DC++ 0.883 is out

This year’s new DC++ release has just been put out. It is primarily a bugfix release, addressing some minor but rather complex problems that have existed in the client for several years.

The changelog in the DC++ help lists the important bug fixes, with links to the official bug tracker entries where all the sympthoms and reasons behind the fixes are explained in detail.

The following are the most notable additional, user-visible changes:

  • From now on, DC++ supports connecting to secure NMDC (with nmdcs:// URI in the address) hubs but still doesn’t, and likely never will, support secure NMDC client-to-client connections. The reasoning behind the decision, as to why so and why now, is available and discussed in this bug entry and in particular, in this comment.
  • Some public hublists allow hub owners to specify an alternative, secure hub address beside the main one (mostly for having an option to connect to the same hub using an encrypted connection). With this release, DC++ starts supporting this feature by displaying the more secure address option in the hub lists, when it is available.
  • The MiniUPnPc port mapper gets a Broad device detection option, introduced mainly as a response to this support conversation. The mapper code now also returns better identification of the device to the logs, which can be used to determine exactly which device a port-mapping operation happens on.

For complete information on all of the fixes, please refer to the list of commits. As usual, DC++ 0.883 will be advertised as a testing release first for a small set of the userbase, starting today. This new version should go stable later, in case no problems are reported in the testing period of roughly two weeks.

DC++ 0.882 is out

A new version of DC++ has been released today, wrapping up a year of fixes and improvements.

The following are the notable changes that’s been made in the user interface:

  • The Find text function within contents of hub and private chat windows now offers selected or at-the-cursor text by default to search for
  • Similarly a “Search in hubs” by text and TTH context menu function has been added to most textual content windows for easy searching all connected hubs for chat contents
  • From now you have a quick way to copy and share magnet links of freshly indexed files, right from the System Log entry by using a new item in the window’s context menu
  • A popular request has been filled with adding an option to disable DC++ window previews in the taskbar rather than using the global setting of the operating system

Some under the hood improvements:

  • Implemented the ADC encrypted active search results feature (SUDP). The feature is enabled by default on all secure ADCS hubs for search and result transfers between the newest DC++ versions
  • More secure processing of XML files coming from foreign sources
  • No loss of partially downloaded data in case of an operating system shutdown during non-segmented downloading of large files
  • More efficient hash data rebuilding
  • Segmented download initial chunk sizes has been tweaked to align with current average internet connection speeds. Please note that due to the special nature of the algorythm DC++ has for multi-source downloads, this change should effectively disable segmenting for the second chunk and on for downloads having only one source in most cases, due to the high bandwitdth availability of most of today’s internet connections. This change might also help you dealing better with those anti-segment evangelists – a few are still around after 25 years…

For a complete list of fixes, as always, please refer to the changelog or the list of commits. As usual, the release availability will be advertised only for a small set of the userbase for now. If no problems are reported, DC++ 0.882 will be set as a stable release within a few weeks.

Vulnerability disclosure: remote code execution in Scripting Plugin

A new version of the Scripting DC Plugin has been released today fixing a serious vulnerability that allows attackers to remotely execute any code in the host system running any DC client compatible with DC Plugins, such as DC++. The nature of this vulnerability can cause various security issues, for example it makes the attacker possible to aquire any files from the host’s mounted filesystems.

For successful exploitation, Scripting Plugin version 1.0 should be installed AND enabled in any DC client / versions that support DC Plugins. DC clients having this particular plugin not installed (or installed but as long as the plugin is in disabled state) are NOT vulnerable.

For users running Scripting Plugin version 1.0 it is highly recommended to upgrade to version 1.10 as soon as possible to get protected from this vulnerability.

Please note that a vulnerable function named LuaExec has been completly removed from the plugin’s scripting API and that this release also updates the internal Lua engine to the latest version, both of which changes may cause incompatibilities with existing customly created Lua user scripts.

