PlaneShift
Gameplay => General Discussion => Topic started by: DeathsAngel on August 09, 2006, 05:25:15 pm
-
Hi everyone,
Been a while I didn't come on the forum, but I'm still active ingame, just hidden.
I was reading PS stuff about licensing, because I want to put on my guildforum a direct link to download PS AND/OR host the install file so they could also download it from my PC or storage server I can create.
But I fall on this line : You cannot distribute the client, sell it or gain any profit from it
The important part that worry me a bit is the bold one. Can anyone (Dev, Moderator, or Talad himself) tell me kindly if I can or not :) Thanks.
-
That line is mainly to try and stop virused clients etc. from being spread around the net. It gives us a legal lever to use :) You can host the file if you wish. Place the md5sum of the installer next to it (like is done on the PS site) so people can validate it's the correct one and you're fine I guess.
-
WOAH! :o That's very insecure. You should provide the md5sum exclusively at the main site. It's very easy for someone to virus a client and calculate a new md5 sum, putting it next to the file as the real sum. Make all mirrors tell downloaders to go to the main PS site for the md5sum. That's the whole point of the system. You can download the client at an insecure site (mirror) and go back to the trusted site for validation. Even if the mirror is trustworthy, there's always the chance that someone could hack the mirror, placing a poisoned client and md5sum. If it's at the main PS site, while it's not invulnerable, you're much better able to practice damage control.
-Mykentros
-
Thanks Xordan. At first it was what I thought, that it was to stop virus clients.
I'll put a direct link to the md5sum on the main website, just to be sure to have the latest one and also in case mine get corrupted and for some reasons that mister Mykentros said also (you had a good points there).
-
WOAH! :o That's very insecure. You should provide the md5sum exclusively at the main site. It's very easy for someone to virus a client and calculate a new md5 sum, putting it next to the file as the real sum. Make all mirrors tell downloaders to go to the main PS site for the md5sum. That's the whole point of the system. You can download the client at an insecure site (mirror) and go back to the trusted site for validation. Even if the mirror is trustworthy, there's always the chance that someone could hack the mirror, placing a poisoned client and md5sum. If it's at the main PS site, while it's not invulnerable, you're much better able to practice damage control.
-Mykentros
There's nothing stopping people from comparing the MD5sums from the PS site and the mirror ;) But yes, that's a better idea.