Vice City Multiplayer

General Discussion => Previous Betas => Public Beta => 0.4 Public Beta #2 => Topic started by: Fuzzy168 on November 09, 2013, 05:50:16 am

Title: Some Concerns
Post by: Fuzzy168 on November 09, 2013, 05:50:16 am
I have some concerns regarding the new file transfer feature of 0.4. Given that it will download the files the server owner wants them to, wouldn't that open up a whole new way for irresponsible server owners to transfer Virus/Malware/Trojan/etc to unsuspecting players? I know that it will only transfer a certain type of extension but some cunning server owners will definitely find a way around it.

I suggest you allow the player the option of choosing whether to download the file or not.
Title: Re: Some Concerns
Post by: MatheuS on November 09, 2013, 01:50:32 pm
I have some concerns regarding the new file transfer feature of 0.4. Given that it will download the files the server owner wants them to, wouldn't that open up a whole new way for irresponsible server owners to transfer Virus/Malware/Trojan/etc to unsuspecting players? I know that it will only transfer a certain type of extension but some cunning server owners will definitely find a way around it.

I suggest you allow the player the option of choosing whether to download the file or not.

+1
Title: Re: Some Concerns
Post by: stormeus on November 09, 2013, 08:28:59 pm
VC:MP never executes a file that is downloaded. Files cannot be downloaded to arbitrary locations where they will be automatically executed and are confined to a folder within VC:MP's installation directory.
Title: Re: Some Concerns
Post by: maxorator on November 10, 2013, 06:55:55 am
I will make it ask it when you enter some server with downloads for the first time. So it will give an option to either allow downloads or disconnect.

While executables are not in any way executed, there still remains the risk of various security holes due to how the game loads model files. I've done my best to remove such security holes from VC, but since I do not wish to be responsible in case I've missed any, it's best to leave it up to the user to decide.