We’d like to thank RoLex of Team Elite for reporting, sharing proof of concept and recommending fixes for this issue.

DC++ 0.881 is out

A new DC++ release has been made available to download this week. Version 0.881 continues to be a largely code maintenance release, however, this time it also comes with some improvements on the user interface as well.

First and foremost with this release DC++ is moved to a modern compiler platform that produces an executable that shoud be considered secure and acceptable by modern Windows versions long term, with their default security settings. Since these defaults can change and go stricter at anytime it is highly recommended for users running Windows 11 to upgrade their DC++ to version 0.881.

There’s also a revamp of many icons throughout the user interface which makes DC++ more fit visually to modern Windows themes. An away status indicator overlay is also added to the taskbar icon. The look of the list of users and their details in the Users window has been modernized as well; more of this kind of improvements to come in the next release.

The optimized (64-bit) build is now compiled with use of SSE4.2 CPU instructions making further improvements in performance for those with capable hardware. We still provide a legacy (32-bit) build for users with older computers.

Plenty of supporting libraries that DC++ has built in have also been upgraded to the latest and greatest versions, improving security and stability.

There are also many less important or unlisted improvements; for a complete list of fixes as always please refer to the changelog or the list of commits.

As usual, the availability of this new testing release will be advertised at the start of the program for a small set of the userbase from now. If no bigger problems are reported, DC++ 0.881 will be set as a stable release within a few weeks.

DC++ 0.880 is out

The first DC++ release that brings a few notable changes since last fall’s version 0.870 has been made available to download this week. Version 0.880 marks the start of a new era, an active maintenance mode if you like, that we announced roughly a year ago. Along with that line there are no new significant functional improvements to be expected in the foreseeable future – we focus on possible speed and resource optimizations, bug fixes, compatibility as well as to keep the program up-to-date security wise. So finally you get the first pack of those improvements with DC++ 0.880.

Here are the most important changes, the already announced ones listed first:

  • DC++ is being released under GPLv3 from now.
  • Binary distributions split to optimized and legacy with according hardware requirements
  • Used a new updated compiler version for better performance that allowed optimizations for speed, compatibilty with modern Windows versions and more.
  • This version introduces a new stable hublist server.
  • Fully restored the use of an up-to-date GeoIP country database service, the one allows you to see what country a DC user is from, determined by their IP address. Country info display was absent or has relied on a pretty outdated static database in the last few years so this goes back to normal from now.
  • Hublists caching have changed according to the joint proposal of all hublist server owners: downloaded cached lists are set to expire in 24 hours from now by default. But this simple method alone would break the original purpose of the hublist caching function which has been introduced years ago to help users finding public DC hubs when hublists providers are out of service. So now we implemented a change with the original purpose in mind: cached lists are deleted only if a hublist refresh is successful. When a hublist download attempt fails or the resulting list is invalid the proper cached copy of hublists are being kept (even indefinitely e.g. when the source server is discontinued).
  • Added a safeguard to attempt outgoing ADC connections on IPv4 only if there’s no IPv6 connectivity available. So far this decision was based only on information coming from hubs which, in case of improper IP address information supply, could break transfers and searches in DC++. There is at least one ADC hubsoftware that has such a buggy behavior triggering the issue so this change actually fixes existing problems already experienced in the wild.

There’s also a few less important or unlisted fixes improving security, stability and usability; for a complete list of fixes as always please refer to the changelog or the list of commits.

The availability of this new testing release will be advertised for a smaller set of users who are running the latest stable release of DC++. If no severe issues arise, DC++ 0.880 will be marked as stable within a few weeks.

DC++ license change

A quick but important notice: from version 0.880 (release imminent) and on DC++ will come with General Public License version 3. The license upgrade has been done with the written approval of Jacek Sieka, the original author and copyright holder of DC++.

This change is important for the future maintainability of DC++ since some external data sources and (future versions of) libraries (will) require a compatible license. The change should be equally important to projects using code from DC++ for the same reason.

