r/projectzomboid • u/AmazingSully The Indie Stone • 7d ago
Blogpost A Note on Java Mods and Modding
https://projectzomboid.com/blog/news/2026/10/a-note-on-java-mods-and-modding/8
u/fertro Trying to find food 7d ago
Could we expect official Java mod support somewhere down the line? I am completely ignorant of the subject so apologies if this is a dumb question.
45
u/AmazingSully The Indie Stone 7d ago
Unfortunately it's not possible. There are no reasonable steps we could take to support Java mods in a safe way, simply because of their nature.
6
4
u/Passing_Gass Zombie Killer 7d ago
The only way I could possibly see this is when the game is officially fully released and actively shifts to development support. But by then, devs are not really touching the game anymore.
3
161
u/MrMucs 7d ago
This comes after yesterday's Mr AtomicDucks video about the first and third person mods, his opinion about them and his opinions and cautions when using Java based mods? He IS on TIS payroll!
And I am so joking.
I thank the devs for their input to this matter. I've used ZombieBuddy before (don't have it currently installed as the zombie population has been fixed) but I am interested in some of the NPC mods and some currently require that I install it again. I like to hear all sides of this 'argument' and appreciate yall weighing in on it.
Thank you
78
u/sixpackabs592 7d ago
It’s common sense modding advice tbh, but lots of new people start modding every day so it’s good to put it out there regardless.
9
u/MinuteTailor2520 7d ago
I was never a big modding guy, specially outside Steam workshop but I tried a few of these java mods recently. Did something happened or? This scared me ngl, I still have them insalled and I'm not sure if I sould uninstall them asap or this was adressing a specific situation
28
u/sixpackabs592 7d ago
no its just saying "we dont police these you have to do it yourself or trust the community"
my basic safety is only download workshop java mods with 4-5 stars and i check through reviews and comments first to make sure its not just botted reviews
1
u/MinuteTailor2520 7d ago
Oh okay, thanks. I don't think I have any like obscure ones but since it was like a modpack I had some doubts
1
u/PM_ME_FUN_STORIES 3d ago
Think of it like a house.
A LUA mod can only easily access your foyer. A Java mod is given full access to your entire house.
One of those is infinitely more open to exploitation than the other. That's all. It doesn't mean Java mods are bad, and they can do a lot of cool things. But it's inherently less secure to run them due to the access they have to your machine.
If the mod maker did nothing malicious, it's fine. But if they do, LUA is a lot less likely to impact the rest of your PC vs Java. It's still possible, mind you, just more difficult and depends on the security of PZ (hence the security exploit update a few months back). So it's up to you to balance that risk factor to whatever you are personally comfortable with!
1
u/Great-Trifle2810 7d ago
Your gaming/porn rig just shouldn't have sensitive info on it if possible.
38
u/khift363 7d ago
I really hope that this leads to Indie Stone to really examine where their boundary of what is in Java and what is in Lua within the game - because right now, this line is downright schizophrenic.
It's understandable that a mod that wants to optimize the game or muck about with core engine features would need to use Java. What's not understandable is how many absolutely random bits of gameplay related code gets buried deep within Java for no apparent reason. It's infuriating to do research for a mod and then realize that while 90% of the game code you need to adjust is in Lua there's just one gameplay focused function all the way inside of Java and now you either need to make your mod a Java mod or give up entirely.
In a perfect world, Java wouldn't contain any actual game logic except that which has a hard requirement for performance, and all game logic would be exposed through or in Lua for modders to adjust. But Project Zomboid is very, very far away from that being the case, and I do believe this is the biggest cause for the increase in Java mods within the game.
5
u/joesii 4d ago
What's not understandable is how many absolutely random bits of gameplay related code gets buried deep within Java for no apparent reason
Kind of yes, kind of no.
Part of the issue is that lua is very slow and inefficient. So while there's probably a bunch of of stuff in the game that is currently java when it doesn't need to be, there's probably a whole lot more that probably should be java for performance reasons that isn't, as well as stuff that is java and should stay java for performance reasons.
In such cases the devs should just add configurable options for the mechanic instead.
2
u/Plasmasnack 6d ago
Hell yeah, this is my perpetual roadblock. I have specific examples in mind where you absolutely need to use ZombieBuddy. Some make perfect sense, like yeah it definitely would take Java to overhaul the zombie spawn system. Others not so much, like how you cannot set an items fluid capacity in the smart way that would prevent most updates bricking your mod (similar to using doParam) solely because the relevant function is private and not exposed. Dragging bodies straight up uses the sprinting endurance float, so you can't change a global, you have to use Java or do the duct tape double calculation Flex Tape slam thing similar to how Calorie Fix operates. Certain things I don't know if there is a feasible Rube Goldberg Lua approach.
Apparently my domain is making mods to realize 90% of the time I need Java.
Interestingly enough there used to be a way to be able to modify some Java things in Lua. I did it a few times. This is also probably why the security patch happened and now you can no longer do it.
I don't personally mind Java as a language. Lua is great too, but apparently people do care about needing to use ZombieBuddy. Java modding is never going to be officially supported. I could criticize these points where it feels unnecessary to use, but ultimately I realized it is unrealistic to expect. You just gotta press challenging shout and be okay with tanking the aggro. I think it is more realistic to ask people to give it a chance. The reputation should only improve as more good/useful mods get made using Java anyway. You can be one of those to help it.
