Where is the new Winmx ?

[spaceman]

Hello !

Years already have passed since the attacks began
Where the hell is the new version of winmx ?

how tha fuck can someone sustain a DOS attack for years ? where are the hacker computers located ?

[GhostShip]

Its pretty easy to susstain an attack on the network if you know the holes in the protocol that allow a simple program to swap some of the data fields, to do this you need to be using some third rate server company who dont check for spoofed packets originating from their network, the attacker has had to shift his operation at least once already due to the hosting company clamping down on him, he will continue until we lock him out of the network using technical hurdles and thats the plan we are still engaged upon. As with anyone asking about where the new client beta 2 or later is I give out the stock answer that it is being worked upon as thats the truth, we are still seriously short of coders and thats pretty much the whole of the delay, if you can find some who are able to use C++ MS flavour (MFC) then point them this way and watch the client output rate rise,.

I hope I have addressed all of your questions but if not please feel free to delve for further information that I will be happy to provide. 

[Trestor]

I wonder if anyone who has connections to other people in other places could make a point of appealing to others not connected to Winmx to come here and volunteer some assistance in coding? I suspect the current visitor base is too small to find coders within our own ranks, but those who are here may be able to put the word out to others and let them know about our need. I suppose volunteers would have to be vetted first?

[GhostShip]

I think I can work around the vetting by allowing them to work on some of the parts we need resolving in isolation, the problematic area as most of you know is the primary engine, the rest of the client is pretty tame but the primary is the area that has the networks security mechanisms and in the code much supplementary information on those, when folks move off of the old client it wont be an issue but while folks are still using winmx I cant in good faith allow the primary code out of my hands to an unvetted user, there are 4 folks who have versions of ourmx so its not a super tight circle but a small one certainly.

A pool of coders who have the skillset for this project can be found in the emule community and those who maintain shareaza, both of those projects use the same coding style and would be able to work on our project with little trouble, the problems we face is not really one of hard coding just not enough hours in the day and so a fresh set of willing hands will make the world of difference, two sets would see more activity than we have ever had, there has only ever been 2 folks working on this at any one time. The design requirements are all in my head and simple to explain to outsiders we just need hands and many of them if we are to move ahead with any speed, any help in this area would be most welcome.

We have made a start with the opennap side of things also to give us some flexibility in how to change the primary side operations as once we have some method to hold the folks safely we can implement the changes that are necessary to lock out the attackers , something we cant do at the moment as ourmx is not ready to take the whole userbase, theres no option to take a gamble in this area, it has to be solid and reliable or we face a disaster.

Slow and sure is the safest path but its also the most frustrating for us all, however we are creeping nearer to the goal, each day progress is made to fix or improve an area and fill in missing controls and add ever complex routines constructed over many months, we simply need more hands to speed the work up and once the vital networking level changes are made we can release the code to open src and anyone and his dad can set to work on adding further functionality but that's running ahead, we have a lot of code in the bank but we still don't have a completed client clone to go forward into the time of changes and so to reach that stage we need assistance or more time than all of us want this to take.

I hope that clarifies our current position and sets some scope for those wanting to help who may not be known to our community.

[White Stripes]

considering search doesnt work.. channel list doesnt work... the whole network is being DDoSed and is being used as a DDoS tool... how much more damage could be wrought at this point if the client were made open source?

[GhostShip]

As you say it can be used as a ddos tool and so the answer is a considerable amount, the client is still heavily used in Japan and that region in fact makes up the majority of the current userbase.

We cant even be sure open sourcing the client would find anyone interested enough to continue its development at this stage, I know it might well assist some who may work on their own pet projects but thats not a valid reason for simply throwing what we have to the wind and trusting to good luck 

[Pri]

Should probably have put the client up on Github a long time ago to be honest. That would allow people who are interested to fix what they want to fix in their leisure. Putting up barriers, vetting people etc is just making it harder for people to fix things.

For example when we first tried OurMX and we saw our channel list being presented in the client the encoding was wrong so some of the characters used in channel names and topics was not being rendered correctly. If the code was on github we would have fixed that ourselves to help the project. Having to get the code from you guys and not from a central repository, modifying it then giving it back to you, then waiting for you to add it in to the project and test it works (since we won't have all the code to compile and check it ourselves) means that it's not worth our time/effort getting involved. The administration aspect of being involved is too time consuming.

