Lua items - mixed feelings (and impact of modding on servers in general)

To be fair, it's a really cool idea, nothing wrong with that, since it gives tons of opportunities for modding and that's obviously great and fun.

However, with the current amount of abuse already possible with lua scripting for techs (and objects), I feel that this step is going to bring the word "abuse" to a next level for most servers out there because it becomes much more accessible and easier to do it, and I'm not talking about giving yourself some items or anything trivial like that.

It's not even only lua though, it's pretty much valid for modding in its entirety (last time I tried flipping on the asset checker it was still not functional, sorry if I'm mistaking)

Wouldn't it be a good idea to implement some optional limiting factors on servers (per world) for specific entity groups such as NPCs, projectiles, and so on before making modding more and more powerful? For instance something like "max projectiles at the same time" = 400

With optional I mean the limits could be configured or turned off via the server configuration file for the people that wish to be unconstrained while testing out their mods on SINGLE player, so they won't be able to do silly stuff that can crash or lag any server out there with the snap of a finger.

Perhaps servers won't have to hide behind a password/whitelist anymore to provide a remotely playable environment then?

 

You do realize that no server-side cheat detection is in place yet, right? And when that is implemented, it completely invalidates your gripes.

 

If this gets implemented, they'll have to (or at least consider it) being able to blacklist certain API calls. I don't see how making items more lua-bound is bad at all.

 

Yea good one, "when that is implemented". When? Until then my gripes are valid.

This isn't even necessarily about cheating at all, this is mainly about people that like to mod their stuff to crash a server.

Main point is that modding gets more and more elaborate while no measures are taken to keep it within its bounds for servers.

You don't see how it's a bad thing, because you haven't seen what people can do with it. Making lua objects work on servers is impossible because it uses the server's scripts once placed, making lua techs that do funky stuff required a bit of figuring (also about how to acquire said tech), but making items lua based is going to make it very easy, since you can manipulate gear that is easy to get, the matter manipulator (ironically) for instance.

So you just copy paste the snippet of configuration that tells an item to use a lua script from some other item that is lua based, then you make a lua script that can potentially crash/lag things (plenty of ways) and make the item use it.

 

There's no need for that attitude. He asked a legitimate and calm question. Cool your jets. Don't attack people for posting questions or opinions.

Op, I don't know anything about LUA in terms of how it can affect servers but I'd imagine once we get some server-side item systems in place to check modified files, we'd be okay. I think this should be a top priority right now since playing online means dumping yourself into an environment where people are capable of cheating on a grand scale. I don't think they should be modifying the way items work at all until they fix the way servers work.

 

Oh man, if you'd only know what people are capable of with assistance of LUA scripts... It's overwhelming (and even a bit hilarious in some cases).

The modified files thing is very interesting, because I recall that the game had nailed this one pretty well early on, but it seemed to be broken since the conversion of the assets to .pak format, and it was never fixed afterwards (unless I'm missing something). However it had some flaws initially, one of them related to extra music also being counted as "mod" (thus not letting people in with additional abc files).

A proper server-sided system is definitely what I'd love to see in the end, but that's going to be time consuming to implement, so I tried to propose some kind of middle-ground thing that will put limits on entities, kinda like what they did with item drops (they clear if they reach a certain number, and certain items have their own timer).

 

Basically you're saying we shouldn NEVER have access to this amazing feature, because we're currently in phase 1 beta, and multiplayer has about as much security as a wet paper bag at present.

Core engine features like this have to go in early, if that creates more trouble for server hosts in the short term, well, so be it (We all knew what we were getting into when we signed up for beta). But we can't throw out entire major features, just because it "might be abused" in the short ter m

 

And where did you retrieve that "logic" from? Because nowhere did I use the word "never", and nowhere do I say that nothing should be added to Starbound before measures are put in place. Did you read my main post entirely? Because I think you are misinterpreting it badly... Just read it again please, I tried to make my point in a friendly manner without forcing anything (even though I made a snarky last remark in it).

I'm simply hinting that continuously elaborating on the modding system without putting some bounds on it for the sake of servers will have a detrimental effect on said servers, and I proposed a quick fix for it (quicker than complete server rewrite).

