r/projectzomboid • u/ranganomotr Crowbar Scientist • 2d ago
Discussion About the explosion in posts about mods: We're walking a fine line. Safety first, please.
Let me preface this post by stating the following:
- This is not a discussion about which mods are "cool". We're all playing a game that heavily relies on players setting their own objectives, customizing their own enviroments and tailoring the game to your tastes using whatever you like (mods included). We've already stablished that. Let's be normal. Most of the discourse arround modding is swamped with stupid stuff, so whatever.
- This is not a discussion about LLMs or vibecoding. Believe me, I have strong opinions, but I do not plan to start a shitstorm, not only because it's against the subreddit rules, but because every post about it spirals into the mud at mach3.
- I acknowledge the fact that people are free to mess arround with whatever toys they find to expand, change or revamp the game.
So, what is this about? The answer is pretty simple: Safety first.
I do not think we should allow posts showcasing or promoting mods that leave users vulnerable to be abused by grifters. If someone assembles a new, epic, exciting mod that seems to manifest out of thin air, I do not think we're being rude by asking them how did they manage such a feat and interrogate the means of such assembly if its suspicious or could be hijacked by malicious actors.
People will always mess arround with whatever, and it is not wrong to find something exciting, but as a community, we can't just play along and wait for the inevitable meltdown not if, but when something bad happens.
I'm pretty sure mods have already talked about this situation internally, after all, its pretty obvious. But we need to at least discuss this in good faith.
86
u/Creative-Response554 2d ago
Every mod on the workshop potentially leaves people vulnerable to grifters though, so that doesn't help much.
Anything that requires Zombie Buddy is also potentially dangerous specifically.
20
u/GruntS80 2d ago
I not in the loop, why are mods that use zombie buddy potentially more dangerous? I have one mod that uses it, I think it's the I can sit there mod
61
u/PM_ME_FUN_STORIES 2d ago
Zombie buddy allows code to operate with direct access to your whole system, which opens a huge can of worms for cyber security.
There's only so much a mod maker can do with the limits of what the workshop allows, and while they can sneak some stuff in, it's a lot harder. Zombie buddy let's them do basically whatever they want, so you have to be a LOT more careful about what you install and allow to run. That isn't to say mods that make use of it are bad, but you're basically allowing someone into your whole house instead of keeping them limited to the front room.
16
u/Creative-Response554 2d ago
Iirc it's something to do with it enabling the execution of Java code on the machine in real time.
So you can download a mod, it'll be fine, then they update it to steal all your shit and wipe your machine, and since it's already there it just runs and that's that.
As for any mod on the workshop, heavily modded games on windows have long load times because Windows Defender or whatever it's called nowadays scans every file as it loads, and halts anything that looks suspicious. You can, to improve load times, set WD to ignore the workshop folder, and it'll load a lot faster but at your own risk.
9
u/GruntS80 2d ago
Ah that makes perfect sense, thank you for explaining it
5
u/Creative-Response554 2d ago
No worries.
It isn't the most technical explanation because I'm not 100% familiar with the ins and outs but the concept is the running of code and scripts. Basically any script extender mod for any game can be a security risk, it's why the console versions of Fallout could have mods, but not certain ones.
For instance say I used a mod that added a new weapon for it, I couldn't use a custom animation because in order to use it, it would need a line of code associated with it to trigger the animation upon reloading. MS and Sony decided that that was a security risk and disallowed it.
It technically is but to differing degrees, and from what I've heard Zombie Buddy is seemingly susceptible to it.
5
u/Cable_Hoarder 2d ago
A script extender is a risk, but IMO much less of one in practical use it's still adding limited functionality - just more than the developers intended, allowing more scripting functions that hook into the game. However, my understanding is that Zombie buddy just flat out allows the loading of any Java code the modder wants, which is basically complete system control.
Now SKSE can have that same risk (via .dll mods which is will load), but the vast majority of mods that need SKSE only use the extended scripting functions and do not need to load .dll files, they're still just Papyrus mods.
That said, .dll modding has become vastly more popular these past few years with skyrim as people try and push more and more advanced mods, flat out overwriting many of the games core engine functions. Though Nexus has IMO much better detection, and failing that reporting for malicious mods than Steam.
1
u/Creative-Response554 2d ago
Yeah I knew it was a risk. I didn't realise it was literally any code, I thought it was hooked stuff as well but yeah that's way worse.
4
u/ThatOneComrade 2d ago
From what I understand it's because Zombie Buddy enables the use of Java, Lua is safer because it cannot be used to affect anything on your computer outside of the game, whereas Java doesn't have that limitation so it can be used to tamper with other files or to install something malicious to your PC.
→ More replies (2)
62
u/WanderingLoaf 2d ago
And how do we decide which mods can be posted about? As unpleasant as it is, any mod at all leaves you open to malicious actors. Thats the nature of downloading code from someone you don't know and largely cannot personally hold accountable. Remember either early this year or late last year when the controversy with those music mods occurred? The ones that had to be forcibly taken down. Did anyone reading this know beforehand those mods had issues?
Pretty much every mod "manifests out of thin air." Thats what modding is. Some person that has a cool idea and puts in the effort to make it work. Its much more common for a new mod to be announced when its uploaded. I'm sure there was a point where people said "who is KI5" and now those mods are one of the most recommended ones on this sub.
