Teeworlds - development

I've tried a couple VMs actually. I looked into lua, wasm, js and I looked into something along the lines of qvm. A bytecode interpreter is probably not acceptable performance for us and maintaining a JIT ourselves (a-la qvm) is just a maintenance nightmare. So if we want our own bytecode our best bet is relying on something like libjit to do the JIT part for us. OTOH luajit, wasmer and V8 are quite stable now. Wasm seems to have the least overhead among the three but js(V8) and lua(luajit) are much more mature.

09:17

The reason we might want our own bytecode is to limit the capabilities of the VM

Can we just add validators client-side to remove offending bytecodes from a code pushed from a server? Or it's not that simple?

09:54

I know that adding any VM or bytecode will open a pandora box of vulnerabilities to mitigate. (edited)

you are basically making an anti-virus at that point

Antiviruses use signatures, but if we want our VM to accept only a subset of bytecode ops then that would be simpler. (edited)

The point of a VM is that it's a sandbox

i'd say using existing vm rather than writting our own bytecode is generally safer

Yeah definitely, I'd stick to one of lua, js or wasm

The point of a VM is that it's a sandbox

nice

The reason we might want our own bytecode is to limit the capabilities of the VM

why limit then? to prevent bitcoin mining on client machines?

Atleast to make it harder

09:57

Running untrusted turing complete bytecode is a rather tough problem

it has to be Turing-complete to be useful, and it means you cannot prevent that (edited)

09:58

what we make is basically JavaScript for teeworlds. JS servers could make clients mine crypto too, but that's not a big problem

eBPF has verifier to make sure it at least finish in time. but that's different

I cannot image turing-incomplete useful VM at all (edited)

Well calls to the VM would have strict execution limits and it's output would be rather hard to communicate to the server with the small bits we get out of it at a time. So I think we'd be safe from a miner

is that even a risk?

it is worth thinking about

if a client will make cpu spin 100% people will just leave that server

10:00

just as it is with malicious sites which make JS mine monero

@Deleted User it's not always trivial to write any program even in a turing complete instruction set. It takes a single instruction to be turing complete

https://github.com/xoreaxeaxeax/movfuscator

xoreaxeaxeax/movfuscator

The single instruction C compiler. Contribute to xoreaxeaxeax/movfuscator development by creating an account on GitHub.

Subtract and branch if negative, in a single instruction is enough

10:01

mov too

I've written one-instructions CPU's

10:02

in evolving programming project

Anyway, as you said, the more important issue is not something like a bitcoin miner

it was fun how much one instruction can do

the issue would be a sandbox breach, e.g. if the bytecode could access the filesystem

i've never done anything interesting in school

1

10:02

I've yet to see any CS/CEng curriculum that's actually useful

Maybe I am wrong but I'd better stick to some existing VM that has 100M+ users and 1k+ devs than try to reimpolement our own "safe" VM.

10:04

Also implementing own VM is too ambitious project. Last time it was used in games it was Another World DOS game

10:04

in like 90x, but there was to GPU, Flash, JS, wasm and so on

10:05

so one French genius had to implement VM to make his game portable and to develop it faster

I've yet to see any CS/CEng curriculum that's actually useful

nah, i think you are just smart.

I don't just talk from my experience. It's what I observed over the years about people studying in many computer related programs

10:11

okay

does tw dev team have a patreon?

no. there used to be a donation button on teeworlds.com, then enough money was gathered to pay for servers

13:00

developers never received money

13:01

there is no well-defined "dev team" either since the project was moved to github

Does it slows a development?

what do you mean?

I mean if there would for example bounties for some features, would that help developers to get more time to do them?

13:27

And to improve involvement of devs in general?

I think most wouldn't be too affected, but I know that some would put Teeworlds on a higher priority if there were perquisites

I know that dev time is costly and that money is not the only motivator. But people could crowdfund some important and hard-to-do features

a bit less than a year ago I had a chat with oy about the possibility of opening donations and bountied issues

13:28

for hard-to-do features

also I understand that it's not only about coding but about decisions like protocol break/extensions and how to do that

we kinda agreed on a few possibilities but I lost motivation to organise that

maybe analytic could be bounted too, not just coding

decisions like protocol break/extensions

that's unrelated to bounties, decisions are taken by oy

I understand how hard is to organize anything

13:29

so first of all we need to convince oy to do anything like that?

like what? bounties?

for example, yes

he was favorable to that when I offered to organise