Removing Support for Third Party Closed Source Modules

As far as calling out about outsourcing Moderation. Reminder that Roblox has in house moderation staff and contractors. They never have publicly claimed outsourcing. So in that regard you’re spreading a rumor about moderation. Don’t do that. Trust me. Staff aren’t friendly when you throw around baseless claims.

That being said. I mean. You’re not wrong. They’d need a special mod team that understands what all the code does. They’d need to put a high price on the amount it costs to post code for sale on a market to get back out the cost of the moderation staff they’d need. Tbh not feasible in the long run.

Oops, my bad. I’ve removed it from the post; I thought it was said on an official source, but I guess not.

1 Like

This is a dubble-edged sword.

You just screwed all good free model developers,

but you protected games from being exploited due to the creator’s fault.

:confused:

Bots have claimed yet another feature.

If we keep going this way, this platform will loose it’s magical community,

and instead have a divided, toxic one.

9 Likes

Let’s not exaggerate the effect. A lot of people make free models, not just scripters. Even then, not all scripters are making closed source modules. This effects specific free model developers, not all.

1 Like

Roblox’s philosophy has always been to protect the majority of players over the minority. It sucks to lose private modules but it’s a quick fix that buys time for a better solution and system.

Honestly a better solution would be teaching developers how to find these, and to give them a lesson on how to better protect your game.

4 Likes

This was the right call, there were way too many people abusing this.

1 Like

My thoughts on the coming change.

What will this do?

The change will primarily kill old private module code, but kill malicious code and good code evenly due to their being two relevant groups of content creators.

Inactive

When Feb. 1st hits all of the models that require a private module from an inactive creator will break.

Active

When Feb. 1st hits the private modules will break or not by the creators choice. Malicious and regular code creators will decide if they want to protect their IP or go open source.

Summary

Older games and older models will be hit the hardest due to inactive creators. You could argue that older models have more bad code? I’m not sure why that would be the case though.

Newer games and models will be hit evenly across malicious and regular code since both malicious and regular code creators will use the same workarounds and similar reasons for going open source or not.

The change will result in more broken models and games, and less private module use, but not less malicious code.

6 Likes

What would my best option for selling things that require closed source modules now be? It’s not that I have API keys or anything like that inside my scripts, I use private modules to protect from people leaking my products. What would my best option be? Open-sourcing the products isn’t an option because I would make 0 profit if I did, what should I do?

This update angers me because you are completely disregarding the developers who use private modules innocently. You are destroying what some of us have been working at for ages with 0 alternative to use once they are removed. This update will cause more bad than good and it’s annoying that you haven’t taken any of us who use it legitimately into account.

8 Likes

There are most likely more people that reply on private modules for an innocent reason (not just the creators, the people that use the products that are created with private modules, too) than people with malicious intentions. Even after this update happening, exploiters will still use other methods to hide their backdoors and the same amount of people will still be effected. I do a lot of ro-aviation and almost every group use a plane system, or most other pieces of tech like a check in system, that use private modules. This update will kill most roaviation groups, among with so many others.

Yet while you are doing a “quick fix” you are also completely destroying tons of groups that sell products on this platform.

3 Likes

First and foremost, the idea that closed-source third-party modules should exist is inherently against the idea of having modules in the first place. It wasn’t the intention of modules, but as with all things given enough time, there will be those who find other uses for the feature.

Let’s take for example node packages, they are all by nature open-source but have a license included which permits the user to use the source-code in whichever way the developer wants. Whether or not this is respected is unknown, it’s a shot in the dark but it works.

I do see that some people who wish to conceal their source-code for whatever reason, be that monetary gain or just trade secrets. This DOES NOT and SHOULD NOT be allowed on Roblox for several reasons:

  1. Modules are not invincible from theft. A few years ago I and @einsteinK had found a bug which allowed for modules to be stolen with nothing more than a studio place. I believe still works to this day.

  2. If you want others to use features you’ve implemented in the first place, why should the source be private? All it does is form a toxic developer environment where people do not have the ability to learn from each other.

  3. Continuing on that point of toxicity, don’t take my word for this, but I’m fairly sure it’s against Roblox’s TOS to profit externally from anything hosted on Roblox (something to do with their IP).

I could go on, but I think the rest is obvious.

TL;DR - Your modules can still be stolen, if your work is that important to you then don’t make it a module for others to use.

The calls for a compromise do make sense, as some people do still want to have some control over their IP, and for that, I suggest the implementation of licensing agreements (https://choosealicense.com) for modules. Anyone caught breaking terms can be punished in whatever way that is fitting.

Whether closed-source modules were supported or not, it’s a shift in the mentality of Roblox developers which is required.

