Non-sequential Asset ID Generation Coming Soon

[Hexcede]

@weakroblox35

It’s not hostile if it’s in the right hands, I know a person who managed to somehow find 10 hidden inappropriate places disguised as models (MainModule) using that method, all were reported since Roblox doesn’t auto-moderate or check any big files being uploaded (>= 10mb)

It is absolutely hostile, you’re making potentially hundreds or thousands of rapid API requests to find content, there is no reasonable definition by which that isn’t a hostile/unreliable way to obtain an image ID from a decal.

Arguing that you can also “use this for good” is not particularly relevant because my argument never had anything to do with this kind of thing, nor am I talking about what you can do outside of a production game, I’m talking about within a production game. This is a far deeper problem than sequential asset IDs, and having sequential asset IDs is definitely not a proper solution for it.

[weakroblox35]

@Hexcede

It’s an rbxm like most things uploaded to Roblox are, and like pretty much all content on Roblox, if the client can access it (required for the content to be visible)

Expect animations doesn’t require any authentication or anything unlike models.
Even meshes and audios don’t require any authentication (Through audio can be fetched using web browser rather than any api calls)

@Hexcede

This is a far deeper problem than sequential asset IDs, and having sequential asset IDs is definitely not a proper solution for it.

Exactly but since there is no proper solution implemented by the team (auto-moderation actually checking big files for inappropriate names or properly blacklisting), reporting and asset logging these models can only do for now.

About auto-moderation, you can hilariously use an api call to actually check an asset content by yourself btw. I don’t know why roblox doesn’t do this automatically.

[Hexcede]

@weakroblox35

Expect animations doesn’t require any authentication or anything unlike models.

Yes, but animations have to be loaded by the client in the first place. Models are different because they are instance content that can only get loaded by the server, animations have to be able to be loaded by the client.

@weakroblox35

(Through audio can be fetched using web browser rather than any api calls)

This is just making an API call, but in the browser. When I say API call, I mean via HTTP requests to the different asset delivery endpoints that Roblox uses to fetch asset content. You can’t make something private without actually making it private, you can’t have animations not be loadable by the client without making animations not loadable by the client.

If you insert a model into a game it can be stolen in the exact same way that an animation can, the difference is that an animation has to be loaded by all clients so that they know the keyframes to play back in the first place.

You can’t get rid of this without getting rid of the client’s ability to play the animations unless you are suggesting that the server should be downloading the animation content and then having connected clients then download it from the server, which has its own large set of flaws and complications for a fairly insignificant gain.

Notably, this would mean that all of this content delivery has to get routed through Roblox game servers which would be pretty inefficient and would ultimately slow down asset loading and, if you actually want to protect the assets, prevent you from being able to cache it at all.

Caching is also another way content can easily be stolen, I have even written tools experimentally that can rip unions and meshes out of the cache, and even recover the contents of scripts included in the parts that made up the unions since that data is part of the union (for the purpose of separating the union).

@weakroblox35

About auto-moderation, you can hilariously use an api call to actually check an asset content by yourself btw. I don’t know why roblox doesn’t do this automatically.

I am not really sure I understand what you mean by this at all, Roblox already does automatically check the contents of models.

@weakroblox35

Exactly but since there is no proper solution implemented by the team (auto-moderation actually checking big files for inappropriate names or properly blacklisting), reporting and asset logging these models can only do for now.

Okay but that’s still definitely not a reason to justify sequential asset IDs, the ‘feeling’ that sequential asset IDs are somehow necessary here is a symptom to the greater problem of moderation tooling.

[weakroblox35]

@Hexcede

I am not really sure I understand what you mean by this at all, Roblox already does automatically check the contents of models.

No it doesn’t, it only does for small files but not big ones.

[tnavarts]

To update, thanks for the feedback: We’re investigating what options we have to solve the decal → image issue.

[RaterixRGL (Raterix)]

I agree, if I can insert the asset from the toolbox, what’s the difference when using InsertService? It’s an annoying limitation and I want the old insert service back. There’s already work arounds with people using the “require” feature and parenting models to the MainModule. Seriously just remove the limit on InsertService already.

[bostaffmanbulgaria1 (Lua_ProgrammerBG)]

Whatever is possible for getting an image id from any and all decals would be great.
If it could include information about the dimensions it’d be even cooler. As right now the only methods to get actual image sizes is via 3rd parties or unreleased features(editable umages)