Ren'Py Lessons in Love [v0.43.0] [Selebus]

[BlackDays]

That DRM shit was a shoot in the foot, it affected a lot of subscribers too. By the talks here if he does the same or worse the retaliation will sting.

The problem is that it is not only not working as intended, but could be even turned against them (Sel and team). Which i guess already happened and might still happen, regarding the subscriber complaints.
I hope they shut the service down for their own sake, unless they have a solution for it.

Thanks to vehemental i saw the code, and if i understood it correctly, lets just say, it's a bit frightening.

 

[KnowNoHope]

Thanks to vehemental i saw the code, and if i understood it correctly, lets just say, it's a bit frightening.

What was scary about it

 

[BlackDays]

I guess the person went with the name alt-f8 here? The developer of it.
I think he already admitted it, that it wasn't a good idea to have it in plain sight and human readable.

Besides that, theres more to the code (thats the scary part), but i don't want to go into detail. Don't want to give people ideas.

Maybe they should have at least put it into a dll or something.

 

[Bingoogus]

theres more to the code (thats the scary part)

That sounds like something we should be informed about man, for our own security, wtf else did it do to our computers?

 

[KnowNoHope]

I guess the person went with the name alt-f8 here? The developer of it.
I think he already admitted it, that it wasn't a good idea to have it in plain sight and human readable.

Besides that, theres more to the code (thats the scary part), but i don't want to go into detail. Don't want to give people ideas.

Maybe they should have at least put it into a dll or something.

did Sel really put malware or worse in his own damn game?

That sounds like something we should be informed about man, for our own security, wtf else did it do to our computers?

exactly

 

[Axismundi]

I guess the person went with the name alt-f8 here? The developer of it.
I think he already admitted it, that it wasn't a good idea to have it in plain sight and human readable.

Besides that, theres more to the code (thats the scary part), but i don't want to go into detail. Don't want to give people ideas.

Maybe they should have at least put it into a dll or something.

If there is something that even possibly dangerous, you should let people know. Better to cause a fake scare then let serious damage be done.

 

[BlackDays]

Guys, lol no. As far as i've seen, besides the save file and script.rpy stuff, i didn't see any other malicious code for clients.
That said it's still kinda bad to do that. They should have just tested it first with the "you don't download a car" blah blah text alone and see if it works and observe people, before anything else.

The scary stuff is, that it (the "drm") could be turned against them too.

And i got a feeling someone might just have done that already.

 

[KnowNoHope]

Guys, lol no. As far as i've seen, besides the save file and script.rpy stuff, i didn't see any other malicious code for clients.
That said it's still kinda bad to do that. They should have just tested it first with the "you don't download a car" blah blah text alone and see if it works and observe people, before anything else.

The scary stuff is, that it (the "drm") could be turned against them too.

And i got a feeling someone might just have done that already.

oh... scary for them. that sucks
a bit relieved though.

 

[Bingoogus]

Guys, lol no. As far as i've seen, besides the save file and script.rpy stuff, i didn't see any other malicious code for clients.
That said it's still kinda bad to do that. They should have just tested it first with the "you don't download a car" blah blah text alone and see if it works and observe people, before anything else.

The scary stuff is, that it (the "drm") could be turned against them too.

And i got a feeling someone might just have done that already.

Ah ok, so more like, the DRM sending requests to their server is open to exploitation and certain forms of attack have an in? That's hilarious.

 

[TheLarceny]

I hope whatever is going on, it dosent end up by canceling the game

 

[BlackDays]

Ah ok, so more like, the DRM sending requests to their server is open to exploitation and certain forms of attack have an in? That's hilarious.

You're on the right path, yes.
Obviously i don't know how things are handled server side, just checked if his host provider has at least the bare minimum countermeasurements in place, which they have.
And i really don't want to shite on any other devs work, and there's still a chance that im wrong with my assumption, but the whole situation looks kinda dire to me.

Let's just say that if i was a dick, i at least knew an angle to put a lever on.
And if this all is good for at least something, i hope it creates some awareness on Sels side, even if it puts me in a bad position here.

 

[Bingoogus]

I hope whatever is going on, it dosent end up by canceling the game

Don't worry, Selly is a complete narcissist so if he quits then us filthy pirates would 'win' (in his mind) and there's no way he could tolerate that.

 

[Chrander]

Does anyone have the new puzzle answers? Specifically the one about hiding under the bed.