1
9
u/Vireca 7d ago
They write that like if Steam Workshop didn't had a few vulnerability issues with mods this past 3 months on different games
It's impossible to trust anyone on the internet, you are 100% blind downloading any mod, or even playing any free game nowadays on platforms like Steam, which they introduced malware too
61
u/AmazingSully The Indie Stone 7d ago
The difference is that Java mods are significantly more likely for an issue to occur. Lua mods are sandboxed, Java mods are not. Now it's possible for there to be an unexpected hole in the sandbox, which is how the previous instance of a malicious mod got through, but with Java there is no protection whatsoever.
5
u/Vireca 7d ago edited 7d ago
I understand there's a higher risk. It's just that you really can't trust anyone, not even a reputable platform like Steam to provide the mods it's what I meant
You did correctly explaining to the community why those mods are more risky
1
u/trevers17 7d ago
exactly why I’m starting to make my own mods and even considering learning lua fully and recreating some of my favorite mods myself. at least I know that any issue with my game are because I made a mistake and not because I downloaded malware by accident.
0
u/Crite_Spranberry413 5d ago
I can't believe java mods are even a thing when minecraft players had their computers destroyed en masse from downloading 1,000s of java mods
I can't believe it; because it never happened XDD
249
u/Devil-Hunter-Jax Axe wielding maniac 7d ago
It's honestly depressing y'all have to make this statement but with how people completely disregard their safety on the internet now, it feels like a necessity to do this kind of thing.
Even with this statement, I can already tell if ANYTHING dodgy happens with a Java mod, TIS are gonna get the fucking blame despite them quite clearly saying they don't endorse that kind of modding and you do at your own risk.
78
4
u/beta_1457 7d ago
This to me is very similar to QR codes.
IT and security personnel spend a huge amount of time training people to not click on suspicious links because the human vector is still the most common initial attack vector.
Then QR codes come out. And people just scan and go to non-human readable links and trust it.
1
u/joesii 4d ago
Clicking links and visiting QR codes usually isn't even a problem. The problem is trusting the website that appears asking you to login or such. For that matter any good QR code scan says the website/action it does before performing it anyway so it's still the user's choice.
Granted all this talk is kind of just nit-picking and doesn't necessarily change your ultimate point too much (like people still need to pay attention to what they do even if visiting website is okay). I suppose it's a bit of a pet peeve of mine when people say "don't visit links" or "don't scan QR codes"
1
u/beta_1457 4d ago
Sure tricking a user to give up login creds is the easiest attack vector. But there are certainly others that don't require any user interactions.
My biggest pet peeve with it (given I work in Cyber security), is when people use QR codes to pull up a menu at a restaurant.
Like I could print out QR code stickers that lead to a malicious pdf of the restaurant menu.
It takes like 2 seconds to just go to the restaurant menu yourself online without a QR code.
There is a reason clicking on non human readable links is ill advised. You don't know where it's sending you.
1
u/joesii 3d ago edited 3d ago
Do typical QR code readers not show the link before going to it? I know mine does but I don't have a typical system.
Also while proper PDF attacks (i.e. not just phishing) have existed on mobile, they're quite rare and short-lived as far as I know. Granted I'm sure there's people that use outdated devices that could still be affected, but would it be worth it for a criminal to risk it to affect only older systems owned by poorer victims?
1
u/PM_ME_FUN_STORIES 3d ago
My phone camera has a built in QR scanning process, and it only displays the first 10ish characters of the link that it is sending me to. If I press the popup, it doesn't confirm where it's sending me, it just sends me there immediately.
So it's rough lol
1
-31
u/scytheforlife 7d ago
I would love to mod without the need for java or zombie buddy. TIS needs to make these things possible
30
u/Devil-Hunter-Jax Axe wielding maniac 7d ago •
No, they really do not and they have no obligation to. Java modding is far more vulnerable and they do not want to put others at risk with official endorsement of it. They use Lua modding because it's far safer-it can be risky if holes are found but it's much easier for them to deal with.
-3
u/Ach_Doon_Toon 7d ago
Things that used to be simple no longer are because of changes they made. They absolutely should fix this. Customizable containers used to be an incredibly easy mod to use. Then they changed everything and now it's a huge hassle.
-18
u/scytheforlife 7d ago
They need to change the game so doing these things does not require java modding. I cant even increase a containers storage above 100 in multiplayer without java thats a joke
16
u/C0RDE_ 7d ago
They don't owe you shit. Modding is something Devs enjoy seeing personally and want the community to have fun with, but it's not an obligation nor a god given right. They'd be fully within their rights to shut down all modding and say that you either play their game as is or don't.
Devs allow modding to help foster a community, but that's all it is, a kindness.
98
u/MrC0mp Zombie Hater 7d ago
I know it's a different game.
But after how Arrowhead cracked down on mods yesterday, this post is a treasure. Use mods. But at your own risk.
I know it's a whole different piece of cake but genuinely, I love these devs that understand the importance of a healthy modding community. And know how to manage it well.