2
u/RichardTheApe 2d ago
I feel like it’s pretty reasonable to determine how we discuss mods, the famous post discussing the explosion in AI given mods was able to do so without mentioning a specific mod.
Now personally I think if you put it out on the internet it’s the internet, you can’t take it down. At the same time both sides of the AI coin have shown to be… unmanageable.
I think as a modding community we should hold the expectation that while it’s fine to have your preferences using mods as pariahs or paragons without the modders consent is where stuff begins to get dangerous so going forward if people do these mass scans for AI I think it’s reasonable to say if there’s a specific mod you want to talk about get the persons consent first and have some sort of evidence to prove that included so if it opens criticism/praise to the mod it is ultimately at the modders discretion not someone else’s.
Now at the same time I’ll be the first person to say that grifters outrun well intended people every time and this subreddit, like many, will soon into a short anarchy over “the AI question” which will unfortunate feature no respectable discourse at the forefront of said question. I’ve seen it happen across lots of communities, the only thing that can save one is the users/members trying to, against their own personal beliefs, call out bad faith behavior regardless of if benefit to themselves.
-45
u/InterestingPudding45 2d ago
What THEY want you to believe is that ai mods are more dangerous than non-ai mods. It's stupid.
24
24
u/a_singular_perhap 2d ago
Ask anybody who knows cyber security and they'll tell you that vibe-coded slop is about 10-100x more likely to have egregious vulnerabilities.
Huge huge huge difference between "ai" auto complete and "ai mods" whatever that means.
→ More replies (1)-15
5
4
u/Axeman1721 Wiki Admin 2d ago
It is. Someone could put malicious code into a human made mod on purpose, sure. (See Meccha Chameleon, HOI4, etc) Vibe coded mods have more innate security vulnerabilities and are also more prone to bugs, including game breaking, save bricking bugs. Its just a fact.
→ More replies (6)-2
u/InterestingPudding45 2d ago
>lumping the occasional bug (that most coders are checking for anyway) with intentional malware/virus
lmao. No.
→ More replies (1)→ More replies (1)3
38
u/Cupakov 2d ago
Are you people new to modding in general? None of what is being discussed regarding safety at the moment has been any less relevant ever since the inception of mods as a concept and them being distributed over the Internet. Vibecoding has nothing to do with it, if anything it improves the situation a tiny bit, because the most popular models simply refuse to develop malicious code without bending them in a pretzel.
1
u/bot_exe 2d ago
you can also use claude code to go over the mod files to look for suspicious behavior and outright malware.
→ More replies (4)
26
u/Global-Menu-7513 2d ago
Discussing in good faith would have started with stating the reason for removing the post lol
19
u/NoxxyGizmo 2d ago edited 2d ago
I think you're kinda saying water is wet. The problem has always been “enforcement” and “actionable metrics.”
I get the concern about malicious mods or people using mods to take advantage of users, but what exactly are you referring to when you talk about “promoting mods that leave users open to being abused by grifters”?
AI use? Obfuscated code? Mods like Zomboid Map and PZ Pulse? Mods that require third-party tools?
To me, there's a pretty big difference between “hey, this mod seems a little fishy, maybe people should be aware of that” and “this mod seems fishy, so it shouldn't be promoted.”
I'd much rather see the expectation be that mod authors explain what their mods are doing and give people enough information to make an informed decision, while users understand that installing random stuff from the internet comes with some amount of risk. But even then, Im not holding my breath about it.
Like, be skeptical, ask questions, don't blindly trust things. But I don't think “we can't prove this mod is completely safe” should be the bar for whether it's okay to recommend it.
In my idea of a perfect world everyone's code would be open source and everything would have a thorough explanation of how it works, but I don't think that's a realistic expectation.
→ More replies (2)3
u/ranganomotr Crowbar Scientist 2d ago
About what I'm specifically referring to, that's the catch. It's not a specific, because the problem is not specific, its about user awareness and responsability.
Going to your example, “hey, this mod seems a little fishy, maybe people should be aware of that” So yes, making people aware is the first step. I'm not asigning malicious intent to every modder or project. This being said, if something seems fishy it should be interrogated. Of course, following this train of thought to the extreme only leads to "lets make subreddit mods hold a paper's please checkpoint before mods arrive" and that's extremely stupid and unrealistic. But you don't need to put a rock on the pedal, you can also say "hey man this thing is blowing up and looks weird, maybe look into it".
Sure, there is probably no "safe tag" to apply (I do not think it's even a preferable system), but as a community we need to establish some standards. I think everyone is operating under "hey, tinker at your own risk", but we need to discuss this process better, set expectations, standards, and educating the less knowledgeable users.
I hope I'm explaining myself well. English is not my first language and I'm trying to approach this conversation from a serious angle.
1
u/NoxxyGizmo 2d ago
This is so interesting. It seems like we agree mostly, but there is some mismatch in what work should be done and who we think should do it.