DC++ 0.880 will introduce new build names, require SSSE3

DC++ has already introduced CPU opcode feature requirements in the past when those features were widespread enough in various PC hardware the program had been used on. We already require SSE3 since DC++ version 0.863 and SSE2 since 0.861. They have brought siginificant advantages and optimizations to the code as you see in the linked posts in detail. We added those optimizations carefully back then, knowing all the features in case had been already widely introduced in all CPUs manufactured in the previous 10 years or more so it shouldn’t have caused issues for the vast majority of users who care to keep their system and software up to date.

The obvious step forward is to require SSSE3 to gain more advantages but there’s a caveat: while Intel introduced this feature in its client CPUs in 2006, AMD has added it only surprisingly later, in 2011. Aging of PCs are knowlingly slowed down in the recent years so requiring this feature would make the latest versions of DC++ unusable on many old but still working PCs and we’d like to avoid that. At the same time, if we decide to require at most ~10 year old CPUs now then we can go much further with optimizations as there are plenty of other new CPU opcodes are supported by the processors that has been manufactured in this timeframe.

Therefore we decided to make a difference in optimizations between the two available builds of DC++: the 64-bit build, named “Optimized” from now, will require a CPU that is manufactured in the last 10 years going forward whereas we plan to make the 32-bit build (now called “Legacy”) remain usable on pretty old (currently 15+ year old) computers and 32-bit client editions of Windows. We plan to release this build as long as there’s some form of official support of 32-bit Windows editions exist.

As a first step foward the Optimized build of DC++ 0.880 will require an SSSE3-capable 64-bit CPU, which is basically anything newer than Core2 from Intel and FX series (Bulldozer architecture) from AMD. We plan to add more feasible CPU opcode optimizations in the subsequent releases of DC++.

This also means that from version 0.880 and on, users running 64-bit Windows versions on older, non-SSSE3-capable hardware will have to use the 32-bit Legacy build of DC++, even on 64-bit CPUs.

We added an automatic, completely seamless mechanism to the installer of DC++ that decides what build is best for the users’ system and that will be offered by default in the options at install time. Those, however, who like to use the portable releases have to be cautious. We’ll update the informative readme file in the download folders for help the decision of what build to download.

We release these two builds from now as predictably there would be not much demand for 64-bit releases targeting older CPUs, even less for 32-bit ones targeting newer processors. However, if you’re in this unlikey situation for some reason then do speak up in the dev hub and your request won’t be denied.

DC++ 0.871 is out

A new testing version of DC++, 0.871 is pushed out today with only a few but very important updates of security and stability:

  • Fixed a bug that restores web connections to certain servers with multiple hostnames, unfortunately including our SourceForge host server. This means that we’re unable to show the usual announcement of the available update at the start of previously released DC++ versions – therefore everyone should do the upgrade manually this time by visiting our official project host website’s download page. Please make sure, for your own safety, that you always download DC++ from the official site and not from other 3rd party websites search engines may suggest.
  • Updated the secure connections library (OpenSSL) fixing a serious, rather easily exploitable issue that can allow malicious DOS attacks. This should certainly impact all released DC++ versions since 0.851, but older versions from the last 15 years might also be affected.
  • Added a new, opt-out mechanism that time to time informs a random subset our userbase about possible new testing releases, similarly as it is done for stable releases, at the start of the program.

This important release should be marked as stable within a few days. Please everyone upgrade as soon as possible and due to the circumstances, this time, if you can, help us with encouraging others to do the same. Thank you!

DC++ is 20 years old today

In the beginning there was NMDC, as its name says (Neo-Modus) a new way of file sharing. It was a quite good, if not revolutionary idea of its time but a bit clumsy and low-quality implementation of a business model that wanted to get revenue through displaying ads in its client software. NMDC could be used for sharing of files using a community hub capable of controlling direct file transfers between its online users and also relaying searches and instant messages. This system of direct file sharing built around online communities has quickly become a success at the end of the 90’s, despite its clumsiness and annoying limitations.

