• Please make sure you are familiar with the forum rules. You can find them here: https://forums.tripwireinteractive.com/index.php?threads/forum-rules.2334636/

Custom mutators...

Honestly, we too want non-White Listed mutators to at least allow Perks to be loaded, but due to the design of the scripting system in Unreal, this is a big security risk. If we allowed that, someone could actually design a mutator for a server that instantly gave everyone full Perks and it would actually properly get sent off to Steam and stored permanently. The only way to fully stop that possibility is to not allow the Perks to even load.

Trust me, we have looked at every possibility to allow this, but the lack of security in the scripting system has forced us to simply not allow non-White Listed mutators to touch the Perks at all. It really kills us that there is no secure way to allow this guys, we love mutators too =/
 
Upvote 0
Honestly, we too want non-White Listed mutators to at least allow Perks to be loaded, but due to the design of the scripting system in Unreal, this is a big security risk. If we allowed that, someone could actually design a mutator for a server that instantly gave everyone full Perks and it would actually properly get sent off to Steam and stored permanently. The only way to fully stop that possibility is to not allow the Perks to even load.

Trust me, we have looked at every possibility to allow this, but the lack of security in the scripting system has forced us to simply not allow non-White Listed mutators to touch the Perks at all. It really kills us that there is no secure way to allow this guys, we love mutators too =/

well at least they're honest.
 
Upvote 0
I think I understand what happens. When there's any altered content (which includes non-whitelisted mutators), the Steam security check fails and it won't let you access stats and achievements. Am I right?

It'd be nice if at least perks could be downloaded to a file every time access is possible, and then loaded from this file when it's not possible.
 
Upvote 0
It'd be nice if at least perks could be downloaded to a file every time access is possible, and then loaded from this file when it's not possible.

You mean like a local copy of your profile? That might work, but then again, correct me if I am wrong here but someone could just edit the local file to give you full perks and the scripting system reads the file and sends the tampered data off to the perk server. So it is not secure that way either.

I think we need a perk replacement mutator that will never be whitelisted?
This could be used to allow players to set their perk level to whatever they want if they just want to fool around and play with their perks. If someone set it to 5 even if they weren't then that is their problem.
 
Upvote 0
You mean like a local copy of your profile? That might work, but then again, correct me if I am wrong here but someone could just edit the local file to give you full perks and the scripting system reads the file and sends the tampered data off to the perk server. So it is not secure that way either.

Not quite, the file would only be read from when the stats and achievements cannot be accessed, and the data in this file would only be used for that. The system would still work how it currently works.
 
Upvote 0
Maybe I should elaborate. ;)

The data stored in the file would only be used when perks cannot be accessed normally, and this data will never be transferred back to the server, only from it. So for example you could probably edit the file and use whichever perks you wanted offline (TWI could encrypt it to make it harder if necessary), but this data would never be transferred to the stats server, in fact it would be overwritten upon contact with the server again.
 
Last edited:
Upvote 0
Maybe I should elaborate. ;)

The data stored in the file would only be used when perks cannot be accessed normally, and this data will never be transferred back to the server, only from it. So for example you could probably edit the file and use whichever perks you wanted offline (TWI could encrypt it to make it harder if necessary), but this data would never be transferred to the stats server, in fact it would be overwritten upon contact with the server again.

That might work, now we probably should wait for input from TWI.

But the discussion was about custom mutators that might tamper with the perks. I am sure they have considered this option too but I have a feeling there could be some security issues which might make this unfeasible.
 
Upvote 0