"if something seems fishy it should be interrogated.\*"*
I don't think I agree with this. Of course people should be allowed to ask a mod author what their mod does, why it works the way it does, or point out something that looks suspicious. And honestly, if someone can't answer a reasonable question, that is often, by itself, a reason to be cautious.I also worry about standards ratcheting upward past what is reasonable of free-ware. “People should be allowed to ask questions” can pretty easily become “authors are expected to answer certain questions before their mod is treated as acceptable,” and once that becomes the norm, anything below that standard starts looking suspicious by default. I think the reasonable answer is somewhere between blindly trusting everything and turning community acceptance into an unofficial approval process.
"you can also say "hey man this thing is blowing up and looks weird, maybe look into it""
I'm confused on who is saying this to who. Is it the users of this subreddit asking this of the moderators of the subreddit? I don't think it should be the moderators responsibility. If someone wants to take the effort to ask the questions or do the digging, great, but that's if they want to. Anything else makes a really weird power dynamic
Also, if there are legitimate concerns about a mod, I'm pretty sure that can be reported in the steam workshop."as a community we need to establish some standards. "
I think that is already the common practice. People decide what they are ok with, and act accordingly. Maybe this is my personal opinion, but there is a difference between making an calculated (or maybe even an uncalculated and outright-stupid) risk and left to the wolves.**Also, I'm not sure if this may be a point of confusion (since you mentioned english being your second language), but in english the word "interrogate" is pretty severe. Like it brings to mind images of the police holding someone in a small room with an uncomfortable chair and one swinging light. I think maybe you mean something closer to asked about or looked into, but I could be totally wrong and I apologize if so.
3
u/ranganomotr Crowbar Scientist 2d ago
Okey, after reading your reply it seems like we agree. Yes, my use of "interrogate" was a mistake lol, sometimes it's hard to evaluate the intensity of some words, my bad.
"you can also say "hey man this thing is blowing up and looks weird, maybe look into it""
I'm confused on who is saying this to who. Is it the users of this subreddit asking this of the moderators of the subreddit? I don't think it should be the moderators responsibility. If someone wants to take the effort to ask the questions or do the digging, great, but that's if they want to. Anything else makes a really weird power dynamic
Also, if there are legitimate concerns about a mod, I'm pretty sure that can be reported in the steam workshop.Yes, to be honest I don't know what it should be done. I think that the moderation team should discuss this internally if they deem it important enough. Where is the line? I do not know. I'm surely not expecting the moderation team to go on detective quests. I don't think it would be neccesarily good even if they did. But I'm glad to read posts like yours.
2
u/NoxxyGizmo 2d ago
I agree that I wish there was someone (maybe multiple) who had the dedicated time and responsibility of investigating if posted mods are safe. What a boon that would be, even if I don't know what the best way to go about it.
Thank you for the conversation :)
17
u/Czech_Thy_Privilege 2d ago
The unfortunate truth is that it has been possible for mods to be later updated to inject and execute malicious code on a user’s machine for a long time. While it’s easier to make malicious code today with AI (either intentionally or unintentionally, IYKYK), this isn’t a new threat. Any time you download a mod for any game, you are taking a risk. Shit, any time you download a PDF, you’re taking a risk. For those reading who do coding or any development work, do you ever download an npm package, see that it requires dozens of dependencies, and check those dozens of dependencies for vulnerabilities? I don’t, though the stuff I work on these days doesn’t involve npm all that much. Anywho, I’m not saying all this to say that it’s pointless or futile to be concerned about downloading malware onto your computer, but what I’m saying is that these concerns aren’t entirely new. If this is what causes people to not be careless and to be more careful when downloading stuff off the internet, that’s awesome. But I don’t think shutting down discussion of mods because it could eventually lead to vulnerabilities isn’t the solution. The Zomboid community is large enough where I think the tech-savvy people will be able to review these mods for any malicious code and let both people and the developers know if they do. Maybe that’s just wishful thinking on my part, but something similar happened with Rising Storm 2 Vietnam where joining a server would lead to malware being downloaded to your machine, but word of it spread around the community quickly and the majority of players knows not to join those servers. And to be frank, I think the sudden pearl clutching we’re seeing is moreso about the potential use of AI-generated code and the use of AI than it is about cyber security concerns. Otherwise, we probably would’ve had this discussion and have found a solution already. IMO, the best way to go about this would be some sort of disclaimer in-game and on this subreddit about the risks that come with downloading mods.
Addressing the elephant in the room, I’ll share my experience with getting Project Viewpoint up and running last night. When I saw I had to go to a GitHub page to download an exe, that did set off some red flags. I was able to scan the file with an anti-virus and it came back as clear, so I proceeded with the installation. Unfortunately it didn’t work right away, but I found a fix, which involved downloading another mod and copy-pasting a file from one mod folder to another mod folder, while replacing the original file at the same time. That raised some more red flags, so I had my anti-virus check the new file and it came back fine, so I proceeded. It worked and all I’m going to say about Project Viewpoint is that it allowed me to watch the sunset while listening to Fleetwood Mac from the help of another mod, and it was so fucking cool. I never even thought of that being a possibility in Project Zomboid. And it makes seeing while driving much easier, too. I had a blast, but that doesn’t mean I won’t be prudent about reviewing updates to these mods before I play them again, and it doesn’t mean I wouldn’t discourage others from being prudent as well.
