The 0.0.0.0/8 subnet refers to "this network", (c.f. RFC 3330) and in
particular, 0.0.0.0 can be used to refer to the local computer. As such,
it should be blocked by default, as loopback addresses currently are.
This default configuration was relevant to a challenge in the ALLES! CTF
2020 competition, see https://play.allesctf.net/tasks/ALLES!Craft or
https://ctftime.org/event/1091. The challenge involved multiple servers
interconnected with Waterfall as a proxy, to enable server
teleportation. The solution to the challenge was to use an internet card
on one of the servers to connect to 0.0.0.0, bypassing the Waterfall
proxy, and replay or reverse proxy a Minecraft handshake in Lua, which
allowed spoofing as a different user.
This change required removing our minimum budget cost (the cost for a component invoke) which was .001 (budget limits are ~1)
This affects a number of cheap component api calls, so that they no longer have a .001 minimum call budget. From tesing it appears that tight loops caling these api don't experience a different behavior, they still fail with "too long without yielding" just the same. Additionally, these api are safe to call without forcing a budget cost. This should have a small quality of life improvement in many places, being able to call some api ever so slightly faster.
also, added better config options for vram settings
1. if /home is readonly, a helpful message is displayed tell the user to run install
2. remove -i from `cp` alias because a bunch of people complain about it
3. `install` now does not clobber /etc/rc.cfg nor /home/.shrc
note: dirty page bitblts to a screen are increasinly expensive for larger buffers
bitblts to vram are "free" (no budget, no energy)
note that any direct component call has a minimum .001 budget cost
We've discussed a large variety of options for the gpu
I've reviewed our options and suggestions. Ultimately - users want faster graphics. Most of the ideas are relating to what api is meaningful to the user. The core issue we have in making graphics faster is an increase load on the server.
For example
Tier 3 GPU and Tier 3 Screen has a max resolution of 160x50
If you set the viewport (via gpu.setViewport) to 160x25 the bottom half of the buffer will no longer be shown. All gpu.set, gpu.copy, and gpu.fill calls into that space have no cost
Overlaps are calculated for partial cost. Half in and half out will have half the power cost.
closes#779
the openos io buffer in utf8 mode can splice inside a utf8 sequence
this code prevents that by reading the next chunk to complete the sequence
in the case the stream actually has bad utf8 sequence, the io buffer decides to return
more data than it was asked, rather than corrupt the stream
closes#1207