If you're looking for a fight or something you can PM me and we can sort it out over there then, but on this thread it would be nice to see some meaningful replies that try to think along with the issue (I don't mind if people counter it really), instead of replies with false assumptions of things that have NEVER been said.

 

You're kidding, right? You're complaining about a feature that isn't implemented for a feature that isn't implemented?

edit: until then, your gripes aren't valid. And that's logic you can't argue with.

 

Please read the rest of the posts and the main thread again, the issue is definitely present at the moment and the implementation of this new feature makes it worse, I merely proposed a way of softening the issue's impact.

I can definitely not argue with that logic because it is uninformed and thus unrelated to this subject, it's like saying a banana tastes like an orange (and defending that) without ever having tasted a banana in the first place.

 

I was merely saying that you can't complain about something that isn't implemented for a separate feature that it's paired with that also isn't implemented. I can understand what you're saying, but it's in no way stating something blatantly untrue like "bananas taste like oranges." Saying so just looks whiny. While I doubt they'll implement the server security features alongside with the new proposed changes, I will say that they should.

Hopefully the game will remain playable for you while these features are unimplemented. I haven't been able to enjoy the game much at all because a majority of features still haven't been implemented well enough. I'm not the kind of person that enjoys "just building".

 

It's called taking preventive measures, and it's usually appreciated a lot since nobody will suffer from unforeseen consequences (and also used a lot in various situations, most of them not even related to computer games). I'm surprised that you think this is a weird thing, it's really common for people to rather prevent something than letting it cause damage and then fixing it later. I made my absurd comparison because it honestly felt as if you were criticizing something I didn't state in the first place, but apparently there was some misunderstanding.

I don't play the game much anymore to be honest, right now I try to take care of my server which is going fairly well (when using a password), but it would be nice if public servers would become viable again, because right now server owners with public servers can pull their hairs out everyday because of issues everywhere. I can tell popularity has decreased just by looking at the serverlist, which is emptying itself faster compared to earlier days (also more and more "private servers" with hidden IPs).

I'm very patient when it comes down to new gameplay features, those have to be thought out carefully anyway or they will suck, but for the time being you're right: building is the game's main appeal right now.

 

A lot of people are obviously not completing understanding what the OP was about. I personally think that they probably have some amazing multiplayer systems in the next update or two and are just keeping it secret. I don't see them releasing more complexity and moddability to the game without first addressing the state online is in right now. The staff who work on this game have proven time and time again that they listen to their fans, read the forums and reddit replies and are very competent. At this point, it would be absurd to assume they're not aware of the chaos that happens on servers. Not long ago, I saw someone shooting giant meteors and causing 10k latency, then someone else crashed the server with something else. If LUA makes this game's modding even easier or more in-depth and there are no measures in place to stop hackers by then, those of us who play online (judging from the replies here, I'd say not many people in this thread play online regularly with more than friends) are boned.

 

I’ll say upfront I haven’t played online with anyone aside from friends, but I don’t see how an option to limit specific entries from the server will help solve the problem of online cheating. Hackers will just get more creative when it comes to working within said limitations. For example, 400 projectiles max at a time is way more than enough to force a crash, since even one projectile that breaks a bunch of tiles at once can be quite resource intense.

I feel you might be aiming for a solution that isn’t very effective for a problem that hasn’t arisen yet. How will expanding lua scripting for items suddenly make this a much bigger problem? It’s not like it isn’t hard to get ahold of objects that can allow for scripting. I don’t think limiting modding to stop some cheaters will help out much since it would deny others those options. Granted there might be some rather dangerous lua functions that are specifically disabled, but this sounds like basic functions like spawning in items and projectiles would have to be kept on a tight leash to prevent abuse. I know you mention optional server side options for this and not “take it away”, but even then I feel like that’s barely a solution as explained above.

 

The first part of your first sentence said it all... I've seen the issues with my own eyes and I have even reproduced them, 400 projectiles do not nearly crash a proper server even if they break tiles unless you're running it off a toaster. I'm talking about a completely different order of numbers, I'm talking about the 100000 projectiles in a circle every 0.01 seconds order, the game actually allows that kind of sillyness, now imagine each of those projectiles being explosive as well, blowing up a fair amount of tiles, you can imagine how to make it even worse perhaps....

