MWSE, Lua and OpenMW compatibility

General discussion regarding the OpenMW project.
For technical support, please use the Support subforum.
User avatar
psi29a
Posts: 5355
Joined: 29 Sep 2011, 10:13
Location: Belgium
Gitlab profile: https://gitlab.com/psi29a/
Contact:

Re: Windows Pre-build Script Documentation Updated

Post by psi29a »

Taking a step back here to help get a feel of the situation...

MWSE has evolved further and added LUA, allowing more modding opportunities for Morrowind. I think it would have been done sooner had OpenMW not existed and people got tired of 'waiting' on OpenMW. That's a reasonable decision and I think LUA is a very good choice as a replacement for mwscript in the scope of MWSE/Morrowind.

OpenMW will be taking another road, one that makes mwscript suck less.

However, I personally think, and as has been already discussed in the forum multiple times, if you can provide a way to properly sandbox and prevent native code execution, then you'll have a real chance of seeing it in OpenMW.

Lua seems to be at the for-front here for three reasons:
1) TES3MP already has it on the server-side and TES3MP _will_ be merged into OpenMW post 1.0
2) It makes sense since MWSE also supports Lua.
3) Lua is easier to sandbox than other scripting languages which helps alleviate security concerns.

Another reason why I think people are concerned and frustrated is that this post-1.0 design document is much talked about and not yet seen in full. This is unfortunate because people fear the unknown and details are sparse. Zini has been working on this for awhile and wanted Scrawl to proof-read it to see if it made sense. It is supposed to be a guide for the way forward, but that isn't as set in stone as people might think.

To quote Field Marshal Helmuth Karl Bernhard Graf von Moltke:
Kein Operationsplan reicht mit einiger Sicherheit über das erste Zusammentreffen mit der feindlichen Hauptmacht hinaus.
or
no plan of operations extends with any certainty beyond the first contact with the main hostile force
No matter how great and well-thought out, a plan will change when dealing with new events and it has to be adjusted accordingly. No one is going to blindly follow orders or be apart of a project that they don't believe in. OpenMW developers understand that. So cut us a little slack please. :)

I believe there is enough wiggle-room to please modders and move forward.

If someone wants to lead the effort to see Lua go into OpenMW, it likely won't be an overnight affair. Like TES3MP, it will be a long living branch and will require a lot of testing along the way. Actually having something goes a long way to having it included in OpenMW. Any concerns about it can be hammered out and adjusted and I'm sure a compromise can be found.

Just remember, the only 'hard stance' that Zini has is:
Zini wrote:This is the one point where I take a hard stance. I do not compromise on security and there is nothing more to discuss.
Keep this in mind, then we may have something.

With that being said, I'm going to split this conversation off from the main since it's another tangent. :)
NullCascade
Posts: 121
Joined: 16 Jan 2012, 07:58

Re: Windows Pre-build Script Documentation Updated

Post by NullCascade »

psi29a wrote: 14 Jun 2018, 09:03MWSE has evolved further and added LUA, allowing more modding opportunities for Morrowind. I think it would have been done sooner had OpenMW not existed and people got tired of 'waiting' on OpenMW.
This was recorded a few weeks ago, before some of the newest drama, but here's a link to the portion of my interview with DarkElfGuy where we start talking about OpenMW: https://www.youtube.com/watch?v=EZx2rBYh_zw&t=24m54s

Went into some my motivations re: working on OpenMW vs. working on MWSE. I think it's somewhat chicken-and-egg-y.
User avatar
psi29a
Posts: 5355
Joined: 29 Sep 2011, 10:13
Location: Belgium
Gitlab profile: https://gitlab.com/psi29a/
Contact:

Re: MWSE, Lua and OpenMW compatibility

Post by psi29a »

About the security concern, both DarkElfGuy and yourself are quoted as saying that no viruses have ever shipped as mods and that the virus scanner on Nexus was due to popular consensus and not from anything that has happened.

