Whitelisting, blacklisting, or disabling external module loads to prevent backdoors and similar issues

As a Roblox developer, it is currently too hard to deal with backdoors run through public modules which are a huge nuisance, especially with all the unsafe models and plugins.

As a Roblox developer, it is currently impossible to whitelist certain modules, or turn off external module loading completely.

If Roblox is able to address this issue, it would improve my game / my development experience because backdoors are incredibly dangerous and, especially for bigger games, something even as catastrophic as complete loss of all data could happen. If external modules could be whitelisted, blacklisted, or turned off it would help me and a lot of others sleep at night.

11 Likes

I know its been 4 - 5 years since this was posted, but I want to see something like this added to protect games!

2 Likes

In my opinion, requiring by ID should pretty much be soft-deprecated. It can’t take advantage of newer features like typechecking and native codegen, and it just opens more vectors for attacking (besides backdoors, what if one of the trusted accounts who uploaded one of your libraries gets hijacked?)

If a property like ServerScriptService.ExternalRequiringEnabled was added and set to false for every new place, it would help tremendously.

2 Likes

Yeah similar to loadstring().
Which is why they shouldn’t deprecate it (and thus possible of removal in the future) completely, since some users/devs still use require by ID, admin modules for example and things that need auto-updating.

Full support on ServerScriptService.ExternalRequiringEnabled being added, it can be turned on on older games and turned off on newer places.

They are already planning to deprecate this. There’s a poll/survey by roblox somewhere about removing require by id.

1 Like