Is L2J's gameserver security indefinitelly compromised ?

Again: Tell me the name of your pack and let's see how secure it is. It's unfair that public packs get all the blame since they are in the forefront of exposure. Name of the pack, source or jar location and I'm happy to waste my tokens on yours to help the community with fixes. After all I dont need them anywhere else, I'm a bus driver.

If your pack is SO secure, you have nothing to afraid from a bus driver with a Claude Max subscription. Name the pack, I'm waiting.

By aguy · 8 minutes ago8 min
Is L2J's gameserver security indefinitelly compromised ?

Six months of asking Claude questions doesn't make you a security expert. You're confusing AI-generated findings with actual engineering knowledge.

Experienced developers build, maintain, and fix entire projects. You make accusations without providing verifiable evidence.

Enough attention-seeking. Go back to driving and leave software development to people who actually understand it.

By Atumenos · 10 minutes ago10 min
Is L2J's gameserver security indefinitelly compromised ?

It's correct that at the right hands these tools can augment visibility and tracing of issues. But only if your priority is to look for these issues. The problem is that nobody seems to be looking. AI won't magically tell you once you open a random context, hey you have race condition there, an invalid state there, a threadlock there. It needs investigation.

So far the evidence we have from the open source packs is that their developers are not activelly looking. Check my other thread about how to dupe adena in L2JMobius. Confirmed exploit ingame, 2 lines patch, he didn't even bother to fix it. Previous exploit about adena dupe in his pack, same thing, reported exploit, reproduced, patch shared, only applied it after enough pressure and countless of arguments with his team so as they finally get to understand how it works.

Now regarding patching and contributing. The nature of patching and contributing has changed. It's more valuable to investigate, prompt the right questions and instructions, find and validate an issue, than sharing the patch. The patch is easy to generate once the exploit is shared. Some people operate under the assumption that we will hand-feed them PR requests for issues they have caused themselves.

You are wrong to believe that AI tools will make the code more secure. Here's where we disagree. The tools are only good for what you use them for. Most people use them to prototype things, get them to "just work". There's tons of new code created this way every day, that simply there's not enough manpower to use the AI tools to do security analysis.

To put it simpler:

If 10 people use AI to make features and only 2 look for security in them, the 2 will get simply overwhelmed. It's only nature. Thats the reason we are entering a bad phase for security, it's not the quality of the AI tools, but hte priorities people seem to have with them.

AGAIN: if you are so sure that your pack is secure, tell us its name so as we can audit it. Hiding behind anonymity so as only the open source projects take the bullet is not a proof of security.

By aguy · 13 minutes ago13 min
Is L2J's gameserver security indefinitelly compromised ?

There is something fundamentally contradictory about your entire argument.

You claim that AI has become so powerful that it can uncover vulnerabilities experienced developers have overlooked for years. At the same time, you argue that these same AI tools are going to destroy software security because developers are incapable of using them properly.

You seem to have missed the most important part: AI does not exclusively benefit people looking for vulnerabilities. It also benefits the people identifying, understanding, preventing, and fixing them.

Modern AI systems can analyze large codebases, trace execution paths across multiple classes, identify missing validation, examine trust boundaries, suggest architectural improvements, generate regression tests, and assist with reviewing complex changes. These capabilities are available to defenders just as they are to attackers.

And unlike the picture you are trying to paint, experienced developers do not suddenly become irrelevant because someone with an AI subscription can ask questions about source code. Quite the opposite. Developers who understand their systems can use these tools with significantly more context, evaluate their conclusions, recognize false positives, and implement changes without introducing regressions elsewhere.

AI is a force multiplier, not a replacement for engineering judgment.

You also appear to misunderstand what constitutes a verified security vulnerability.

An AI identifying a suspicious method is not proof of an exploit. A plausible attack scenario is not proof that the attack succeeds. Even a proposed patch is not necessarily proof that the original code was vulnerable.

A proper security finding requires an identifiable failure, a reproducible scenario, an understanding of its actual impact, and verification that the proposed correction addresses the underlying problem.

None of that becomes optional simply because an AI generated the analysis.

You have repeatedly claimed to have discovered an extraordinary number of vulnerabilities affecting virtually every available project. You have also accused developers of incompetence, questioned their priorities, and suggested that they charge people for security improvements that supposedly do not exist.

These are substantial accusations, yet you expect them to be accepted without independently verifiable evidence.

You are free to withhold exploit details. Nobody is asking you to publish instructions that could harm running servers. But withholding evidence also means accepting that others cannot independently validate your conclusions.

