I want to add the ability to make custom maps to my game at some point, but I just saw this post:
https://devforum.roblox.com/t/40000-lost-be-careful-making-games-that-include-freeform-user-creation/4801926
Which seems the user was banned because of someone made something bad in their game, and AI was not helping them at all.
This is scaring me from adding player made maps, is there a way to combat this?
Yes, use Local Script for all free-form creation and never send anything to server or from server back to client if it is related to free-form user creation elements.
Sending free-form creation from client to server works as long it is implemented safely, however I would highly advise against replicating, sending free-form user creation elements from server back to client, for example a save system for buildings which sends back creation to the client. Exploiter can take advantage of remote events and potentially redirect where free-form creation travels, so inappropriate creation in such case could be sent from client to server and redirected to another user.
If you absolutely need something like client-server saving system, it may be possible to implement it, but you have to be extremely cautious about it.
TLDR; As long as creation is made using local scripts, client side, doesn’t replicate to server, there should be no issues.
I’m planning to do something to fe2, where players can load in their custom made maps.
I’m guessing it’s a no go on that one?
Well, big games like Welcome to Bloxburg saves player created map. You can definitely implement this, but you need to make sure that the code has absolutely no issues.
that post also scared me and traumatized me not even joking i don’t know what counts as free-form user creation but i assume if i force my users to upload it as public free model and then load only older version of the model with insertservice then i should be safe from the ai moderation killing that dude cuz every asset would have to go thru my moderation before its allowed to be used in my game + it would go thru roblox model moderation at the same time
edit: however i will have to consider completely blocking f3x from being used and probably completely remove it since that would require my moderators to constantly moderate in-game
my game isn’t even that big im literally at the coding stage where its still private and im still testing it so i guess before full release i’ll disable f3x 100% and not allow anyone to use it
edit 2: before anyone asks “but how are you gonna use insertservice on free models you don’t even own yourself”? Well the method to use the InsetService:LoadAssetVersion on any free model is actually public knowledge and roblox allows us to do it freely
let me explain so first of all you have to use opencloud api to automate whitelisting process of the asset
You can actually automate this whitelisting process with this opencloud endpoint
You could use both either roblosecurity or opencloud api key but i would recommend opencloud api key more since you don’t have to setup a bot account
https://apis.roblox.com/asset-permissions-api/v1/assets/permissions
Once the asset is whitelisted you can load older versions of the asset during runtime with InsertService:LoadAssetVersion
I believe this is what would actually protect me from roblox moderation taking my game down because every update of the asset would also have to go thru my own moderation and you would have to send an update request for it thru my gui
