6 ms·

Repo: https://github.com/bobsgame/bobsgame/ https://github.com/bobsgame/bobsgame/ (deleted, see edit below) I looked at it a few weeks back and it's really str

Repo: https://github.com/bobsgame/bobsgame/ https://github.com/bobsgame/bobsgame/ (deleted, see edit below) I looked at it a few weeks back and it's really strange. It has really weird restrictions that don't make any sense regarding the license - I'm not even sure if they even are legal. The author claims he is sharing the source but that nobody else can fork it, unless they fork it on GitHub?! Anyhow, within a few seconds of reading the source you'll find that the first thing the binary does is call home to download and extract a newer .zip file from the bobsgame.com website. It does this over HTTP and without any kind of signature/signing of the binary. Before it actually downloads the .zip file it actually tries to grab a version number from a PHP script on the website that doesn't exist. The website instead renders some HTML. The C++ casts this HTML to a number and gets 0, so it always assumes that the website does not have a newer version of the game to download. This means if someone on the local network can DNS spoof the website it will dutifully talk over unauthenticated HTTP, the attacker can actually provide a PHP script that responds with a high version number and then deliver the payload over a .zip file. It's a fascinating tale! EDIT: It does appear the author has been removing things =( His GitHub has been wiped clean https://github.com/robertpelloni https://github.com/robertpelloni If anyone is curious here is a fork of the repository I was trying to link: https://github.com/mpavlinsky/bobsgame https://github.com/mpavlinsky/bobsgame

shawabawa3 5y ago
Looks like the repo has been deleted
WoodenChair 5y ago
Your link is already 404ing a minute after you posted it. Is it possible Bob is reading this thread and already removed it?
- ddtaylor 5y ago
  It appears so. I've updated the comment with a fresh link.
dec0dedab0de 5y ago
I looked at it a few weeks back and it's really strange. It has really weird restrictions that don't make any sense regarding the license - I'm not even sure if they even are legal. The author claims he is sharing the source but that nobody else can fork it, unless they fork it on GitHub?! I don't know if the wording is legalease enough to be enforced, but of course a license like this is legal. Just because you can see the source code doesn't automatically grant you any privileges with it. He is saying he is only allowing unmodified redistribution. With an exception that you are allowed to distribute a modified version of the source code for the sole purpose of submitting a pull request. One problem he might get into is if accepts non-trivial pull requests, then the contributors copyright would come into play, and things could get hairy.
- jcranmer 5y ago
  The first two clauses of the license are the BSD-2-Clause license, nothing weird or unusual there. The third clause is... interesting. I suspect it's probably legal, but it may well have unintended consequences because it appears to be requiring you to use a trademark. The fourth clause may fall afoul of First Sale Doctrine. It's something that I wouldn't trust without talking to an IP lawyer to work out what it actually means and how much is actually viable to be done in an open source license. The fifth clause is nullified by the terms of GitHub, I think, as GitHub's ToS seems to require you to allow anyone to fork your repository without encumbrance, which the fifth clause tries to narrow.
  - dec0dedab0de 5y ago
    The fourth clause may fall afoul of First Sale Doctrine. It's something that I wouldn't trust without talking to an IP lawyer to work out what it actually means and how much is actually viable to be done in an open source license. I don't think the first sale doctrine comes in to play here at all. If we make it physical media for arguments sake. First sale doctrine would say that if a user bought a cartridge of the game they could resell that cartridge. That is not the same thing as redistribution which would be the equivalent of copying the game to new cartridges and selling those. Also, this is definitely not an Open Source license. However, it is similar to the Creative Commons Attribution-NonCommercial license. The fifth clause is nullified by the terms of GitHub, I think, as GitHub's ToS seems to require you to allow anyone to fork your repository without encumbrance, which the fifth clause tries to narrow. I'm pretty sure the terms of a website can't overrule the license of the software. I think at best it could get the project kicked off of github, and make it hard to prosecute someone who didn't realize. His biggest problem is use of the word fork when he really meant derivative work. Which comes down to my point that the goal of the license is legal, but maybe not the wording.
jart 5y ago
> #bob's game is: ##THE GREATEST PUZZLE GAME EVER MADE [...] bob's game is "source available" [...] but not "Open Source" That means no forks except to create pull requests! Would you consider deleting your fork? It goes against the author's wishes and I don't feel comfortable gawking at someone who might be experiencing health issues. He's clearly trying to distance himself from the attention it's received.
- ddtaylor 5y ago
  I don't have any forks of his code, it's the first result for searching for the repo on GitHub. In either case, I do believe once the source code to something has been released it's fair to continue to archive it.
  - jart 5y ago
    Did you bring the security vulnerabilities you discovered to his attention before disclosing them on hacker news? Regardless of what you think is fair it's pretty clear you aren't acting with his best interests in mind.
    - duxup 5y ago
      Telling users here (some I'm sure will / would download the code) seems entirely acting with the user's best interests in mind.
    - ddtaylor 5y ago
      Full disclosure is the most responsible disclosure.
rozab 5y ago
GitHub ToS requires you to allow others to fork your code on GH. This policy leads to a lot of bizarre licensing decisions on the site. https://docs.github.com/en/github/site-policy/github-terms-of-service#5-license-grant-to-other-users https://docs.github.com/en/github/site-policy/github-terms-o...
meibo 5y ago
HTTP/unsigned patches are frighteningly common in the video game world. One of the major MMOs doesn't do either and has some other nasty stuff like easily stealable login tokens over the network.
BugsJustFindMe 5y ago
It's currently still archived by Software Heritage https://archive.softwareheritage.org/browse/search/?q=https%3A%2F%2Fgithub.com%2Fbobsgame%2F&with_visit=true&with_content=true https://archive.softwareheritage.org/browse/search/?q=https%...

