Could I ask you to check my understanding of this part?

I think your understanding is basically correct, but i just want to clarify what i did with the specs:

I found the source code, which doesn’t include the rendering engine, is composed of Python and C++ and contains the game logic.

I then fed the LLM the source code I had available to turn them in to a set of specs for that specific codebase, for important APIs and the logic that connects then.

I then took those specs and made the LLM genericize them, and in particular creating a structured, human readable description of all game rules.

With those new generic specs, i was able to creat a development plan and architecture (with heavy aid of LLM), the new engine is written in Godot with json data store.

Project was bootstrapped like normal, start with the smallest core functionality, especially including debug infrastructure. Get it stable and then keep adding features and testing until everything seems okay.

I guess i have a follow up question which is, is it possible that the Civ IV source code was included in the training data of the LLM, and would there be any way to know?

Agreed, that’s actually part of why I said I don’t think i can prove it’s fully clean room!

But I did try my best to make it unlikely, and even if it did, I imagine it was closer to broken bits and pieces.

I appreciate that at least we are all reeling from the implications of it all.

I think that’s a very interesting point about the compiler, companies have really leaned on that as a way to obfuscate code, some folks seem to think compiled is as good as encrypted? Just another lock on the door, I guess, and a free one at that.

I think it does make a ton of sense that an llm would be so capable at decompiling code… it’s basically just translating? But having decompiled some stuff myself years ago, it’s still sort of amazing to see such a tedious process automated.

Bleh, too many conflicting feelings… yes, let’s hope we reclaim some bits of culture taken from us! And let’s cross our fingers that copyright is destroyed in a manner that actually benefits people…

I’ve been thinking about this a lot too, because of seeing all these decompilations (with all the implications that comes with, as you point out some of them), but also because my own “learning LLM tooling” project was reverse engineering Civ IV, and rereleasing in a 64 bit engine with more accessible controls at the expense of 3d (sort of like Unciv).

I did not do a decompilation, especially because the core of the game has restrictive-licensed source released, but i was able to build clean specs from that source, and then with as clean of context of possible, stage the production and testing of features. I honestly don’t know how you’d prove a classic clean room implementation with LLMs (and definitely not in a one shot), and i can’t really prove my implementation is clean either.

I really hate the direction of all this stuff (so so much), and i hate that my disabled ass feels compelled to learn such tools so I am able to feed myself. But I did try to have some good come out of it (generic reverse engineered specs, basic accessibility framework, game automation framework, and i definitely learned a lot, plus it does work pretty ok)

I haven’t been able to figure out a way to release in a way that fits my ethical framework, without also resulting in people insulting me (which I don’t have a lot of room for in my life right now). I’ll happily take suggestions though!

I’d love for this to not be wasted effort, especially because of the accessibility enhancements for a beloved but proprietary game.

Tl;dr - Choosing parameters for ECC is very important but also very difficult. Also, ECC is more resistant to quantum algorithms than RSA.

I didn’t know about the PQC readiness of ECC so thank you!

To my understanding, picking the right ECC parameters is critical to ensuring large enough entropy that it can’t be brute forced. There are a lot of weak and easy to compromise parameters, and a lot of trust has to be put in the standards organizations declaring which ones are “safe” like the NIST curves. Or you can choose your own, with a lot of risk associated.

There’s also the fact that I believe there’s more potential to leak info/expose side channels on the embedded devices running these protocols (I’ve personally had to worry at work!)

interesting about the security, it looks like ECC is arguably more secure against quantum algorithms? I first learned about all of this stuff about 10 years ago, and I only vaguely remember reading about the pqc resistance. Thanks for the update on that!

Edit: But I want to be clear I’m not a security expert, just some lady whose had to deal with embedded cryptography from time to time.

Ohhh so that’s what they meant by putting IoT nodes on the Edge!

And if I remember correctly, I believe it has more weaknesses (especially potential unknown ones) than RSA.

But it’s definitely more efficient on embedded hardware, and for sure still gets used in that space. Not that I’d know cough cough