 

[Vizer007]

Does anyone have the new puzzle answers? Specifically the one about hiding under the bed.

Cute Puppy
And all the answers are on the main page)

 

[worthlesspeon]

Ah ok, so more like, the DRM sending requests to their server is open to exploitation and certain forms of attack have an in? That's hilarious.

I do think the idea of a porn game phoning home without explicit permission is a bit worrisome. Especially one with content as questionable as this one. I'm curious how much data could be collected if they were inclined to do so. Especially since Sel has threatened legal action in the past. Even if ren'py is fairly sandboxed and can't just go collecting data from the entire host, the logs do still reveal some information about the host. Not to mention he'll have an association with real IP addresses. Even if the content of the game is legal (which is probably not true in all countries), many of us would risk our jobs if it came out we play this game.

Additionally, the more I think about it, the DRM as it is may well violate the EU's GDPR law. Specifically the data processing regulations.

You must be registered to see the links

 

[k1n5l4y3r]

You'll want to update the post linked in the FP with your updated version as that's the one the FP is directing people to.

Edit: ah shit, another freckle...

Thanks, I edited the one that is linked and will keep that as the main one.

 

[graz150]

I do think the idea of a porn game phoning home without explicit permission is a bit worrisome. Especially one with content as questionable as this one. I'm curious how much data could be collected if they were inclined to do so. Especially since Sel has threatened legal action in the past. Even if ren'py is fairly sandboxed and can't just go collecting data from the entire host, the logs do still reveal some information about the host. Not to mention he'll have an association with real IP addresses. Even if the content of the game is legal (which is probably not true in all countries), many of us would risk our jobs if it came out we play this game.

Additionally, the more I think about it, the DRM as it is may well violate the EU's GDPR law. Specifically the data processing regulations.

You must be registered to see the links

Yes, all this.
I don't know what it would entails, as I'm a noob about these things, but it might be worth it to only share a "cleaned up" version of the game here in the future. Just in case some malicious content get added to random files in future updates.

I'm sure even subscribers might be interested in getting a safe version of the game.
Or maybe more knowledgeable guys could share tips on how to prevent future damages?

 

[b7512966]

I don't know what it would entails, as I'm a noob about these things, but it might be worth it to only share a "cleaned up" version of the game here in the future. Just in case some malicious content get added to random files in future updates.

I'm sure even subscribers might be interested in getting a safe version of the game.
Or maybe more knowledgeable guys could share tips on how to prevent future damages?

That is not difficult at all.
It is really easy to make a metadata cleaning script + using git to check the differences between version of his game to know what he is changing on the code. Even if he does decide to share only rpyc files, or rpas, it is really easy to decompress and deobfuscate them.

 

[Axismundi]

I'm sure even subscribers might be interested in getting a safe version of the game.

It should be possible to upload a "fixed" version, but I'm sure you'd need to talk to the moderators on this site so they don't update the front page every time a new release gets leaked here. But now that I think about it, this game doesn't appear on the recently updated page anymore, right? So I guess it's only an issue for the people sticking around.

 

[chronox42]

It's seriously unethical for a program to call out over the internet without the knowledge or consent of the people using it. This is especially true when the program has never done so before and does not present itself as such. The incident we've all been experiencing points out Renpy's insecurity and the ease of foisting abusive behavior on trusting players. Selebus's choice to deceive LiL's entire player base without warning is disturbing. What might he do next? Renpy has the potential to collect extensive information about your computer and send it off for their perusal.

Everyone who plays Lessons in Love should consider their options for running the game with no internet access, or better yet, in a sandbox where it can access only certain files. This goes for all similar games as well, but now we've seen that Selebus is actually willing to start down the path of distributing thinly disguised malware.

This is a frustrating situation for me because Lessons in Love is my favorite work of fiction. The story is a joy to experience and I want to see it completed under good conditions. Selebus is an excellent author, and I don't want him to lose his social or financial motivation to keep working on the game. Unfortunately, I will never financially support his work as long as he shows contempt for the people who use the program he distributes.

Some here have suggested that things would be better for everyone if Selebus behaved as if this site did not exist; I agree. His obsession with "piracy" hurts all with a stake in LiL's success. Selebus: focus on your work, let the grudge go, and you will continue to enjoy the prosperity you've created for yourself with this amazing story. Everyone else: be careful out there.