ATTACK OF THE KILLER CUPS

[strawberry crab 57 / 2,941]

First there were only a few. 

Then they came in droves

 

THEN THEY KILLED US! PICKING US OFF 1 BY 1 TILL ONLY A FEW WERE LEFT. THESE NOBLE SURVIVORS ended up dying the next round.

 

Anyway for those who weren't there. This was a server wide glitch with the scp- 294 add-on.  Spectators would spawn in explosive drinks when they "spectated" various living players. When these cups didn't cause lag they would kill people as they would purposefully (rarely) accidentally (the most common) press e on them when say trying to hit a switch. The player(s) in question didn't even have to press e on the cups to die because as long as they were in the hitbox of the explosion they would die. 

 

I'd suggest bug fixing 294 so this doesn't happen ... that often.  It was fun the first 5 to 6 times but got wary after 30 minutes or so.

Edited December 22, 2018 by strawberry crab

[annoying furry 6,300 / 63,955]

4 minutes ago, strawberry crab said:

I'd suggest bug fixing 294 so this doesn't happen ... that often.  It was fun the first 5 to 6 times but got wary after 30 minutes or so

didyoureadthegoddamnchangelog

[strawberry crab 57 / 2,941]

39 minutes ago, Xy_ said:

didyoureadthegoddamnchangelog

@Xy_

 

I checked the one on December 14th. I didn't check the log at the time of posting this. As the most recent changelog update was only 2 hours old at the time of writing this post.

[annoying furry 6,300 / 63,955]

4 minutes ago, strawberry crab said:

@Xy_

 

I checked the one on December 14th. I didn't check the log at the time of posting this. As the most recent changelog update was only 2 hours old at the time of writing this post.

the 2 hour ago one said that this was fixed kek

[strawberry crab 57 / 2,941]

1 minute ago, Xy_ said:

the 2 hour ago one said that this was fixed kek

@Xy_ yeah ik it's fixed now dude. I checked the log about 10 minutes ago. I just didn't know at the time. Is there anything wrong with that?

[annoying furry 6,300 / 63,955]

Just now, strawberry crab said:

@Xy_ yeah ik it's fixed now dude. I checked the log about 10 minutes ago. I just didn't know at the time. Is there anything wrong with that?

No?

 

I was just pointing out that I had already fixed and posted.

[strawberry crab 57 / 2,941]

1 minute ago, Xy_ said:

No?

 

I was just pointing out that I had already fixed and posted.

oh, alright well thanks for letting me know regardless @Xy_

[cd326s 13 / 2,068]

I blew up 3 fucking times trying to open doors damn it.

[annoying furry 6,300 / 63,955]

Might as well post some specifics. The cup thing was caused via an exploitable net message in the 294 addon from the workshop that we used. Essentially, you used to be able to write a clientside lua script that could start a message called 'GiveSCP294Cup'. Perhaps doing something like this

 

--Clientside lua, loaded using lua_openscript_cl, must have sv_allowcslua 1 to work

--Extremely rapid, every frame. This can lag the client if you have a shitty PC, but generally overhead on the server is much more.
timer.Create('lagServer', 0, 0, function ()
	net.Start('GiveSCP294Cup')
    net.WriteString('cola') --This is the flavour of 294 drink. Doesn't matter
    net.WriteEntity(table.Random(player.GetAll())) --NULL entity will cause an error on the server, causing a flood of lua errors. Default SCP-294 addon does NOT check for validity of the sent entity. This is bad practice. However this is probably what Bran used, this would result in a cup being spawned on a random player.
    net.SendToServer()
end)

 

 

This had 2 noticeable effects: 1) It generated about a 200 MB log on the server due to the lua error spam. 2) Cups seem to be teleported to players because ent was probably a player object, hence cups appearing around players

 

The SCP-294 addon:

 

1) Assumes data coming from the client can be trusted. The following assumptions are made by the scp294 server code 1) The entity sent is the scp294 entity 2) The entity is not NULL. Obviously in the example above, assumption 1 does not hold true

 

2) Has no real rate limit. There is a rate limit based on proximity of the cup to the spawn location; this was probably the only thing that stopped the exploit from lagging the server out instantly. However #1 allows cups to be spawned at the current locations of all players on the server, as well as anywhere they might move, so the amount of cups increases very fast. Cups take 10 seconds to despawn, this is another factor that probably helped the server not crash.

 

 

This all was fixed by validating that the entity sent is valid and checking that it is a vending machine entity upon receiving the entity from the client. We also added a rate limit that automatically bans you if you try to spawn more than 3 cups per second, this is literally impossible without the use of a script. Any script doing less than 3 cups per second shouldn't cause any lag, so it's not a concern..

 

[Guest]

3 hours ago, Xy_ said:

didyoureadthegoddamnchangelog

no

[Doomnack 199 / 4,888]

I was there during the tragedy. Barely survived.