Removing Support for Third Party Closed Source Modules

[Automationeer (Eleanor)]

Plugins are very difficult to view the code of and audit unless you know what you are doing. Furthermore, plugins can have encrypted/obfuscated or other methods to hide malicious code.

[Automationeer (Eleanor)]

It’s clear that Roblox won’t keep Private Modules, so I’m just asking for them to delay the removal until we can get a functioning alternative that can help developers protect their IP and source, with methods like sandboxing or permissions.

This would be beneficial for everyone involved, malicious modules would go and developers who need to protect their code would still be protected.

I feel like Roblox should talk to developers and get their suggestions on how to move forward and create a great solution to Private Modules without harming people who use private modules to support their workflow.

[grilme99 (brooke)]

however, private modules is the only feature that allows for arbitrary code to be run on games without the developers of that game ever knowing.

I completely agree with this, but that doesn’t mean you remove the feature without providing a good alternative.

This has already been done by many models and plugins and may be happening in many private modules such as admins.

Also, saying that it

And it will keep happening even after this update. Tons of people will still be affected by it. Exploiters will just obfuscate their code.

Also, saying that it affects thousands of people is completely untrue. There are no estimations on this and many admins are open source.

Untrue, most admins aren’t open source. Most of the ones I’ve seen used in games are closed-source.

Some people may sell products through private modules, however, if cared about their customers they would be willing to disclose the source code. This means that the update also helps customers find the right people to buy from.

I do care about my customers, but, let’s be honest, if I open source, what is the likely hood I will receive even a quarter of what I did before?

[grilme99 (brooke)]

I 100% agree. The reason I am most annoyed about this is that Roblox is making us wait up to a year for an official alternative.

[Sublivion]

You can find a plugins source by looking in file explorer, and there is not much a plugin can do without being noticed. Obfuscated code running in studio is definitely not as dangerous as hidden code in a game.

[Sublivion]

Obfuscated code is not as dangerous (and is easily spotted) as hidden code.

Adonis Admin, the most used admin, is completely open source.

The likelihood is quite high, as your competitors would stop selling due to the update.

[grilme99 (brooke)]

The likelihood is quite high, as your competitors would stop selling due to the update.

That isn’t the point. If my code is open source no one would pay for it because they can easily get it for free.

[Automationeer (Eleanor)]

As I said, it is difficult to view the source of plugins. Most users don’t know…

1. How to access the Roblox directory
2. The methods of finding the right folder
3. Importing the rbxm file into studio

Also,

1. Security is on the developer’s part
2. Most users still don’t know how to look for potentially malicious code.

Obfuscated code running in studio is definitely not as dangerous as hidden code in a game

This is technically correct but again, most users don’t know how to look for malicious code.

[Automationeer (Eleanor)]

Additionally, we’re not asking for private modules to be kept; we’re asking for Roblox to delay this change until we can get a viable replacement. This way, people who rely on them for an income won’t have negative effects.

Many people, myself included, have provided methods to improve modules and to make them better for everyone.

[grilme99 (brooke)]

Yes, if it wasn’t clear before, I don’t want them kept, I just want a viable alternative before they are removed.

[LordMerc (Merc)]

That is actually incorrect. Plugins can implement backdoors, not even having to be a private module. They can easily parent an admin script somewhere and boom. No private module used, but a backdoor was implemented.

[NicholasY4815]

They can easily parent an admin script somewhere and boom.

A patch for irregular places to run scripts was sent out in this thread however plugins can still place scripts in regular places and developers may not notice them. This is why it is ultimately up to the developer to implement security and regular checking of backdoors and exploits, especially now that we have tools provided by other members of the DevForums (e.g., Chrisbru01’s Backdoor/Infection Detector).

However, that being said, most backdoors often use methods of obfuscation and directly require a private script module so that they can be updated constantly (whether it be allowing for more users to use the exploit if it includes a whitelist). Removing private modules is ultimately the most efficient way of removing all/most of the backdoors that games contain.

[BraxbroRoblox]

Then they should let us properly make paid modules we can sell.

[BraxbroRoblox]

I disagree; the security of your places is on you, not roblox. You’re dumb enough to get backdoored? Oh well. Solve the problem and don’t do the same thing again.

[NicholasY4815]

Even though it is ultimately up to the developers to ensure the security of their game, those that don’t have experience in patching bugs will ultimately, at one point or another, end up sending Roblox a massive support email as to where they went wrong. In turn, Roblox gets tons of emails that could in general be avoided if private modules were removed and maybe even help speed up the speed of customer service replies.

[grilme99 (brooke)]

This update won’t change that. If you don’t have that experience, chances are, you can’t spot potentially malicious (obscured?) code.

[GameAnnounce]

Yes, but replace ‘private modules’ with ‘scripts’ and the statement is still true.
Yes, but replace ‘private modules’ with ‘public modules’ and the statement is still true.

Not only is this not relevant to anything I’ve said, but it’s another massive leap in logic. I’ve not implied anywhere that by open-sourcing modules the issue of misuse will be fixed. Of course, it won’t but it’s a step in the right direction for modules as a whole.

Your concerns with the number of people who utilise private modules are wellfounded, I’m with you on that note. I do see how many people it’ll affect, but everyone has been given a fair warning and now it’s their time to form a solution. This reminds me very much of the ‘removal of loadstring’ posts a while back, it’s also those fringe groups (of which I’m part of) who are always against change.

However, about the updates at any time. I’m not too sure since I haven’t taken a look into how LinkedSource works at the moment (as in the past, the source was evaluated in Studio). But if it’s evaluated at runtime, simply having a ModuleScript with the LinkedSource of the module you want to use. Functionality will not change .

[GameAnnounce]

Re-think what you just said.

[GameAnnounce]

Okay, I’m not sure how much I should disclose but here’s a cool case study that is still running to this day.

A few years ago, a friend of mine published a public module purporting to do something interesting and it does exactly that. But by the nature of their obfuscation it’s practically impossible to tell what is going on, and what it actually does is send analytical information to their google analytics page.

At any moment in time, they can update this module to do whatever they want. I’m fairly sure Seranok will remember this module as it was discussed on the old forums but no one has yet figured out what it does.

[NicholasY4815]

By shutting off the private modules, Roblox removes a large majority of the backdoors that exist out there. Most of the backdoors are based upon private modules so most developers, no matter the experience they have with removing backdoors, won’t have to go through the pain of having to track down a backdoor.