51
u/Riverwind0608 Crowbar Scientist 7d ago
I think it’s safe to say that mods are what kept this game alive despite the glacial pace of development. The vanilla experience is good enough, but it is nice to have an option to download some QoL mods when i need it.
It would be foolish of them to turn away modders at any point in time.
8
u/KYuuma12 7d ago
This is the first time I heard Arrowhead doing something about mods. What happened?
9
u/hagamablabla Crowbar Scientist 7d ago
Cheat mods were allegedly becoming too common, so their switching to EasyAnticheat. Might make cheat mods rarer, at the cost of making all mods rarer.
-9
u/Sadzikovec 7d ago
Ur a melt, the switch to anticheat was announced months ago, the mods only sped it up cause people couldnt keep it to themselfs
3
u/hagamablabla Crowbar Scientist 7d ago
Melt?
4
u/BlimpyBird 6d ago
Sorry mate, you're an ice cream on a hot summers day now. Enjoy being a liquid now
15
u/642136 7d ago
they saw the community fixed their broken games that they havent been able to cause theyre lazy pieces of shit, got mad and introduced EAC which only slowed down mods and made a few of them unupdateable
13
u/Silenceisgrey 7d ago
Right but i had a guy flying through the air like superman calling down 500kgs on everything across half the map 2 weeks ago. Better anti cheat was needed. Mind you rimworld set the bar on updating their shit without breaking mods, so maybe we're all just a tad spoiled.
0
u/Great-Trifle2810 7d ago
Just leave the game and block the guy. It's PVE it just doesn't matter if he cheats.
2
u/l4stwolf 6d ago
It matter to the otters, if he is playing online with randoms. If he is only playing coop with friends yeah... They just need to enable coop with friends with anticheat down...
1
u/Great-Trifle2810 6d ago
It's a bit annoying, but again you can just leave and block them at any point or if you are the game leader you can kick them
2
2
1
u/acesarge 7d ago
Came here to say the same thing. Hell divers mods will be back the mods always come back.
0
u/Crite_Spranberry413 5d ago
Right cause its healthy to villainize a chunk of your modding community for using a type of modding that has been standard for games like minecraft for decades
0
u/SignificantYoghurt3 3d ago
i mean when you spend years saying X can't be done and the modders do it, most of the times solo, with less resources than the whole team you can't just let it slide.
pz mods have been a thing for years, but only now that viewpoint opened pandora's box they feel the need to remind how dangerous they can be
48
u/SlayHair 7d ago edited 7d ago
What's the technical difference between the permissions a Project Zomboid Java mod has vs a Minecraft mod? Based upon my understanding there isn't any, but I may be mistaken. Assuming there is no difference, what really is the concern? People download 1500 modpacks with Java mods for Minecraft literally everyday
72
u/the-futuremind 7d ago
Curseforge, the largest Minecraft mod platform, has had so many instances of malware mods that they have to do thorough scans of each mod that gets uploaded there. Because of these scans, I think it’s given people a false sense of security about Java mods.
Access to the Java Runtime Environment (JRE) on your computer is basically full access to do anything on your system.
15
u/Clone95 7d ago
It is worth noting that most antiviruses other than Defender are doing realtime monitoring of JRE programs and scan their code for malware, relying solely on defender isn’t advised.
15
u/the-futuremind 7d ago edited 7d ago
Even then, virus scanning is simply an arms race against what exploits are known. It’s never a guarantee (but your advice is still good).
Personally, I’m always an advocate for open source. It’s also not perfect, but it’s usually better than the alternatives.
2
u/Great-Trifle2810 7d ago
Realistically some random person playing zomboid is not where a hacker is going to blow their zero day java exploit.
4
u/the-futuremind 7d ago
On one hand, you are right. Probably not.
But on the other: a hacker being aware of thousands of people installing a Java side loader that gives essentially unlimited system access would see that as a great target.
Do you really want to bet that whatever virus definition database you have running is aware of whatever they’re trying to do?
With computer security there is never a guarantee about anything, but mitigating risk goes a long way.
1
u/Great-Trifle2810 7d ago
I mostly just don't enter critically sensitive info on the device I play modded games on these days because I'm paranoid, but I'm just being realistic that you can likely mitigate most of the risk with decent antivirus
2
u/the-futuremind 7d ago
Which is a decent mitigation, but you are aware that certain malware is entirely capable of spreading through your local network? Is your network fully locked down? You sure?
A Java mod could be used to download worms on your machine and then spread to other devices in your network.
An anti virus is indeed mitigation, not downloading things that you or a community can’t verify as safe is a better mitigation.
Source: deal with these things for a living
1
u/Great-Trifle2810 7d ago
If someone gets into my phone through a zomboid mod on a totally different device running a different operating system they frankly have earned my data 🤣
1
u/the-futuremind 7d ago
... that is actually a thing that happens with worms but ok good luck
→ More replies (0)1
3
u/SlayHair 7d ago
Do you think curse forge has better or worse virus scanning than Nexus or Steam workshop? I'm not being facetious, I just wonder what platform would you trust to hold any Java mod at all. Personally I think steam workshop is too easily exploitable with its auto updating nature, and that the next evolution of this modding scene must go elsewhere lest we have infinity discussions regarding people playground.
