security on game

[Jake]

what you say is very true but having a small basic protection just to show people this game is not meant to be copied is a good idea

Sure. And as AlphaProspector mentions above, there's a small basic protection available from the obfuscation you can access in the Tools -> Archive menu in the Ren'Py launcher. It packs all your source files and assets into monolithic archive files.

If you're going to make the game commercial, I understand obfuscating it, but if you're going non-com, there may not be much of a point...

It's been debated more than once before, with people on both sides of the fence, but really - it's up to the individual developer whether they feel they need to obfuscate their game; when someone asks how to do it, "you shouldn't need to do that anyway" isn't a particularly helpful answer... it's like telling someone who's asking where to buy a car that they should ride a bicycle everywhere instead because it's good exercise.

[delta]

I think something is not quite clear here: Archiving does exactly NOTHING towards making your game harder to copy (if anything it makes it infinitesimally easier because you don't have to deal with hundreds of little files). It just makes reading your source scripts and other files harder, and most people don't even want to do that.

[Jake]

I think something is not quite clear here: Archiving does exactly NOTHING towards making your game harder to copy

Mm, if you want to make your game harder for people to make a copy onto a flash stick and pass it to a friend, then you have to look for a third-party solution... this thread on TIGSource for example has a few links to DRM options.

Just bear in mind that fundamentally, they'll all have been cracked in principle already, all you're doing is stopping the casual user from throwing the game on a flash stick and giving it to his friend, so it's generally wise for whichever option you pick to be as non-intrusive as possible to avoid annoying people.

[Adorya]

IMHO, I'd be more inclined to try to hack into the code of a game that's been obfuscated than a game that isn't... It may be just me that feels that way about games, but I think everyone here feels better when they have something (achievement) that makes them "special" or "elite." That's how those Special Edition things grab people and how researchers get small children to fight over raisins. :laughs:

And since I'm an open source-loving hippie, I don't obfuscate my games, anyway. :p

On the opposite side, when I see a game directory structure left open, I can't help but have a peak and see what is modable
A basic exemple is Wesnoth, which is fully open to read and modify, as I am not a good STG player I "customized" a bit the game to make it easier. Of course this is intended and it's even a recommandation to sneak in and edit the files, but if I was a map author that would mean that I failed to make it balanced (or even it destroy the challenge if the map was intended to be hard).

[delta]

I'll elaborate on this a little. These are two very different topics, actually, so I'll do it in sequence.

1. Copy protection

A tried and tested system will cost you - there are no good open-source or even freeware implementations around for pretty obvious reasons. You can roll your own, but that would probably cost you time and effort, which is money too - probably more unless you are an ace coder and chances are you aren't. Sure, you can do simple schemes like serials on request or just wrapping the whole thing in a passworded rar archive and the like, but those are laughably easy to get around and even hard to crack ones don't work. You best guess is to appeal to the user's morals - it's a lot less resources spent and works just as well.

2. Archiving / "Obfuscating"

I like obfuscation, but not for security reasons - As I said, it's still easy to get to them, but if someone wants to unarchive and decompyle bytecode, they probably deserve it for their effort. I just think it's... untidy and unprofessional to have tons of files lying around, and to expose everything which is supposed to be a designed user experience to the casual browser. As for code (which is not user-visible, unlike everything else), if I think something is really useful for someone else and want to share it, I'd just post it here. It's not that special anyway. If someone disagrees with my usefulness asessements, they can always ask for it.

[Nio]

I dunno about you guys, but as an artist I don't want to just hand all my images over to whomever has the game. Just because it's easy to crack doesn't mean it has no value. Also it should help from spoiling the game. For example I would want people to play the game to see the special scenes and unlock them for the gallery. If they could just look at them in the game folders that would sort of ruin the gameplay to me.

I've had people use my art on websites without asking and even had some try to make money off it. That might be okay by some because they feel you can't stop it so why try, but I have and you can. So if there is any way to help prevent that, I'm gonna take it.

[PyTom]

The current method, obfuscation, tends to stop the sort of person who's just going to poke around the game directory and see what he can find. I'm about to make a minor change to the obfuscation that will also stop people who use non-Ren'Py-specific tools from being able to easily unpack the obfuscated files.

There's nothing I can do to stop people who are willing to take the time to understand how Ren'Py works, and write a Ren'Py-specific tool. Ren'Py being open source makes this a little easier, but seeing how many games get cracked each week, I don't think much easier. Remember, people can just play through the game and hit printscreen.

