Is L2J's gameserver security indefinitelly compromised ?

There is something fundamentally contradictory about your entire argument.

You claim that AI has become so powerful that it can uncover vulnerabilities experienced developers have overlooked for years. At the same time, you argue that these same AI tools are going to destroy software security because developers are incapable of using them properly.

You seem to have missed the most important part: AI does not exclusively benefit people looking for vulnerabilities. It also benefits the people identifying, understanding, preventing, and fixing them.

Modern AI systems can analyze large codebases, trace execution paths across multiple classes, identify missing validation, examine trust boundaries, suggest architectural improvements, generate regression tests, and assist with reviewing complex changes. These capabilities are available to defenders just as they are to attackers.

And unlike the picture you are trying to paint, experienced developers do not suddenly become irrelevant because someone with an AI subscription can ask questions about source code. Quite the opposite. Developers who understand their systems can use these tools with significantly more context, evaluate their conclusions, recognize false positives, and implement changes without introducing regressions elsewhere.

AI is a force multiplier, not a replacement for engineering judgment.

You also appear to misunderstand what constitutes a verified security vulnerability.

An AI identifying a suspicious method is not proof of an exploit. A plausible attack scenario is not proof that the attack succeeds. Even a proposed patch is not necessarily proof that the original code was vulnerable.

A proper security finding requires an identifiable failure, a reproducible scenario, an understanding of its actual impact, and verification that the proposed correction addresses the underlying problem.

None of that becomes optional simply because an AI generated the analysis.

You have repeatedly claimed to have discovered an extraordinary number of vulnerabilities affecting virtually every available project. You have also accused developers of incompetence, questioned their priorities, and suggested that they charge people for security improvements that supposedly do not exist.

These are substantial accusations, yet you expect them to be accepted without independently verifiable evidence.

You are free to withhold exploit details. Nobody is asking you to publish instructions that could harm running servers. But withholding evidence also means accepting that others cannot independently validate your conclusions.

What is particularly interesting is your assumption that developers working on gameplay accuracy must therefore be neglecting security.

Software development does not operate according to that false choice. Gameplay correctness, protocol validation, stability, performance, architecture, and security can all be addressed as part of ongoing maintenance. A commit correcting a skill formula tells you absolutely nothing, by itself, about the security knowledge or priorities of its author.

There is another point worth considering.

If AI has enabled you to discover problems that you could not previously identify, that demonstrates the potential of AI-assisted development. It does not establish that the developers maintaining these projects lack competence.

In fact, your own experience supports the opposite conclusion from the one you are promoting: AI is making sophisticated code analysis more accessible. The same technology can help developers discover weaknesses earlier, investigate them faster, and systematically improve code quality.

Naturally, AI-generated code requires review and testing. So does human-written code. Neither has a monopoly on mistakes, and neither deserves blind trust.

The meaningful distinction is between disciplined engineering and careless engineering, not between human development and AI-assisted development.

Finally, repeatedly announcing that the entire community is heading toward catastrophe contributes nothing measurable to its security.

If you possess verified findings, those findings have technical value. If you choose not to disclose them, that is your decision. But the absence of disclosed evidence cannot be turned into evidence that everyone else is incompetent.

AI has changed what individuals can accomplish in software engineering. It has not changed the burden of proof.

And perhaps the greatest irony here is that the technology you credit with making you capable of discovering vulnerabilities is the very same technology you underestimate when it is placed in the hands of developers who understand the systems they maintain.

The future of software security will not be determined by who can generate the most alarming forum post.

It will be determined by who can turn increasingly powerful tools into verified, reliable, and maintainable software improvements.

By Atumenos · 8 minutes ago8 min
Is L2J's gameserver security indefinitelly compromised ?

The issue is more complex than you make it appear.

If me, a bus driver turned AI coder, can identify various exploits using AI for six months now (it started in April for me), it's only logical to assume that seasoned senior engineers can do much better. The problem is I don't see the fixes. I have access to the three flagship open source packs (L2JServer, L2JMobius, aCis) that have recently released newer versions. None of them have any of the fixes, but has tons of unecessary tweaks on skill formulas, geodata and such. This looks like the developer teams don't know what priorities are or that they have no sense on the reality of the emulation / server world. They treat the projects as toys.

And that would be fine, except they are charging people money for private versions supposedly having earlier fixes, which they don't have !. Which is why, answering to the 2nd quesiton, I am not sharing a list of exploits, nor am I contributing any fixes. I have no obligation to the developers of these semi-public packs. And besides, this forum here is called maxcheaters, not maxcoders, not maxcvedatabase. There's a section about sharing exploits, we are the bad guys here.

