monopd

Monopd back on track?

Software

Don't immediately dismiss those rumours you've heard: it looks like a new monopd release may indeed be around the corner, considering the various signs of activity in that direction:

All in all, it looks like I'm slowly finding the right motivation to get my software projects back on track.

Raiders of the Lost Arch

Software

Good news: I have finally committed the already supplied monopd DOS patch to my Arch archives which I have restored on my private network and will see if there's a way to make it public again. There may be hope for me and this project (along with Atlantik) yet.

Slackware 10.2 packages for Monopd

Software

One benefit of running a 100% vanilla Slackware installation: I can make proper packages for my software once again. If you're running 10.2 and are interested in a hassle-free installation of Monopd: head for the Atlantik download page and marvel at the TGZ packages for libmath++, monopd and libCapsiNetwork.

Or maybe you are really hip and using slapt-get (Slackware's APT) in which case you could just add SOURCE=http://www.robertjohnkaper.com/downloads/atlantik/slackware-10.2/
to your /etc/slapt-get/slapt-getrc and a simple --update and --install monopd will fetch and install all packages required for monopd automagically.

Patch against monopd 0.9.3 DOS attack bug

Software

Luigi Auriemma reported a security bug in monopd 0.9.3 which could result in a denial of service by extraneous resource consumption:

The Monopd server makes the string replacement (escapeXML) of some chars in the input data of the client for avoiding the manipulation of its XML output.

The problem is that the replacing of the bad chars takes many CPU and memory if the string is too long (over 15000 chars) so any client in the server will not be able to play and join during the attack.

I have written a proof-of-concept for testing the bug:

http://aluigi.altervista.org/poc/monopdx.zip

A fix against this DOS attacks is available in the form of a patch against monopd 0.9.3, from the Atlantik and monopd download page. It limits the amount of characters accepted from user input involving strings (player names and token images, game descriptions).

Atlantik, monopd and libCapsiNetwork

Software

I'm still enjoying my break from software development and when I look at my gig plans I must admit there is still not much room for such activity in the near future (blame all the lovely punk rock girls). But due to popular request I have uploaded the latest versions of all Atlantik related sofware, so go ahead to once again download Atlantik, monopd and libCapsiNetwork straight from the source!

GNU Arch development archives will follow as soon as I resume development. After all, I still have plans to merge the server code and base classes into a single library. And I'd love to see an Atlantik complete with all the wonderful features I envision such as SVG game boards and instant messaging integration. Maybe when I get tired of those punk rock girls I'll start playing with the new Qt and KDE stuff instead!

New Monopd

Software

Just released a new Monopd, 0.9.2 to be precise. Valgrind found the nasty bug that was in the previous release, and more importantly it contains a bugfix guaranteeing the "correct transfer of properties to the bank when a disconnected player doesn't reconnect in time".

That's good news for Atlantik and KDE users, as all clients out there automatically benefit from these fixes.

© Copyright 1995-2009 Robert John Kaper. All rights reserved.

Tom has more friends but mine are prettier! (#1/1)