General discussion on scripting

[the guyver]

LUA scripting is already in the game but fairly limited at the moment.
And I know a proper scripting scripting API is planned.

But how should scripting be done ?
Currently you need to have ftp/direct file access to a server to add scripts to a multiplayer game.

As a server owner I would like to be able to allow users to upload their own scripts, but this has some big issues to over come,
Having played with the current scripting I know how easily a typo can bring down a server or at least flood it with error messages.
So there needs to be some form of approval / admin control system to prevent harmful /server killing scripts from running.

What I would like to see is several levels of scripts
IE.
General server script.
Used to configure and control environment entity spawning / behaviour.

Faction scripts.
Each NPC faction can have it's own script so AI factions can have compleatly personalised behaviour

Object scripts.
Scripts attached to things like the upcoming PC block, Bobby ai/NPC pilot etc

What type of methods / events do you think need be accessably by scripts

 

[Snk]

We should have programming blocks that allow us greater control over the ship. We could do things like fire multiple weapon computers at once, and make an auto FTL charger. What they could do could be edited by server owners. What do you think?

 

[Shadar]

I like the concept, especially with regard to AI control. I would like to see the ability to have an AI controlled fleet fly in formation while following the faction flagship.

 

[jayman38]

Server side scripts should have access to almost everything. (Problem: will require a massive re-write of the core game to put much stuff in scripts; will also increase loading time as a result. Maybe the core game could have "compiled scripts" of some kind that loads a little faster.)

Special note: The game should have server script checks for basic stuff such as: No deleting or modifying files on a client unless the client gives access permission (E.g. Custom block overrides, AI behavior overrides, HUD behavior overrides, etc.) Similarly, it shouldn't write new files unless the client gives permission. This could be game-breaking for some clients who want to use features on a custom server, but don't want to give write permissions. They'll just have to move onto another server. (This could lead to a webpage where servers' trustworthiness is rated.)

1. No deleting core script files.
2. No replacing core script files with empty files. (This is not quite deleting them, but close enough.)
3. No infinite loops.
4. No file writes over 2 GB.
5. Kung Fu grip on data sizes. No buffer overflows allowed! Data sizes must get passed along with the data itself. This makes it tougher on script writers, but the alternative is a Wild West with broken servers everywhere, and having to tell newbie server hosts to delete the core script files so the game can recreate them from defaults.

Client side scripts: Maybe HUD behavior? That would be fun. (Bring the targeting reticle from 20% opacity up to 50% opacity only when in combat mode.) Allowing the game behavior to be altered by client-side scripts is Trouble with a capital T. Any game-changing scripts should have to be sent into admin before they can be used and selected in the game. So, effectively, client-side scripts that change the game can be selected from a drop-down list of available options. Probably needs an additional server-side script to auto-disable incompatible client scripts. ("You want to make the reticle flash red AND white in combat? Nope. Pick something else. Like that nice alternating-red-and-white-flashing script over there.")

 

[Monchoman45]

This is just not possible to do safely. There are all sorts of problems with this; but it actually doesn't matter in this case, because one of them takes the cake:

3. No infinite loops.

It is mathematically impossible to guarantee this.

This problem is so important in computer science that it actually has a name: it's called the halting problem. Alan Turing (did you see Imitation Game?) proved that this problem is mathematically unsolvable back in 1936.

This means that I can write code that does not appear to be an infinite loop, but that also never terminates. If I were allowed to upload this code to any server, I could crash any server I wanted.

Sorry guys. Math said no.

 

[jayman38]

This is just not possible to do safely. There are all sorts of problems with this; but it actually doesn't matter in this case, because one of them takes the cake:



It is mathematically impossible to guarantee this.

This problem is so important in computer science that it actually has a name: it's called the halting problem. Alan Turing (did you see Imitation Game?) proved that this problem is mathematically unsolvable back in 1936.

This means that I can write code that does not appear to be an infinite loop, but that also never terminates. If I were allowed to upload this code to any server, I could crash any server I wanted.

Sorry guys. Math said no.

On turing-complete scripting systems, it might be impossible. Instead, we can rely on "close enough" and can use a customized scripting language, where we remove or redirect the real looping constructs from the lexicon and replace their usage with functions that add a large-number counter check to the looping procedure. (Example: If StarMade will use LUA, the lexicon list is in llex.)

Given multiple levels of looping, a hostile programmer can still overwhelm the server, which is why non-trivial scripts need to be vetted by the administrator prior to implementing in the game. However, for most modders, an additional integer-counter check will be sufficient protection.

