It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
avatar
LordZanny: It is probably the biggest failing of Steam on Linux right now that their client doesn't integrate or interact with anything else at all. Yeah they have their own aesthetic, but it makes it look like a toy when the Steam window clashes deeply with the rest of your desktop.
... not that Steam integrates very well with anything on Windows or OS X either, or looks like it belongs on either system.
Post edited June 06, 2014 by Maighstir
avatar
Fenixp: All right, FireFox. There's an application called Pale Moon - it keeps most of the FireFoxe's source code and is directly compatible with FF's addons, but is backed by a slightly different design philosophy, improving upon several aspects of the browser. That would be JMich's aplication with hookers and blackjack.
avatar
Piranjade: Ah! Thank you! Now I can imagine what this is about!

Wouldn't the fact that my GOG client can communicate with my friend's GOG client via the chat function be a problem security-wise?
I could imagine somebody writing a modification that sends data to my computer using this connection, you know like "evil" data. ;-)

Edit: If all these questions are getting on your nerves or if you don't have time, just tell me, OK?
That's already a common threat with closed-source software.

It's possible for an attacker to install something like Galaxy or Steam, then hook into the operating system's network layer and record or modify traffic sent or received by it and any experienced computer crook will be very skilled at finding vulnerabilities in closed-source software by having a deep understanding of where a coder is most likely to slip up and leave things vulnerable when programming in a given language.
avatar
TheCycoONE: There are a couple reasons the security argument (all bugs are shallow) is bunk, both of which were evidenced with the heartbleed vulnerability.

a) Just because the code is open doesn't mean benevolent outside experts are actually auditing it. Open source projects without corporate backing struggle to find enough even semi-competent outside help. Most software developers don't spend their free time reading code that they are not paid to read beyond their own pet projects.

b) When a security problem exists in open source software, the black hats will know exactly how to exploit the flaw as soon as the code is released, which must be as soon as the binaries are generally available. This means that everyone who doesn't patch the moment a new version is released (or even before that if development is done in the open as well) are vulnerable.

I say all this despite being a Linux user and an open source contributor.

All that said, opening the protocol could have more benefits.

For one it would force GOG to seriously consider security at the protocol level and not rely on trusting the client.
For a second, if/when people do develop alternate clients, it would break up the monoculture and make the cost of a vulnerability in any particular client substantially less.
Have you seen the talk by one of the LibreSSL guys?

It's very interesting. He goes into detail on how horrendous the OpenSSL codebase is and makes a very convincing argument for it being so horrendous that nobody outside the project wants to admit to examining it because they fear the risk of being shoehorned into writing and maintaining out-of-tree fixes.

(As he puts it, it's not coded in C. It's coded in "OpenSSL C".)
Post edited June 08, 2014 by ssokolow
avatar
Kristian: For the same reason they can't use Steamworks as is. You have use GPL incompatibly licensed libraries. If instead GOG were to distribute GOG Galaxy(including source code) under the MIT license this wouldn't be a problem.
avatar
JMich: Haven't really checked the GPL license, but what do you mean "incompatibility licensed libraries"? Assume that the client side API is available (packets require to be formatted as X, send to Y address) but the server side isn't available. Doesn't that cover GPL? If you send the server the packets it expects, it parses them and responds, if you send different packets, it ignores them.
Basically, the GPL says the following:
1. You can do whatever you want as long as you give credit where credit is due and anyone who gets the binaries can request the source code you built them from.
2. You cannot add new restrictions.
3. If a project contains any GPL code, then all code which links against it must also be available under GPL terms.
4. Do whatever you want with network protocols. The GPL stops at the edge of the program and imposes no restrictions on talking to other programs.

Points 2 and 3 are what force GPLed games to reinvent client libraries if they're proprietary. GPLed code is not allowed to be crippled by being shackled to components under more restrictive licenses. (The MIT requires a subset of the GPL and doesn't forbid adding new rules down the line.)

Point #3 is also why companies can get away with "open-source engine but you still gotta buy the CD-ROM for the art/music/sounds/levels/etc.". GPLed code has nothing to say about non-code stuff you distribute alongside it.

It works that way because the GPL was designed to protect what its creators call "the four software freedoms":

0. Freedom to run the program as you wish.
1. Freedom to study the source code of the program and then change it so the program does what you wish.
2. Freedom to help your neighbour. That’s the freedom to redistribute the exact copies of the software when you wish.
3. Freedom to contribute to your community. That’s the freedom to distribute copies or modified versions when you wish.
avatar
Fenixp: b) Developers! If GOG provides both API AND source code for the application, devs can actually make their own additions of features they would expect of the client - again, with no cost for GOG, but with the benefit of GOG saying whether or not that particular feature is acceptable.
avatar
Piranjade: To explain it to somebody like me (who has no clue) - there could be something the "Barefoot Essentials for GOG" for the client, modifying it in some ways? Or did I misunderstand that?
Barefoot Essentials is only possible because, by design, unless the entire site is written as one big Flash applet, the bits of a website that get sent to your browser are unavoidably open-source. (There's no way to compile the stuff the browser sees and nothing can be done to prevent Barefoot Essentials from playing around with the browser's internal representation of the site.)
Post edited June 08, 2014 by ssokolow
avatar
ssokolow: Basically, the GPL says the following:
So under what conditions could GOG Galaxy be used with a GPL game? Game side API is open source, GOG Galaxy itself is closed? Or something else entirely?
avatar
ssokolow: Basically, the GPL says the following:
avatar
JMich: So under what conditions could GOG Galaxy be used with a GPL game? Game side API is open source, GOG Galaxy itself is closed? Or something else entirely?
I'd say if the license of the GOG client libraries provided for developers who want to enable Galaxy features in their games is GPL compatible.

