Requesting source code for the security module

[Baker]

There is a mod called Nehahra, it uses fmod.dll -- a closed source library that provides a few interesting extra features.

DarkPlaces uses it, JoeQuake uses it, Qrack uses it.

Another example is glquake.exe; when you start up glquake.exe it uses opengl32.dll. Opengl32.dll is the graphics driver for the OpenGL API for video cards and almost without exception all of them are closed source.

And yet another example, using the -dinput command line option invokes a Windows .dll.

.dll files are external shared libraries and their use has been common ever since the days of Windows began.

.dll files don't fall under the license of an executable using them.

If they did, people could be demanding the source code for kernel32.dll from Microsoft or demanding that Nvidia release the source code for their OpenGL API.

If you would like a second opinion, a great place to repeat this question is at Inside3D.com where some truly intelligent long-time professional coders who happen to love Quake hang out.

[Baker]

John Carmack's 2002 email to JP Grossman telling him he isn't willing to make a special consideration for ProQuake.

He tells Grossman he must comply with GPL and release the source to ProQuake 3.10 as a result and encourages him to solve the cheat-protection issue in a GPL-compliant way by putting the security features in an external DLL.

On Fri, 14 Jun 2002, John Carmack wrote:

You are obligated to release the source used to build any binaries that you
have already released.

In a perfect world, we could release code in a way that let everyone do
"cool things" with it, but still allowed us to retain the rights to stop
anything that pissed us off in some way. We have used custom
"non-commercial" licenses in the past, but questions always come up about
the exact boundaries of the license.

I chose to move to the GPL because it is a well defined license that
addresses many of the troublesome questions we were always getting, like
the legality of distributing derived works on magazine disks or for
promotional efforts. It clearly outlines the rights and responsibilities
of the users of the code, and provides the possibility of using it for
entrepreneurial ends. I do believe in the benefits of community code
sharing, and the tack that some people (not you) have taken in arguing
against releasing their code I find borderline insulting -- When people say
"I put I lot of work into this, why should I have to give it away?" they
have clearly lost perspective on how much work *I* put into it before they
started.

For the original Doom codebase, this was an almost uncontested Good Thing,
but the competitive network cheating issue with Quake made it a lot more
muddled. Still, this is the path that has been chosen, and we are sticking
to it.

I encourage people to look for solutions to the cheating issue that are
either external to the main executable, or more social-policing in nature.

John Carmack

Link:

http://proquake.planetquake.gamespy.com/john2.txt


ProQuake FAQ:

Does ProQuake 3.20 comply with the GPL?

Fully. The security code has been packaged into separate modules which are distributed separately, thus complying with the specific terms of the GPL. The security modules are not quake-specific and are not in any way based on the Quake source. You can see a full list of exported functions in security.h from the ProQuake source. Finally, ProQuake is fully functional without the security modules; they are only required to start or connect to a cheat-free server.

ProQuake and the GPL

[cortex]

There is a mod called Nehahra, it uses fmod.dll -- a closed source library that provides a few interesting extra features.
DarkPlaces uses it, JoeQuake uses it, Qrack uses it.

I am interested in ProQuake's security module. If other projects violate the GPL, that's sad

Another example is glquake.exe;

glquake was released by id Software before Quake went GPL.

About -dinput invoking a Windows .dll.. as I've already said in my first post:

there is only one special exception to this, and it concerns:

"... anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, ..."

.dll files are external shared libraries and their use has been common ever since the days of Windows began.

.dll files are external in the same sense one function is external from another function within the same program as far as the GPL is concerned. They indeed don't fall under the license of an executable using them. But they have to be GPL'd if a GPL'd program is to use them (as cheatfree ProQuake does), according to the GPL (except for "... anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, ..." as already mentioned). So I can't demand the source code for kernel32.dll by waving the GPL flag.

Also, as far as the GPL is concerned, the security module is a derived work from Quake. Furthermore it shares the same executable context and data structures with ProQuake, function calls are made back and forth, there are lots of places in ProQuake's source code where the security module is checked for, the security module encrypts ProQuake's connection... the security module is deeply intimate with ProQuake.

And from the FAQ:

The substantive part is this: if the two programs are combined so that they become effectively two parts of one program, then you can't treat them as two separate programs. So the GPL has to cover the whole thing.

John Carmack ... He tells Grossman ... and encourages him to solve the cheat-protection issue in a GPL-compliant way by putting the security features in an external DLL.

Actually I don't think that he did. Assuming Carmack meant what the GPL means with "external to the main executable", he could have meant a solution involving a proxy, or in the QuakeC (which is interpreted and does not fall under the GPL), or perhaps using a magic Python script, or simply having an admin eyecam cheaters, or something yet unheard and unthought of.

And I don't agree with JPG that ProQuake 3.20 fully complies with the GPL, for the reasons stated in this and my previous posts. If any of those reasons are invalid, I would appreciate it if someone points that out to me. English is not my native language so I might have misunderstood the GPL somewhere

Best regards!