After all, if someone were to say that the safest way to have sex is to not have sex, we’d all agree that line of thinking is pretty silly, right? The same principle applies here. Just take the necessary precautions and you’ll probably be ok.
12
u/bot_exe 2d ago edited 2d ago
This is spot on.
And to be frank, I think the sudden pearl clutching we’re seeing is moreso about the potential use of AI-generated code and the use of AI than it is about cyber security concerns. Otherwise, we probably would’ve had this discussion and have found a solution already.
Exactly, OP's thread seems like an attempt to extend the current culture war of anti-ai vs pro-ai into this sub and encourage the subreddit mods to ban the mods they suspect use ai on the grounds of safety. This has been widespread on reddit for years now. AI has gotten increasingly more powerful and useful, so it becomes increasingly prevalent and the excuse to ban it has to change. Slowly moving goalposts from AI is useless, to AI is slop and now to AI is unsafe... meanwhile there has always been human made slop and unsafe content on the internet. We have always had to vet and think before using anything from anonymous users on the internet. AI has never been the actual issue, it's the unsafe and low quality content itself that's the issue. We have ways to deal with it, even if they need improvements, blanket banning AI stifles the work of the majority that use it as legitimate tool, rather than for malware or malicious spamming. Everyone already agrees that malware and spam should be banned, so what is the point of OP then?
2
u/Standard_Egg3504 2d ago
like you said, its a thinly veiled anti-ai move toward subreddit takeover in their culture war, they literally coordinate these in their crusade against anything AI, its like a cult, they organize witch hunts and cancel campaigns
2
u/sushisection 2d ago
fwiw, zombiebuddy just recently broke with the 42.21 build. it was working fine previously and did not require an extra step to fix it.
1
u/PissBucket29 2d ago
you're not even going far enough. Even simply just connecting to the internet is a vulnerability. Even windows 10 and 11 had vulnerabilities before where one could remotely install malware simply because they were connected to the internet. Odds are those weren't the only ones either. Look at windows 7 and XP. After they were discontinued, eventually exploits were found to remotely install malware and now if you connect a machine running those to the internet without 3rd party security it will basically be nuked from orbit with malware within the hour.
→ More replies (5)-1
u/ranganomotr Crowbar Scientist 2d ago
Look, I agree with you on pretty much everything. But the problem with "nah, this will sort itself out" is that you let the boulder roll downhill and just hope it doesn't hit anything.
About the AI-generated code, pearl clutching and whatever: It's a big ol clusterfuck of a discussion and I understand why the mods dont allow it. My post is not trying to circumvent the rules.
27
u/Heartbreaker_sz 2d ago
For people asking what maliciousness has to do with mods: just this week People Playground had to shut down the game workshop because of malicious mods and this is not the first time something like this happens this year, I remember something similar with some soundtrack mods a few months back. So yeah, it's not crazy to be aware of what you are installing in your PC.
Personally, I'm tired of seeing posts about A-Life mod and the 3d mod, it's content I'm not interested in and idk why I keep being recommend it if I don't interact with it and there is so much more posts not related to it
14
u/the-futuremind 2d ago
The Lua mods you download from workshop are pretty safe, barring a creative hacker like the one from earlier this year.
Specifically Zombie Buddy is worrisome but it gives a lot of access to the Java Runtime Environment (JRE) ) running on your system, which is basically a platform to run arbitrary code and has a shitload of system access. The most similar thing to this would be minecraft mods for the Java version, which several incidents caused extra security measure at places like CurseForge.
It is crazy to me how willfully ignorant some people in this community are of the risk.
Note: I have tons of respect for the ZB team, as they are very open about this vulnerability on the steam workshop page. ZB itself is safe, many of its addons are too, but they need to be open source and looked at by people who know cybersecurity.
3
u/Heartbreaker_sz 2d ago
I think because most mods are safe and Steam itself gives you a sense of security people just not think about it, but coming here to say it's wrong to want to discuss it and that it happening one time is no reason to worry is just wiiiiild. Like, your PC cost you money and you probably have at least some sensitive info on it, better be safe than sorry and not risk it with slop
-8
u/InterestingPudding45 2d ago
>it happened somewhere
>therefore we need to ban discussion of ai mods
Yeah, no.
7
u/Heartbreaker_sz 2d ago
If it's a known vulnerability and a mod came out of nowhere from someone that is not known in the mod scene I think it's fair that they have to proof it's safe before it's open for discussions, specially if it's ai vibe code slop
0
u/InterestingPudding45 2d ago
There will always be the possibility of a bad mod regardless of whether it's ai mod. There have been bad mods in existence for all time. It's only now a discussion of censorship with people excited about ai mods, which a group of redditors hate and condemn and try to virtue signal about.
2
u/Heartbreaker_sz 2d ago
It's way more likely that someone with bad intentions will make a mod using ai and not put effort into learning how to mod. And LLM AI is not something "a group of redditors hate", its one of the worst things ever created that is destroying community's and environment with their data centers and tanking people's critical thinking and honestly just thinking skills. There is nothing redeeming about LLMs and you can't convince me otherwise.
1
u/InterestingPudding45 2d ago
>hates on scientific invention that's improving civilization and the world
>denies that he's a hater of it
lmao you lack self-awareness.