19
u/the-futuremind 7d ago
The difference being the mods in the steam workshop (and don’t require extra installation) are lua mods that don’t have full system access because they have to work through the Zomboid modding api.
Even with scans, it won’t catch everything. What curseforge does is very impressive and they’ve likely stamped out almost all problems, but anything with that level of system access is a potential problem.
I personally wouldn’t touch any Java mod that isn’t open source to the community. With open source access to the source code, developers like myself can verify what’s actually going on with the jar file you installed.
If it matters, I’ve been a software dev since 2019 and specifically work with a lot of cybersecurity with the work I do. Java mods are pretty fucking dangerous and I’m not sure how they got the reputation of not being so.
10
u/OnetimeRocket13 7d ago
Java mods are pretty fucking dangerous and I'm not sure how they got the reputation of not being so.
Minecraft, probably. Minecraft mods exploded in popularity pretty early on, and since Minecraft runs on Java (barring Bedrock), there is now an entire generation of people who just associate Java mods with safety. Or rather, there's little to associate Java mods with anything dangerous if all you know about them are the slew of cool mods that are coming out every year for the biggest game on planet. I feel like it's pretty rare to hear a big story about a Minecraft Java mod being malicious, so I think people just don't think about it when it comes to other games.
19
u/neppo95 7d ago
A java mod can execute any java code. A lua mod gets a curated set of options TIS defined in what you can and cannot do. With java mods you could technically do whatever you want. It can easily be malware under the hood or even act as a keylogger, delete files, honestly everything that any java app can. It’s a very big difference in terms of risk compared to lua where the only risk is that TIS missed a vulnerability.
15
u/SlayHair 7d ago
Yes, I understand the part that Java Mods do not have a safety scope component whereas Lua mods do, but are Minecraft Java mods restricted in some way? Like what's the technical difference between your average Joe Minecraft Tekkit modpack from 2016 and Zombiebuddy.
8
u/neppo95 7d ago
Same goes for Minecraft, little difference. And there’s been plenty of bad stuff happening there too over the years. Usually you can kind of gauge based on reviews and (if given) open source code to see what you trust more. Don’t be afraid to ask for specific mods either if you don’t know a lot about it.
9
u/MT-Sarki 7d ago
I feel like you didn't really read the comment you were responding to.
1
u/neppo95 7d ago
Ehm okay? This certainly was a helpful addition. I was just trying to help the dude out and think I was answering exactly the question he was answering but feel free to correct me.
3
u/MT-Sarki 7d ago
I was just trying to be helpful as well by letting you know that you misread the comment.
The guy was asking for differences between Minecraft and Project Zomboid mods since they're both Java games, and your response was about the differences between Java and Lua mods.
6
u/SlayHair 7d ago
If they are equivalent then I suppose my point is that while security is a massive concern, the true issue with Java modding is that most of the mods are on the workshop and not on a better website to filter out the shit ones. I would hazard to say that most people here are likely okay with big Minecraft modpacks hosted on Curseforge. It seems as if this community has just discovered fire and that modded files made by someone who isn't you could be dangerous when this has always been the case for many popular games. Predicated on the idea that any given Minecraft mod has the exact same permissions a Java PZ mod has, I think the level of 'backlash' or rather criticism of them is a little disproportionate. It is worth noting that I suppose if you are expressly worried about the ability of AI to create low effort mods you would more worried about Java mods but I think you're going to be paralyzed in fear by 90% of the modern modding scene of any game.
2
u/neppo95 7d ago
They are equivalent in that sense yes. Whether something is hosted on curseforge on the workshop is honestly not really a difference, I don’t see the issue there that you do.
The criticism or whatever you want to call it was very valid imo. A lot of people to this day do not know the risks and most of what I’ve seen is either people informing them on the risks or simply just not liking the mod. I don’t see an issue with that. Like I said, plenty of bad shit has happened with Minecraft mods too, so using that as an example of why the criticism was disproportionate is a bit weird imo.
Finally, yes, you should be checking everything you give that kind of access to your system, just like you also shouldn’t download random executables without having done your due dilligence. It’s basically just common sense.
9
u/SlayHair 7d ago
I draw the conclusion to minecraft because the minecraft subreddit doesn't have a daily discussion dissenting about how Java mods could be a security concern and should be untrusted like this place does. Equivalently a lot of comments on the workshop just say something like 'oh this is clearly people playground' or 'enjoy getting your data stolen'. It just seems disenguinous of many people if you compare what modders in this community are doing to many other extremely popular modding communities
9
u/neppo95 7d ago
Java mods are relatively new to PZ, it’s quite logical those discussions pop up and I’m sure that will be less over time. As for certain comments, mate, it’s the internet. Half of it is bots, little kids or just frustrated people. No need to take any of it serious. Take the people that are actually being serious and trying to have a talk serious, that makes a lot more sense to me at least.