Realistically if the project was on github we could have fixed the encoding issue in probably 5 minutes from a dead start. But the way things are now we are talking 2-3 days for something very simple.

I would urge you to open source it because I don't honestly think it will cause more damage. The network is already suffering and there are plenty of other open source programs with primary network implementations (like WCB) which can be used to infer vulnerabilities not to mention the protocol has been documented on a number of occasions in full and finally anyone who has the ability to code such a program wouldn't benefit from having the OurMX source because they would already have the expertise necessary to cause damage.

[GhostShip]

I haven't seen the interest in folks wishing to fix anything that you seem to be assuming Pri, its not like folks haven't been asked directly to join the team if they have the talents, have I missed some pool of coders within our community with a wish to get involved in p2p client coding ?

I hear what your saying in terms of some parts of the primary engine, but from my point of view I think we both know the amount of abusers willing to go to the effort of folks like KM and NB are few and far between, simply handing more data/code  to these other folks will make it a trivial matter to launch even further attacks, I can remember many of those who speak of open src now waging virtual war on me in times past for even suggesting that path.

As always I have a simple suggestion for this time and its this, all of the interested developers need to get around a table and agree on a new primary protocol implementation and work at creating an example dll or simply open code the whole engine and then the way ahead is clear for all of us, as I say I cant in good faith open src the current primary engine knowing the quantity of current Japanese users as well as those remaining here in the west.

I think this is the best path ahead, we need to finalise a new protocol that protects folks against an abuse of the flood broadcasting system, if that can be achieved I think all will be satisfied that the future direction of development is safe and reasonable.

[Pri]

I haven't seen the interest in folks wishing to fix anything that you seem to be assuming Pri, its not like folks haven't been asked directly to join the team if they have the talents, have I missed some pool of coders within our community with a wish to get involved in p2p client coding ?

I would say you are missing out on coders yes. Github is a great way to collaborate. And this is why, lets say I try OurMX. And I notice a bug like the web list encoding issue I mentioned above. If that bug annoys me I can just go to the github page of the project, look at the source file that handles the chat list, see the issue and fix it. My fix would then be submitted to the project and can be included in the main source tree. It takes like literally a few minutes of my time. And all these niggly little issues, especially to do with the interface that are very visible will get coders to fix them.

I do not want to join the project in an official capacity. But I would definitely fix problems if it was on github where when I'm in the mood I can jump on and see the latest up to date source to make sure my fix is relevant and do it very quickly. This level of convenience is important to a project like this.

I'm not suggesting you post the source code on these forums by the way. I am 100% behind github specifically. It supports commenting on files, discussion threads, versioning, history of all edits and who made them, it supports private listings for only collaborators you want to work on and see the project. It will vastly speed up the projects development even for just the coders you have working on it right now but if you do decide to open source it, that would be the best way to go about it.

Seriously had it been on github I would have fixed that encoding problem on the channel list myself. I have spoken to other programmers on the network including Hollow, Josh, Adrian, Sean and we all think very much the same in that none of us want to be committed to the project but we would all make edits here and there in our free time if the barriers to doing so were removed and we all have github accounts and contribute to projects that we use daily in our own software.

To put it another way it's crowdsourcing development one edit at a time.

I hear what your saying in terms of some parts of the primary engine, but from my point of view I think we both know the amount of abusers willing to go to the effort of folks like KM and NB are few and far between, simply handing more data/code  to these other folks will make it a trivial matter to launch even further attacks, I can remember many of those who speak of open src now waging virtual war on me in times past for even suggesting that path.

As always I have a simple suggestion for this time and its this, all of the interested developers need to get around a table and agree on a new primary protocol implementation and work at creating an example dll or simply open code the whole engine and then the way ahead is clear for all of us, as I say I cant in good faith open src the current primary engine knowing the quantity of current Japanese users as well as those remaining here in the west.

I think this is the best path ahead, we need to finalise a new protocol that protects folks against an abuse of the flood broadcasting system, if that can be achieved I think all will be satisfied that the future direction of development is safe and reasonable.

I think on this part there cannot be compromise between what you see as the right thing to do and what I see as the right thing to do. I'm very much of the opinion that the damage is already done and getting the code out there to be worked on by as many eyeballs as possible is best to sort out a solution as soon as possible.