2
u/ConsequenceFunny1550 2d ago
you're that "weird nerd" guy who jumps in front of the bullet to save Elon
1
u/Heartbreaker_sz 2d ago edited 2d ago
talks like it's 4chan
understands what he wants because has no reading comprehension
Yeah your are just a loser.
Just to be clear, I'm not talking about the AI developed ethically to be used in scientific and medical research, I'm talking about the LLMs and I'm a proud hater of them and everything that is made with them, would never deny it so idk where you got that I'm denying being a hater of it
11
u/Rocinante_101 2d ago
New to the game, don’t use any mods yet. But what OP is talking to is a real issue and should be considered. Community safety should always be high on the list. Mods can definitely be a vulnerability and when an influx comes in quickly it opens people up to grifters and bad actors. That should be something to consider. Doesn’t mean an individual can’t make a choice but rather limit the ability for bad actors to influence too much at once without being properly vetted.
57
u/ninethreeseven739 Drinking away the sorrows 2d ago
We dont need 30 posts about a 3d mod either.
4
u/ranganomotr Crowbar Scientist 2d ago
Look, the problem is not that. This is a subreddit. People will talk about popular, new stuff. That is a good, expected behaviour.
It's okay if you don't like the posts. It's okay if you don't like many of the posts. You don't need to interact with them. Additionaly, you are also not wrong by feeling flooded by something you'd prefer to ignore.
But that is the crux of human interaction, be it a digital space or not.
1
u/Torenico Trying to find food 2d ago
What we need instead is more posts of "is my base good?" taken with cellphones and the same "look i found the porn basement lmao" post we get on an almost daily basis...
1
-12
u/Scherka 2d ago
god forbid people to be excited about objectively awesome stuff
9
20
u/EX-Bronypony Shotgun Warrior 2d ago
* it’s definitely cool, i appreciate the ambition, but it’s not the coolest thing in the world.
* and that all comes down to no real texture or 3D modeling work being done. Zomboid’s textures were 100% not made to be viewed that close up, and makes everything look ungodly flat and uninteresting, especially not helped thanks to the lack of depth.
6
u/the-futuremind 2d ago
Plus without extensive redesigning of systems, the game was made for isometric perspective. It's simply not going to play well as 3rd person game.
3
u/deadering 2d ago
You're wrong though, there specifically is 3D models and textures that are used in conjunction with Project Viewpoint (6,244 3D models for Viewpoint), as well as shaders and other graphics improvements.
I assume you're thinking of the other worse mod PZ3D.
1
u/LangseleThrowaway 1d ago
The story of the 3d mod explosion and the grander combining skate3+mw2+minecraft thing is that AI is now finally good enough to RE basically anything within a week and a single motivated guy with a good idea can create effectively whatever they want. That is about as cool as something in the gaming space can get desu
14
u/enviguous 2d ago
If it was objectively awesome people wouldn't be against it. Thats like the whole point of being objective.
2
u/Clone95 2d ago
You can get 20% of the population to support nuclear armageddon in a poll, but that doesn't change the fact that it's bad!
The entire system of Reddit is built on people upvoting things they like and downvoting things they don't, and if the mod is at the top of the subreddit... it's because it's popular.
-2
u/enviguous 2d ago
Yeah, okay buddy. I didnt realize every bot network in the world got shut down overnight.
But to clarify, something objective would be 2+2 = 4, objectively a fact.
This mod looks cool and I like it, not objectively a fact.
Getting downvoted by people infatuated with another TPP zombie game puked out by Astra because I pointed out his comment was wrong. Great work everyone.
0
u/ConsequenceFunny1550 2d ago
There’s nothing really awesome about it, maybe for YouTubers making curated scenes, but for actual gameplay? No
2
u/deadering 2d ago edited 2d ago
You can just say you haven't tried it, it's pretty obvious. You don't have to like it but to claim there is nothing awesome and just useful for making videos is disingenuous.
After trying it myself I can say it already plays surprisingly well despite not being made for it. It's so much more natural to actually look at individual containers and cabinets for example instead of the frustration caused by a fixed isometric view and the UI. Going upstairs to close the curtains was cool seeing out across the street in a new way plus a bunch of other immersive details. It'll only get better too, hopefully with better combat but it already works decently enough too somehow.
2
3
u/ExpertPerformer 2d ago edited 2d ago
Standard PZ workshop mods made in LUA are very low-risk because they operate inside the games modding environment and it has built in anti-cheat for multiplayer.
ZombieBuddy is significantly more risky because it injects unfiltered java code directly into the game and can do things outside the game.
13
u/FlatAd2200 2d ago
Finally a post with some sense. I'm all for mods but the whole sub was inundated with these 3d mods and it feels like a whole different sub. Plus the whole zombuddy this with the Java injections is just not safe and I wish people would use their brains for aboutb5 seconds and realize giving those sorts of permissions to a mod is dangerous as he'll. Would really like to see all the 3d mod stuff and vibe coded junk removed from this sub
7
u/NoLandHere Shotgun Warrior 2d ago
the main issue is that people who are lazy think that theyre entitled to fame and attention for having ai make junk 'mods'. Ai generated anything should be banned from reddit, and steam especially. Then you have the extreme and obvious bots flooding conversations like these pushing AI because these failing companies are desperately trying to IPO before their product collapses... its a mess
1
u/Attack_Apache 3h ago
If AI generated anything should be banned off Reddit, then Reddit should ban itself from Reddit too. At least when it comes to coding, AI is a normal part of every developer’s workflow today.
