks like what I need. I sent them a request for cost and information. The font page shows a ‘dashboard’ that reminds me of W4 Build. I hope it’s not costly.
I will post what the cost is as soon as they let me know. I hope this works out because GodotBuilder looks like what I need. Good tip!
It’s been a few days since I read your question, but this sentence kept churning through my brain subconsciously.
I’ve seen the word “elitist” being used in new ways (novel to me personally, at least) on this forum.
I think most your point is valid: the response was not very polite. It may have been more fair if they had made the time to look up in their docs what addresses your issue (in their perception anyway), and then give a hyperlink pointing you to it.
That’s how I handle these issues, anyway. But my biggest repo doesn’t have 70 forks. It has 7.
If, however, there are 70 forks and hundreds of issues raised, it may seem like a big success for the maintainer to you, but on the others hand, chances are they’re not getting rich off of this repository. Chances are “they” is a team of one, like so often is the case. And earnings is 0.00 $€¥£ per hour.
My point is:
I always associated the term “elitist” with either snobs, showing off book knowledge to make you feel small, or super rich folks who never hear the word “no” to any opinion they spout and are even worshipped by some poor sots.
Impolite does not equal elitist, in my humble opinion.
Moreover: short, direct and concise language is considered very polite in most software development circles.
Reason being that it shows you how much effort someone made to remain on-topic for you.
As for your MMO comment, this is completely backwards. For an MMO specifically, you should not care about protecting the client side player in any way, because you should never, ever TRUST the client side to begin with. That’s rule #1 of most online games, especially MMO RPG games. In my opinion, having some basic PCK encryption with a modified Godot source to hide the encryption key in a different place is about as far as you should go, but for an MMO specifically, all your important protections should be on the server itself.
@renevanderark
Life experience. At age 62 I have been coding longer than many of you have been alive. My roots go back to companies like Atari in ‘the day’. That arc of experience allows me to quickly determine intent. When responses include “I know it’s hard to read” and never allow the issue to be vetted or clarified, my experience suggest that individual is elitist, self important, unsympathetic and unprofessional. No one I will deal with.
In fact this community imho possess more than a few such individuals, quick to make a comment and judge the situation without first getting the fact’s straight or seeking more information. Ready to belittle you and your situation.
Collaboration is founded on patience, listening and acting. Working to solve issues and reach a common larger goal.
I can relate to the sentiment. We should not treat (with) each other this way.
Still, I can’t help but think: “Are they underpaid? Over-worked maybe?”
The economy (monied class) has kind of been sucking dry the sources of income for especially those young’uns you mention.
I dare say I’m the last of the lucky ones (born around the time Atari was founded…? 1982) that could settle in a steady job, even living in the “pampered” EU.
Maybe I’m a little blind to that… Or not bothered by it?
@tibaverus
There two reasons you might obfuscate your application data. The first is defeating casual attempts to hack your game though the client. Making it easy to access code is inviting trouble if your game gets popular. You can’t make your authoritative server bullet proof as it where. There will always be areas of the architecture and design that have vulnerabilities. Over time these can be dealt with, but nothing kills a new MMO faster than widespread cheating. Standing in the way of easy access to your code by obfuscation buys you some time to establish your new MMO without cheating and more importantly data flooding from running rampant. It’s when a game gets popular that serious attempts at cheating begin in earnest. The roadblock of obfuscation limits access attempts to only a few and buys you time at the very least. I also use TLS encryption. All of the internet data is encrypted also adding to security.
Secondly there is a legal aspect to consider. Obfuscating your application data, especially though encryption, may add to any legal claim you may have against an individual or group breaking into your applications data. One way to look at is like a locked car with tinted windows. Breaking in to see what’s inside is a crime in most places. Breaking into a locked application could be consider to be similar crime. In addition to data protection I view obfuscation as allowing an additional layer of legal protection.
I have a fully authoritative server with a client that basically is a slave to the server sending move data (up,down,left,right,fire,etc) but it is still open to vectors of attack that are unforeseen. When it comes to large scale MMO design. Doing ‘all’ that you can to secure your system is a good thing and worth the effort and that includes obfuscation in my view.
Unfortunately I’m not sure I agree here. Spending time with obfuscation for an MMO specifically quickly gets into the terriroty of diminishing returns.
You cannot ever trust the client, you always have to assume that they are already compromised. For this very reason, it doesn’t make sense to spend a lot of time obfuscating and protecting it, because you cannot put any trust on it anyway.
For most large games, the client is just a renderer and an input device for the most part. Your server should be responsible for making sure the actions the client is asking for are valid, legal, and make sense.
Godot specifically can be reverse engineered really easily. Maybe there are other engines that are specifically made for these type of things, but, again, you should not trust the client ever anyway.
I don’t have much opinion on obfuscated/encrypted packs, you may not see much effort on the Godot side of things since we harbor open source fans like myself. You could try programming your game in GDExtensions, unlabeled assembly is a pretty good obfuscator; but like you’ve stated it’s really only kicking the can down the road, a motivated hacker may come along immediately, maybe in 20 years, maybe never. Security through obscurity is paper thin.
Ironically though adding TLS may be making your server less secure, OpenSSL is a huge library with many attackers trying to crack it, and thus CVEs including a pretty recent and horrible remote code execution. Encrypting the data doesn’t mean your code is any more secure or trustworthy, clients can still send what ever they want encrypted or not. And using TLS means TCP, and TCP means your server will ingest data slower and send data much slower than UDP, unless your game is slower paced this would be a huge problem for an MMO.
Security aside for a sec. .. Really? I have not encountered this. I have run test with 80 bots in a twitch style fasted paced game with no issues. I’ve also done limited testing with bots and connected clients and no issues. I am using RPC and TLS encryption and doing exactly what you indicate possibly can’t be done. My ping times for example are as low as 34ms and average around 50ms. No indications of data slow data performance.
I only post this video of my ‘online’ server and client so you can visually see the results. I will look into this.
As for obfuscation. I will continue look for a viable option. I don’t mind doing it and like the added befits it brings. A build service like GodotBuilder could be what I am looking for. I miss W4 Bulld, that’s for sure.
I’ve learned something new! DTLS was built for TLS on UDP, looks like your doing fine on transport protocol and encryption based on this post showing your client connection using ENet which is UDP based.
Locally both TCP and UDP will be very fast, but once packets start dropping or falling out of order TCP will take a much harder hit. TLS is a little more work for the server, especially on new connections, but it’s worth it for privileged information, I’d argue movement data isn’t privileged information like passwords are.
Right on. You were blowing my mind there for a sec. LOL. I was like, what?
I have no issues just using DTLS (that’s the acronym we should refer too right?) across the board as it were. That way all the data is encrypted and you as a hacker have to go to the client to find a method of attack. I have really encountered no issues doing it that way and feel better with it all encrypted.
