This could be great for detecting if a client inserts/removes a script from the character. Say a fall damage script which requires local StateType updates, or anything that can’t be done on the server like sending arguments for the mouse position to the server, this can even be used to prevent people from stopping their ragdoll effect since you can detect if joints were removed on the server. I’d argue it’s an effective way to prevent these exploits. That being said, you can easily make the change to place your values inside the player and keep those safe.
I currently use this replication behavior to my advantage by having the server add anti-cheat local scripts and scripts in player characters and kicking a player if I can’t find the script in their character. I also use this to destroy a large number of instances in player characters locally, to reduce the burden on the server (basically creating bullet tracers in player characters and having a local script delete the tracers). I would really hate it if this replication behavior were to be removed, as the way I’m using it allows there to be less lag on the server.
I have developer tools in my game that allow specified users to do certain functionalities during testing to simulate what an exploiter would do as well as interface to interact with player data, this includes the ability to delete parts. I am finding that when someone deletes an NPCs head, that NPC ends up dying despite the deletion of the head happening locally. The server recognises that said health of the Humanoid is also 0. This of course is very bad.
Could this be a result of the unintended/desired behavior you are experiencing?
I rely on this replication behavior to reduce the load on the server by deleting instances inside player characters with LocalScripts and having a timed deletion in a server Script using the Debris service in case the player doesn’t delete the instance when they are supposed to. This replication behavior is incredibly convenient (speaking as a developer who had a hard time converting from Experimental Mode). Personally, if I didn’t want something in a character to be deleted, I would use signals server-side to make sure to respawn players if they remove anything important (DescendantRemoving/ChildRemoved/AncestryChanged).
In my roleplay game, some exploiters are deleting their shirt / pants instances to walk around without clothes on, which doesn’t look very appropriate. Furthermore, some of them are going “limbless” by deleting their arms/legs.
There should be a CharacterRespectFilteringEnabled flag. This would also allow me to not waste time with programming server detection on things like this.
WE need more attention on FilteringEnabled, especially on things that we can prevent super easily!
Just ran into this same behavior. I was locally deleting a weld on the client as part of a client-prediction system for my game, only to find out it’s screwing with the game’s state on the server. This is a serious security hole - any code that relies on avatars not being completely broken could potentially be broken by an exploiter.
This should be a high priority to fix this extremely security-invading issue. We need more spotlight on these core vulnerabilities rather than introducing newer and newer features.
It could have ended badly if I haven’t found out this problem on my own.
BUMP
Uhhh, do you have any data to prove that? This sounds like nonsense.
The server will have to destroy the instances by itself anyway, regardless of which side initiated the action.
You can’t magically use the client’s computing power to do stuff on the server.