Pseudo code:
While(X,LessThan,Y,IncrementAmount,CustomFunctionToExecute)

Function While ( X, Op, Y, i, funcstring, looplimit ) {
local loop_limiter = 0
local loop_max = 0

if (0 < looplimit < 2100000999)
loop_max = looplimit
else
loop_max = 2100000999

Case Statement for Ops
...
(LessThan)
while ( X < Y && loop_limiter < loop_max )
X+i
loop_limiter + 1
exec ( funcstring )
break
...

I have used this method in a production scripting environment to make the server decide it's had enough of a loop and move on to the next op. It immediately gave my scripts an extra "9" in reliability. (In that case, it went from about 98.(something)% to 99.9% reliability. Further enhancements were implemented later, ensuring four nines. The bosses wanted five nines, but that's only about 5 minutes downtime a year, they weren't giving us a redundant server for that system, and server reboots in that network environment ensured that five minutes were exceeded.)

 

[Monchoman45]

What stops me from uploading a script that's nothing but maxed out for loops with the most expensive body possible?

You can throw on as many restrictions as you want to get a system that's fake-secure enough to keep you happy, but you'll just be screwing over legitimate modders and limiting the domain of scripts that can be practically used. To make things worse, the only reasonable way to implement that system would include putting all of those restrictions in config files for admins to change at will. Good luck writing a portable mod when everyone can change what language constructs are or aren't allowed.

The alternative is having admins review and install each script manually. You're going to have a hard time topping the security of that.

 

[jayman38]

What stops me from uploading a script that's nothing but maxed out for loops with the most expensive body possible?

...

The alternative is having admins review and install each script manually. You're going to have a hard time topping the security of that.

After all that, we can finally agree. The Admin stops you. That's what I've been advocating. Now it looks like you haven't read my posts all the way through. I'll repeat the specific lines below to help you. The restrictions would be there to HELP the admins. Not replace them.

...Allowing the game behavior to be altered by client-side scripts is Trouble with a capital T. Any game-changing scripts should have to be sent into admin before they can be used and selected in the game....

...Given multiple levels of looping, a hostile programmer can still overwhelm the server, which is why non-trivial scripts need to be vetted by the administrator prior to implementing in the game. However, for most modders, an additional integer-counter check will be sufficient protection....

 

[Ithirahad]

What stops me from uploading a script that's nothing but maxed out for loops with the most expensive body possible?

You can throw on as many restrictions as you want to get a system that's fake-secure enough to keep you happy, but you'll just be screwing over legitimate modders and limiting the domain of scripts that can be practically used. To make things worse, the only reasonable way to implement that system would include putting all of those restrictions in config files for admins to change at will. Good luck writing a portable mod when everyone can change what language constructs are or aren't allowed.

The alternative is having admins review and install each script manually. You're going to have a hard time topping the security of that.

Ummm, I don't think the intention with the scripting system is to have some kind of per-player custom inter-server LUA modding API thing (that's nigh-impossible to control and manage...), it's just to allow players to create AI behaviours (For ship and crew AI) and stuff, and allow server administrators to create... er, even more stuff. If someone's script still manages to eat up too much server power, there should be some system in place to automatically terminate it.

The modding API is probably a separate thing that only server admins can install mods through for their server. A client-side-specific modding capability (For things like Rei's Minimap) might exist, but it would have to be incapable of being used to feed any data to the server. Or... something. I'm not the expert on this stuff, but I was just saying... I think you guys are getting a bit carried away here. :p

 

[the guyver]

Ummm, I don't think the intention with the scripting system is to have some kind of per-player custom inter-server LUA modding API thing (that's nigh-impossible to control and manage...), it's just to allow players to create AI behaviours (For ship and crew AI) and stuff, and allow server administrators to create... er, even more stuff. If someone's script still manages to eat up too much server power, there should be some system in place to automatically terminate it.

The modding API is probably a separate thing that only server admins can install mods through for their server. A client-side-specific modding capability (For things like Rei's Minimap) might exist, but it would have to be incapable of being used to feed any data to the server. Or... something. I'm not the expert on this stuff, but I was just saying... I think you guys are getting a bit carried away here. :p

I realise that but would like to see some game mechanic where players can upload and request thier script is added to the server, as there are a lot of better scripters than me out there :p

 

[LeifRoss]

The infinite loop problem can be solved without much effort by having a observer system that simply kills the script after a certain number of instructions.

The implementation described in this thread solves all the problems with script abuse: http://starmadedock.net/threads/rhino-js-scriptable-block.6719/

(Sandboxing and simplified instruction observer)