Worrying questions about Steam Workshop, we found some strings

[tonpix]

Peardox, Xaratas and Kilay found 2 interesting strings, there they are:

<Entry>
     <ID>4967</ID>
     <DefaultText>Steam Workshop</DefaultText>
     <FemaleText />
   </Entry>
   <Entry>
     <ID>4969</ID>
     <DefaultText>Publish this mod to the Steam Workshop?
 
By publishing this mod, you agree to the Steam Workshop <link="https://steamcommunity.com/sharedfiles/workshoplegalagreement">terms of service</link>.
 
You will have a chance to review the mod's Workshop page before making it visible to the public.</DefaultText>

 

and

 

4965 = Unsubscribe4966 = Unsubscribe from {0}?4967 = Steam Workshop4969 = Publish this mod to the Steam Workshop?By publishing this mod, you agree to the Steam Workshop <link="https://steamcommunity.com/sharedfiles/workshoplegalagreement">terms of service</link>.You will have a chance to review the mod's Workshop page before making it visible to the public.4970 = Upload to Steam Workshop4971 = Update Mod4972 = Briefly describe the changes made to your mod since the last version.4973 = All files in this mod are my own creation, or I have permission to use them.

 

First string gives a question - from what source is it going to publish on Steam Workshop?

 

Second string seems to give some light on question - uploading mod that's placed in override folder and is detected by game's Mod Manager.

 

This, and discussions we had on slack yesterday yielded next questions.

 

Won't the nexus/slack/solo modders be at risk of being stolen by someone who can simply rename mod folder name and republish on steam as his/her own mod? 

 

What are protections against this possible action, what would we do in case someone republishes non-rightfully?  

 

Please keep in mind that when we saw roadmap with "Steam Workshop" for 2.1 patch on Slack, it shook things hard and chat was very lively. A most popular player platform, with huge player base with major part of Deadfire players, easy integration for mods and much better promotion for mods - few of more possible advantages I can pull from mind now.

 

However, some slackers had doubts, and I believe they're legit and need to be adressed by Obsidian. Some slackers are concerned that Steam Workshop might be slow at removing plagiarized mods (some say it's known for Workshop having lot of such mods, some have neutral opinion).

 

We didn't discuss much after discovering strings and I wanted to bring modders' attentions to this matter and start possible discussion there.

 

I haven't thought much about solutions for that - theoretically a option to lock mods to specific mod platforms (Nexus, Workshop, Selfhosting etc.). It can be changed only by author. Might sorta help with keeping mods in places where authors want to be.

 

What are your thoughts?

Edited August 3, 2018 by tonpix

[Phenomenum]

Hahah. Good question. I hope they found any solution before mess take place.

[peardox]

The answer is fairly simple but obstructive

 

Provide a hash that verifies a newly installed Mod as valid and the modder is the author

 

There are great issues here of course

 

I can easily verify our slack members Mods (soz dude - brain connected to keyboard again)

 

This would require some work by OBS but is a valid concept

 

I'm online and download a Mod then install it - this requests the OK to use the Mod (and I hate DRM)

 

If you're deving a MOD we have the same freedom we currently have but if we download from any other source it gets kicked

 

I understand @TT1's concerns here - so mate if I didn't get it yesterday but @tonpix's post makes this clear

This is the START of a solution and as I've been on it 15 mins not properly explored

 

@maplejar any thoughts?

 

We'll discuss this properly here and in Slack

[BMac]

Almost any technical countermeasure can be circumvented by a determined user, so we won't be attempting to introduce mod DRM or anything like that.  We will require people to take an additional step in the data files so it's not as simple as just clicking a button in-game. The dialogue to submit a mod to the Workshop also requires the user to explicitly check a box that says "All files in this mod are my own creation, or I have permission to use them."  This should prevent users from accidentally or casually publishing your non-Steam mods to the Workshop.

 

In the event that someone does choose to circumvent these measures and publish your mod anyway, it's not just impolite, it's a violation of United States and international copyright law.  On the rare occasion that this does happen, you can ask them to remove it. If they won't, you can file a DMCA takedown request with Steam.  If you have a link to e.g. your Nexus mod page that clearly shows you've previously published this mod, you should have no trouble demonstrating that it's not theirs to publish. Valve will process these requests (pretty quickly, according to reddit) and remove the mod from the workshop - you won't need to wait for Obsidian to take any action.

[peardox]

How does this help?

 

Let's look at the worse possible scenario - a POE2 hijack via mod

 

Would I do it (no) could  do it (most likely) - too many vectors (not giving methods of hacking out)

 

So the question is not is it possible it's how to stop it

 

My friends raise valid questions

 

I have some ways to reduce impact without DRM

 

Slack - @TT1 raises a valid concern here

 

I can run some tests - @maplejar help req on this one, right up your alley

 

I will do some thinking etc on this one in the AM

[peardox]

Sorta worked it out but still hackable

 

Thinking about DRM-Free hard to hack crap

 

I'll try this on my own MODs only (may need to borrow one or two)

[Kexby]

This is something that concerns me too, but not for the reasons mentioned.

 

I'm one of those people who HATE Steam! I will never use it, not for any reason. So any mods that are released on Steam Workshop won't be available to me

 

I'm using the GOG version of the game and at the moment everything is great, I can download mods from both Nexus and the forum without any problems. But in the future, it looks like I'm going to be excluded from some mods and that bothers me.

 

As for stolen content, this has happened to me. I'm more of an artist than a coder and I've had my artwork taken and used without my permission. It annoys me, but I've learned to deal with it (I try to see it as a compliment, that somebody liked my work so much they thought it was worth stealing ).

 

But all of my content (mods and otherwise) will always be free. So if the person who 'borrowed' my content uses it to create free stuff that they share with the community, then fair enough. But if they try to sell my content as their own and make a profit from it, then that's another matter.