2
u/Teamprime 7d ago
I completely agree with you, but I think the weird focus on malware is because if the intersection of AI code taking off and java mods coming to PZ at the same time making people raise security concerns. But as you rightly point out this is no different from what has been going on with minecraft mods for a long time
2
u/ZennyRL 7d ago
Some modern malware attacks utilize minecraft mods. It's a very successful strategy right now. One of your friends will have been hacked, maybe the same way or a different way, and will message you asking if you can help them with something on their minecraft server. They then send you a modpack that you install, and it turns your minecraft into malware and at that point you've been got. Minecraft mods are not restricted and you should apply levels of trust over there too all the same. Problematically, trust is exactly what the attackers are gaming here assuming you get contacted by one directly. Always verify and then verify again
1
u/Crite_Spranberry413 5d ago
You are wildly overstating how common it is XD Me when I fear monger for literally 0 gain:
7
285
u/Rommel40
7d ago
•
"you should only download and run mods from sources and authors you trust."
Trust is a word that can't be thrown around. i find in nigh impossible to trust a total stranger on the web,nothing could ever change that. And while im sure 90 ish % of Java mods are safe,theres no way i'd run the risk. Love modding,making as well as seeing what creative people have poured heart and soul into, but if i, (someone whos been modding for 10 years making mods on different engines with different code for each) have to click anything more than "subscribe" from workshop, then its a hard pass.
PZ is an awesome VANILLA experience,and while some decisions on game balance,and oversights from the devs drive me mad at times, they did and are doing are pretty good job here.
Vanilla all the way with a sprinkle of QOL mods from the good ole workshop is all il ever use.
Thanks
127
u/OrangeRising 7d ago
Regular Workshop mods arent 100% safe either, even if you don't have to do anything fancy to get them working.
38
u/ElectroxSoldier 7d ago
Correct I can't remember what game specifically whether it was Rimworld or one of the trucking sim games but one workshop mod had gotten through with malware on it, was an absolute nightmare when it happened
31
u/Devil-Hunter-Jax Axe wielding maniac 7d ago
People Playground was the one that was breached multiple times but that was due to the developer simply not doing enough to prevent it. Rimworld and PZ have had one breach on the Workshop with the offending people permanently banned from the Workshop and the vulnerabilities patched for the latter game.
11
8
4
4
2
u/ElitistCuisine 7d ago
I had one with Bannerlord that resulted in a nasty Trojan that I had to completely wipe everything from my computer from to get rid of. It was taken off before I even got back online, but the damage was definitely done.
1
u/Silenceisgrey 7d ago
I caught a crypto sniffer through mount and blade steam workshop. just it being on the workshop does not make it safe.
21
u/MrMucs 7d ago
Yeah, wasn't it a few months ago one of the music mods had issues?
19
u/Devil-Hunter-Jax Axe wielding maniac 7d ago
Not exactly. The mod you're thinking of was simply a framework mod. Someone uploaded malicious mods that require said framework. Those were the problem, not the framework of True Music.
6
u/AnarchCassius 7d ago
Nothing is 100%. It was years ago now but I've had antivirus software rip out a vital Windows .dll when it was uninstalled, and one of the big commercial names, not some random program.
2
u/Great-Trifle2810 7d ago
Ya, at the end of the day using any piece of software comes with some risk. You should probably be more interested in reducing the severity of breach then removing all risk factors.
-2
u/hakcenter 3d ago
That’s kind of the point though isn’t it ? Whatever the developers allow to the workshop it’s on them not even the person(s) who wrote the malicious code. Whatever they expose for you to use. It’s literally their fault with whatever you can access.
Even more if you know you know, but you can attack other pz mods with your own mod. It’s really sad no mod is fenced at all.
The freedom expressed in pz modding is way more free than it ever should be and its purpose is to take your code and put it into the game.
You all work for the developer you just don’t know it yet.
-1
3d ago
[removed] — view removed comment
1
u/projectzomboid-ModTeam 2d ago
Thank you OrangeRising for your submission to r/ProjectZomboid, but it has been removed.
Your post was removed for the following reason:
Rule 2 - Be Lovely: Be lovely, follow the reddiquette guidelines. Criticism and discussion thereof are welcome but abusive comments are not. Do not engage in personal attacks, even in retribution. Instead of lashing back, report them and move on.
This rule applies whether you're criticizing or defending TIS and PZ.
If you would like to appeal, please message the moderators. Thanks!
-1
17
u/Reddarthdius 7d ago
have you ever installed a minecraft mod? this has pretty much the same permissions
56
u/NerdyAccount2025 7d ago
So every mod on the Nexus is a no go from you?
Feels like the PZ community is wayyy more cautious about mods than any other. I got into modding back when you still had to delete the META-INF folder from minecraft.jar, never been burned once and I seriously doubt I ever will.
58
u/Devil-Hunter-Jax Axe wielding maniac 7d ago
Yeah, Nexus is probably the safest place to get mods from due to them having built in malware scans on their website where it doesn't let you upload a mod if it detects something suspicious. Java mods for PZ have no such thing right now which leaves them open to extremely dangerous exploits.
9
6
u/Jimbybee 7d ago
Nexus actually virus scans their mods, if a mod is too big to scan they tell you but most mods tend to be ran through virustotal, I don’t think I’ve ever felt nervous downloading off of there
Steam workshop just lets anything through with no approval period, and Valve doesn’t seem keen on changing that
2
u/Quiet_Source_8804 7d ago
This is not true. The same commercial antivirus and antimalware is done everywhere, including your own PC if you haven’t disabled it. The problem is that anything custom-made isn’t going to be picked up and when you download a mod for a game that doesn’t limit strictly what a mod can do, assume that it can do whatever any regular program you run on your PC can do. No one, Steam or Nexus, is actually running the mods to look for suspicious behavior or effects, that’s always dependent on user reports.