Also do not assume that I have not approached people discretelly in the past to explain to them where their packs need attention. In the best cases, they didn't even understand why their packs are vulnerable, and dismissed fixes they later applied silently. At worst cases they became very rude about it confusing a discrete privatelly disclosed issue to them personally, is an attempt to insult them.

Also I'm not irresponsiblity spreading exploits. I've only posted one adena dupe and gave an explanation to a leaked one that the project owner didn't patch for long and people found out. That doesn't mean I have any responsiblity to explain to everyone how to use every exploit. If you look carefully at conversations, you will notice that certain high profile open source developers, have difficulty grasping how an exploit works when you give them the fix / patch. That show's that they are probably not good enough, or experienced enough in that matter.

Do you wanna tell us what pack you are using / developing so as we can check how valid my claims are ? Maybe I'm wrong and your specific pack which I don't know, is not vulnerable. That would be good to know there's at least a pack that's secure enough for us to use. I'd be glad to spend some tokens on it to do an audit.

By aguy · 20 minutes ago20 min
Is L2J's gameserver security indefinitelly compromised ?

You repeatedly warn everyone about the dangers of inexperienced developers relying on AI-generated code, while openly describing yourself as a vibe coder who relies on those same tools.

You accuse established developers of not understanding security, yet apparently trust AI to identify vulnerabilities and validate the fixes for you.

There's nothing wrong with using AI or reporting genuine exploits. The problem is presenting AI-generated findings as unquestionable proof of widespread insecurity while dismissing the people who actually maintain and understand these codebases.

Security requires evidence, reproducible findings, proper validation and responsible disclosure. Not dramatic predictions about the end of an entire development community.

By Atumenos · 2 hours ago2 hr
Is L2J's gameserver security indefinitelly compromised ?

And for these who can't write the exploit themselves when Claude Code denies to write it, they can switch to OpenCode and GLM 5.3 and it will do the dirty job without any objection.

These AI tools will be the DDay for our sector the following months I tell you. The newer models are finding way more vulnerabilities the old ones couldn't and some of the ways they exploit the code is very creative.

I can't believe that prominent developers of open source projects are "patching skill xml values to match retail formulas" while instead they should be focusing 100% on the shitstorm that is about to hit.

It seems to me that the people who are curerently running the open source sector of L2J (aCis, L2JMobius and the smaller packs), have no clue of what running a real server means. Cause if they had any freaking idea, they would be working on security first.

And there's a second i ssue too. Vibe coding with AI introduces the same amount of exploitable code as developers themselves did in the past. You have to guide the AI properly or make it pass your code with different context focus 2-3 times after you develop your feature in order for it to find the vulnerabilities it just created.

And what makes it worse is that this accumulates if AI is not given good instructions on how to properly layer the code. After a couple of new files the code gets so spaghetti if not intentionally architectured, that a single line here, introduces 5 exploits in another place of the code.

All in all:

AI's are able to find exploits (and patch them) at a very rapid rate, but the way they are used, introduce many new ones at an even faster by inexperienced users. And since most people focus on "building things" than "fixing things", the code quality (and security) is expected to go DOWNWARDS the next months / years.

By aguy · 3 hours ago3 hr
Driver Service for all servers (Reborn,Dion,Club and More)

UPDATE INFO FOR 2026-2027

🔸DRIVER SERVICE AVAILABLE FOR L2 AND WOW FOREVER🔸
How does it work ?
📍Basically I play your character for you doing the activities you need in the game (buff, spoil, exping, farming... etc).
Notes:
📌The progress of in-game activity hours will depend on your own equipment, character level and class.
📌The service is charged by the hour.
📌The time starts from when the character is online.
📌The service is for all Lineage 2 servers and WoW Forever.
📌The price of the service is $5,50 per hour with a maximum of 2 online accounts(L2), each additional account has a cost of $0.55 (L2)
NOTA: For purchases exceeding 50 hours, you will receive a 12% discount.

🔹Discord: thebeaver88#0185
https://discord.com/users/630654907527069698

By The Beaver 88 · 4 hours ago4 hr

[HELP]

Featured Replies

Create an account or sign in to comment

Posts

Is L2J's gameserver security indefinitelly compromised ?

Is L2J's gameserver security indefinitelly compromised ?

Is L2J's gameserver security indefinitelly compromised ?

Is L2J's gameserver security indefinitelly compromised ?

Driver Service for all servers (Reborn,Dion,Club and More)

Topics

[L2OFF] CLExt Gracia Final P110 — Alpha/Beta

L2 TORCH X15 H5 SUB ACU BASE +3

Is L2J's gameserver security indefinitelly compromised ?

[Share]korean protocol 606 new lobby collection

Looking for a Serious Lineage II Project Partner / Co-Owner

Group Legend

Who Was Online

Important Information

Account

Navigation

Search

Configure browser push notifications

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)