So what I’ve read so far is that Sponge is added to the Forge mods folder on the server. Any other mods added have to be downloaded on the client.
What if mods acted like texture packs and could be downloaded from the server? It would seem like a more efficient and probably faster way of adding a mod for a server, especially if you’ve never added a mod before.
Thoughts?
I can see a downside to this so maybe only trusted mods can be downloaded.
This has been extensively discussed.
Basically: no. Go dig up the thread fore more info
To make it short, they will never allow remote code execution from the server. The way mods can be made, can damage your computer badly. They said something about a remotes repo with soak-plugin (/soak install worldgoard).
But I am sure you can read more about it here.
(Note: the information about soak is a bit spread over reddit and sponge forums)
I expected someone to mention something about malicious scripts in mods, hence why I suggested only trusted mods. So in other words, where we can upload plugins, a spot for mods with the same system.
Only downside to my suggestion is that a small piece of code an easily be looked over. I’m actually starting to think against my own idea as I’m slowly coming up with ideas on how I could bypass it and it scares me…
Yeah thats why I mentiond something about the soak-plugin. I don’t know who will make it, but I saw something on reddit about it. Basicly they want to make a secure repo with soak. And allow servers to install plugins that way. And lets say clients have the soak plugin on them (manually). They could download client-addons when they join the server. But its something that is still heavly discussed (and honestly I am not following it anymore).
Any server owner would then be able to install malicious content on User’s computer.
The only way the would if it was only from “TrustedMods.spongepowered.org/Optifine.jar”
And all mods on that would have to be VERIFIED, before being published for public use.
HOWEVER I highly doubt this will happen.
The only way this would really happen is to have a repo similar to the way bukkit did, except with mods, then servers could request that clients download the mods from the repo, then the client could download and verify the mods. The biggest issue here is security, you do not want a malicious server doing remote code execution on your system. Mods would have to be carefully inspected to be added to the repo, this is hard, time consuming and people simply don’t want to do it and automatic scans can be bypassed. Direct transfer from server to client is essentially out of the question. Like it has been stated before, there is a low likelihood of this ever happening due to the amount of persistent work it would take.
The biggest problem is actually, that most of minecraft’s developers (I don’t want to offend anyone) aren’t security specialists. And even if they where, their is always a way arround it. Even with a repo, we will have to carefully allow mods their. I am pretty sure hackers will try everything to break the system.
Being realistic I don’t think such system will ever been made or widely used. The risks are just to high. If forum members from sites like: http://www.mpgh.net/. Even take the time to manipulate a simple shooter like robocraft. I am sure they will break our systems as well.
Its stupid, I wish this world was less corrupt and that we could freely make stuff without being worried, but sadly enough…
Unless someone can figure out a bit of hackery to load in forge via a resource pack the vanilla client will not support it. And in that case it will be less trouble for the end user to download a launcher like Technic (since it is open source you could offer a modified download of it with the servers pack preadded)
if you want a pile of sponge plugins on your client you will have to use a launcher such as FTB or technic for distributing these in an easier to use fashion.
under no circumstances will the sponge team be allowing ANY code downloading on the client inside sponge itself.
Forge needs to be secure in order to do that because if Sponge has a repo for mods (repo.spongepowered.org), a hacker will make a plugin that exchanges the repo for another (repo.hacker.org for example). This is why Forge must be secure to block some malicious code.
Besides the Forge issues with the order of initialization, etc. the basic issue surrounding this is the order of trust problem. Even if a trusted site were to be set up with the equivalent of certificate exchange for trusted download, the problem is the level of examination of the code to ensure trust. There have been a number of instances, especially lately with different, diminished staff, where Bukkit has allowed malicious plugins to get by their inspection process and be published for download. This will inevitably happen with Sponge too despite everyone’s best efforts, and allowing auto-download of a malicious Sponge plugin would only magnify the problem.
Wouldn’t be Java SecurityManager (https://docs.oracle.com/javase/7/docs/api/java/lang/SecurityManager.html) enough to make running downloaded code safe?
Also Coremods would not work, and also mods thst register things in preinit (anything that adds blocks etc) would not work properly, as preinit already happened, and tricking it (faking a FMLPreinitilazationEvebt) usually ends poorly.
Almost all browsers use a security manager, yet java as a plugin is still quite a risk. Trusting the security manager only is like pitting Deep Blue vs Edar Allan Poe in a poetry contest
~Edit: Edgar Allan PIE???
Basicly like Spoutcraft?
I’ve studied the code for Resource Packs and there is seemingly no way to do it.
I was close though, but it safely names the file such that it can’t be a .jar and I couldn’t move it out of the server-resource-packs directory.
Could you have the .jar within the zip?
You can, but it wouldn’t do anything. Minecraft will only look for certain files within the zip, and at no point does it extract the contents. It does not care about any files that it does not recognize.
I suppose that’s for the best. I have a feeling nearly every <13 year old with a Minecraft client - as well as a few of the older players - would be screwed to the n-th power if code could be run from resource packs.