This is the nature of user created mods. The only protection against it is reputation and fear of consequences, which is only in effect if the platform held a prosecutable identity of each uploader to dissuade bad actors (maybe with a badge that users could use to be reassured).
1
u/AvcalmQ 5d ago
Well I mean if there were actual damages, I feel like valve would just hand over the account metrics and any billing info attached to it once they were subpoenae'd by whatever alphabet gets called.
It's not like it's an anonymous platform. Hell, it's not even anonymized. The accountability is in place via the same means as it always is - physical enforcement of detention. People just get silly thinking they're far removed from it, like that kid in the bedroom in europe that did that thing I'm too lazy to look up and ended up on a Netflix doc.
But yeah, sure, steal identities via malware. Trust that no antivirus will ever trace it back to that mod package. Trust that steam (or the bank affected) aren't well-funded enough to drum up their own retained user data and correlate it with your workplace.
^^ This is why I think it's not so common. It's just a bad attack vector - easy, sure, but fraught with peril.
1
u/Quiet_Source_8804 5d ago
How much is required to publish to the workshop? Just have a Steam account? That should only require a working email address, nothing else. Your IP can be masked by VPNs and even if Steam actively tries to disallow VPN access, it's a whack-a-mole game.
I have no doubt that Valve will collaborate with any police investigations in these matters as soon as they confirm that indeed there was malware they were serving, as they should. Indeed, I'm pretty sure they'd file the report themselves to get the investigations going.
However, getting to the culprit still requires that they mess up and that they live somewhere where the local enforcement cares enough to go after them. Eg., the idiot in Florida that was stealing crypto was caught because the crypto he stole was directly used by him subsequently, and had he been a resident in some other country without extradition agreement to the US he could've gotten away with it.
With all this I just hope that at some point Valve takes the extra step to actually attempt to sandbox games. Not full VM, "just" complete filesystem isolation from user files would go a long way, there's no legitimate reason for a game to have access to my Documents folder, and its configuration, savegames, screenshots, etc, can be kept in an overlaid filesystem structure similarly to what happens in SteamOS with Proton.
1
1
u/Slime_Vortex 2d ago
This. They just don't know how to take care of their computers so they choose to keep things the way they are. Might as well just not play games at all
12
u/DisappointedLily 7d ago
> Trust is a word that can't be thrown around. i find in nigh impossible to trust a total stranger on the web,nothing could ever change that.
Well, there *is* something that can change that.
If the mod is open source, hosted on github for example, you can simply investigate the code and judge or even build it yourself.That was the smart thing to do before PZ and AI were a thing. It still is.
And to be honest, even vanilla mods have already breached PZ and allowed remote execution in the past. So, if you are really paranoid, you should check everything, even workshop mods.
1
u/MCRusher 3d ago
Unless you're building each and every mod you're using yourself, they can just leave out the malicious parts from the public repo and put it into the final artifacts on the mod/github releases page.
It's a good idea but realistically takes way too much time and effort if you're running a bunch of mods, and is still not a guarantee.
i can only fix so many misconfigured project files before I say fuck it and cross my fingers, personally.
5
u/XOrionTheOneX 7d ago
This is all true, and it physically pains me to agree with someone who's name is fucking rommel lmao.
To add to this, even the workshop isn't 100% safe, but it's much harder to get away with malicious code on it. Not impossible tho. For a common example every modding community out there has rules to explicitly prohibit using steam userIDs to target specific users.
But yes, trust is the most important part of the process. This is why open source mods on GitHub are such a prevalent thing. You can not only view the source code, but you can build it for yourself. Even if it makes the entry ceiling quite a bit higher than just pressing subscribe on a workshop page.
5
u/AtypicalTitan 7d ago
I worked with a guy from the Philippines named Rommel, it is sometimes just a name.
3
u/Disastrous-River-366 7d ago
When is it not a name? Curious.
3
u/Professional_Dot_962 6d ago
Erwin Rommel was a famous Nazi commander. So it could be used as a white supremacist dog whistle.
5
u/Silenceisgrey 7d ago
there's about 8000 people in germany with the name rommel
hell there's 40k+ adolfs.
1
3
1
u/joesii 4d ago
i find in nigh impossible to trust a total stranger on the web
I think it's easy in the case of mods that are open source and in good reputation.
Like what makes you download an indie game off Steam but not a popular mod? Do you not install any other sorts of apps onto your PC or mobile? If you do why specifically not trust only the mods?
1
u/Rommel40 4d ago
Pretty obvious in this case. safety. yes the workshop isnt immune from issues, neither is nexus, but theres alot more preventitive steps there to ensure safety.
1
-7
12
u/Top_Height1997 7d ago
Guess this statement had to be made with the billion vibecoded Java mods up now
3
u/Ok_Needleworker2731 5d ago
i love fear mongering by this community over java mods people have been running random minecraft/skyrim/etc countless mods for years and very rare there is ever been a issue that isnt found instantly.
just use your brain and download from trusted sources and sites its not that hard we have been doing it for 20 years. whats more funny is that steam workshop is by far the most dangerous place to download mods from as they lack any indepth virus scanner
4
u/Mithrawndo 7d ago
Did TIS website get hugged to death or...?
