Welcome to the Second Life Forums Archive

These forums are CLOSED. Please visit the new forums HERE

General security tips

Stavros Augustus
Registered User
Join date: 14 Nov 2005
Posts: 38
05-17-2007 17:43
I've lately been thinking about script security, and I was wondering what ideas others have had about the subject.

Suggestions (I may add others' suggestions to the list if people find this thread valuable):
-If you have to use chat to sent data, use obscure channels, multiple dummy calls, and hashed messages.
-Try to avoid, however, using chat, as there is always the possibility of its being intercepted or decoded. Whenever possible, use link messages, or if time is irrelevant, even email.
-If you want some parts of your scripts to be modifiable, but want to keep other parts a secret, consider separating the scripts into mod and no-mod scripts and have them work together using link messages.
-Alternative to the above, you may consider obfuscation (see below for more).


Tips for obfuscation:
-Use low-level operators, especially bitwise, whenever possible. If your code contains:
CODE
[integer]*=8;

Consider using this instead:
CODE
[integer] = [integer]<<3;


-Use redundant and strangely-named variables and functions.
-Use hexadecimal integers instead of decimal ones (remember that they start with "0x";)

I'm interested to hear tips from other people.
Pip Helios
Registered User
Join date: 29 Sep 2006
Posts: 22
05-18-2007 06:03
From: Stavros Augustus
I've lately been thinking about script security, and I was wondering what ideas others have had about the subject.

Suggestions (I may add others' suggestions to the list if people find this thread valuable):
-If you have to use chat to sent data, use obscure channels, multiple dummy calls, and hashed messages.
-Try to avoid, however, using chat, as there is always the possibility of its being intercepted or decoded. Whenever possible, use link messages, or if time is irrelevant, even email.
-If you want some parts of your scripts to be modifiable, but want to keep other parts a secret, consider separating the scripts into mod and no-mod scripts and have them work together using link messages.
-Alternative to the above, you may consider obfuscation (see below for more).


Tips for obfuscation:
-Use low-level operators, especially bitwise, whenever possible. If your code contains:
CODE
[integer]*=8;

Consider using this instead:
CODE
[integer] = [integer]<<3;


-Use redundant and strangely-named variables and functions.
-Use hexadecimal integers instead of decimal ones (remember that they start with "0x";)

I'm interested to hear tips from other people.

i;m not exactly sure why you would need to secure scripts to this extent? I mean I use link messages for HUD (common sense for lag reasons if not security) and when I use llDialog it uses randomized channels per call, also check hud to object communication by owner of the HUD (to distinguish my HUD from copies when chat communicating) but I mean.... I just don't see where security would be that big of a issue to this extent. Actually purposefully obfusticating my scripts would only increase server load and make it harder for me to reference my code later. I'm sure their viable cases but I guess I'm at a loss for what they are (except possibly breaking up scripts to make parts mod, maybe for license reasons).