The issue is more complex than you make it appear. If me, a bus driver turned AI coder, can identify various exploits using AI for six months now (it started in April for me), it's only logical to assume that seasoned senior engineers can do much better. The problem is I don't see the fixes. I have access to the three flagship open source packs (L2JServer, L2JMobius, aCis) that have recently released newer versions. None of them have any of the fixes, but has tons of unecessary tweaks on skill formulas, geodata and such. This looks like the developer teams don't know what priorities are or that they have no sense on the reality of the emulation / server world. They treat the projects as toys. And that would be fine, except they are charging people money for private versions supposedly having earlier fixes, which they don't have !. Which is why, answering to the 2nd quesiton, I am not sharing a list of exploits, nor am I contributing any fixes. I have no obligation to the developers of these semi-public packs. And besides, this forum here is called maxcheaters, not maxcoders, not maxcvedatabase. There's a section about sharing exploits, we are the bad guys here. Also do not assume that I have not approached people discretelly in the past to explain to them where their packs need attention. In the best cases, they didn't even understand why their packs are vulnerable, and dismissed fixes they later applied silently. At worst cases they became very rude about it confusing a discrete privatelly disclosed issue to them personally, is an attempt to insult them. Also I'm not irresponsiblity spreading exploits. I've only posted one adena dupe and gave an explanation to a leaked one that the project owner didn't patch for long and people found out. That doesn't mean I have any responsiblity to explain to everyone how to use every exploit. If you look carefully at conversations, you will notice that certain high profile open source developers, have difficulty grasping how an exploit works when you give them the fix / patch. That show's that they are probably not good enough, or experienced enough in that matter. Do you wanna tell us what pack you are using / developing so as we can check how valid my claims are ? Maybe I'm wrong and your specific pack which I don't know, is not vulnerable. That would be good to know there's at least a pack that's secure enough for us to use. I'd be glad to spend some tokens on it to do an audit.
By
aguy · 5 minutes ago 5 min