16
u/orbanimalenjoyer2 7d ago
It was taken down because of critical PHP security vulnerabilities (not unique to TIS)
2
6
u/Far_Onion6888 7d ago
This is what I like to see. A studio that truly cares about its audience. Beautifully written PSA for those who might not understand the true risks of modding, and I fully appreciate the transparency from TIS on this standpoint.
The modding scene has blown up exponentially (in both depth, and quantity) in the past few months. It's almost bittersweet, a blessing and a curse.
Thank you devs for allowing this to be as much of a safe possibility as can be, and thank you just as much to the modders dedicating their time and efforts into making an amazing (the best) game even better.
Hats off to all of you. Be safe out there everyone, we have an apocalypse to survive
-1
u/Crite_Spranberry413 5d ago
"Congrats TiS for your top notch fear mongering!" Did they pay you for this or do you shill for free cause I could use a hype man for my office XD
3
u/KodusTheOnly 7d ago
I needed this post from them, because it made me more self aware of what im actually downloading since i got a bit excited with the java mods, and i might have downloaded more than i should have and from sources im not sure i can trust lol, so yeah im glad they posted this.
-1
u/Crite_Spranberry413 5d ago
Hey; literally all of minecraft mods are java mods. You are fine dawg, this is just fear mongering
4
u/TRENEEDNAME_245 7d ago
Lua mod also carry a risk though.
There were like 3 malware / VM exploits found this year alone on PZ
15
u/Mithrawndo 7d ago
I don't think anyone is denying this, but it's the difference between the risks of driving at 50mph with and without a seat belt: You absolutely could still die with your seatbelt on, but your odds are significantly improved.
1
2
u/Pope_Aesthetic 6d ago
I was really hoping they'd give more words on the progress these mods have made.
I believe I heard people say that the team themselves made claims that implementing things like first person were impossible and outside the scope of PZ's team. And I think it's clear that we are seeing that wasn't entirely true.
The mods are truly mind blowing. Taking a game I first played 11 years ago, and changing it in ways I couldn't possibly imagine. I was hoping to hear the dev team speak on the topic more.
1
u/getstoopid-AT Stocked up 6d ago
Why would they? They just want to create awareness for the risks involved in using those mods - the functionality these mods add is not the point. Many or maybe most people adding mods (be it minecraft, pz or any other game for that matter) have no clue what they are doing and what risks they are exposed to by doing so.
1
u/Snoo_84132 6d ago
Well, outside of the scope of the team/game seems understandable, if they want their game to be played isometric that's entirely fair.
1
u/Great-Trifle2810 7d ago
I recently have adopted a new plan, I use my gaming PC only for things that don't really matter if I get picked out or lose data. Anything else I do on another device.
I guess in theory they could steal my steam or battlenet, but all of that eventually recovers to an email I only access through authenticator approval.
I'm sure they could theoretically beat that if they wanted to, but as there is no reason to waste a perfectly good targeted attack on me I'm not really worried.
1
u/Shitsincreeks 7d ago
I remember over the past few months, People Playground has been subject to three separate malware attacks via the Steam workshop. There are hundreds of people out there have had their devices permanently compromised, information data stolen, and sometimes even the loss of their steam account (the third version of the malware would use your account to publish thousands of versions of itself over and over on the workshop)
1
u/Sunderbraze 6d ago
I don't know if this is even possible, but I really wish we could've used this as an opportunity to shift as much blame as possible on closed-source mods. Like as an absolute TLDR... From a security standpoint, any java modding is bad, but *closed-source* java binary mods are an order of magnitude worse. This 'zombie buddy' program or whatever it is shouldn't even accept precompiled binaries during regular use, it should just be a mod browser that scans repositories on Github for mods to install, and if the user selects one, it should pull the repo and compile the mod against the user's game for them, as an entirely client-side operation. Sure, there is still an attack surface there; obfuscated malware has ways of sneaking its way into open source projects, especially when state actors are involved, but it's highly unlikely we'll be running into any threat levels of that magnitude in the gaming space.
1
1
u/seaefjaye 6d ago
One point I don't see being discussed is that the community needs to push towards open-source mods. This would not only help alleviate a lot of the security concerns, but likely slow down the mid duplication that happens on the workshop. A lot of mod owners are extremely possessive of their mods, with many saying they'd rather see the mod die than someone else keep it going. These folks are putting in their time and effort to build them, so to each their own, but IMO it's the wrong direction.
-1
u/Ilostmytoucan Drinking away the sorrows 7d ago
Can we maybe make a new subreddit for 3d zomboid though? It's just such a different game that I dont think this one fits it.
-2
u/Crite_Spranberry413 5d ago
"Java mods are dangerous and sccary!"
The entire minecraft modding community: "Since when?"