But it would crash the hacker's client before anything would really happen you say? Yea, this is indeed where hackers become really creative.

Also note how the devs have actually left several (melee) items in the assets (public release yes) that are meant to crash the game. People have been using this all the time to grief each other, and they still do this. They also adapt other items to follow the same malicious behaviour, with more destructive effects mainly affecting other players.

The problem is definitely there, not for the people that play on a private server with a few friends though, they won't notice much, but there's a very good reason why most sane server owners decided to password their server instead of leaving it public, you can't tell me that's just pure coincidence or some random mood swing (I've done the same thing for the same reason, it works surprisingly well).

My proposal would soften most of the free room modders get to make such devices purely meant for griefing servers. Sure, they can get more creative like that and invent all kinds of ways to bypass it, but at least you will narrow down the opportunity a whole lot and make it a very difficult thing to accomplish rather than making it something trivial that every fool can do, aka changing a few numbers here and there from stock assets or from uploaded mods (lava gun? ;p). Also, every single item will be able to use lua script if this gets implemented, even your matter manipulator.

Right now, every single object can make use of lua script as well, just copy paste the configs from existing examples (npc spawner, turret) and make your own lua files or copy snippets from other lua files from other mods to get what you want. Objects though... Are handled server-side because they are placed in the world, so they won't use the client's lua scripts (phew). You can even use the lua code used for techs to do whatever you want with items probably... The dangerous thing is that lua for items actually gets read from the client, because inventory management is client-side... Same with techs, but items are relatively much easier to acquire/change.

My proposed solution... Is it a perfect solution? Absolutely not, but it's definitely better than nothing at all. Having a limit for most types of entities and actions (drilling/blockbreaking) ensures that there won't be any crashes related to massive spam, which is right now about 90% source of lag and crashes for most (public) servers and clients (because in all honesty, a starbound server is quite stable as long as everybody behaves neatly). Making it optional and configurable will keep everybody happy as well, I don't see what's wrong with it, if people don't like the limit for projectiles (400) they can make it 100 then, or 1000.

Just for the record, I'm not making things up, I've seen it happen and I'm talking from all the experience I've gathered so far about hosting a starbound server, modding assets, and how modded assets can influence servers positively and negatively.

Lua items are not the only reason I'm bringing all this to the table btw, but their announcement motivated me to create this thread to discuss how modding impacts servers. I could change the title (if that's still possible) to something more accurate.

 

You have a very broken sense of how software development works. In short, you're complaining that an unfinished product does not have everything completed. That doesn't make any sense.

Then, you go on to say that cheat protection should be a high priority while the ability for Lua scripting should be low priority. As a programmer that has dabbled in game development, I'm telling you for a fact that you are wrong. First, because getting it to just work is your first goal, then improving it (ie. server protection) comes later. Also, the way the Lua integration works is ingrained within the core; to even attempt to add it after the fact would essentially mean a completely rewrite.

The developers are doing things in the order that they are doing them for a valid reason, I assure you. It comes from knowledge and experience rather than just thinking how nice it would be to have a certain feature working right now regardless of the implications.

 

I didn’t say the problems didn’t exist, just that I’m not sure how your solution would be a fix to them. Modding will only expand as development of this game continues and I feel a different method of handling this would work over hard limits. When I meant one explosive projectile, I mean those that have a huge radius like mods with nuclear bombs. On the other hand, it would be hard for there to be a legit reason for their needing to be close to 400 projectiles at once, even with rapid fire weapons and custom bullet hell style enemies. 100,000 projectiles every hundredth of a second surely would have to be the result of edited lua scripts. For tech and items, they would probably have to be changed to be handled server side, at least the lua aspects of them if possible.

What I mean by another solution is a MD5 hash check on the assets.pak and only mods allowed that are also on the server. I take it that isn’t the problem, but somehow modding official items without additional files? I’m aware of the unused items like the chainsaw, but I wasn’t aware of how some of them could cause crashing results. It seems like a solution for that would be to remove those game breaking effects and possibly add developer only items to a sort of black list. For example, attempting to use developer items in Terraria would cause massive debuffs to be placed on you, pretty much rendering those items unusable.