What is particularly interesting is your assumption that developers working on gameplay accuracy must therefore be neglecting security.

Software development does not operate according to that false choice. Gameplay correctness, protocol validation, stability, performance, architecture, and security can all be addressed as part of ongoing maintenance. A commit correcting a skill formula tells you absolutely nothing, by itself, about the security knowledge or priorities of its author.

There is another point worth considering.

If AI has enabled you to discover problems that you could not previously identify, that demonstrates the potential of AI-assisted development. It does not establish that the developers maintaining these projects lack competence.

In fact, your own experience supports the opposite conclusion from the one you are promoting: AI is making sophisticated code analysis more accessible. The same technology can help developers discover weaknesses earlier, investigate them faster, and systematically improve code quality.

Naturally, AI-generated code requires review and testing. So does human-written code. Neither has a monopoly on mistakes, and neither deserves blind trust.

The meaningful distinction is between disciplined engineering and careless engineering, not between human development and AI-assisted development.

Finally, repeatedly announcing that the entire community is heading toward catastrophe contributes nothing measurable to its security.

If you possess verified findings, those findings have technical value. If you choose not to disclose them, that is your decision. But the absence of disclosed evidence cannot be turned into evidence that everyone else is incompetent.

AI has changed what individuals can accomplish in software engineering. It has not changed the burden of proof.

And perhaps the greatest irony here is that the technology you credit with making you capable of discovering vulnerabilities is the very same technology you underestimate when it is placed in the hands of developers who understand the systems they maintain.

The future of software security will not be determined by who can generate the most alarming forum post.

It will be determined by who can turn increasingly powerful tools into verified, reliable, and maintainable software improvements.

By Atumenos · 28 minutes ago28 min
Is L2J's gameserver security indefinitelly compromised ?

The issue is more complex than you make it appear.

If me, a bus driver turned AI coder, can identify various exploits using AI for six months now (it started in April for me), it's only logical to assume that seasoned senior engineers can do much better. The problem is I don't see the fixes. I have access to the three flagship open source packs (L2JServer, L2JMobius, aCis) that have recently released newer versions. None of them have any of the fixes, but has tons of unecessary tweaks on skill formulas, geodata and such. This looks like the developer teams don't know what priorities are or that they have no sense on the reality of the emulation / server world. They treat the projects as toys.

And that would be fine, except they are charging people money for private versions supposedly having earlier fixes, which they don't have !. Which is why, answering to the 2nd quesiton, I am not sharing a list of exploits, nor am I contributing any fixes. I have no obligation to the developers of these semi-public packs. And besides, this forum here is called maxcheaters, not maxcoders, not maxcvedatabase. There's a section about sharing exploits, we are the bad guys here.

Also do not assume that I have not approached people discretelly in the past to explain to them where their packs need attention. In the best cases, they didn't even understand why their packs are vulnerable, and dismissed fixes they later applied silently. At worst cases they became very rude about it confusing a discrete privatelly disclosed issue to them personally, is an attempt to insult them.

Also I'm not irresponsiblity spreading exploits. I've only posted one adena dupe and gave an explanation to a leaked one that the project owner didn't patch for long and people found out. That doesn't mean I have any responsiblity to explain to everyone how to use every exploit. If you look carefully at conversations, you will notice that certain high profile open source developers, have difficulty grasping how an exploit works when you give them the fix / patch. That show's that they are probably not good enough, or experienced enough in that matter.

Do you wanna tell us what pack you are using / developing so as we can check how valid my claims are ? Maybe I'm wrong and your specific pack which I don't know, is not vulnerable. That would be good to know there's at least a pack that's secure enough for us to use. I'd be glad to spend some tokens on it to do an audit.

By aguy · 40 minutes ago40 min

Hi!

Featured Replies

Create an account or sign in to comment

Posts

Is L2J's gameserver security indefinitelly compromised ?

Is L2J's gameserver security indefinitelly compromised ?

Is L2J's gameserver security indefinitelly compromised ?

Is L2J's gameserver security indefinitelly compromised ?

Is L2J's gameserver security indefinitelly compromised ?

Topics

[L2OFF] CLExt Gracia Final P110 — Alpha/Beta

L2 TORCH X15 H5 SUB ACU BASE +3

Is L2J's gameserver security indefinitelly compromised ?

[Share]korean protocol 606 new lobby collection

Looking for a Serious Lineage II Project Partner / Co-Owner

Group Legend

Who Was Online

Important Information

Account

Navigation

Search

Configure browser push notifications

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)