See https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
Post edited June 08, 2014 by shmerl
avatar
JMich: So under what conditions could GOG Galaxy be used with a GPL game? Game side API is open source, GOG Galaxy itself is closed? Or something else entirely?
avatar
shmerl: I'd say if the license of the GOG client libraries provided for developers who want to enable Galaxy features in their games is GPL compatible.

See https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
So for example this one?

A license that allows redistribution and modification, along with source code availability, even if the client or the server side scripts themselves are closed, would that be enough to be used with GPL games?

I am mostly trying to understand post 84 of Kristian. I know that an open source code is usually easier to use with GPL, but I'm asking what is the bare minimum one needs to do to allow his code to be used with GPL.
avatar
shmerl: I'd say if the license of the GOG client libraries provided for developers who want to enable Galaxy features in their games is GPL compatible.

See https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
avatar
JMich: So for example this one?

A license that allows redistribution and modification, along with source code availability, even if the client or the server side scripts themselves are closed, would that be enough to be used with GPL games?

I am mostly trying to understand post 84 of Kristian. I know that an open source code is usually easier to use with GPL, but I'm asking what is the bare minimum one needs to do to allow his code to be used with GPL.
The license of the code must allow all the same things as the GPL and must not restrict people from doing anything the GPL allows. At the same time the license must not otherwise forbid combinations with GPL software. Source code availability is a precondition for this to be possible.

Edit:

Informal licenses are a bad idea. No lawyer would ever recommend it. It is too risky and amigous. As far as scipts go that would depend on the precise nature of the technical stuff that is going on but I am far far from an expert but my hunch is even an expert would need more knowledge of the specifics. But it can't be ruled out in the first place.

Edit2:

For compatibility with both the GPLv3 and GPLv2 and to allow use with proprietary software(you have to because almost all the games are proprietary) the so called MIT license(that the FSF call the X11 license to differentiate it from other license MIT has used from time to time) is probably the best bet: [url=http://directory.fsf.org/wiki/License:X11]http://directory.fsf.org/wiki/License:X11[/url]

It is the license that Valve uses for their open source code such as vogl their openGL debugger: https://github.com/ValveSoftware/vogl/blob/master/LICENSE

The Valve written code in the Steam runtime: https://github.com/ValveSoftware/steam-runtime/blob/master/COPYING and:

ToGL their Direct3D to OpenGL translation layer: https://github.com/ValveSoftware/ToGL/blob/master/LICENSE

They even use a non-commerical only variant(Thereby not open source and not free software, the freedom to sell free software is a very imporant philosophical point for the FSF: https://www.gnu.org/philosophy/selling.html) for the Source SDK: https://github.com/ValveSoftware/source-sdk-2013/blob/master/LICENSE.
Post edited June 08, 2014 by Kristian
being a gnu/linux user since 2012, i can't see any logical reason why anyone wouldn't want galaxy to be open-source, it makes literally ZERO SENSE. this of course, assuming they even know what open source is... which they probably don't.
avatar
ibrokemyback: being a gnu/linux user since 2012, i can't see any logical reason why anyone wouldn't want galaxy to be open-source, it makes literally ZERO SENSE. this of course, assuming they even know what open source is... which they probably don't.
Apparently GOG know. They use DosBox and ScummVM in their own releases, and even ship sources of them to comply with GPL.
avatar
Kristian: For compatibility with both the GPLv3 and GPLv2 and to allow use with proprietary software(you have to because almost all the games are proprietary) the so called MIT license(that the FSF call the X11 license to differentiate it from other license MIT has used from time to time) is probably the best bet: MPL 2.0.

It's explicitly compatible with Apache 2.0, GPL 2.0, LGPL 2.1, and AGPL 3.0 as well as all later versions and it's sort of an even simpler, less demanding alternative to the LGPL.

(The LGPL stops copyleft at the edge of the library and has some tricky requirements to ensure people can swap in another version of an LGPLed library used in a closed-source application. The MPL stops copyleft at the edge of the file, so you can use MPLed code in anything but you have to share your copies of any files that were MPLed when you got 'em.)
avatar
ibrokemyback: being a gnu/linux user since 2012, i can't see any logical reason why anyone wouldn't want galaxy to be open-source, it makes literally ZERO SENSE. this of course, assuming they even know what open source is... which they probably don't.
avatar
shmerl: Apparently GOG know. They use DosBox and ScummVM in their own releases, and even ship sources of them to comply with GPL.
But last I checked they don't do that with that free id Tech based game they ship.
avatar
shmerl: Apparently GOG know. They use DosBox and ScummVM in their own releases, and even ship sources of them to comply with GPL.
avatar
Kristian: But last I checked they don't do that with that free id Tech based game they ship.
I'm actually not sure if you need to ship the source of DosBox. That's somewhat of an overkill. You can link to it for example, or provide it if anyone requests it.
avatar
Kristian: But last I checked they don't do that with that free id Tech based game they ship.
avatar
shmerl: I'm actually not sure if you need to ship the source of DosBox. That's somewhat of an overkill. You can link to it for example, or provide it if anyone requests it.
True but they don't do that with that game(I forgot the name).
avatar
Kristian: True but they don't do that with that game(I forgot the name).
Warsow I think? You also don't have to provide source with the download. Not to mention how pointless it is, really, if somebody wants to see source code to a software, chances are he knows how to use google.
avatar
Kristian: True but they don't do that with that game(I forgot the name).
avatar
Fenixp: Warsow I think? You also don't have to provide source with the download. Not to mention how pointless it is, really, if somebody wants to see source code to a software, chances are he knows how to use google.
While it can be pointless, formally the license requires them to provide access to source if anyone requests it. So shipping it together covers their legal ground for sure, but there should be simpler ways.