Sending Mods To Client

Sponge Sponge Development
22

So like the iOS walled garden?

23

This could work except for the fact that if a server really wanted to use malicious mods they would just upload the malicious mod to the said repository, then add it to the “server mod list”.

As far as config files go they could be downloaded straight off the server and kept in a folder tied to that specific server. Since config files can’t be executed there is no real security threat there.

24

I sort of understand the security concern here, but isn’t it the same security concern you have browsing the internet? You go to off the wall porn or warez sites and you’re going to get a virus. You go to off the wall minecraft server and just let it install anything it wants, any you’re going to get a virus. That’s life; do dumb things, suffer the consequence.

I just want to make things easier on the new users of my server.

25

Yes I know that, and the idea behind the “Official” repository is that each mod would have to be given the OK by a moderator (probably from Sponge) before being available on said repository. The only problem is that it would take forever for someone to go through all of the mods…

26

Oh, sorry for the misunderstanding.

27

Do something like the Steam Community system for obtain mods like GarrysMod, have a rather large notifier on the top of the download page stating whether or not the mod has been “verified” as safe or flagged as a virus.

2 Likes
28

Going off of this, I suppose a neat idea would be that when a player joins a server, the server sends a list of required client-side mods before logging in. These can be downloaded off the bat automatically in game, or the mod in the list could be clicked on to open a tab in the players browser where the file is located (or an alternate website such as the modder’s website) and downloaded manually. In this said list the verified mods could be shown. Here optional mods that are not required, such as minimaps, could also be chosen for download. After the mods download, the config files could be sent directly from the server, since they do not pose a security issue.

29

I like the idea, but It won’t do any good if you’re connecting from inside minecraft.

30

A prompt system would be very good, to prevent malware. Sponge could do certifications, like you click the “View Certificate” button and it takes you to the Sponge plugin download page, where it should show whether or not it is certified.

31

I realized my system would be rather impossible without a client-side mod to begin with, but that could be changed with a custom installer similar to forge for easy first time setup. I really like ColonelHedgehog’s idea. The said certificates could withhold information such as date approved, mod version approved, who approved it (To track malicious moderators), and a vote on whether the certificate should be reviewed/is it safe.

32

I feel like we’re actually making some progress here. Now we just need a MODERATOR to see what they think…

33

It might be effective to get on the IRC channel and ping a developer, unless you can pm a moderator over these forums.

34

You actually probably won’t get a virus if you’re using an up to date browser. In addition, the risk actually comes more from ads that all on most of the Internet – those have, on many occasions, sent malware to users.

With Minecraft servers,

  1. You can’t even really tell whether a server is trustworthy.
  2. Without any sandboxing or validation, there is utterly no barrier at all.

Garry’s Mod addons are sandboxed.

A certificate system ultimately requires that we approve projects.

36

@sk89q:

Well… yeah. Sooner or later, you’re going to need to have someone go through and approve projects.

I’d say sponge has a large enough community that this would not be a problem.

2 Likes
37

IMO the current system of the user downloading mods or a modpack (manually or through a launcher) to match the server they want to join is, while not ideal, working pretty well in practice.

We may be able to provide a client mod that lets server do extra things

An interesting idea, might be worth doing (and would certainly be more sane than sending scripts to clients - just send specced-by-Sponge plugin messages that do a specific thing).

1 Like
38

I mean in the same fashion, basically downloading automatically from a trusted source, and alert a user if it is not a trusted mod or has been flagged.

39

There may be sufficient lag time between “a lot of people downloading it” and “someone discovers it has a backdoor.”

Note that I am not against (or for) approvals at this point. We have not gotten to this issue yet.

1 Like
40

It would probably lag/hang the client if the feature loops through the jar contents.
Another thing to note is how would the feature detect what mod is installed without some kind of log of installed plugins as client side mods can modify any file in the client jar file.

  • TangentSpy
41

Actually, only allow trusted would probably be a better default.

42

Honestly Id love to see mods auto download but it is very clear that that is unrealistic.
so the next best thing would be a webpage where server admins can create a group of mods from some mod/plugin index. the server admin is given a short Code. When the client joins and does not have the required files the short code ( well i guess its really a url ) links them back the the group of mods on the site where they can manually download each mod and install them.

That way users can decide for them self if its safe the same thing server owners have been doing for years putting things on their server. looking back at bukkit I only know of two plugins that ever did any thing nasty.