Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - Jay Dolan

Pages: [1]
Quake / Open source, cross-platform anticheat
« on: April 12, 2013, 04:38:08 AM »
hifi and I were brainstorming the AC dilemma this morning and came up with a possible cross-platform, open source solution that could facilitate multiple maintainers. It uses industry-standard techniques like digitally signed binaries and HTTPS. There are two major components: a client-side agent and a server-side web service. There are also minor game protocol extensions required. Here's how it works:

  • Consensus around trusted clients is built from the community. Quake2 engine maintainers deemed trustworthy begin signing their releases with GNUPG. They submit their signatures to a central repository.
  • An agent program is created to run on all client machines where AC will be used. The agent is responsible for launching the game. The agent will refuse to launch any binaries which do not have a hit in the authoritative list of signatures, which the agent downloads from the web service over HTTPs at startup.
  • The agent launches the client with a cvar (+set ac 1) which informs the client to attempt to use the AC protocol extensions.
  • Because the agent launches the signed client, it can parse its stdout. During the connection handshake, after a challenge has been initiated, the client generates a one-time use token and prints it out before sending it to the server to complete the challenge.
  • The agent program parses out the token and submits it to the web service as well. The token is tied to the client's IP and qport for identification.
  • The server can now query the web service for the token before allowing or disallowing the connection. The token is removed from the web service once it is returned to the game server. Tokens also expire automatically from the web service after 1 minute.
  • The presence of a valid token in the central web service demonstrates that a signed client has initiated the current Quake2 connection.

This doesn't yet handle any content hacks, but I think it's a good start towards supporting as many client engines and operating systems as possible. I think the work to implement this on the client is actually rather minimal, too. And because we can verify that the client is authentic here, adding content checks in is actually meaningful. So that's a huge plus.

There is minimal risk in allowing the the Quake-side implementations of this AC be open source. Because only trusted maintainers can submit signatures for their binaries, having the source code readily available poses no immediate threat. The agent and web service can also be open source. The credentials the agent uses to authenticate with the web service in a production environment, however, will have to be very carefully guarded and only included in "official" builds. Obfuscating these credentials in the official builds will be a key concern, as this would be the primary attack vector in this system. A compromised agent program could execute unsigned, insecure client engines, allowing them to pose as authentic.

The point of this thread is to discuss any pitfalls or problems with this approach and to gage the level of interest in this solution. If enough people want it, I would probably build it for Q2 and Quake2World.

Quake / High resolution skin for Generations Arena jacket armor
« on: April 09, 2013, 04:30:46 AM »
There are quite a few incarnations of the Generations Arena pak still floating around, but all of the ones I have found still have a shit-tastic skin for the green armor. Does anyone have a skin for this model that wasn't made in MS Paint?

Quake / Updated AprQ2 for Mac and Linux users
« on: February 24, 2011, 04:59:12 AM »

Anyone looking to play Quake2 on a Mac or on Linux might want to check out my maintenance effort for the AprQ2 engine:

This "fork" of AprQ2 is based on the 1.211 source code, and is mostly focused on portability and stabilization.  You get the latest and greatest AprQ2 release, plus some useful things like updated R1Q2 Protocol 35 support and high-resolution conchars when using gl_scale > 1.0.  The INSTALL guide walks you through setup and installation of the game data plus a few recommended pieces such as R1CH's high-resolution texture pack.

Most recent changes include:

- Support for Mac OSX via SDL, libjpeg and libpng
- Fixed numerous compiler warnings for 64 bit architectures
- Fixed multithreaded SDL audio crash on Linux
- Fixed conchars crash when using gl_scale > 1.0
- Updated INSTALL and CONFIG documentation

Full CHANGELOG is available too, if you're interested.

Compiling it on either platform is actually pretty darn easy if you install the dependencies in the same manner required for Quake2World.  See for platform-specific instructions.