What you're trying to do is protect the network from further harm, I get what you're saying. But at this point what further harm is there to be conducted really? The channel list doesn't work, searching for files doesn't work. What are these Japanese users on the network even doing? They can't find files and they can't find chat rooms. I have the visitor data for WinMXUnlimited.net's room list and it isn't dominated by Japanese users and its traffic is dropping off month after month, and not just a little, more like cliff drops as the users dry up and stop visiting looking for rooms.

I feel like if we keep going at this snails pace to protect the barn after the horses have already bolted we are going to find ourselves in a position where there is no users left to protect by the time the replacement client is bug free.

One thing lastly I wanted to mention, Seans Mato client is really good. It runs great, I've not encountered any bugs, its design is very nice. I don't think he wants to work under other people he wants to work independently is my feeling (this is my opinion, not from his mouth). But that doesn't mean he wouldn't port some protocol implementations from his client to OurMX if the road to entry was barrier free. There are things in OurMX I wanted to fix but can't because I too do not want to be involved in the project, I just want to submit my fixes and not need to talk to people or debate or trade files over instant messaging etc. Everyone uses github because it's convenient and featureful.

[GhostShip]

In short then: No one can be bothered aside from Sean who is working on his own project, and that basically is why things have taken so long, without commitment theres little point in making anything open src as we would be simply handing the keys to the network to further less skilled attackers, it may suit you to tinker now and then on fixing some of the bugs but lets be honest this project needs folks who want to get the network working again and without any bad blood to have to climb over whilst doing so.

There has been nothing to stop either yourself or Josh creating a seperate page that works with ourMx's channellist , but that of course means some work on your behalves, the fact you havent suggested or implemented it is indicative of what sort of support we can expect from the raft of developers who may or may not appear out of thin air to fix our network, I cant rely on that nor will I expect anyone else to do so, plodding along is slow, frustrating and annoying to all but its safe and we wont face a re-run of the constant fighting that this network has seen over the years.

I am also concerned you havent addressed the sensible way ahead I suggested or is that too a rainy day issue ?
Josh, Adrain and Hollow have all worked with you during the last few years and so can hardly be seen as independent of yourself or your views, what I am sure of is that if theres no commitment to assist the community theres very little to discuss, theres a lot to do still and "maybe, perhaps and might" are not the words I treasure when I'm looking ahead for insight or expectation for the future.

I am sorry too that we wont ever agree on the basic point but I predicted this carnage and tried unsuccessfully to head it off and nearly left myself back in 2011 when KM did the dirty on this community after being thrown out of another community he got involved with on IRC but after a days break I felt that I had a duty of care to those whom had no one else willing to step up to the plate to turn to, nothing has changed since then and I have dropped nearly all of my other duties to devote all of my own spare time to working on both documentation diagrams and code and so whilst I'm happy to work with anyone and discuss virtually anything that reaches a common goal of mending the network for its userbase, simply casting fortune to the wind to await invisible coders is not rational in my opinion.

[Pri]

In short then: No one can be bothered aside from Sean who is working on his own project, and that basically is why things have taken so long, without commitment theres little point in making anything open src as we would be simply handing the keys to the network to further less skilled attackers, it may suit you to tinker now and then on fixing some of the bugs but lets be honest this project needs folks who want to get the network working again and without any bad blood to have to climb over whilst doing so.

It's not a case of being bothered. It's that we move quickly, our time is precious and we work with the most efficient tools available to us. When we collaborate on projects which we do all the time for our chat room and our shared Minecraft server we do so by using the right tool for the job. Not just in the languages we write things in but the way we share and manage source code. Github is the most efficient way to collaborate. That is why it is the worlds most popular git repo.

There has been nothing to stop either yourself or Josh creating a seperate page that works with ourMx's channellist , but that of course means some work on your behalves, the fact you havent suggested or implemented it is indicative of what sort of support we can expect from the raft of developers who may or may not appear out of thin air to fix our network, I cant rely on that nor will I expect anyone else to do so, plodding along is slow, frustrating and annoying to all but its safe and we wont face a re-run of the constant fighting that this network has seen over the years.