The early years

In the fall of 2001 one DC user, a secondary school teenager, thought he could easily make a much better, ad-free client for this network and that it would would be a fun project for him to improve his skills in C++ programming. So DC++, an open source replacement of the original Neo-Modus client has born, exactly 20 years ago this day. And the rest is history…

DC++ had rapidly become a success. Many users switched to it and enjoyed the new intuitive interface, the slick and fast look-and-feel, the new thoughtful functions like the ability of connecting multiple hubs in parallel. Neo-Modus had put out a new versions of its client as an answer, trying to amend the limitations of the original one but the effort was completely futile – by that time DC++ had already become the go-to client for the DC network.

As it happens with most open source development, with time, contributors appeared and helped to add their ideas and fix bugs in DC++. Many of them just came and went but some remained, giving more and more input and help for the original author to make DC++ better and better. Somehow, the changelog of DC++ preserved some of what that early development was like, it is a fun to read from the distance of so many years, especially for those who hadn’t been around DC that time.

But not all of those outside ideas and directions were accepted to DC++. Many people wanted to go to different ways and this can be easily done in open source; soon, there was no shortage of various forks of DC++, some existing just for the sake of a few additional functions while others went much further, to different directions adding complete set of new features and optimizations. But, with the exception of the few examples, most of them were still built around the code provided in DC++ as a base. Many forks were short-lived, having been abandoned within months or years but a few ones are still remained being developed or at least maintained these days.

These were the years when DC as a file sharing network flourished; public hubs with overall usercount in the hundred thousand magnitude and also a lot of smaller private communities.

On the pinnacle of file sharing

Once DC++ achieved the initial target of being a fast, full-featured, easy-to-use NMDC replacement, it was time to improve the initial system created by Neo-Modus. The protocol (1), (2), connections, file transfers were insecure, especially the latter; file identification and corruption problems were an everyday thing in DC. For example, files were identified by their names and sizes only so searches for other sources for the same file many times came up with another file of the same size, resulting a corrupted download.

This needed to be fixed and the fix came in the form of Tiger Tree Hashes that allowed the files to be properly identified, searched and verified after download so no corrupted or arbitrary content would arrive anymore to your computer. It’s still the same today; it comes with the need of hashing files before sharing, but it provides the ultimate safety and integrity. Some users and forks hated hashing and stayed behind – eventually, DC++ has become incompatible with these old clients and their stubborn users.

Interesting part of the story is that before the old ways of transfers without hash check is finally removed in 2006, the team has released DC++ v0.674, a version that’s become quite popular among large group of DC users – so much that even today it is still the most widely used old version of DC++ among those stubborn people mentioned above. Yes, this version was moderately stable at the time, an end result of an era in the development of DC++, still compatible with the old hashless ways. And since big changes were coming in the forthcoming releases, this one remained known as “the best” and “working” DC client for many. Nevertheless, DC++ 0.674 has soon become less and less secure and by today plenthora of vulnerabilities has been discovered in it. Also, being developed on a different era with the tools of the time, it isn’t that stable running on modern Windows versions, either. Our favorite support requests are when people demand to fix these instability issues on a 10+ year old version of the program when even most of the tools that used to build DC++ back then aren’t working anymore on operating systems of today. Of course the fix is available long time ago, only a version upgrade away.

Still leading the way to be secure

In the meantime, DC’s decline started to happen as in the middle of the 2000’s torrents became popular. The development of the Internet as a whole and the way torrents work fitted better for many file sharing users. In torrents, related group of files were bundled and client software were easier to set up and use, community members not needed to be online with a client software anymore to communicate with each other as messages were persistent on the web. IRC could be set up and used for those who missed instant messaging so this was a suitable replacement of earlier file sharing methods for many.

