Diff

Have to play with it, flagged mods simply disappear.

Oh wait you're not MirthOfManus, my bad. MirthOfManus said they installed it globally as the root user on SteamOS, I was asking about that because SteamOS often wipes changes to the root partition on OS updates.

Then I'm confused, if it was installed locally to the folder why install as the root user?

Did that solution survive OS updates?

You know bud I'm with the forums on this one. Maybe upload as an attachment?

Flatpak's probably the easiest solution. It works because Flatpaks bundle everything they need inside (more or less).

The server does trust whatever the client says, but should only be certain things the client is capable of telling the server in the first place. I can punch you, the cheat is that the server probably shouldn't let me punch you 20 times in under a second. I can mine a block, the cheat is mining 500. I don't have hands on an actual cheat mod to tear it apart, but based on those strings "Nuker", "KillAura", "InstantShot", those all sound like abuses of normal, expected actions rather than wholesale rewriting reality at every player's whim. RNG is not the kind of thing I would really expect the client to be able to tell the server about.

Wait, can we confirm this? Is it not all server-sided? I know the server is naive but I didn't think it farmed out actual RNG calculations out to the clients. Runs a little contrary to what I thought I knew about the server/client split, but I do go out of my way to avoid the networking portions.

Hey I put together a thing tonight because I was getting more curious about why ConfigLib wouldn't have crashed playerlists. Still investigating it, but on my way I made this: https://mods.vintagestory.at/notconfiglib It's a mod that will print in chat when you join whether or not the current loaded set of mods would have crashed with Config lib on a multiplayer server. If you check the Git history you can see it came from a file that was basically just AdditionalStuff.cs stuffed into a ModSystem. Since that initial commit, it's been stripped down, defanged, and spruced up, but still contains the same checks. Test it out if you're curious, let me know if anything blows up. On my machine it properly aggros at CNC and URL Radio but oddly doesn't aggro at playerlists... That kind of aligns with the total lack of crash reports for that mod, but I don't know why that would be yet. EDIT: PlayerLists doesn't crash because it's actually not obfuscated enough. Added some debugging to NotConfigLib and it reports that PlayerLists only has 20.8% short names the way ConfigLib calculates it, not the required 22%. For reference, CNC is 29% and URL Radio has 35%. That opens the question back up, is it a different playerlist mod that crashes? None of the other forks I checked had any obfuscated code at all.

@Thorfinn Found it. It's actually "playerlists" not "playerlist." There currently is no "playerlist," apparently there was some interesting drama going on with the original and its descendants. But after "playerlists" forked off from the original, it started obfuscating, likely related to being "merged with my own security addon" mentioned in the description. So, same thing as the other two. This is by far the most popular of the false positives, with 3500 downloads on the latest version. Oddly nobody in the comments complaining about crashes. Both of the other mods had people in the comments, and this one should have been ripe for it with it being explicitly multiplayer-focused. Not sure what to make of that. EDIT: Author confirms no reports of crashes, or crashes on their own server running the mod with one of the retracted versions of ConfigLib. I don't see how it escaped ConfigLib's wrath.

Separate things. Short names are just what ConfigLib hunted for and targeted. And specifically, short class and type names. Short variable names were beyond what it was looking at (Assembly.GetTypes()). The cheat mod, separate from its short names, operated by exploiting the fact that the server just kinda trusts clients to tell the truth. The cheat mod lied and said "why yes, I mined all 470 blocks in the vicinity in the past 0.1 seconds." "Hey, server, I just killed everything within a 10 block radius." The server doesn't check to make sure that's sane or possible.

Believe only internal references get scrambled. So like instead of CheatModSystem and CheatModDialog and CheatModConfig, you get a, A, and b. URL Radio for instances has a lot of normal names and only an interior core gets scrambled. Obfuscation like that makes it really difficult to fingerprint a chunk of code, especially when obfuscated names can change version to version. Today's q might be tomorrow's zN. If they had used longer names, or names that had a less consistent scheme, it could have been even more difficult to latch onto.

I haven't looked at playerlist yet, planning to this afternoon. The first two angered ConfigLib by being obfuscated. More than 22% of their types were 2 chars or less. That's likely the case for the third, but there's a small chance of other shenanigans biting here.

Those accounts are different beasts entirely. You can't sneak malware through code review. You can maybe sneak a vulnerability through code review, but that's primarily in memory-unsafe languages like C and C++. C# can't have memory unsafety holes accidentally poked in it just because you weren't paying close enough attention. XZ didn't sneak past code review. It was done by a maintainer where there was no code review at all. I'm deeply confused by this statement, a conflict in what way? Developer modding their own game with their own personal ideas without integrating them into main sounds like a great way to toy and experiment in a low-stakes way that can be trashed at a moment's notice.

What I'm not understanding is, who cares to tamper with it if it's not doing any additional detection or prevention? It's not doing anything the server couldn't already do, so there's no value to a cheater to even pay attention to it. They'll still get away with it until it's reviewed (which will be after the damage is done and likely after they've had their fun). And the other thing I don't understand is actually the same thing flipped, what's the gain vs a hypothetical anti-cheat that was purely server-side with no client-side component? Either they cheat and the server-recorded demo records the cheat and they get caught, or they don't cheat and fight fair and it doesn't matter, and that's it, there is no third thing. It just looks like a server side anticheat (which I like) with extra steps. In your poker analogy, in VS, the dealer does write all the bets. If the server can't be trusted then everyone's screwed. The server contains the only true authoritative record of what is happening in the world at any point in time. It's deeply centralized, and this client-side model doesn't make sense when the necessary data is already centralized.