3 Likes

I think the problem some developers have with licensing agreements is that some people are going to ignore the licensing agreement and simply add it anyway - they don’t want anyone to even theoretically distribute their code. With Roblox models, the answer would simply be to contact Roblox and take it down - if the customers purchase an asset, it’s usually given to them through a .rbxm file, and it would be fairly easy to distribute that file again, and Roblox is no longer the host of the content. You would have to file a DMCA request to take down the content - some developers aren’t comfortable with that and won’t even take it that far, never mind the kind of hosting sites that don’t listen to DMCA requests.

Licensing legally protects developers, although some feel it is not enough and want their code to be hidden.

3 Likes

Is there anyway we could reconsider this choice? Many admin and gun scripts are going to break, and it’s up to the developer to make them opens sourced.

3 Likes

They won’t break at all, the only thing the change will do is force you to open-source your modules if others need to insert it themselves.

And if you read my post above, your IP is, of course, yours but licenses are the way forward. But to let others use your modules without them knowing what’s going on is both dangerous and silly. It’s for your own safety the change is being proposed.

I like your post and a lot of the points made are good.

I want my source to be private so I am able to profit off of my creation. Making the source public will just result in people using the source code so they don’t have to pay for the product/service.

Earlier you used Node packages as an example. I’d like you to keep in mind that most people who use Node are adults and they know how licenses work. Roblox is a platform designed to allow younger people to develop games. A child/young teenager probably won’t know how a license works, and even if they do, most people on Roblox don’t listen to moderation threats against your account because they think that “the moderation system is broken” (as they say). All of that put together just shows that licenses will have little to no effect on the platform to help protect users IP.

Let’s be honest, if I open-sourced my paid product, how will I keep track of who is using it? If it is open-sourced you can just remove the part that tracks if you have purchased it/if you are using it in your game. I would have no way to know they are using my service without paying for it? If this update goes through then there is literally no good way for me to protect my IP.

2 Likes

But again, on Roblox, you shouldn’t be selling a service via modules. That’s just the way Roblox functions. I do understand why you’d want to profit, but the only legitimate way to profit is to monetise a game you’ve made.

I see your point, but you can simply license into laymen terms. They’re incredibly straightforward for anyone to understand. And if each module before taking them displayed the license information, it would be impossible for anyone to ignore it.

Whether or not people decide to ignore your license is up to them, and finding out is of course difficult. It’s putting trust into others (hence why I said it’s the mentality of Roblox developers which needs to change), and hoping they won’t abuse that trust. It’s how the real world works, and exactly how Roblox should work.

You shouldn’t be having closed-source modules, they aren’t intended. You may be one angel who keeps their code clean, but we already know not everyone does. The only way to combat that unintentional blindness we all have when using someone elses module - open-sourcing is the way.

Just to make this clear, I’m not an advocate for open-source everything. I develop many projects which are closed-source and for profit, but that does not apply to modules or libraries I wish for others to use. Providing a service is different to providing a public resource.

1 Like

What do you mean by “legitimate”? Your forgetting about creating clothing and selling assets to groups among other things. I don’t see why creating a service that provides assets to games isn’t legitimate? I am a part of a group who provide all sorts of assets to Roblox airlines. How is creating tech and selling it to these groups, not a legitimate way of making robux? We have made almost 600k robux from our service and it’s frustrating to see that Roblox is killing half of the service we provide. Not only will this update a ton of services like mine, but it will also kill thousands of games and groups.

This ignores the point that I have no way of knowing if someone is using my product without purchasing.

8 Likes

Most people use private modules with API Keys to gain profit, if you don’t want your product leaked and you still want to gain profit, then wouldn’t people just be able to just pass on the set of numbers that the script requires in game and get access? If you want to make money, then API Keys are the way to go.

Although I will agree with this, you must also consider the sheer number of free models on the marketplace that actually have infections and backdoors. This isn’t about the small group of modelers who actually make legitimate models and ask for nothing return. Many out there are willing to pay modelers to insert a small backdoor into their models just so that they can break the game.

With scripts, you could massively delay the discovery of your scripts by using obfuscation. Although it might be a lot of work, it will ultimately pay off if you really want to keep your scripts available to other people but not have to worry about other people gaining full knowledge of the ins and outs of the script.

1 Like

I whitelist with user id, not api key.

This update will not stop that. Exploiters will just obscure the backdoors, etc. And as far as I am aware, after this update all private modules will automatically be made public so this won’t get rid of any of those.

This is what I think I’m gonna do but it’s gonna be annoying.

2 Likes

It seems impractical to make all private modules public considering they’re just normal models. It seems more likely they’re just going to break private modules intentionally.

3 Likes