Diff

If you're just replacing an existing sound, that's all you need. That "Shut The Insects Up!" mod I linked from inside the thread you linked only has these files: ├── assets │ └── game │ └── sounds │ └── creature │ ├── beesting.ogg │ ├── cicada-short-looping.ogg │ ├── cicada.ogg │ └── grasshopper.ogg ├── modicon.png └── modinfo.json Compare to this mod: ├── assets │ └── survival │ └── sounds │ └── creature │ └── bell │ ├── alarm.ogg │ ├── death.ogg │ └── listen.ogg ├── modicon.PNG └── modinfo.json Only real difference besides the asset paths (which are all correct) is the domain, like Brady said.

Not interested in your paper but post your GitHub, you working on anything cool on your own time?

No shade because a literal "Intro to C" class isn't actually required to know anything but thought it was funny you said this considering

Nexus is THE modding platform. VSModDB is just a lil guy.

If you want to have a good, productive conversation you should seek to not blatantly misrepresent the situation. They are banned, and stretching existing employment and losing control of all of your active passion projects into "free maintenance and a job" distracts heavily from what I think are understandable points you have to make. What are they

Deleting attachments means nobody else can see them, even if they had a direct URL to the uploaded file.

Not possible to do exactly what you're saying currently, but if you go into settings there's the ability to filter out mods that have been reported as "AI/low-effort." Unfortunately this requires people to report it, and I don't think many are.

Have to play with it, flagged mods simply disappear.

Oh wait you're not MirthOfManus, my bad. MirthOfManus said they installed it globally as the root user on SteamOS, I was asking about that because SteamOS often wipes changes to the root partition on OS updates.

Then I'm confused, if it was installed locally to the folder why install as the root user?

Did that solution survive OS updates?

You know bud I'm with the forums on this one. Maybe upload as an attachment?

Flatpak's probably the easiest solution. It works because Flatpaks bundle everything they need inside (more or less).

The server does trust whatever the client says, but should only be certain things the client is capable of telling the server in the first place. I can punch you, the cheat is that the server probably shouldn't let me punch you 20 times in under a second. I can mine a block, the cheat is mining 500. I don't have hands on an actual cheat mod to tear it apart, but based on those strings "Nuker", "KillAura", "InstantShot", those all sound like abuses of normal, expected actions rather than wholesale rewriting reality at every player's whim. RNG is not the kind of thing I would really expect the client to be able to tell the server about.

Wait, can we confirm this? Is it not all server-sided? I know the server is naive but I didn't think it farmed out actual RNG calculations out to the clients. Runs a little contrary to what I thought I knew about the server/client split, but I do go out of my way to avoid the networking portions.

Hey I put together a thing tonight because I was getting more curious about why ConfigLib wouldn't have crashed playerlists. Still investigating it, but on my way I made this: https://mods.vintagestory.at/notconfiglib It's a mod that will print in chat when you join whether or not the current loaded set of mods would have crashed with Config lib on a multiplayer server. If you check the Git history you can see it came from a file that was basically just AdditionalStuff.cs stuffed into a ModSystem. Since that initial commit, it's been stripped down, defanged, and spruced up, but still contains the same checks. Test it out if you're curious, let me know if anything blows up. On my machine it properly aggros at CNC and URL Radio but oddly doesn't aggro at playerlists... That kind of aligns with the total lack of crash reports for that mod, but I don't know why that would be yet. EDIT: PlayerLists doesn't crash because it's actually not obfuscated enough. Added some debugging to NotConfigLib and it reports that PlayerLists only has 20.8% short names the way ConfigLib calculates it, not the required 22%. For reference, CNC is 29% and URL Radio has 35%. That opens the question back up, is it a different playerlist mod that crashes? None of the other forks I checked had any obfuscated code at all.

@Thorfinn Found it. It's actually "playerlists" not "playerlist." There currently is no "playerlist," apparently there was some interesting drama going on with the original and its descendants. But after "playerlists" forked off from the original, it started obfuscating, likely related to being "merged with my own security addon" mentioned in the description. So, same thing as the other two. This is by far the most popular of the false positives, with 3500 downloads on the latest version. Oddly nobody in the comments complaining about crashes. Both of the other mods had people in the comments, and this one should have been ripe for it with it being explicitly multiplayer-focused. Not sure what to make of that. EDIT: Author confirms no reports of crashes, or crashes on their own server running the mod with one of the retracted versions of ConfigLib. I don't see how it escaped ConfigLib's wrath.