Yet the author of DC++ had his next big thing to realize. A complete change of the old commmunication protocol of DC, inherited from Neo-Modus, to a brand new one that is professionally designed, defined and documented; a standard protocol that is secure, aims to fix the design issues of the old one and is extensible with features, most notably with support of secure encrypted connections. The new protocol was named Advanced Direct Connect (ADC) and the first draft has been released in 2006. In parallel, with the help of many contributors, elements of the new protocol had been started to built into DC++ and also into its forks.

Thanks to ADC, by the end of the first decade of the new millenium Direct Connect was ready for the change to become a fully standardized file sharing system with safe and secure encrypted communications. Yet ADC has never taken off, really. Partly because it has came too late and the focus of file sharing has already moved elsewhere, partly because the reluctance of members of the DC network: key hub software developers, hub owners and hub list server maintainers. Many new ADC hubsoftware started to appear, written from scratch, some were just hobby projects while others showed promise and were high quality software. Since the DC network was reluctant to adapt to ADC, most of the new hub software were abandoned soon, and by now only a few that are still maintained. ADC has become popular only within small private DC communities due to its security and advanced integrity.

From development to maintenance

By 2008, DC++ had completely switched to free, open source build tools and libraries, not to rely on closed products of big tech companies. Meanwhile, inputs from the original author of DC++ started to phase out and eventually completely stopped. Under the control of a new leading developer DC++ had started to catch up with other DC clients in user-friendliness: new graphical UI elements, modern look-and-feel, easier setup and complete documentation of UI elements and functions, plenty of new functions like automated connectivity setup, secure encrypted private messages between users and so on.

And then, after a few years, the constant development that had characterized DC++ in its first 12 years of existence, just ended abruptly. In the following years DC++ had been slowly switched into maintenance mode, with mostly essential security and small bug fixes added to each release. Some other DC clients are still improving – changing and adding features to DC in their own ways but, at least to this point, remaining mostly compatible with DC++.

And this is where we are at today, 20 years after the start.

These above just semi-randomly picked important parts of the whole story. There were ups and downs, problems and solutions, you can find many more piece of the puzzle (mostly the technical aspects) throughout this blog. But the things mentioned here today are enough to show that key people created and worked on DC++ had been the most influential ones on the development of the DC network, at least in the best part of the last two decades. And while by now others shaping DC, almost everything is still based on the work of the people who have been in and around DC++ in these years.

And all the contributors to DC++, both ones who realized plenty of big ideas and ones with just small additions, they’ve done it mostly for having fun and to learn new things, improve themselves. They were many – you can find all the names preserved in the About box of DC++.

DC++ is still somewhat popular these days, around 10k people still interested on it in a course of a month. The program is still maintained, albeit in a slower speed and no ambitious feature updates in the plans. People remained with the project want to provide the safety, stability and compatibility and want to make sure that DC++ at least remains viable for some use cases. Hopefully, this will help users to keep having fun using DC++ for many more years.

Happy birthday DC++ and keep on sharing!

DC++ 0.870 is out

Later is better than never, years after the release of the previous version, a testing version of DC++ 0.870 is now available with various library updates for security and stability, mandatory TLS 1.2+ support, revised selection of public hub lists, fixed GeoIP country display and numerous bug fixes including one that has been present for at least 15 years.

The following are the most important, user observable improvements:

  • DC++ 0.870 and later will require TLS 1.2 or newer (currently only TLS 1.3)-based ADCS connections to hubs and other clients. This has already been announced before and is now done with this release.
  • GeoIP files aren’t deleted after an unsuccessful download and thus does not leave the user without GeoIP data for the session. The country data display in the Transfer View and Search window is also fixed.

The list of complete changes for this new version are available here.

This release has gone through the usual testing cycle and should be marked as the new stable release within a few days.

Updating and using the newest, most secure DC clients is always important so users who want to give the new release an early go can head over the DC++ download page and do the upgrade now.

Design a site like this with WordPress.com
Get started