You're being pretty defensive in this quote. The encoding issue is not on our side. We use standard UTF-8 encoding, the same encoding used all over the web in every website and API I can think of, your software needs to be able to understand UTF-8 or decode it to something your application can render properly, perhaps ISO-8859-1.

I would have been more than happy to fix it in the client, make it standards compliant, but there is no source repository for me to be able to do that unless I want to commit an exorbitant amount of time to the project when all I really want to do is fix one bug. And to be honest with you if I had that kind of access on Github I would fix other bugs.

I am also concerned you havent addressed the sensible way ahead I suggested or is that too a rainy day issue ?
Josh, Adrain and Hollow have all worked with you during the last few years and so can hardly be seen as independent of yourself or your views, what I am sure of is that if theres no commitment to assist the community theres very little to discuss, theres a lot to do still and "maybe, perhaps and might" are not the words I treasure when I'm looking ahead for insight or expectation for the future.

With your sensibile way ahead I am assuming you mean a round table discussion about fleshing out a new protocol is that correct? - I didn't discuss this in my post before because I think that is really so far off in the distance from where we are right now.

I truly believe if this project is to actually reach feature parity with WinMX it needs to go Open Source. Many hands make light work and I'm sure you would feel a great burden lifted off your shoulders if we could fix bugs while you focus on implementing features. I mean what I'm really saying here is, I would help fix bugs if there was a lower burden to doing that, I have no interest in implementing new features at this time as that is a lot more time intensive and I have a lot of other personal projects going on.

I cannot speak for the others but I do know they also have a lot of personal projects that have a deep meaning to them and I don't think they would want to get involved at a feature implementation and discussion level but they would lend a hand, implement small changes and fix bugs.

I am sorry too that we wont ever agree on the basic point but I predicted this carnage and tried unsuccessfully to head it off and nearly left myself back in 2011 when KM did the dirty on this community after being thrown out of another community he got involved with on IRC but after a days break I felt that I had a duty of care to those whom had no one else willing to step up to the plate to turn to, nothing has changed since then and I have dropped nearly all of my other duties to devote all of my own spare time to working on both documentation diagrams and code and so whilst I'm happy to work with anyone and discuss virtually anything that reaches a common goal of mending the network for its userbase, simply casting fortune to the wind to await invisible coders is not rational in my opinion.

There are a lot of projects out there like OpenSSL which are open source and underpin the entire infrastructure of the internet. Security by obscurity doesn't work. It's not a viable security model. I do not support the idea that by hiding source code we make the ecosystem healthier. All my stuff is open source, my WCB plugins my Metis scripts, my Metis plugin. When you have oversight and auditing bugs are found, disclosed and fixed. That is how OpenSSL's Heartbleed was found in a code review by a 3rd party.

And we aren't talking about invisible coders here we are talking about real people who would like to do a little bit of the work, we don't want to be involved in the politics or design decisions.

I've spoken to someone who says that your current way of coding the software is trading source files over instant messaging and that there isn't any source control just editing the files and trading them amongst yourselves. I do not know if that is true, so I'm asking is this really how the project is being managed? and I ask not to judge but to understand.

Thanks.

[GhostShip]

I don't want us to move ahead of ourselves here so allow me to focus on the point of contention first and then we can look at other matters such as how file changes are distributed, the key to any open sourcing of the current ourmx client is simply the balance of  delivering a primary engine capable of allowing tens or hundreds of extra attackers to mess with whats left of the network against the weak promise of folks "chipping in" when they feel like it, do you not see the lop sided nature of this ?

As things stand anyone with the right know how can demolish the network in short time, I monitor all of the various attack attempts and look at variations being tried at intervals but I know that our attacker is not trying to demolish the network with any speed as that might get folks motivated enough to actually do something about it in a rapid fashion, so we have the slow-slow drip of attacks that shrink the network in a more acceptable fashion , law enforcement are not contacted and the attacker is more than happy.

This is the fine balance we work with daily, upsetting this balance will In my opinion do more damage than we can sustain, many more folks will discover things that they where previously unaware of and might decide that its fun to abuse the network in some fashion, this cant happen in a massive way until we deliver the key knowledge to them to do so and until 2011 it was successfully held privately and the network trundled along without major disruption.