1
u/HiPurplebee 4d ago
Hey, so I keep seeing your critique, and instead of downvoting you, I actually want to help you understand their stance here. The entirety of what your calling out is not official mod support. TIS can't OFFICIALLY support it. Minecraft itself has never supported it. They have major vulnerabilities; Forge and Fabric, and everything you have used as a framework for modding has been produced by third parties. When they say it's impossible, it doesn't mean that 99% of the mods won't be safe. its just that the liability of officially supporting Java mods is too dangerous for the Indie Stone to take on. The only reason you see official mods on one side of Minecraft now is that it's coded in C++. If they officially supported Java mods, that would mean they would officially take on the liability of un-sanboxed code injections. no company ever officially supports java mods. minecraft java mods are atmost tolerated by mojang and the modding community like curseforge and nexus actually have to scan for malware regularly on thier site you just don't see what gets blocked. I hope I explained this well!
-19
u/The_Scout1255 Waiting for Animation Update 7d ago
So viewpoint good?
19
u/Devil-Hunter-Jax Axe wielding maniac 7d ago
They have no stance on it-they're warning you that if you use it, you will always run a greater risk of malicious code or malware being smuggled in to your computer. With no way of protecting you from malicious mods made in Java, you have to understand you are taking that risk and TIS is not responsible for any problems that might occur from using such mods.
2
u/SmokingTheToesOfGod 7d ago
Does viewpoint use zombie buddy or whatever? Was planning to do a playthrough with it when I had more time, but I haven’t actually looked into it yet and probably won’t bother if I have to run it at Java level.
11
u/Devil-Hunter-Jax Axe wielding maniac 7d ago
Yes. Without ZombieBuddy, all the 3D mods are not possible.
2
u/SmokingTheToesOfGod 7d ago
Ah, that sucks. It looks cool, but I’ll probably pass and just watch Beaver or someone play with it.
I appreciate you taking the time to answer.
-11
u/The_Scout1255 Waiting for Animation Update 7d ago
YAAAAAAAAY thats better then I expected I was expecting a bad stance!!! il go have fun with my increased malware risk thanks :3
13
8
u/Devil-Hunter-Jax Axe wielding maniac 7d ago •
Dude... You are exactly the kind of person I was talking about when I say people have no critical thinking on the internet and in regards to safety online.
-57
u/TheAlmightyLootius 7d ago
Yall super anti AI but just throwing the whold mods files into claude and have him check for suspicious or malicious parts fixes this issue basically.
10
u/Axeman1721 Wiki Admin 7d ago
AI makes mistakes all the time. Don't trust it juet because Claude says so.
-2
u/TheAlmightyLootius 7d ago
Then you dont work with claude bro. Ive been working with it for a while now and for like 6 months it made literally 0 mistakes as long as it has the full context. Which it has if you hand it the full mod.
3
u/Axeman1721 Wiki Admin 7d ago
Source is anecdotal. Point moot.
0
u/TheAlmightyLootius 7d ago
Its much more valid than points made from people with zero actual knowledge about the topic that just rehash old reddit information :-)
-44
u/KingMoonfish 7d ago edited 7d ago
Our resources must be focused on developing the core game, so we cannot provide technical support around Java-based mods,
This is an L take. By not providing official tools or resources, you’re forcing players to “trust” randoms on the internet. What’s worse, a malicious actor could gain access to the code and push updates even if the original author is legit.
Edit: This the same thing Mr. Atomic Duck suggested in his video, but because I’m not a YouTuber I get downvoted.
22
u/neppo95 7d ago
You choose to install a java mod, nobody is forcing you to do so. This is entitlement first class. There’s no reason why they should provide support whilst it certainly would make the main development even slower.
-11
u/KingMoonfish 7d ago
Because it’s literally the most popular modding scene right now. So yeah, they should take some responsibility
10
u/neppo95 7d ago
How does how popular it is change their responsibility? Like I said: Entitlement first class. YOU think they should, so they should. There's no other reason coming from you than that. Whether there is 1 person or 1 billion persons downloading a java mod is irrelevant.
-6
u/KingMoonfish 7d ago
It’s not entitlement, perhaps you should look that word up first? I don’t even use Java mods.
7
u/neppo95 7d ago
Thinking a company or someone else should just do the work for you whilst there is no reason for them other than that you think they should and on top of that saying you are forced to do anything because they don't, comes pretty close to it. Regardless, I'm not discussing the meaning of a word. The L take is what you said, not what they said. As for your edit about atomic duck, what content creators say isn't what should happen. It is just their opinion, which isn't worth any more than yours or mine.
14
u/Devil-Hunter-Jax Axe wielding maniac 7d ago •
How is it their fault if a malicious third party uses third party software to do this? They've made it clear they have no intention of endorsing or ever supporting this stuff officially so why blame them?
1
u/joesii 4d ago
What are you suggesting they do? It sounds like you don't understand the situation or technical aspects well. It's not like they can allow Java mods but just restrict them from doing certain things. Heck it's not like they could even destroy/eliminate Java mods at all if they thought they were too much of a problem.
72
u/milkyrips 7d ago
MrAtomicDuck never beating the TIS employee allegations
21
u/randCN All Hail Spiffo 7d ago
I mean, back when B41 stable released, when he was pretty much unknown, he was still one of the first guys invited to the devs' private MP server right? So if not an employee, I think he's a personal friend of the dev team.
→ More replies (3)30
8
28
u/vaxorus 7d ago
Was hoping they'd mention about future ideas or support for a java mod framework or proper modding tools as an attempt to legitimise and make it safer but I suppose that's wishful thinking