Separate things. Short names are just what ConfigLib hunted for and targeted. And specifically, short class and type names. Short variable names were beyond what it was looking at (Assembly.GetTypes()). The cheat mod, separate from its short names, operated by exploiting the fact that the server just kinda trusts clients to tell the truth. The cheat mod lied and said "why yes, I mined all 470 blocks in the vicinity in the past 0.1 seconds." "Hey, server, I just killed everything within a 10 block radius." The server doesn't check to make sure that's sane or possible.

Believe only internal references get scrambled. So like instead of CheatModSystem and CheatModDialog and CheatModConfig, you get a, A, and b. URL Radio for instances has a lot of normal names and only an interior core gets scrambled. Obfuscation like that makes it really difficult to fingerprint a chunk of code, especially when obfuscated names can change version to version. Today's q might be tomorrow's zN. If they had used longer names, or names that had a less consistent scheme, it could have been even more difficult to latch onto.

I haven't looked at playerlist yet, planning to this afternoon. The first two angered ConfigLib by being obfuscated. More than 22% of their types were 2 chars or less. That's likely the case for the third, but there's a small chance of other shenanigans biting here.

Those accounts are different beasts entirely. You can't sneak malware through code review. You can maybe sneak a vulnerability through code review, but that's primarily in memory-unsafe languages like C and C++. C# can't have memory unsafety holes accidentally poked in it just because you weren't paying close enough attention. XZ didn't sneak past code review. It was done by a maintainer where there was no code review at all. I'm deeply confused by this statement, a conflict in what way? Developer modding their own game with their own personal ideas without integrating them into main sounds like a great way to toy and experiment in a low-stakes way that can be trashed at a moment's notice.

What I'm not understanding is, who cares to tamper with it if it's not doing any additional detection or prevention? It's not doing anything the server couldn't already do, so there's no value to a cheater to even pay attention to it. They'll still get away with it until it's reviewed (which will be after the damage is done and likely after they've had their fun). And the other thing I don't understand is actually the same thing flipped, what's the gain vs a hypothetical anti-cheat that was purely server-side with no client-side component? Either they cheat and the server-recorded demo records the cheat and they get caught, or they don't cheat and fight fair and it doesn't matter, and that's it, there is no third thing. It just looks like a server side anticheat (which I like) with extra steps. In your poker analogy, in VS, the dealer does write all the bets. If the server can't be trusted then everyone's screwed. The server contains the only true authoritative record of what is happening in the world at any point in time. It's deeply centralized, and this client-side model doesn't make sense when the necessary data is already centralized.

If the demo file capture by the client doesn't matter, why is it capturing it? If the server is also monitoring all the actions and has to compare them, what's the point of sending everything twice? Sounds even more like it should just stay server-side and then your client side can never be defeated. So you've attested that the mod is installed, or that someone merely copied the handshake from the decompiled DLL or the open-source implementation. If the client isn't doing anything the server isn't already doing, I'm unclear what is gained. The client isn't seeing or sending anything extra, so it doesn't harm a cheater at all to just let it be. An LLM requires a massive amount of processing power. A neural network built for a task can be small enough to run on a microcontroller. In like 2016 I built one to detect bass kicks in music based on a small amount of messy audio data that I hand labeled in an hour or two. Basic machine learning predates LLMs and is a time tested technique for certain kinds of problems. I would never want to directly ban someone based on the output of one of these things, but it'd be certainly useful to flag them for manual review in your demo reel when they hit a threshold of confidence.

That's a nontrivial problem that large open source distros with large amounts of corporate funding took years to solve and complete the work on. Most of them still don't bother. It's not a setting they didn't turn on, it's the computer in its natural state, and it's the same situation that every game modding community out there finds itself in. You compile the same mod twice on two different computers, without taking explicit action to prevent it, you will have two different DLLs built from the same source, both equally correct.

Weird, with nicely rendered fat, the only other gotcha I see is that the rod can't be gold, silver, cupronickel, or electrum but your rod doesn't look like any of those. Like you said, hammer and chisel shouldn't be it either. Those only need 30-40 durability. I'm stumped.