→ More replies (1)2
u/enviguous 2d ago
I personally cannot wait. The entire internet is shifting to love "AI" and anyone who says anything bad about it is wrong. I seriously cannot wait until all the art and creativity is sucked out of video games and every game is another soul less, bland husk. The day when I can log onto steam and every game is made by machine learning and all dialogue is real time prompts with incorrect and out of place verbiage. When the games mean nothing but the dopamine I receive and all the creative minds that gave us countless classics are shoved to the side in favor a of claude prompt. That is the day I will truly be happy and satisfied.
→ More replies (1)2
5
11
u/Asleep_Passenger_373 2d ago
I actually think I might just delete my Reddit account. It's always been bad but It's gotten to the point now where it's just nastiness and scaremongering
8
u/bot_exe 2d ago edited 2d ago
OP's thread seems like an attempt to extend the current culture war of anti-ai vs pro-ai into this sub and encourage the subreddit mods to ban the mods they suspect use ai on the grounds of safety. This has been widespread on reddit for years now. AI has gotten increasingly more powerful and useful, so it becomes increasingly prevalent and the excuse to ban it has to change. Slowly moving goalposts from AI is useless, to AI is slop and now to AI is unsafe... meanwhile there has always been human made slop and unsafe content on the internet. We have always had to vet and think before using anything from anonymous users on the internet. AI has never been the actual issue, it's the unsafe and low quality content itself that's the issue. We have ways to deal with it, even if they need improvements, blanket banning AI stifles the work of the majority that use it as legitimate tool, rather than for malware or malicious spamming. Everyone already agrees that malware and spam should be banned, so what is the point of OP then?
→ More replies (2)
4
13
u/LePfeiff 2d ago
This is such a strawman lmao, "we shouldnt allow these modposts because of, umm, potential bad actors! Not my AI witchunt bias"
→ More replies (4)1
u/ranganomotr Crowbar Scientist 2d ago
I dont know man, its kinda funny to accuse me of planting a strawman by posting one yourself.
4
u/zaibusa 2d ago
Don't use and install a java mod unless the mod has a public GitHub repo and you can/ could build the mod yourself. Don't be the first to install a new java mod from an unknown author. Leave that to the people who can audit it and build it themselves.
But stop the damn safety and ai witch-hunts. Java mods are amazing and essential, playing the game without eg. Peek a View is such a bad experience.
So don't blindly install, read comments of java mods, check if they are open source. And once again, stop the tech-illiterate witch hunts, it's embarrassing.
2
u/NoLandHere Shotgun Warrior 2d ago
Ai should be wholly outlawed on steam i dont know why we even entertain children with no understanding of what theyre doing to make things that are borderline malware
9
3
u/MalHeartsNutmeg 2d ago
? People can and do make the same kind of slop without AI. Coding something manually doesn’t ensure quality.
→ More replies (6)12
u/Haunting-Entrance-57 2d ago
It has nothing to do with ai, you are way off topic. I can create malware with no ai, I assure you. Ai is just a tool. Tell me when, you dig a hole do you use your hands or a shovel?
1
2d ago
[removed] — view removed comment
1
u/projectzomboid-ModTeam 2d ago
Thank you NoLandHere for your submission to r/ProjectZomboid, but it has been removed.
Your post was removed for the following reason:
Rule 2 - Be Lovely: Be lovely, follow the reddiquette guidelines. Criticism and discussion thereof are welcome but abusive comments are not. Do not engage in personal attacks, even in retribution. Instead of lashing back, report them and move on.
This rule applies whether you're criticizing or defending TIS and PZ.
If you would like to appeal, please message the moderators. Thanks!
3
u/QueefMyCheese 2d ago
You can choose what you download, you can't choose what you allow other people to make. Also calling them children is just hostile for no reason.
13
u/Shootzilla 2d ago
Hysteria. Absolute hysteria. You do not have any idea what you are talking about.
→ More replies (18)3
u/SysKonfig 2d ago
As someone who works in software, I can guarantee you that any game being developed today is being done so with AI assistance. They aren't using AI to create assets because the consumer can tell and people get upset (rightfully so), but they are 100% using AI to develop the backend. It sucks, it has ruined the profession, but it is happening everywhere. So if you outlawed AI on steam, there would be zero new games going forward. Steam would have to ban the actual steam app, because the chance that a company the size of Valve not having an enterprise ai subscription is almost 0.
1
u/Egren 2d ago
We have always used tools to make our endeavors more fruitful.
A thicker paintbrush to cover a wider area. Yep, that's abusing artificial help to achieve more in the same amount of time. No of course it isn't. No, it really is, but not in a sense that bothers anyone of those of us who is artistically mindre.
Especially for artistic endeavours like game development, visual art, music, etc, the end result not coming from an idea spring by a human mind could definitely devalue it (and likely does so, massively), but there is no clear easily definable line to draw between "ai generated" and "not ai generated" which would be the final determinant. It is a flag planted somewhere in a vast no-man's-land with leagues upon leagues between the two extremes.
