7Seas Fishing Forum

Attention, plug-in code developers.

I'm adding plug-in support for the new, upcoming contest types. Basically, they'll announce winners on a known channel in a known format. However, I'm not sure how best to support your security desires.

The key is to making your plug-in listen only to the authorized board, to avoid spoofing. For the contest board, this is done by giving it the ability to announce any text the user wants to announce on a known channel, so you can be sure it's the right board.

This time around, I'm thinking what it'll do is when the owner clicks on the board, it announces itself. That way, the timing is the control factor, not the message; if your plug-in listens briefly on the channel, odds are low someone will spoof in that brief setup time.

Would this meet your needs? Or would you prefer something completely different?

As you've gotten no replies on this yet I've gone and asked a couple of programmer types in 7Seas, or AM asking them and will post their replies here for your perusal.

[2:30] Rygel Ryba: I would generate a channel based upon object owner name.

More to come as they log in...

I was considering simply connecting the bounty hunt board to a custom prize giver via the Blueprint Password. A little bit of a usability issue in that I'd have to explain the connectivity and have a means to set up the password AND the name of the prize to give all through blue-box menus, but it'd mean needing no special plug-ins just to hand out prizes.

But you'd still need a plug-in for cash prizes or for some sort of local contest stat tracking system, so the question stays open about what system to use.

I'm not a fan of obfuscated channel numbers. They've worked okay for me in the past, but I know for a fact that there are people sweeping 7Seas gadgets with channel scanners trying to find these things so they can spoof messages... the guy who had 6 million bait (before we locked down bait with authentication) is proof of that. The only real secure methodology you can use is to lock your plug-in to listening to the board's key and that alone, or use an authentication hash like we do with OpenBlueprint.