Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[SirHartley]

Consider throwing up a text box asking the player for permission the first time the game starts up with the mod, with a simple yes/no choice that enables or disables it. If you tell the player what exactly is being collected, and for what reason, I don't see why people wouldn't opt in!

Edit - disabling calls to the server from old versions without the opt in shouldn't be an issue if you go for that approach.

[Alex]

The data will be too biased to be useful if it's opt-in, so I guess I'll just stop collecting it entirely.

I'll remove the API calls in the next update, and I shut down the webserver so the API calls being made from older versions of the mod won't do anything.

Thank you!

I thought the idea of mods containing malware was entirely ridiculous, and I certainly wouldn't do anything like that... but I guess you would, wouldn't you, which means it's only a matter of time before someone else does, so; pour one out for Starsector modding, we had a good run.

Thanks.

The matter is already addressed, and coming in with a personal attack is uncalled for.

[Harmful Mechanic]

I thought the idea of mods containing malware was entirely ridiculous, and I certainly wouldn't do anything like that... but I guess you would, wouldn't you, which means it's only a matter of time before someone else does, so; pour one out for Starsector modding, we had a good run.

Thanks.

The matter is already addressed, and coming in with a personal attack is uncalled for.

No, it's actually not.

I just got done rebutting a paranoid accusation that there's malware in my mods. Now that's plausible, and any modder anybody doesn't like is going to be accused of bundling malware or analytics tools without a shred of evidence.

This destroys so much trust that it's probably not worth continuing to mod Starsector for me; so, it's actually a big deal, yeah. This just hands a huge win to the 'harass modders you dislike out of the community' side of things, and if you're fine with that, great, but I'm not.

And Boggled is the one who made that happen. Good job! Well done.

[Alex]

If anything, this shows that if there's anything even a bit iffy, it will be addressed. And, of note, this mod's OP stated clearly what it was doing (which is nothing malicious, to the best of my knowledge) and how to turn it off. Yes, an opt-in would've been much better, but what happened here I think provides a pretty good contrast with what happened with those odd accusations a while back.

I can't tell you how to feel about it, and I see part of your point; certainly someone so inclined *could* use this as ammo - but it doesn't take much for that to be possible. Regardless, personal attacks are not going to be tolerated.

[Harmful Mechanic]

TASC's analytics meet the legal standard of malware in many jurisdictions. I'm pretty sure the mod as implemented violates privacy laws in multiple EU states.

I'm not seeing 'a personal attack' here. I see a massive legal liability and breach of trust introduced by a modder who feels he has a right to collect player analytics without telling them about it. If describing the likely knock-on effects of this behavior is 'a personal attack', then; yeah, I'm unrepentantly making a personal attack, because this is actually a bridge too far for me.

I've never added crashcode for other mods I didn't like; I've only ever made sure that dependencies would cause a crash if they were missing when that was the only way to ensure dependencies were marked properly. Not because there's not stuff out there I think shouldn't exist, or is junk; some of it's using my assets, and there's a whole self-valorizing subculture out there that prides itself on keeping that stuff going once it gets canned from the forum, and sure it ticks me off, but because it violates the social contract of free and open software.

Modding your game entails a certain degree of trust in that social contract; and this just shattered it. What you do, or don't do, to repair that trust determines whether or not it's worth continuing to mod your game for a lot of us. I can't make you do anything, and I know exactly how little my opinion on the subject matters.

But I'd just like to register (not the least because saying so is a way to head off further harassment) that this is really, really bad for anybody who, unlike you, has no financial stake in this project and is (at least notionally) here modding Starsector for fun.

[Alex]

I'm not seeing 'a personal attack' here.

This, especially with the emphasis on the "you", is hard to interpret as anything else:

... I certainly wouldn't do anything like that... but I guess you would, wouldn't you ...

[presidentmattdamon]

TASC's analytics meet the legal standard of malware in many jurisdictions. I'm pretty sure the mod as implemented violates privacy laws in multiple EU states.

I'm not seeing 'a personal attack' here. I see a massive legal liability and breach of trust introduced by a modder who feels he has a right to collect player analytics without telling them about it. If describing the likely knock-on effects of this behavior is 'a personal attack', then; yeah, I'm unrepentantly making a personal attack, because this is actually a bridge too far for me.

I've never added crashcode for other mods I didn't like; I've only ever made sure that dependencies would cause a crash if they were missing when that was the only way to ensure dependencies were marked properly. Not because there's not stuff out there I think shouldn't exist, or is junk; some of it's using my assets, and there's a whole self-valorizing subculture out there that prides itself on keeping that stuff going once it gets canned from the forum, and sure it ticks me off, but because it violates the social contract of free and open software.

Modding your game entails a certain degree of trust in that social contract; and this just shattered it. What you do, or don't do, to repair that trust determines whether or not it's worth continuing to mod your game for a lot of us. I can't make you do anything, and I know exactly how little my opinion on the subject matters.

But I'd just like to register (not the least because saying so is a way to head off further harassment) that this is really, really bad for anybody who, unlike you, has no financial stake in this project and is (at least notionally) here modding Starsector for fun.

there's always the potential for bad actors to exist in any medium. i don't really understand why this incident would have completely shattered trust in the community and company to handle cases like this given that it was jumped upon and dealt with as soon as it was uncovered. it's simple enough for people to not use mods that don't release source code, in any case.

