Security
How an old game server package is treated: audited instead of trusted, admin access kept off the internet, backups, and what you can do to stay safe as a tester.
The server and client come from an old game package that the community has passed around for years. It is not taken on trust.
What was found and done
- An audit of the package found weak default passwords and a dangerous admin panel. The defaults were changed right after installation.
- The world runs on a dedicated server. Admin access is restricted to the owner's private network.
- Public access is a separate, controlled step. Before people are let in, a checklist has to pass: only the game login faces the internet, while the admin panel, the database and remote login stay unreachable from outside.
- Backups run every hour, and restoring a backup into a separate folder has been checked. A full restore of the live world will be rehearsed before the beta.
Why some things stay closed
The code is closed on purpose. The game server and client are not ours to publish; the AI engine in other hands would be a ready-made bot farm; and the source of the security fixes would show an attacker where to aim. What lets you check fairness is open instead: population, rates, gold rules and costs.
Staying safe as a tester
Report exploits and security problems privately to livingpw@proton.me, not in the community groups.
Something unclear or missing? Ask in the community