[LVUER]

Remember, people can just play through the game and hit printscreen.

Ah, yes. The mighty print screen button. How can I forget about it after used it so much in past. And there are even mightier software to do just thing like that (like Screen Capture).

[Nio]

Of course they can print screen, but that doesn't mean you shouldn't bother hidding your work. It doesn't mean they will see everything, every ending and sprites will be hard to crop out from a background. It's not perfect, but it's better than nothing.

I guess having my work stolen several times has made me bitter. (shrug)

[papillon]

Open resources do invite players with basic computer skills to mess around and mod them. I personally think that's a good thing, but it certainly shouldn't be a requirement. And in a game where collecting CGs is a large component of the gameplay, keeping them at least slightly locked up may help drive people to actually complete the game.

But I don't think it does much to stop people who are intending to *steal* the resources (either to make their own games or to post the art). People whose intention is stealing for 'public' use rather than modding for private use are willing to put up with a lot more hassle... and feel more achievement through having done it the hard way. Most sprite rippers aren't taking sprites from games with open resources. Why bother, anyone with the game already has those! And there are a good number of commercial games (not just mine!) that leave a lot of resources open, and this doesn't seem to lead to a massive flood of abuse.

*shrug* It's up to you, it just doesn't make that much difference really. IMO.

[LVUER]

There is a saying "No defense at all is better than imperfect defense" (or something like that). Is that saying also applied in this kind of situation?

So if we make it open-source, may be people will think "Why we should bother stealing the sprite/BG, it's open source!?"

[PyTom]

Well, if you make it open source (under a permissive license), it actually becomes hard to steal the pictures. I mean, if I put a pile of candy on my porch with a sign that says "FREE! Please Take!", and someone takes them, it really isn't stealing.

On another topic:

Is there anyone that actually has a problem with the current obfuscation method, which does a pretty good job of protecting against generic attacks, but won't stop a determined person? I don't want to invest much effort into improving it, knowing that:

- Anything more complicated than what we have will slow down performance a bit.
- Every protection scheme is crackable, and is likely to be cracked if someone actually tries.

[LVUER]

I don't mind with the current Ren'Py. Having too complicated security will only make the program heavier and more expensive (remember that we get Ren'Py for FREE). And someone will eventually crack it anyway (if she/he really that determined). We only need general protection for people who lazy enough to make something on their own (and I doubt people like that will go to the extent cracking Ren'Py).

Actually, since we get Ren'Py for free, I don't think we have the right to complain anyway ^_^
But really... I'm already satisfied with Ren'Py as it is.

Well, if you make it open source (under a permissive license), it actually becomes hard to steal the pictures. I mean, if I put a pile of candy on my porch with a sign that says "FREE! Please Take!", and someone takes them, it really isn't stealing.

Yes, of course. You can't fire your employee if they already quit beforehand. I mean the tougher the security we make, the more people want to crack our security. And just like dealing with children, the more we forbid them to do something, the more they want to do it/the more curious they are.

[AlphaProspector]

Not worth the effort... I would rather see Ren'Py getting shinier and nicer. Plus it's already free, shiny, nice and mega-friendly. Couldn't ask more!

Announcing all over that a program has new 'improved' security measures is calling all the sharks with a fresh and bloody bait. They will feast on the 'improvements'... And that invested time could've gone into something else.

Obfuscation sounds just as fine and probably does its job and I like the fact that's it is not really widespread and flat-out mentioned as PyTom once stated.

A developer could always use that command that extracts files from the rpa (like music or graphics) as a 'prize' for beating the game or something. This is stated in the wiki.

So, if you know the music is good and the composer won't mind to have it copied, then indicate that beating the game unlocks the music files for personal use (which would discourage hacking through the game files for them).

[delta]

Is there anyone that actually has a problem with the current obfuscation method, which does a pretty good job of protecting against generic attacks, but won't stop a determined person? I don't want to invest much effort into improving it, knowing that:

- Anything more complicated than what we have will slow down performance a bit.
- Every protection scheme is crackable, and is likely to be cracked if someone actually tries.

Not me. I already think that the current scheme is more complicated than it needs to be, what with the random key and all. I mean, anyone technical enough to know how to take a look into an archive with a hex editor also is technical enough to read the source code of Ren'Py.