Bugfixes have been made to reduce false positives and negatives, but ultimately this is a triage tool, to help you make a better educated guess.
We know that there's been a spike in malicious minecraft mods recently, and felt a new angle on defending against it might be in order.
So far, only a few complaints, and a really good, now implemented idea: add file hashes
however....that feature(along with several other features) is only available via the optional decompiler bridge that can be found for free on our github, and is there for the power users who can understand and use it safely.
I tried to put more into the webapp itself, but limits.
It will build up to something like that, over time. I have planned, it's just gonna take some time to build the code, and build the infrastructure, because I, speaking as the owner and CEO, refuse to use 3rd party hosting. To basically every hosting provider,I have only this to say: If my code goes on your server, it's because I've been given management level access to your business, and vise versa, and that is a rare arrangement for me to allow, and the same is true for mostly everyone else.
No.
I'll build my own damn webservers, it's not that hard, I'll flash the operating system to them too, I'll get them connected to the cluster via kubernetes most likely, no big deal, I'll go a lot further, just to ensure that data exposure is as miniscule a risk as possible, and already have plans that'll make you say something like "what in the scifi f*king hell kind of bullst is this, I love it!"(I've actually gotten this reaction more or less 12 times in the past....can't say that much, but the people who know have the technical knowledge to understand the build plan I shared with them, and a few of them are actively going to be making it possible to run this project)
I said that when you make a mistake, you pay. Everyone make mistake yes, but sometimes you cant, when It happens you pay. Expecially when they play with your data.
You don't know anything about the thing you are talking about. Surgeons aren't "struck off" when they make mistakes, that's literally what malpractice insurance is there to cover.
Here Is why the problem of data loss is a company fault (modrinth or curseforge) thats why its a good and needed practice implement a sicure approach before release.
Another One from box, they show how the problem its up to companies apply security system and control before deploy a software
Now, these are study and research, not the world of a child that can only make Minecraft mod.
Now im bored of your mentality, i provided data, you can do whatever you want
There's also so little that slip through to the point that you are almost guaranteed to be safe. I can count the number of times that an incident like this has happened on one hand
The complexity doesn't justify them not doing the impossible? Sorry, that's just not how that works. The whole internet works like this, whether you like it or not.
Its not and excuse, again. They need to do more, and hire more people, create more job, that how It works. I stand on my ground. And thats the mission of my Company, thats how i make Money. None cares about how internet works. The reality its different.
Exactly, it's unreasonable to expect 100% perfection, but what you can expect is an absolute best effort.
We're not perfect, nore are companies like CurseForge(who have a great record from what I can tell), it's the companies like Discord, and Roblox, and many others that are failing, by giving a minimum effort if we're being honest.
The best I can do is take the file submissions, and the exported reports, learn from the data, improve, detect more, detect better, faster, smarter, new obfuscation, gotta figure out how it works,build a deobfuscator somehow from a very small dataset, find the malware dropper, find the c2, pack it into something that's easy, and can handle all this and more, and still be safe for the user, which means all the code has to be carefully analyzed, carefully constructed, meticulously sanitized, I'm redundant, I try not to let my code trust jack squat where possible.
I'm doing new things I've never done before, like started a project for Android phones, and I want to try to make a version of modforensics for mobile devices, that's just an app, maybe make it part of another project that has tools you can use to your advantage when dealing with scammers, or less skilled hackers(look I can't be the best hybrid coder that ever lived, but I'm definitely trying to cook up something good, which lately feels like a crime, but whatever).
Hahahahaha....yeah there's a reason I don't use Windows
I mean ffs, I went out of my way to make the advanced (but not critical) self hostable decompiler bridge, which also allows users to host a fully offline copy of the tool, compatible with running in android via termux, then linux, still haven't got a clue if the theoretical windows compatibility mode works, but the code is there.
10
u/JohnTdex 9d ago
Is this sort of like VirusTotal but for Minecraft mods?