As this area is the main hurdle to open sourcing I feel it needs addressing and to do that we need to work out amongst the community developers what we are going to replace it with, be that large or small changes more or different cryptographic elements or throwing the whole thing in the bin and starting afresh but with a two tier network layer maintained, politics is not facing up to the scale of the hit we have taken and facing it head on, this is pretty simple from this side of the divide, we need to improve the protocol and harden it, only then can we open src anything as to do otherwise leaves the releaser open to the charge of stupidity as well as many other unsavoury names heard from the sidelines over the years.

Currently the swapping of files is done enmasse (zip files) via an instant messenger / or a file hosting location,  it was originally enough to post the changes on a third party web site but given the rapid progress in many areas its just not possible to keep up with all the changes so files are shared in bundles and this simplifies any changes, winmerge is used to asses any conflicting file areas and its a great tool for that job, to spend yet more time setting up a repository and uploading files each time and managing that as well as everything else is just an added layer of bureaucracy that theres no one here with time to deal with, if manpower wasn't so hard to come by over the last 3 years surely others would have taken the steps you mention already and gotten at least as far along as we have, as I have pointed out many times we have no monopoly on this network and are happy to see goodies like Seans Mato and your own scripts etc shared out to the community, thats what this is all about to us here, community and communing together to make the best of our resources and time, that means all of us not just a few and a silent majority who feel rightly or wrongly that helping the community is some cross they cant take a share of , watching a few guys drag a heavy log along a path seems a bit pathetic when theres plenty of strong hands watching from the sidelines don't you think ?

[Pri]

I would say if someone wanted to mess around with the network for nefarious enjoyment they could do so using the primary code in WCB. It is open source and has been for some time. Even before the 2011 leaks. I believe it was open sourced since around 2007. It doesn't implement absolutely everything but it has enough to connect to the network and if modified cause disruption.

And I agree with you that there are people watching from the sidelines who can help but choose not to. But you have to identify that the reason they choose not to help isn't just based on one reason. Many people have good intentions and want to help but they don't want to deal with you personally or they don't want to be integral or they just want to fix one thing that annoys them about the client. Some people want to work solitarily and not have to talk to other people but they could still fix a bug or two. And there is also the potential for the project to be forked and improved upon away from what you're doing and then you can backport well made changes into yours.

Obviously I'm a strong advocator for the open source approach. I don't think my mind can be swayed on this point as I am biased towards it. But it is your project and you're free to do what you want with it. I'm only making suggestions from my own experiences and opinions.

Just on the Github thing: I don't think that using Github would add bureaucracy. Many programming IDE's now integrate with Github automatically so your client automatically downloads the latest code when you want to work on something and when you do compiles locally your code is synced to Github as changes.

The most valuable part to this is that all the programmers always have the latest code and they have history and versioning, which is done automatically it doesn't get managed by the programmers its just done by the infrastructure. Heck you can even write code on Github itself in the browser if you wanted to which is convenient for quick edits when you have a great idea but don't wanna fire up your IDE.

I'm just making a suggestion to look in to it. Even if you don't decide to open source it to everyone you can still create a private thing with only a few collaborators. And also you may want to look in to open sourcing only parts of the client and not the primary network code so people can work on the user facing features which have bugs and not the underpinning network implementation.

[GhostShip]

Technically Pri I'm not the head of the project, Will heads up the effort being the more proficient coder so all the talk of not wanting to deal with me is horse manure. Lazy folks are lazy folks.

I despair of this sort of crap when times being wasted and still folks wont take up the slack 

It seems to me that If no one else wishes to assist in finalising an improved protocol I shall simply continue to work on that too, cryptographic routines are not usually described as "obscuration"  btw but "technical measures".

[Pri]

Technically Pri I'm not the head of the project, Will heads up the effort being the more proficient coder so all the talk of not wanting to deal with me is horse manure. Lazy folks are lazy folks.

You're the one people see posting, you're the one people think are running the project. You are even talking about making the improved protocol yourself. So forgive everyone if they think you're the one managing the project.

But regardless many people just do not want to work with you. Regardless of your role in the project. I'm trying to suggest you use Github widely regarded as the best way to collaborate on code and it's like talking to a brick wall. I could not deal with you day to day on a project of this scope, I feel like we would butt heads on everything.