// Cortex

[Baker]

Also, as far as the GPL is concerned, the security module is a derived work from Quake.

Says who? It sure isn't.

If you read the ProQuake source, it solely exists to generate security seeds and encryption values and was self-written by JPG (who has a phd from MIT --- that's some serious education).

If you read the ProQuake page, it states this.

Furthermore it shares the same executable context and data structures with ProQuake, function calls are made back and forth, there are lots of places in ProQuake's source code where the security module is checked for, the security module encrypts ProQuake's connection... the security module is deeply intimate with ProQuake.

I'm kind and patient and always take the time to explain things to people considerately even when I don't have to.

But, the fact of the matter remains that you are wrong about a great many things.

I'd encourage you to start such a topic at Inside3d.com and repeat this question so countless people not named Baker and not named Rook can walk you through the details.

And by seeking outside opinion you will feel better and learn more about the subject at hand.

LordHavoc, FrikaC, Spike and a horde of other very intelligent people hang out at Inside3d.com and can help enlighten you as to the responsibilities, limits and applications of the GPL.

[Mindf!3ldzX]

I couldnt find the relevance of "Baker" inside the ProQuake 'official' website. Before open mouth and inserting foot, doing homework will garuntee you feet stay planted on the ground,and dont end up between your incisor's and molar's.

Wait, hold up.

If someone sincerely believes the GPL is being violated -- and I do believe Cortex believed/believes this -- he has every right to lodge a complaint.

He did it in the forums, which is the best possible place to a fair and open discussion on the matter.

And if he still believes somehow I am in the wrong I would be more than willing to continue explaining in the forums.

I've been wrong before, you've been wrong before, everyone has been wrong before. We're all friends here and all like Quake.

[cortex]

Also, as far as the GPL is concerned, the security module is a derived work from Quake.

Darn. "derived work from Quake" should have been "combined work with Quake". My mistake I was referring to:

If I add a module to a GPL-covered program, do I have to use the GPL as the license for my module?
The GPL says that the whole combined program has to be released under the GPL. So your module has to be available for use under the GPL.

But it does raise an interesting question. Could the security module have been made, had the source code to Quake not been available and no reverse-engineering been involved? Oh well..

But respectfully Sir, I'm sad to say that up until this point I think you have given me little more than fallacious arguments, not very different from what Sir. R00k did in his first post. I'll try listing them to show you what I mean:

Fallacy - Wikipedia, the free encyclopedia

You tried to shed yourself of the obligations to the GPL by, in effect, saying "I didn't do it" in your first post.

I am not the author of the ProQuake security module and have never made any modifications to it.
Therefore, I have no obligations to anyone nor shall I ever have.

Where in the GPL are you allowed to do that?
Ignoratio elenchi - Wikipedia, the free encyclopedia
Special pleading - Wikipedia, the free encyclopedia

Then you tried to justify yourself by mentioning other projects that do similar things..

There is a mod called Nehahra, it uses fmod.dll -- a closed source library that provides a few interesting extra features.
DarkPlaces uses it, JoeQuake uses it, Qrack uses it.

Argumentum ad populum - Wikipedia, the free encyclopedia

Passing glquake (which I assume you forgot was released before Quake went GPL) you gave me the -dinput argument. Did you even bother to read what I posted about libraries that are part of the OS?
Cherry picking - Wikipedia, the free encyclopedia
Ad nauseam - Wikipedia, the free encyclopedia

".dll files are external shared libraries and their use has been common ever since the days of Windows began."
Automobiles are popular methods of transportation.
Ignoratio elenchi - Wikipedia, the free encyclopedia

".dll files don't fall under the license of an executable using them."
I never said they did.
Straw man - Wikipedia, the free encyclopedia

"If they did, people could be demanding the source code for kernel32.dll from Microsoft or demanding that Nvidia release the source code for their OpenGL API."
Well duh..
Appeal to ridicule - Wikipedia, the free encyclopedia

"He tells Grossman he must comply with GPL ... by putting the security features in an external DLL."
Straw man - Wikipedia, the free encyclopedia

"If you read the ProQuake source, it solely exists to generate security seeds and encryption values and was self-written by JPG (who has a phd from MIT --- that's some serious education)."
So by reading ProQuake's source, I can conclude that the security module is not doing anything evil behind my back?
Begging the question - Wikipedia, the free encyclopedia
Also,
Ignoratio elenchi - Wikipedia, the free encyclopedia
Argument from authority - Wikipedia, the free encyclopedia

You say I am wrong about a great many things, without specifying what. When I first asked you about the source, you said you knew the GPL inside and outside, leftside and rightside, upside and downside, yet you have not presented one single contra argument, showing I have misinterpreted the GPL in any way.

Instead you have been running away from my arguments, presenting me with fallacies, and I presume, hoping I would fall for them. And now, when you are tired of running, you tell me to go to Inside3d.com instead, and bug somebody else. I hope the well isn't poisoned
Poisoning the well - Wikipedia, the free encyclopedia

So sad.. :/

Oh well, I guess that I have made my case and lost.