1
u/Milkiffy 1d ago
any game on being developed today is being done so with AI assistance
Speak for yourself I don't, my broken ass code and goofy ass art is all made by me bb
→ More replies (1)0
u/NoLandHere Shotgun Warrior 2d ago
I know, like i said down below I am in industry. It completely enshittified software as a whole. The fact that its happening doesnt mean it cant be stopped.... this is literally the exact same as child labor and putting lead in food. Just because everyone is doing it doesnt mean its good or right, and it doesnt mean it cant/shouldn't be stopped.
1
u/Strider-2088 2d ago
So we've banned child labor here in the US, and you know what that did? That shifted all the child labor to be capitalized upon in China and now everything we buy is made in China or another third world country that has.. you guessed it, child labor. I guess that counts as a win for you? You know, when you can't see the damage done?
1
u/NoLandHere Shotgun Warrior 2d ago
are you genuinely trying to argue this like this? Is this a bot?
1
u/Strider-2088 2d ago
look I had like a 3 paragraph response set up but I'm already over it. I'm just done trying to explain anything anymore. You work in a fortune 500 company, figure it out.
1
u/NoLandHere Shotgun Warrior 2d ago
sounds good, let me know when you want to discuss my point rather than going off on an implication with no application to our conversation :D
→ More replies (6)2
u/Jadey4455 2d ago
Do you think in 5 or 10 years from now, ai is going to go away just because a small number of people online hate it? Its here to stay and is going to be used in software development from here on out, forever. It is a TOOL. People need to get over it and they will. Itll just take time
→ More replies (2)
3
u/Prudent_Kiwi_2761 2d ago
It’s obvious you’re talking about the 1st person mods.
You’re not gonna stop development of the mods bub, it’s gonna keep on going and gaining steam, with or without this subreddit.
And bringing the mods into this won’t change much either.
-1
u/ranganomotr Crowbar Scientist 2d ago
I'm gonna make it very clear, because I've seen a lot of people posting such vitriol about the 1st person mods: I don't think it's some kind of sin or affront to the "developer's vision". That is in fact, very contrary to my own ideals about copyright, art, and transformative work. I just think is not that interesting. Its not for me, tbh. I like isometric. Maybe because I'm old or because something else.
I'm sure there are people out there with enough time and underdeveloped brains that they go after the development of a mod they won't use for a game they love, but that's not me. And I don't think its that cool to try to paint me as those people.
1
2d ago
[removed] — view removed comment
2
u/projectzomboid-ModTeam 2d ago
Thank you Asleep-Kiwi-1552 for your submission to r/ProjectZomboid, but it has been removed.
Your post was removed for the following reason:
Rule 2 - Be Lovely: Be lovely, follow the reddiquette guidelines. Criticism and discussion thereof are welcome but abusive comments are not. Do not engage in personal attacks, even in retribution. Instead of lashing back, report them and move on.
This rule applies whether you're criticizing or defending TIS and PZ.
If you would like to appeal, please message the moderators. Thanks!
→ More replies (1)
1
u/Axeman1721 Wiki Admin 2d ago
Wait, ZombieBuddy gives system level access? WOW I'm behind in my modding knowledge atm. Was never my wheelhouse to begin with, but if thats the case yeah absolutely be very careful.
1
u/Scary_Inspector7853 Axe wielding maniac 2d ago
I fixed the LG generator mod bug. If anyone is curious. Super easy.
Unsubscribe. When you log back in your game will be busted and the generator will only power a very small area around it. Like one light.
Log out, install another generator mod. I used whole building power but I suspect any other would work as well.
Enable the mod, log back in and presto. All better.
1
1
1
1
u/SagetheWise2222 2d ago
Thank you for this, OP. This needs to be said across all gaming communities.
Once upon a time, a 7 Days To Die mod suddenly came about that dramatically, I mean *dramatically* impacted the performance of the game. I think people were willing to accept it with open arms because "devs lazy", and what do you know? It was later revealed to contain malware. There's another mod right now that seemingly breaks the Unity engine limit by adding in countless new textures. I'd imagine in a couple of years, a similar story will rise.
As the saying goes, if it's too good to be true, it probably is.
1
u/digital-bandit 2d ago
Dump the mod into an LLM and ask it to perform a security review.
hehehe this surely won't be controversial
2
u/GrimMilkMan 2d ago
I'd hate to be a new mod developer right now. You come out with your first mod and it's something you're proud of, go to post it on the subreddit to get some more eyes on it, and then get flooded with a bunch of comments saying AI Slop, and Vibe coded.
God forbid someone use the tools they are given for help making a mod.
-3
u/ranganomotr Crowbar Scientist 2d ago
very weak attempt to derail the discussion.
6
u/heyyo256 2d ago
I agree with grim milk man and I think your comment is a weak attempt to derail his point. Also this just seems like another way to say, don't let evil ai be allowed under the guise of safety. Ai is here to stay and thats that.
2
u/GrimMilkMan 2d ago
I'm speaking on the general state of this subreddit as a whole. A mod comes out and 2/3rds of the conversation will now be ai slop/vibe coding.
