[Esben Mose Hansen]

Man, this is sad. A few points:

• Thank you Stormbinder! And apologies for not wanting to believe you :-( Also thanks to Kristoffer for the official backing, and for the unpleasant work.
• The sources to the game pages are publicly available in a somewhat old Version, under GPLv2, in the LINKS section of my pages. I am occasionally contacted by individuals who wants to set up an identical server, though none of them have yet done so.
• I find it unlikely but possible that my server as such has been compromised. If so, the attacker has been quite skilled. To be safer, I have started the process of upgrading all software on the server. This will undoubtedly cause crashes at some point.
• For those that care, the game itself and my own, simple analysis of the situation is here: Norfleet analysis
• As to how, I would guess hacking the nation.trn and or .2h file is the best bet. I agree with Stormbinder as to the nature of the cheat: Gain gems, possibly resetting the number of gems to a certain value.
• The dominions II game was obviously not written with security as a priority. To do it right, you have to let the server execute and check on all movements the client submits. This is just like writing a web page: All data sent should be regarded as suspicious (Perl: tainted). Care should be made to track this tainted data and untaint it by careful checking. On the other side, no data should be transferred to the client which the client does not need.
• All the big internet game houses have had problems with cheating. It is not trivial to get right, and the above is just an observation, no a criticism.
• I would have Banned Norfleet from the server, but I see no point, especially now.

I'll shut up now. Hopefully, this particular hole will be plugged soon.