Quality control on /idgames/

wesleyjohnson said:

This repeating most of the subject of Malware and virus problems.

It is done for the same reasons as any malware and virus, to see how far they can extend their influence, and eventually for some financial gain.

I don't think there are any such WADs in existence yet, and I doubt there will be any made. It's a lot of effort for a user base that's pretty obscure.

DEH is a security hole. Every port should have some protections against abuse. No DEH text string should ever be used as a format, only as a string to a "%s". The original code did not do this safely and it needs to be fixed where ever that code was copied. Every port should fix this.
DoomLegacy has some more checks to close the security holes.

Indeed, I added some security functions to try to protect against this.

But the Doom codebase in general is a security nightmare. Unchecked array boundaries, etc. Dehacked is only one small thing.

Yea Josh I know who you're speaking of, he pokes his head on the forums periodically.

My goodness this is like, becoming a war. I doubt Terry/troll WADs will ever be nonexistent on the archives. Honestly I think people should just be free to upload whatever they want to upload. Like Zed said, some people enjoy these WADs and I think deleting them would be unfair to the people who want to play them. I wouldn't mind having a new category for Terry/troll WADs though. I think Ty once said he scans each WAD that is uploaded for viruses so that takes care of that. However, in the case that someone does get a computer destroying WAD onto the archives, then I think that should defiantly be removed.

Unless potentially exploitative or malicious code in the WAD, then there is cause for concern.

wesleyjohnson said:

DEH is a security hole. Every port should have some protections against abuse. No DEH text string should ever be used as a format, only as a string to a "%s". The original code did not do this safely and it needs to be fixed where ever that code was copied. Every port should fix this.
DoomLegacy has some more checks to close the security holes.

EE hasn't had any user-supplied format strings for years, excepting one which is sanity-checked thoroughly.

The various buffer overflows in the Boom DEH/BEX parser on the other hand need to be fixed pronto.

Switcheroom was just rejected from the archives entirely for using modified IWAD levels. Except that was more or less the reasoning behind the project's inception, and actually C&P'ing map layouts was not what every submission did - see traversd's maps.

Why are earnest community projects getting rejected while wads that actually are malicious (like the aforementioned zip bombs) allowed to stay? Is the issue more that the terms of submission should be altered?

Since it's now on-topic and more likely that Ty or another someone in-the-know will read this thread, I'll cross-post my question from the other thread:

Xaser said:

I could've sworn there was an old clause applied to the archives that basically said "modified IWAD stuff is okay so long as it requires said IWAD in order to run." Is that not the case here, or is said clause apocryphal?

[EDIT] Crossposting was a bit silly in retrospect, as it fragments the discussion, so I'll just link the "response" rather than try and copy it over here again. Carry on, folks. ;)

I could be wrong here but I *think* that was the line that id took when asked about clarification of their position for KDiZD. I'm not sure that the same rule was ever applied to the idgames archive.

Oh cmon. With "quality control" in place we'd never have such gems as WOW.WAD or Terry WADs upon which to project all of our insecurities and frustrations, amirite? Admit it, you NEED your fair share of shitwads to lash out and give your life a meaning.

Let alone that we'd risk becoming a bunch of Brandon D. Lades ;-)

Maes speaks the truth.

I think it's called Stockholm syndrome. :)

Maes said:

Admit it, you NEED your fair share of shitwads to lash out and give your life a meaning.

All the same I'd prefer ones that aren't deliberately crap or abusive. If I want high quality crap, I'll look for Ruba.

fraggle said:

But the Doom codebase in general is a security nightmare. Unchecked array boundaries, etc. Dehacked is only one small thing.

Video games running on a single user, single tasking OS usually didn't have to worry sbout security considerations (stability is another story, though). The worst that could happen was locking the machine up or crashing to DOS. It's not like a DEH exploit back in 1994 would cause a zillion smileys and malware and trojans to be installed on your machine...and in fact I think that the Sky May Be had some tricks that caused a crash to DOS, but with a custom message (that button that tells you NOT to push it ;-)

I'm just gonna repeat a common opinion here: Why would we need a dedicated system to identify terrywads when we've got Bloodshedder repeating the word "terrywad" enough times across the archives to fool someone into thinking he was a pokemon called Terrywad?

Linkrulezall said:

I'm just gonna repeat a common opinion here: Why would we need a dedicated system to identify terrywads when we've got Bloodshedder repeating the word "terrywad" enough times across the archives to fool someone into thinking he was a pokemon called Terrywad?

I thought people were wanting Terry WADs off the archives completely.

Some of us do, the whole "Terrywad" joke has well worn out its welcome.

Mr. Chris said:

Some of us do, the whole "Terrywad" joke has well worn out its welcome.

If you don't like them, why don't you just not download them?

Are you seriously going to pull that fallacy of "Don't like it, don't download it" on me? I don't go out of my way to download garbage like that, maybe you do but I don't and many others. We're just sick of it.

Canofbacon said:

If you don't like them, why don't you just not download them?

Then we'll have nothing to whinge about!