[boggled]

Consider throwing up a text box asking the player for permission the first time the game starts up with the mod, with a simple yes/no choice that enables or disables it. If you tell the player what exactly is being collected, and for what reason, I don't see why people wouldn't opt in!

Edit - disabling calls to the server from old versions without the opt in shouldn't be an issue if you go for that approach.

I'm not sure that will solve the issue - the data I collected shows that the majority of players using TASC are from countries where English is not the native language. Many players won't understand the prompt, which defeats the purpose of obtaining their consent before collecting anything!

If anything, this shows that if there's anything even a bit iffy, it will be addressed.

I was collecting data for about six months before anyone commented on it, despite the notice being on the original post the entire time and TASC being open source. If I was doing something malicious and didn't draw any attention to it, I'm not sure when it would have been discovered.

[presidentmattdamon]

I was collecting data for about six months before anyone commented on it, despite the notice being on the original post the entire time and TASC being open source. If I was doing something malicious and didn't draw any attention to it, I'm not sure when it would have been discovered.

this is pretty much exactly what i'm talking about. if this is an incident that wakes up the more security-conscious side of the community, i'm happy that it was a case where nothing destructive was occurring, and anyone who thinks their trust has been harmed can do their own due diligence towards making sure the mods they download are safe, as the community has helped to do with this one (not saying it isn't safe, since all it was doing is very anonymous data collection, but still.)

[SirHartley]

Consider throwing up a text box asking the player for permission the first time the game starts up with the mod, with a simple yes/no choice that enables or disables it. If you tell the player what exactly is being collected, and for what reason, I don't see why people wouldn't opt in!

Edit - disabling calls to the server from old versions without the opt in shouldn't be an issue if you go for that approach.

I'm not sure that will solve the issue - the data I collected shows that the majority of players using TASC are from countries where English is not the native language. Many players won't understand the prompt, which defeats the purpose of obtaining their consent before collecting anything!

Hey, don't knock it before you try it - the game's in english, too, as are the forums, so there should be at least rudimentary understanding. I think you'll be surprised as to how many people opt in.

No need to gut the entire feature, I think it's neat.
(Though to be fair, I'd also feel more at ease with an opt in, as having data collected - regardless of what it is - without pressing a button to accept it sits a little strange with me.)

[presidentmattdamon]

Consider throwing up a text box asking the player for permission the first time the game starts up with the mod, with a simple yes/no choice that enables or disables it. If you tell the player what exactly is being collected, and for what reason, I don't see why people wouldn't opt in!

Edit - disabling calls to the server from old versions without the opt in shouldn't be an issue if you go for that approach.

I'm not sure that will solve the issue - the data I collected shows that the majority of players using TASC are from countries where English is not the native language. Many players won't understand the prompt, which defeats the purpose of obtaining their consent before collecting anything!

Hey, don't knock it before you try it - the game's in english, too, as are the forums, so there should be at least rudimentary understanding. I think you'll be surprised as to how many people opt in.

No need to gut the entire feature, I think it's neat.
(Though to be fair, I'd also feel more at ease with an opt in, as having data collected - regardless of what it is - without pressing a button to accept it sits a little strange with me.)

putting the string in strings.json is enough for translators to be able to handle any language barriers that might pop up, too. plus they're likely already using other mods in english too if they're using yours

[Kragh]

I mean, just keep the feature as a opt-in. Unofficial New Game Plus 0.1.0 has a opt-in data collection that give you 1 story point for doing so and it works just fine.

[boggled]

I mean, just keep the feature as a opt-in. Unofficial New Game Plus 0.1.0 has a opt-in data collection that give you 1 story point for doing so and it works just fine.

Consider throwing up a text box asking the player for permission the first time the game starts up with the mod, with a simple yes/no choice that enables or disables it. If you tell the player what exactly is being collected, and for what reason, I don't see why people wouldn't opt in!

Edit - disabling calls to the server from old versions without the opt in shouldn't be an issue if you go for that approach.

I'm not sure that will solve the issue - the data I collected shows that the majority of players using TASC are from countries where English is not the native language. Many players won't understand the prompt, which defeats the purpose of obtaining their consent before collecting anything!

Hey, don't knock it before you try it - the game's in english, too, as are the forums, so there should be at least rudimentary understanding. I think you'll be surprised as to how many people opt in.

No need to gut the entire feature, I think it's neat.
(Though to be fair, I'd also feel more at ease with an opt in, as having data collected - regardless of what it is - without pressing a button to accept it sits a little strange with me.)

putting the string in strings.json is enough for translators to be able to handle any language barriers that might pop up, too. plus they're likely already using other mods in english too if they're using yours

I'll check how Unofficial New Game Plus implemented this and see if it's appropriate for TASC. Thanks for the suggestions!

[jujuteux]

This destroys so much trust that it's probably not worth continuing to mod Starsector for me; so, it's actually a big deal, yeah. This just hands a huge win to the 'harass modders you dislike out of the community' side of things, and if you're fine with that, great, but I'm not.

And Boggled is the one who made that happen. Good job! Well done.

Whoa calm down, drama queen,
stuff is brand fresh and basically no one in usc knows of it and very little in other servers
as long as he makes some message ingame when first loaded or something to ask for opt out then it's basically alright

don't forget, nexerelin's update checker is essentially as invasive and most players don't even knows it contains a mod checker

[Yunru]

I don't think Nex even has an opt-out?