[Mindf!3ldzX]

He has nothing do to with sercurity.dll for fucks sake,even if the GPL is indeed being violated,your barking up the wrong tree homie,Baker neither created,nor maintains the cheat-free DLL.On top of it all, if there was GPL being violated, JPG's planetquake website would have been shut down a long time ago, just like with Trujen's site being shutdown when he refused to release the source code to ProQuake+/XQuake. I really dont understand what your big malfunction is in persisting this.

In response to Baker's "Hold up" comment, it doesnt matter whether this guy 'thinks' the GPL is being violated,its whether in fact it IS or ISNT,and obviously,it isnt,atleast not since it was fixed.

This isn't rocket science,honestly,its not.

[Baker]

Cortex,

I've never published a security module for ProQuake.

If you feel strongly about this issue, I would recommend you contact John Carmack at id Software or Todd Hollenshead and make a complaint.

Or you can contact the the Free Software Foundation, these are the people that write and maintain the GPL.

http://fsf.org/

There wasn't an argument to be had here and I invested a lot of time explaining in my posts.

It would have been nice if you had taken the time to read them. If you take the time to re-read them and click on some of the links, I think you'd see what people like Rook and myself and even Mindzfield were trying to explain.

[Baker]

Cortex, I'm trying to explain in such a way that you don't feel awkward. I don't want the result of this argument to be that you feel I didn't listen -- even though that is not relevant to the subject at hand ...

Everything you need to know is concisely contained in this paragraph from the ProQuake site:

ProQuake FAQ:

Does ProQuake 3.20 comply with the GPL?

Fully. The security code has been packaged into separate modules which are distributed separately, thus complying with the specific terms of the GPL. The security modules are not quake-specific and are not in any way based on the Quake source. You can see a full list of exported functions in security.h from the ProQuake source. Finally, ProQuake is fully functional without the security modules; they are only required to start or connect to a cheat-free server.

ProQuake and the GPL

The security module was self-written by JP Grossman using no Quake source code and the module itself is not even Quake specific and can be used with another application and is not required to use ProQuake.

It isn't covered under the GPL at all, never has been and was precisely the method John Carmack recommended that JPG to pursuit to comply with the GPL.

Please take some time to consider the significance of this post. ^^ If you email John Carmack or the FSF like I suggested, they will tell you the same exact thing --- a module that uses no GPL code and is optional simply isn't covered under the GPL.

[gnounc]

Also flies and honey brotha

some argument ad hominem for ya

you're being a dick.

you didnt exactly ask nicely, bakers responses were pretty polite.


*ps
send me all the links you want I love wikipedia!!

[R00k]

Can I just say cortex fuck off and maybe you will realize no one cares......


People are dropping dead in this world] and your bitching about how high your ass ranks on a damn 1996 video game. yippy skippy you win, love shines on your assshole, move that monkey aside...

[Neil]

r00k ftw.

[spooker]

i really enjoyed reading this thread. impressive arguments on both sides. cortex, your tone was disrespectful to a person who has done more for the quake community than anyone else, which is why you're seeing negative comments from other people. His time is valuable and he is not under any obligation to answer your arguments. Although I find it educational to read where someone has attacked someone else's arguments and labeled them with specific logical fallacies, I can say that as a forum poster who has had this done to them, it is irritating. you seem like a philosophy type, not caring who you upset or annoy with your arguments. i used to be like that. unfortunately, getting things done is all about interacting effectively with other people, and so, often social tact and grace are more important than logical rigor.

[MH]

From the horse's mouth (source: 1999 December | Doom-Ed )

What needs to be done is to create two closed source programs that act
as executable loaders / verifiers and communication proxies for the
client and server. These would need to be produced for each platform
the game runs on. Some modifications will need to be done to the
open source code to allow it to (optionally) communicate with these
proxies.

Argument over, I believe.

[cortex]

spooker:
"cortex, your tone was disrespectful"
It was? Darn, I really need to work on my interpersonal skills, seriously.

"often social tact and grace are more important than logical rigor."
Blah! This is what happens if one had Spock as a role model. I guess I'd make a descent judge but a poor lawyer.

I thank you for your constructive criticism Sir spooker! I shall take it into concideration and keep it in mind.

mhquake:
Excellent find Sir!

Seems Carmack meant what I suggested he did with the proxy after all! And what did Carmack write just above that?

Lo and behold,

So, the problem then becomes a matter of making sure the clients are all playing with an acceptable version before allowing them to connect to the server. You obviously can�t just ask the client, because if it is hacked it can just tell you what you want to hear. Because of the nature of the GPL, you can�t just have a hidden part of the code to do
verification.

He also seem to agree with me about the server administrator's ability of choosing 'which' clients would be allowed to connect.

The server operator would determine which versions of the game are to be allowed to connect to their server if they wish to enforce proxy protection.

... something not possible with cheatfree ProQuake at this time.

Interesting reading!