shawabawa3 5y ago

Looks like the repo has been deleted

WoodenChair 5y ago

Your link is already 404ing a minute after you posted it. Is it possible Bob is reading this thread and already removed it?

ddtaylor 5y ago
It appears so. I've updated the comment with a fresh link.

dec0dedab0de 5y ago

I looked at it a few weeks back and it's really strange. It has really weird restrictions that don't make any sense regarding the license - I'm not even sure if they even are legal. The author claims he is sharing the source but that nobody else can fork it, unless they fork it on GitHub?! I don't know if the wording is legalease enough to be enforced, but of course a license like this is legal. Just because you can see the source code doesn't automatically grant you any privileges with it. He is saying he is only allowing unmodified redistribution. With an exception that you are allowed to distribute a modified version of the source code for the sole purpose of submitting a pull request. One problem he might get into is if accepts non-trivial pull requests, then the contributors copyright would come into play, and things could get hairy.

jcranmer 5y ago
The first two clauses of the license are the BSD-2-Clause license, nothing weird or unusual there. The third clause is... interesting. I suspect it's probably legal, but it may well have unintended consequences because it appears to be requiring you to use a trademark. The fourth clause may fall afoul of First Sale Doctrine. It's something that I wouldn't trust without talking to an IP lawyer to work out what it actually means and how much is actually viable to be done in an open source license. The fifth clause is nullified by the terms of GitHub, I think, as GitHub's ToS seems to require you to allow anyone to fork your repository without encumbrance, which the fifth clause tries to narrow.
- dec0dedab0de 5y ago
  The fourth clause may fall afoul of First Sale Doctrine. It's something that I wouldn't trust without talking to an IP lawyer to work out what it actually means and how much is actually viable to be done in an open source license. I don't think the first sale doctrine comes in to play here at all. If we make it physical media for arguments sake. First sale doctrine would say that if a user bought a cartridge of the game they could resell that cartridge. That is not the same thing as redistribution which would be the equivalent of copying the game to new cartridges and selling those. Also, this is definitely not an Open Source license. However, it is similar to the Creative Commons Attribution-NonCommercial license. The fifth clause is nullified by the terms of GitHub, I think, as GitHub's ToS seems to require you to allow anyone to fork your repository without encumbrance, which the fifth clause tries to narrow. I'm pretty sure the terms of a website can't overrule the license of the software. I think at best it could get the project kicked off of github, and make it hard to prosecute someone who didn't realize. His biggest problem is use of the word fork when he really meant derivative work. Which comes down to my point that the goal of the license is legal, but maybe not the wording.

jart 5y ago

> #bob's game is: ##THE GREATEST PUZZLE GAME EVER MADE [...] bob's game is "source available" [...] but not "Open Source" That means no forks except to create pull requests! Would you consider deleting your fork? It goes against the author's wishes and I don't feel comfortable gawking at someone who might be experiencing health issues. He's clearly trying to distance himself from the attention it's received.

ddtaylor 5y ago
I don't have any forks of his code, it's the first result for searching for the repo on GitHub. In either case, I do believe once the source code to something has been released it's fair to continue to archive it.
- jart 5y ago
  Did you bring the security vulnerabilities you discovered to his attention before disclosing them on hacker news? Regardless of what you think is fair it's pretty clear you aren't acting with his best interests in mind.
  - duxup 5y ago
    Telling users here (some I'm sure will / would download the code) seems entirely acting with the user's best interests in mind.
  - ddtaylor 5y ago
    Full disclosure is the most responsible disclosure.

rozab 5y ago

GitHub ToS requires you to allow others to fork your code on GH. This policy leads to a lot of bizarre licensing decisions on the site. https://docs.github.com/en/github/site-policy/github-terms-of-service#5-license-grant-to-other-users https://docs.github.com/en/github/site-policy/github-terms-o...

meibo 5y ago

HTTP/unsigned patches are frighteningly common in the video game world. One of the major MMOs doesn't do either and has some other nasty stuff like easily stealable login tokens over the network.

BugsJustFindMe 5y ago

It's currently still archived by Software Heritage https://archive.softwareheritage.org/browse/search/?q=https%3A%2F%2Fgithub.com%2Fbobsgame%2F&with_visit=true&with_content=true https://archive.softwareheritage.org/browse/search/?q=https%...