I’m not at all surprised by most public servers being password protected since even without cheating or hacking, there are probably plenty of ways to grief players like stealing items from their ships. If not already done, those things would require specific solutions. From what it sounds like, this is a pretty common problem, but a host can’t say, ban offending players? Actually, if third party programs are being used a run time to hack, it seems like a solution would be to detect those and automatic ban players using them. On the other hand, I’m not sure how you would stop inventory hacks short of making online characters server side only and I can see people not being happy with separate single player and multiplayer characters.

 

But we're not talking about software development here, and there's no single software development experience that's going to be fully normative for every project out there, so your experience in software development is only going to contribute partially to the legitimacy of your words, and as an experienced software developer you should be aware of this, am I correct?

To get back to the topic... You keep making these funny assumptions of things I have never said or implied, why? I never stated they should completely put the lua stuff aside, or do it at a much later stage where it is hard to implement. I said that they have to think about the consequences that expanding the modding system has on servers for instance, and perhaps try to find some quick temporary ways to compensate for it to make (public) multi-player, an important part of most games nowadays, more fun and less frustrating, even at this stage of development.

Let me rephrase this yet another time: I'm just hinting that servers might be doing bad because people can mod the shit out of their assets and break said servers easily like that, and I proposed a possible solution to battle it partially, so that -perhaps- public servers can become a thing again. Why does this statement anger so many people, does everybody hate multi-player on here?

I mean, people are free to post how their solution to the problem would look like, I just quickly made something up that could work, but it's definitely not ideal, but don't ignore the problem, there definitely is one, it's hilarious that people new to the game browse the server-list and cannot find one single public server that allows them to play without issues most of the time.

 

And finally somebody posts a constructive reply with proper reasoning and fresh ideas, and also manages to stay on the subject!

Perhaps world-entity-limits are a bit crude, could also move the limits over to the items though the main gripe with this is that it will permanently reduce modding freedom, so taking this route of limiting is difficult but works partially.. Slapping limits on things, though I'd definitely prefer something less sketchy.

The other solution you proposed was something I hoped would be implemented eventually, because it would solve most worries and headaches. I don't mind when exactly it will come, but it would be awesome for it to come at some point now or later to keep things neat and civil on the servers, it would be a huge plus.

I completely agree with the dev-tool thing, things like that should be hard-coded and simply impossible to use for anybody but the devs, or they could simply be scrapped from public release.

Right now, vanilla server is not even capable of dealing out bans and kicks, so server owners would have to resort to wrappers or other smaller tools to run a proper server in the first place. Luckily there are some wrappers that are very functional already, such as StarryPy, Starrybound (if you modify it a bit, it even had something to prevent stealing from ships!), and some others that are probably upcoming and even better. The spawn protection they offer already prevents a whole lot of "easy grief" (join and try to cause mayhem immediately), because they generally cancel most projectiles and all build attempts at protected planets. Server-side inventory would be a great thing for later, if it will ever happen, but I have this feeling that the community is going to develop something for it eventually, probably something that's plugin based for one of the future (or current) wrappers.

 

Yes we are. Games are software.

No. Some things change, but some things do not. The reason things are being added to the game in the order that they are is because the core infrastructure needs to be in place first. In *any* programming you ever do, you'll often hear common phrases like, "First, make it work. Then, make it work efficiently." You'll find similar quotes about premature optimization. It all boils down to getting a semi-functional scaffolding in place before adding in the filler.

I've worked on everything from games, to large (100+ server network) websites, to financial software. They are vastly different in what they do, but they all rely on the same ideology and logic.

And doing so would, in fact, be cutting out core infrastructure. The very thing that needs to be implemented and tested thoroughly before they continue. This is a beta. The developers themselves use the exact same methods to add content to the game that modders have access to. Any attempt to stiffle mod ability would in essence cause much more unnecessary work for the developers to implement as well as slow down their development speed. Plus, it then wouldn't be tested.

Yes, it sucks that things can go a bit crazy right now, but again, it is not a polished, ready-to-use product. With a majority of things not even working correctly to begin with, they have much more to worry about than people cheating or causing chaos in the sections they do have complete.