Subject Add a server-side setting to force clients to retrieve all configuration data from the server. The pros? -Clients will no longer be able to modify their files and enter the server with severe griefing tools -Once the asset digest setting works again, this will make a server mod-proof (and thus largely GRIEF-PROOF). -Servers can have much more elaborate modifications (recipes, projectiles, codices, etc, still by using stock content though) The cons? -Servers could send malicious data to the client, but this can be solved by making the client check if the downloaded file was valid JSON. -In some cases clients would not be able to modify their files for harmless purposes, but this could be solved by adding an exception list (server-side) -Data usage (can be solved by making clients download the JSONs on the fly rather than at once when joining) Conclusion Firstly, the pros outweigh the cons a lot. Secondly, all the cons can be circumvented with the appropriate security/exception/performance measures. I know there are plans for moving a lot of things to the server regarding modding, but in my opinion this would be the first step. We can have clients downloading .pak files afterwards, but lets first properly fix this one shall we
I don't think you understand the can of worms you have suggested opening. This would be like sv_pure for the srcds games (TF2, CSGO, etc). Anyone who has managed a srcds game server for any amount of time knows how much problems there has been with sv_pure and trying to prevent cheating. This is an extremely problematic area because it pits server operators against players, and figuring out who to favor is rather difficult. Naturally, if you play on a server, you need to play by the server's rules. This gets complicated when the server has mods installed. How do you require a client to install a mod? None the less, this is an interesting idea. I am sure that Chucklefish will think about this kind of thing when they get to anti-cheating and server administration.