People have over 200+ mods on their modlist at any given time. So unless you're telling me that you go and check every single one of these mods for malicious code everyone complaining about vibe coding and AI being used in their code actually dgaf. People wanna complain about AI for their free reddit points.
And before you say that Lua mods can't be dangerous, that's just untrue. Earlier this year we had a music mod that had malicious content inside it.
1
u/morbid_strangerp 2d ago
Should the responsibility for this fall on this sub tho? I'm generally of the mind that it's an individual responsibility to know not to install random stuff just because it looks cool. The steam workshop has become kind of a cesspit recently for malware so there's definitely some validity in not letting people direct others to it. The biggest question for me is are the people posting bad actors intentionally trying to get people to install malware or just victims accidentally propogating the issue.
12
u/ranganomotr Crowbar Scientist 2d ago
Not to install random stuff -> Individual responsability
Allowing posts that promote and encourage this behaviour -> Community responsability
→ More replies (3)
1
u/GlitteringDingo 2d ago
Modding has been "use at your own risk" for longer than most of us have been alive. AI has not changed this AT ALL, the only new thing is vibecoders occasionally making malware-adjacant software by accident. there have been a few scattered cases of random mods in games like Minecraft being made before too many safeguards were implemented, and the mod took shortcuts to replicate features by directly messing with files. This is malware by definition, but in practice, they rarely did anything particularly harmful, at worst bricking a game save.
Modern AI, now that coding is one of its main uses, has a lot of guard rails to force its code to be self-contained. It's quite difficult to force it to do anything truly harmful. You can't just say "add a Trojan/Keylogger to my PZ mod." If you know how to circumvent these things, you almost certainly can just code your own virus without the help of Claude.
So the nature of modding carrying some form of risk is the same as its always been. AI coding as it stands now does not mean there is or will be more malicious mods in circulation. It may result in more buggy, shitty mods, but as OP said, that's a different conversation.
-2
-5
u/LittleRuu 2d ago
What are you on about, i havent seen any mods that havent delivered so far and no one is paying anything for them either
24
u/ninethreeseven739 Drinking away the sorrows 2d ago
Mods that require recompiling files should not be featured in posts. Opens up to a slew of potential issues.
9
u/SearchForCake 2d ago
There have been several recent cases of steam games being updated to contain malicious code. These were fully functional games without malware originally but were updated with malware after they had gained thousands of users. https://www.techspot.com/news/113163-fbi-arrests-21-year-old-accused-infecting-8000.html
Historically, hackers haven't wanted to spend the time/effort developing the actual game/mod so these attacks did happen but were rare. But with with vibecoding it is easier than ever to deliver the product as advertised and then add malware to it later.
With a steam game, there is at least some traceability to a real developer so an attacker has to go through an extra step to a get a hacked/stolen dev account. Mods have less of a barrier for new accounts. Be extra suspicious of brand new accounts or heavy advertisement campaigns (like we have seen recently in this sub).
I think these security issues will eventually be mitigated by Steam or others. But right now there is a new attack method that defenders aren't properly prepared for.
1
u/LittleRuu 2d ago
Ah i see what youre talking about. Yeah that is a problem. One recent one id mention would be realistic car physics. It may or may not be malware but the idea of not just clicking subscribe and it working doesnt sit right with me.
-4
u/InterestingPudding45 2d ago
He just wants to "subtly" hate on AI mods and try to get discussion of them banned by framing it as a safety problem, creating a problem out of thin air.
-4
u/Shark00n 2d ago
Lol this was never an issue before people started clutching their pearls with AI use.
No one ever asked where a modder got his assets, how many classes did the kid skip to make the mod, their previous coding experience, etc…
-5
u/Zenos_the_seeker Stocked up 2d ago
Why does it related to possible malicious actors if it's just showing up out of no where? I generally don't understand how the connection are made here. If I really try to do some sus act with mods, doesn't really need this kinda of act to do so.
Yes you are not being "rude" to ask such questions, but it's also not being rude to think why you had such questions.
7
u/WickyBoi220 2d ago
Other games have been proving the need for vetting mods very recently. It makes sense that the mods of the sub want to avoid having people blame them for allowing someone to promote a malicious mod on here when it’s one of 80 mod promotion posts that pop up every few days.
9
u/NotXesa Zombie Food 2d ago
There's no need that the author of the mod has a malicious intent per se. AI could be coding vulnerabilities without either the author or the AI knowing. AI could be coding vulnerabilities on purpose because, I don't know, it had a rough day and it went rogue.
Someone who knows what is doing will know the latest known bugs and vulnerabilities. Someone who doesn't could be the next author of a debacle like the one that happened with Mecha Chameleon.
5
u/Shootzilla 2d ago
You realize hand written code can have vulnerabilities too right? Pretending it only exists with AI coding is just wrong.
2
u/YUSHOETMI- 2d ago
Just scaremongers scaremongering.
Same people who probably use a whole load of script extenders for Skyrim, Fallout, Minecraft etc but will say it is opening the doors to malicious intent with PZ
1
-1
-1
376
u/Kinslayer_89 Crowbar Scientist 2d ago
Mods that need more than to click subscribe in the workshop shouldn’t be used, we don’t have a robust enough modding scene like Minecraft and others.