Perenyevackor Posted September 3 Report Posted September 3 I’m not a software engineer - I’m aiming for the most simple possible mechanism. This is a small, technical suggestion for ModDB. It’s not tied to any incident; it’s just a minimal idea to reduce future confusion around DLL mods. Non-goals No manual validation work for Tyron No restrictions on DLL mods No mandatory open source No anticheat or heavy systems Proposal Add an optional reproducible build check: Modder uploads DLL. Modder may upload source code to private storage (not public). ModDB performs a sandboxed build. System compares the resulting DLL with the uploaded one. If they match -> “source‑verified” tag. If not -> modder gets a notification. Scope Verifies that the DLL matches the provided source. Does not check for malicious logic. Does not require source publication. Does not block mods that skip this feature. Rationale A lightweight, optional trust signal that reduces misunderstandings without adding workload or restricting modders.
Diff Posted September 3 Report Posted September 3 Reproducible builds are unfortunately notoriously thorny. And so is automatically building other people's projects. Even solving both of those, there are some holes here that reduce the trust guarantee. If public source is not required, and source is not being reviewed, then you can just as easily upload evil source and the system will attest faithfully that your evil source is accurate to your evil DLL. This also doesn't stop someone from uploading private evil source to the ModDB that conflicts with what's in the public repo, but matches the evil DLL. 1
Recommended Posts