Hope this helps the handful of Linux and Mac Quake2 fans out there  :lolsign:

Quake / Calling sport and pro level players..
« on: January 20, 2008, 05:35:47 PM »
Hi guys,

As some of you may be aware, for the past year or so I've been working on a Quake2-derived standalone deathmatch game called Quake2World (  We're really pushing for a 1.0 release this spring, and so before that happens, I'd really like to incorporate feedback from some of the top active Quake2 players.  Some things you should know about the game:

The physics have been modified from Quake2.  Player acceleration, walk and run velocities, air acceleration, and upward jumping acceleration have all been slightly increased.
Weapon ballistics have been modified as well.  All firing rates have been increased, projectile speed and knockback generally increased as well.
The server tick rate is variable from 10hz (Quake2 default) to 120hz.  This allows tuning for LAN vs Internet games, and a more responsive game for everyone.
There is teams play, match mode, ctf, instagib, and rocket arena.  These all need further testing and adjustment.
There are bugs!  95% of the Quake2 source code has been touched, much of it significantly refactored or rewritten.  Do not expect perfection at this point in time.

If you fall into the aforementioned player group, and all of this sounds interesting to you, I'd be happy to bring you up to speed on the project, and get you play-testing immediately.  I'd ask that you only become involved if you see yourself as able to participate frequently over a period of at least several weeks.  To contact the team, please join us in #quetoo on

Quake / Quetoo 0.6.0
« on: December 12, 2006, 05:18:53 AM »
Hi guys,

Quetoo is nearing a release, and I was hoping to get some testing before unleashing it to the public.  For those of you running Linux or BSD, I would appreciate your feedback on the build process, and any defects you notice in-game.  If a Windows user wishes to give a port a shot, now would be a good time.  This latest release brings a long list of changes, namely:

-R1Q2 Protocol 35 support.  Enjoy bandwidth savings and faster downloads.
-Fixed connectionless vulnerabilities in client discovered by R1CH.
-Server now prevents malformed skins (e.g. male/../female/athena).
-Ability to build dedicated server only.  Client object code is not compiled
or linked into binary.  Pass --without-client to ./configure.
-Removed setenv and prog client commands.  These were not used.
-Changed cl_forcefov to simply use fov->value when set.  Value is archived.
-Added instagib and arena gameplay modes to qmass mod.  Gameplay may be
changed on the fly.  Clients are respawned and items are toggled accordingly.
-Added player voting system to qmass mod.  Map, gameplay, fraglimit,
timelimit, kick, and other commands may all be voted upon.
-Added Lithium II style offhand hook to qmass mod.  Bind a key to +hook.
May be toggled via hook cvar, and is votable.  Defaults to off.
-Added client connect and disconnect MySQL logging to qmass mod.
-The zlib cvar has been superceded by a quetoo cvar, which uses an integer
value to bitmap various Quetoo-specific protocol extensions (like zlib).
-Zlib is never considered for messages smaller than 200 bytes.
-New extension QUETOO_PLAYERSTATE makes optimizations for Quetoo client
playerstate messages.  Saves a significant amount of bandwidth.
-Client records demos with the current server's protocol.  Quetoo server
has been modified to handle Protocol 35 demo playback.
-Removed attractloop boolean from server, this functionality can be
resolved by examining sv.state.  Client maintains this field as demoserver.
-Removed loadgame boolean from server.  No longer needed.
-Removed disable screen boolean from client.  No longer needed.
-Game progs are never reloaded, nor their frames run, for demo playback.
-Game for demos is set immediately, rather than latched as before.  This
allows immediate playback of demos requiring game-specific data (e.g. ctf).
-Sound updates are no longer performed if a client is less than fully
connected and active (i.e. no more stuttering during map changes).
-Removed server sided demo recording.  It was never used.
-Functionality in q_shared.c is built as a libtool library, and is made
available to game mods at linktime.  No more duplicate code.
-Game mods to be built are now specified with --with-games='mods'.  Ctf is
no longer built by default.  Try --with-games='baseq2 ctf qmass'.
-Reverted cvar structure.  Quetoo game mods will run on other engines, and
vise-versa.  Try the qmass mod on r1q2ded.
-Removed CL_PrecacheModels.  Was rather uneccessary.



Quake / Field of View? (fov)
« on: October 31, 2006, 03:55:19 PM »
I'm just curious what most players use.  It'd be interesting to find correlations in settings like fov, inverted mouse, sensitivity, etc.. and player's skill level.  Sensitivity is difficult to pin down because it varies with platform, hardware, vid_ref, etc.  Anyway.. vote away :)

Pages: [1]