ZCPU/GPU/SPU

[Vurv78]

This is the last version of Wiremod that contains the CPU, GPU and SPU builtin.
Removed due to security concerns, so be very careful as to not allow unrestricted access to users.

Hopefully a replacement could be made.

It'll be located in a separate addon from now on:
wiremod/wire-cpu

---

This discussion was created from the release ZCPU/GPU/SPU.

[yogwoggf]

Many wire commits have been stupid, but this one takes the cake. It is absolutely incredible how such poor management has led to the most ass-backward commit.

[Titanic4]

Technically, ZCPU, ZGPU and SPU could be moved to separate addon, so existing contraptions using these chips won't break.

[Vurv78]

Yeah think that'd be best for the cpu users. We have the fpga separate in the same way too. Just need to make sure to really convey how dangerous it is

[yogwoggf]

@Vurv78 @thegrb93
Is there actually any concrete reason why the chips weren't deprecated and made "opt-in only" or something similar? Feels like the contributors are too lazy to setup an actual roadmap to ease removal. Or even just disable the chips temporarily?

[thegrb93]

You really don't know? They have RCE issues

[Denneisk]

If someone wants to maintain these chips (or at least make them bulletproof for the next 10 years of Gmod history), then it kind of is "disable the chips temporarily". I'd like for them to come back just as much as anyone else.

[yogwoggf]

Obviously they have RCE issues but completely removing them and just saying "farewell" without input from the community is laughable. Again, the solution is temporarily disable them or deprecate them while figuring out how to replace them.

[yogwoggf]

Since we're removing chips with vulnerabilities, my PR to remove e2 which also has vulnerabilities got closed and locked? #2670

Seems like an abuse of power. All I did was make a legitimate PR to remove e2 just like how @Vurv78 made one to remove these chips, and how @thegrb93 subsequently merged it almost immediately without a review.

[Denneisk]

If you want CPUs to come back sooner, start writing Lua.

[yogwoggf]

No, they should deprecate the chips instead of full on deleting them.

[thegrb93]

We discussed removing them internally for a while. If the guy who found the RCE wants to come out and give advice on fixing it then we can add them back, but I doubt they have any interest in that.

[yogwoggf]

Internally? You are a FOSS project with plenty of people. The whole point of GitHub is to foster communication, and the PR was exactly the opposite, you just.. merged it without a review in less than 5 minutes! I don't understand how you could think doing such a major move like this was fine without starting a prior dialogue with the community

[Anticept]

You are free to fork the project and do your own work. Complaining isn't going to help fix anything, being a volunteer to fix the years and years long issues will.

It's being removed from the main repo for being unmaintained, and serious security vulnerabilities like RCEs are not acceptable to even leave deprecated. We don't want to just delete it outright, so it's been shifted to its own repo at https://github.com/wiremod/wire-cpu and will no longer be included in the default distribution.