Mr. Chris said:

Are you seriously going to pull that fallacy of "Don't like it, don't download it" on me? I don't go out of my way to download garbage like that, maybe you do but I don't and many others. We're just sick of it.

Fallacy? Actually, it really is that simple. Say you're walking down a convenience store aisle and you come across a 2-liter bottle of some soda you don't like. Are you gonna keep walking down the aisle and buy something else or are you gonna go to the manager and complain that they stock this certain brand of soda and demand that they remove all bottles of it from the stock and never purchase more?

You see, the current situation looks a bit like a riot in a mental hospital. If I was asked by a friend to recommend a good place to find some Doom mods, it would be a little embarassing to recommend idgames.

But aside from the fact that not everyone likes to live in a dumpster, everything is perfect.

Mr. Chris said:

Are you seriously going to pull that fallacy of "Don't like it, don't download it" on me? I don't go out of my way to download garbage like that, maybe you do but I don't and many others. We're just sick of it.

If you don't download them then I really don't understand why you care so much about them.

Mr. Chris said:

showing up in latest files section nearly every time in place of legit maps

You could always click the (more) button.

Linkrulezall said:

Say you're walking down a convenience store aisle and you come across a 2-liter bottle of some soda you don't like.

Hopefully, Bloodshedder will continue to label the "bottles" for all eternity, otherwise this argument isn't worth much.

You're neglecting to mention that the soda in question is literally shit flavored and the only people who want it are people who enjoy drinking shit. Just thought I'd mention.

Marcaek said:

You're neglecting to mention that the soda in question is literally shit flavored and the only people who want it are people who enjoy drinking shit. Just thought I'd mention.

You're missing the point. Flavor is entirely subjective. Hell, one could say that anything from Dr. Pepper to Mountain Dew was "literally shit flavored".

Da Werecat said:

Hopefully, Bloodshedder will continue to label the "bottles" for all eternity, otherwise this argument isn't worth much.

The day Bloodshedder stops labeling all the "bottles" is the day the moon falls out of the sky and Mordeth II is released. And he doesn't just label each and every bottle, he actively drinks each bottle of soda in the store to determine whether or not it's a terrywad. In that sense, you could say Bloodshedder is the real Sodaholic.

...Oh dear, I've confused myself

Not to mention the overzealous salespeople who keep trying to shove it in your face for their own profit.

Obsidian said:

Not to mention the overzealous salespeople who keep trying to shove it in your face for their own profit.

A minor annoyance. What good is it to make soda if you can't sell it? Would you like it if you spent a whole 5 minutes concocting a new bottle of soda only for it to go completely ignored? Sure, being an overzealous salesperson might get you punched in the face, but it's worth it in the grand scheme to get more people to try your soda.

...And then spit it out. Oh well, at least you got them to try it.

All the same I think the world could benefit from having less overzealous salespeople, don't you?

But we're getting off track. Like it or not, the cutoff point for these wads will have to come soon. Remember Omegalore getting hacked a few weeks ago? Plus I swear their little website has viruses lurking on it.

Obsidian said:

All the same I think the world could benefit from having less overzealous salespeople, don't you?

Yes, although that's not how /idgames works. Every wad is displayed equally, none of them are highlighted or make popups telling you to download them or anything of the sort.

Obsidian said:

But we're getting off track. Like it or not, the cutoff point for these wads will have to come soon. Remember Omegalore getting hacked a few weeks ago? Plus I swear their little website has viruses lurking on it.

Getting off track? I thought we were finally reaching some form of understanding. Yes, I remember the hacking of Omegalore. Now what does this have to do with terrywads? I went to the website to verify whether or not it contains virii, and it came up clean. Don't click on the graham cracker box.

Weird, I found a little icon that would take you to an attack page if you clicked on it. Also, why exactly are you defending these mongs Link? These wads are CONFIRMED to be malicious in some cases and they are made solely to irritate and annoy other people: I made an analogy likening this situation to someone who keep nailing up pictures of Goatse in an art gallery, and I think it still fits for the most part.

And yeah, Ogre admitted that he hacked Omegalore. As well as quite a few bullying attempts over various websites. These are the type of people you're defending.

Obsidian said:

Weird, I found a little icon that would take you to an attack page if you clicked on it.

Ah, I didn't know that thing was clickable. My mistake. I've edited the original post to resolve this problem.

Obsidian said:

Also, why exactly are you defending these mongs Link? These wads are CONFIRMED to be malicious in some cases and they are made solely to irritate and annoy other people: I made an analogy likening this situation to someone who keep nailing up pictures of Goatse in an art gallery, and I think it still fits for the most part.

Did I ever say I was defending the actions of the people behind the wads? No. Likewise, Sergeant Mark IV is an asshole but that doesn't affect the quality (or lack thereof, in the case of terrywadders) of the wads he produces. Anyways, the point is that yes, terrywads are crap. But they're crap that some people enjoy for some reason. This discussion is about the wads themselves and whether or not they have a place on the archives, stop trying to shift it to the people behind the wads. Likewise, I assume that some people get off to Goatse in their spare time.
As for the wads being malicious, I have yet to come across a single terrywad with a virus enclosed.