I despair of this sort of crap when times being wasted and still folks wont take up the slack 

It seems to me that If no one else wishes to assist in finalising an improved protocol I shall simply continue to work on that too, cryptographic routines are not usually described as "obscuration"  btw but "technical measures".

I'm just one guy having a conversation with you so I don't think you can extrapolate me not willing to discuss a new protocol with you here and now as an indication that no one wants to be involved in such a discussion. Personally I have a community on Minecraft of 75,000 unique users who visited my server last year and I've got my priorities for what I do in my free time as a hobby dedicated to that community now. I simply don't have the time to devote to something like this full time. I regularly make small edits to projects I use on my server, I've even paid developers to make changes on my behalf on the things we use on my server but that's really easy when it's all open source.

[GhostShip]

You seem the only one suggesting you wont work with anyone Pri, please dont write cheques on other folks accounts.

You have stated you point now unless theres anything more I have work to do, please devote your time to what you enjoy Pri, my focus is not github or minecraft, its the winmx community.

[White Stripes]

You're being pretty defensive in this quote. The encoding issue is not on our side. We use standard UTF-8 encoding, the same encoding used all over the web in every website and API I can think of, your software needs to be able to understand UTF-8 or decode it to something your application can render properly, perhaps ISO-8859-1.

just a nitpick .... winmx and ourmx arent unicode... winmx is win95 rev a era software and ourmx is a clone of that so it uses windows codepage 1252 -- 8859-1 is close but missing characters present in 1252... 

[Pri]

You seem the only one suggesting you wont work with anyone Pri, please dont write cheques on other folks accounts.

You have stated you point now unless theres anything more I have work to do, please devote your time to what you enjoy Pri, my focus is not github or minecraft, its the winmx community.

I work great with Hollow, Adrian and Josh on lots of different projects. I also work with many other programmers, my entire business was about designing software for other companies hardware, a collaborative effort. It's what I actually did for a living. You stated that the reason we (other programmers within the community) may not want to help is because we are lazy. I quote you "Lazy folks are lazy folks." - I do not want to work on this project with you because I do not believe we could ever get on, we do not agree on much of anything. This is why I'm saying if you put it on github people who don't want to deal with you personally would be able to contribute.

But like I said it's your project so you can do what you want, I'm just giving my opinion on the forums, you asked the other day that we post more, I thought open debate would be good.,

You're being pretty defensive in this quote. The encoding issue is not on our side. We use standard UTF-8 encoding, the same encoding used all over the web in every website and API I can think of, your software needs to be able to understand UTF-8 or decode it to something your application can render properly, perhaps ISO-8859-1.

just a nitpick .... winmx and ourmx arent unicode... winmx is win95 rev a era software and ourmx is a clone of that so it uses windows codepage 1252 -- 8859-1 is close but missing characters present in 1252... 

I did say, perhaps. I've not seen the code. I've not examined the binary more than running it a couple times.

[Pri]

I just wanted to add that I don't meant to be argumentative. It is you who is working on the project and not me, you should do what you think is best. I just genuinely feel that open sourcing it would get more people involved, myself included. That's a firm yes from me if it was open source.

[GhostShip]

To decode the output of Josh's roomlist requires an additional code page to do the parsing, fixing the primary involves no such library nor the further usage of Josh's site thus this should be the focus of the effort, simply adding work arounds ad-infinitum wont get us to the finish unfortunately and while the clone is getting better each day we need to pull together with those that can be bothered and set some things down in stone as otherwise folks like myself will have to step into the breach and maybe not even do the best job which is disappointing when you know there are many who have great ideas and opinions on security and networking techniques, none of us knows everything but between us all we can make a decent stab at crafting a decent framework on which to build an improved network protocol.

Pri you are right we would never get on, trust does not exist between us, that wont however stop me reading what you post as with all of the posts here, but could you please try to stick to your own opinions when posting here and not talking about third parties who may or may not agree with your statements as being divisive in this manner is a bit of a low blow effort in putting others on the spot who may not want you to highlight their private opinions.

 I would prefer they post for themselves if they have a gripe so the community can see openly the names of those who have refused to assist with fixing the network and instead hidden out for nearly 3 years hiding behind some lame excuse that only wmw can run such a project while they site idle and they dont like me 

I await a string of third party posts echoing your views Pri, I need a good laugh