7 months ago I put in a security bug report detailing a method that allows anyone to view the original source of any script in any scene (or any script purchased in the marketplace). Can the priority of this bug report get raised and hopefully fixed soon? People have been making more and more complex systems that really shouldn't be able to be seen.
Original private bug report with more details (hopefully not publicly accessible):
https://help.sansar.com/hc/en-us/requests/4764
Thanks
So I tried out that sample code and found it did not work. I did my own digging and found that, while I could see a limited manifest of the assets (models, textures, audio, etc.) downloaded and could partly unpack them, they were still encrypted, so I could not decrypt them.
Moreover, I never saw the scripts listed among the assets. Scripts are server-side assets and do not execute on the client side, so there is no reason to download them.
So this may have been possible early on, but I don't think it is now.
There is a future reason, if the seller sets them to mod. But in lieu of that specific condition you should only ever get a key to the script. But apparently that isn't what they are doing.
I think Nop is pretty smart from what I've seen and if he says it's still an issue I'm inclined to believe it.
This needs to be addressed or it will prevent people from trusting selling scripts on the market period.
The FBX's Textures, Sounds is quite different as that stuff has to be on your PC. For that you need to employ good encryption to the point that it's easier to rip off the video card or sound card.
https://www.youtube.com/watch?v=7LGUemSw-4w
Proof of concept taken yesterday from a random sansar sim with the code and asset ids blurred out. Assets are not encrypted (they're all compressed with a proprietary and not so readily available format) and finding out the asset that contains the script's source is too easy right now (i know security through obscurity isn't, but it's at least something i guess).
One of HiFi's biggest sticking points is open source. Creators won't trust that. With no creators you have no market and no revenue.
So this should be the highest priority on the roadmap currently.
That is if you like revenue...
@Nop can we get some regular updates on if this has been addressed? It concerns me greatly.
Great news. I followed up with support today and got an unequivocal response:
_____________________
Nop confirmed that when he subsequently tried to reproduce the problem, he could no longer access source. I suspect he just never got a chance to update that thread.
No, third-party source is not sent in bags and is not accessible when making requests directly from the asset service.
Glad to hear it's been addressed
I'm glad that you're glad!
Gladly,
Garth