12 ms·

The mentioned security requirements likely have to do with certification requirements for games released for the Xbox. You couldn't just make network connection

The mentioned security requirements likely have to do with certification requirements for games released for the Xbox. You couldn't just make network connections willy-nilly, there was some amount of having to declare ahead of time what ports you would be using and for what. The normal socket API is also severely limited, and largely cannot even be used without obtaining a special exception from Microsoft for your games. I was actually at one point (years ago) tasked with determining if we could use curl in a project I was working on. There was indeed much surgery needed to ensure that the code even compiled, much less worked correctly. We ended up just using WinHTTP directly instead. As for getting access to the source code for xCurl, that will likely not be possible without actually signing up as a dev with Microsoft and going through the whole process. And even then, you'd be under a NDA. (My information is several years old though, so it might be somewhat outdated)

pavlov 3y ago
It sounds like xCurl is more like a libcurl-compatible wrapper API on top of WinHTTP rather than an actual fork of curl.
- genocidicbunny 3y ago
  That is highly likely to be the case. I no longer have access to take a look, but from my experience, it would be silly to do otherwise. There were a handful of other xSomething libraries that they had that were effectively wrappers or simplified versions of libSomething.
- SiempreViernes 3y ago
  Quoted in the article: > xCurl differs from libCurl in that xCurl is implemented on top of WinHttp and automatically follows all the extra Microsoft Game Development Kit (GDK) requirements and best practices. While libCurl itself doesn’t meet the security requirements for the Microsoft Game Development Kit (GDK) console platform, use xCurl to maintain your same libCurl HTTP implementation across all platforms while changing only one header include and library linkage.
  - pavlov 3y ago
    Yet the author of the article (and curl itself) seems to think it's a fork: "With large invasive changes of this kind we can certainly hope that the team making it has invested time and spent serious effort on additional testing, both before release and ongoing." "...since I can’t find the source code I cannot really get a grip of exactly how much and how invasive Microsoft has patched this." It's not a patch of libcurl if they just implement a mostly compatible API from scratch.
    - hobofan 3y ago
      The presence of the license strongly suggests that it's a fork. "Fork" and "API compatible wrapper" are also not two mutually exclusive things. Often, one of the easiest ways to build an API compatible wrapper is to start by forking the original project, scoop out the internals and replace them with what you are trying to wrap, and then discard all the dangling code (e.g. features that you couldn't wire up because your custom internals don't support it).
      - pavlov 3y ago
        > ”The presence of the license strongly suggests that it's a fork.” It could just mean that Microsoft copied over the header file from libcurl without using any of the implementation.
        jeremyjh 3y ago
        This was my assumption reading it; it very nearly has to be exactly that to work as described by Microsoft. Which IMO makes all this a complete nothing burger.
dontlaugh 3y ago
This sort of reason is also why gRPC isn’t usable in games that also release on consoles. It comes with its own HTTP implementation which you can’t use and even if you wanted to reimplement it, it requires HTTP/2 which isn’t supported by the “blessed” console libraries.
imglorp 3y ago
> certification requirements for games released for the Xbox Could it be simply that WinHTTP collects usage telemetry and MS wants to ensure their valuable feed by forcing all traffic through their library?
- meibo 3y ago
  I doubt it. If you've ever worked on a console game, you'll know that these requirements are no joke - they're pretty hard to consistently comply with, and using APIs from the manufacturer is often much much easier than to do your own thing. It will also be much cheaper, because failing certification is unimaginably expensive - in the worst case, it can even lead to cancellation. A lot of studios that ship on multiple platforms have abstraction layers that can internally be switched out to every platform specific API.
  - genocidicbunny 3y ago
    > A lot of studios that ship on multiple platforms have abstraction layers that can internally be switched out to every platform specific API. Exactly this. At one point, I was the man responsible for that abstraction layer. Even most of our engine devs never even saw those low layers of the console APIs -- the single exception being the graphics peeps who by necessity had to work at the same layer I was. I basically wrote a Xbox/Playstation/Nintendo/PC libc/runtime that the rest of our engine was based on. I Imagine a lot of other studios that shipped cross-platform had some level of this as well.

pavlov 3y ago

It sounds like xCurl is more like a libcurl-compatible wrapper API on top of WinHTTP rather than an actual fork of curl.

genocidicbunny 3y ago
That is highly likely to be the case. I no longer have access to take a look, but from my experience, it would be silly to do otherwise. There were a handful of other xSomething libraries that they had that were effectively wrappers or simplified versions of libSomething.
SiempreViernes 3y ago
Quoted in the article: > xCurl differs from libCurl in that xCurl is implemented on top of WinHttp and automatically follows all the extra Microsoft Game Development Kit (GDK) requirements and best practices. While libCurl itself doesn’t meet the security requirements for the Microsoft Game Development Kit (GDK) console platform, use xCurl to maintain your same libCurl HTTP implementation across all platforms while changing only one header include and library linkage.
- pavlov 3y ago
  Yet the author of the article (and curl itself) seems to think it's a fork: "With large invasive changes of this kind we can certainly hope that the team making it has invested time and spent serious effort on additional testing, both before release and ongoing." "...since I can’t find the source code I cannot really get a grip of exactly how much and how invasive Microsoft has patched this." It's not a patch of libcurl if they just implement a mostly compatible API from scratch.
  - hobofan 3y ago
    The presence of the license strongly suggests that it's a fork. "Fork" and "API compatible wrapper" are also not two mutually exclusive things. Often, one of the easiest ways to build an API compatible wrapper is to start by forking the original project, scoop out the internals and replace them with what you are trying to wrap, and then discard all the dangling code (e.g. features that you couldn't wire up because your custom internals don't support it).
    - pavlov 3y ago
      > ”The presence of the license strongly suggests that it's a fork.” It could just mean that Microsoft copied over the header file from libcurl without using any of the implementation.
      - jeremyjh 3y ago
        This was my assumption reading it; it very nearly has to be exactly that to work as described by Microsoft. Which IMO makes all this a complete nothing burger.

dontlaugh 3y ago

This sort of reason is also why gRPC isn’t usable in games that also release on consoles. It comes with its own HTTP implementation which you can’t use and even if you wanted to reimplement it, it requires HTTP/2 which isn’t supported by the “blessed” console libraries.

imglorp 3y ago

> certification requirements for games released for the Xbox Could it be simply that WinHTTP collects usage telemetry and MS wants to ensure their valuable feed by forcing all traffic through their library?

meibo 3y ago
I doubt it. If you've ever worked on a console game, you'll know that these requirements are no joke - they're pretty hard to consistently comply with, and using APIs from the manufacturer is often much much easier than to do your own thing. It will also be much cheaper, because failing certification is unimaginably expensive - in the worst case, it can even lead to cancellation. A lot of studios that ship on multiple platforms have abstraction layers that can internally be switched out to every platform specific API.
- genocidicbunny 3y ago
  > A lot of studios that ship on multiple platforms have abstraction layers that can internally be switched out to every platform specific API. Exactly this. At one point, I was the man responsible for that abstraction layer. Even most of our engine devs never even saw those low layers of the console APIs -- the single exception being the graphics peeps who by necessity had to work at the same layer I was. I basically wrote a Xbox/Playstation/Nintendo/PC libc/runtime that the rest of our engine was based on. I Imagine a lot of other studios that shipped cross-platform had some level of this as well.