This topic was automatically opened after 11 minutes.
This feature is just great, there isn’t much to comment on. I’m glad that you guys are doing changes like these!
It would be nice if it also showed that name of the asset. For example, if I required a module with the asset id of 10 (yes I know it’s not real), and the model’s name was “Gun Module”, it would be good if I could see what that name is if I didn’t know it already (like in a gun kit for example). So if a malicious script requires a module script that ill harm your game, and the model’s name is “ue2138saj218hs”, that would be very suspicious, and I could go to the script that requires the module, and delete it. I would already check every script that requires a module from its asset id, but having it display the name would make seeing if it’s safe or not would be even easier.
53 Likes
Regarding Modules, are there any updates to sandboxing 3rd party closed source modules? During the time this feature was removed I heard either promises or ideas about securely adding 3rd party closed source modules to games.
This feature demonstrated in this topic can help tackle backdoors which was the main idea of the removal of 3rd party closed source modules aswell.
12 Likes
Is there anything stopping a required module from adding fake-looking similar messages to mislead the user or spamming other messages to obscure the message?
17 Likes
It would be nice if we could disable the output of these as I use asset id requiring quite a lot, but I also want my DevConsole to be clean.
23 Likes
This is an amazing feature to have, but was it ever considered for this to instead show in a new dedicated developer console tab instead? I feel like it would’ve been far better as its own tab than a print because those can easily get buried by a malicious script simply by spamming prints after the require.
38 Likes
Some of my old projects reuse code and module scripts will require each other so this will only make some things noisy. I was even going to make some Project Sand Cat modules that will eventually play into a bigger module be in that module for development of the bigger thing. Now when I finish Project Sand Cat the finished product will have 100 require messages from unique modules using each other.
7 Likes
This is a great feature, and will hopefully make it easier to identify malicious code in modules. Unfortunately, this can easily be bypassed if the module has several hundred statements that print “Requiring asset” followed by random numbers. It would be great if there was a dedicated way to search for required modules without having to use the search box.
7 Likes
probably the feature is great any updates to doing for changes like about asset seems like messages are require introspection for his feature some of projects to module scripts anything about only time when easily to get script simple there a reduce spamming and other thing about a message could believed that requires make it’s safely than modules message.
7 Likes
According to the screenshot posted in the OP, you can see that the module’s require was printed before the module could print anything. This means if for any reason a malicious module was spamming the output, you can easily determine the asset id by going to the start of the spamming, provided you can scroll to the beginning in time before the history is chopped off. The only downside is if the module delays the spamming but even then you can just go through the modules that loaded before the spamming which shouldn’t be too hard unless for some reason your game has thousands of modules.
6 Likes
This isn’t necessarily true. The spam could come from the script, which after spamming requires the module.
Either way though, it would be very clear which script has malicious code.
Edit:
It would be nice though if the messages went into a different category so we could search for them even if there is spam.
(currently they go into “Log” like print statements)
17 Likes
A free model that reposts a another gun model could modify the gun controller module that so happens to be another model (like the official ROBLOX RPG models do) to spam fake require messages after some real log output from different things that will happen like the raycast debug output and then require the real module in the middle.
6 Likes
Oh that is a good point. I was only thinking of the spamming coming from the module and not the script that required it. Thanks for mentioning that!
6 Likes
The malicious script can spam enough so that the require print gets erased because there’s a limit to how many logs the console shows before it starts removing older ones so this is not true.
7 Likes
Yes I realize this which is why I mentioned:
But as another person pointed out, the printing could be from the script that required it and not the module which would be much harder to identify the module that was required.
However, I want to mention this. If for any reason your game is having this activity, shut it down immediately and review your game content. Do a recursive search through all content in the game for scripts of any type and look through them all. If you are careful enough, this issue shouldn’t really be happening in your game in the first place, but I do understand that it is easy to overlook something, especially if you are a beginner developer.
8 Likes
either way this would be far more useful a feature if it was displayed in its own developer console tab instead where there is a guarantee that it won’t ever get cut off or not shown to the user. As of right now, I’d say my own plugin I made a while back does a better job at showing what code in your game is using requires.
8 Likes
Could we have an option to disable this?
36 Likes
What effects will this have on obfuscated modules?
8 Likes
Probably none since it still calls require
5 Likes
Absolutely love this, will help a lot in reducing the spread of malicious assets!
I would, even more, love it if there was a place in the console (serverside) that would list all required modules in a specific game, so a malicious module can’t fill the server logs in an attempt to hide, as well as the order in which they were required and if they were required by another module.
Either way, keep up the great work! Love seeing these sorts of things get added.
14 Likes