[Freeciv-Dev] Re: (PR#8839) pingtime is insecure

["Christian Knoke" <chrisk@xxxxxxxxx>]

<URL: http://rt.freeciv.org/Ticket/Display.html?id=8839 >

On Tue, May 25, 2004 at 05:44:06PM -0700, Jason Short wrote:
> 
> <URL: http://rt.freeciv.org/Ticket/Display.html?id=8839 >
> 
> The current pingtimeout can be easily fooled by the client:
> 
> - He can make it seem higher than it is by waiting before sending the pong.
> 
> - He can make it seem lower than it is by pre-emptively sending the pong.
> 
> The former is unavoidable, but doesn't give much advantage to the 
> player.  The latter is easily avoidable.  All we have to do is send a 
> signature with each ping and compare it against the reply.

The ping time is just informal. It was nice if we could rely on it, to give
bonuses/maluses to people with bad/good ping. But I don't believe this is 
doable.

Christian

-- 
Christian Knoke            * * *            http://cknoke.de
* * * * * * * * *  Ceterum censeo Microsoft esse dividendum.