From the comments:
Austen Cope
3 days ago
Actually, the Nexus did have an admin account hacked, which was used to replace some popular files on the Nexus with viruses. Project Nevada was one such example, and there were a few others as well.
I believe this incident raised awareness of the problem. You have a point that the Morrowind community is pretty low-prize, target-poor. The concern on other side is that OpenMW is meant to allow people to make games. Think of OpenMW as a game engine of the likes of Unity and UE (not there yet of course), then we start scaling upwards increasing the profile of the engine. This goes beyond just the Morrowind community, especially as we begin to support other games in addition to new games to be built on top of OpenMW.

http://www.escapistmagazine.com/forums/ ... d-by-VIRUS
The popular site for mods for Skyrim, Oblivion, morrowind, and a ton of other games was infected yesterday. Someone got access to an admin account (who likely got a keylogger) and made changes to some of the most popular mods for all recent Bethesda games. The most popular mods like SKYUI were compromised and replaced with a virus.

If you downloaded any of these mods between 12pm and 2.30pm GMT yesterday, you are infected:

SkyUI
ApacheiSkyHair for Skyrim
Fallout 3 Redesigned - Formerly Project Beauty for Fallout 3
Project Nevada for Fallout New Vegas
Oblivion Character Overhaul version 2 for Oblivion

Among these are changes to the ads, which sends some German users to a fake page that claims to download java. Even if you didn't install these 5 mods, but you did install other mods, its good practice to check your PCs for anything.
Here is the source from Nexus:
https://forums.nexusmods.com/index.php? ... n-apology/
We were able to quickly identify and remove access to the account, however, a few more files were changed by the "hacker" before we could trace things. These files, on top of SkyUI for Skyrim, were:

ApacheiSkyHair for Skyrim
Fallout 3 Redesigned - Formerly Project Beauty for Fallout 3
Project Nevada for Fallout New Vegas
Oblivion Character Overhaul version 2 for Oblivion
So yes, it is a real concern and not just a popular concern that nexus mods implemented their anti-virus scanner.

OpenMW has to do a 'best-effort' as well to insure that stuff like that doesn't happen. That also means arming modders with the tools they need to do what they want in a safe and sane way.
User avatar
psi29a
Posts: 5355
Joined: 29 Sep 2011, 10:13
Location: Belgium
Gitlab profile: https://gitlab.com/psi29a/
Contact:

Re: MWSE, Lua and OpenMW compatibility

Post by psi29a »

And there is this...

https://github.com/kurnevsky/openmw/com ... 0b7f3a0f91

someone has been busy adding mwseextensions :)
Jad
Posts: 5
Joined: 18 Nov 2015, 20:22

Re: MWSE, Lua and OpenMW compatibility

Post by Jad »

Speaking as someone who has long been active in the Morrowind scene, and who has been making mods and collaborating with other mod makers for many years; These recent discussions have finally drained the last bit of hope I had for openMW. Lately it has felt more and more like the only "MW" part left of "openMW" is the hope of leveraging the community as free beta testers for your general purpose engine. It's incredibly disheartening to see this sentiment that mod makers should be restricted for some imagined benefit in your future standalone game.

I don't know when exactly it all changed, but I recall a time when openMW was sold as way to empower mod makers, to let us finally do the things that the old engine wouldn't allow. It was this message that brought in all the testers you benefit from. All these years later though, and it seems openMW has just given us the exact opposite. Trying to support openMW in your mods essentially locks you out of all the advancements the rest of the community has made in the last dozen years. It's a pain for mod makers, and a pain for mod users. The only thing OpenMW has done for our community is to drive a wedge into the already small userbase.

Supporting MWSE would go a long way towards helping the situation. I know not many here are active in the Morrowind modding scene, but the new MWSE improvements have been huge for us. I don't mean just the simple xFunctions of MWSE past, but actual real significant improvements, like the lua implementation and event-based scripting. There were 17 MWSE mods released in the last month and more are actively being worked on right now. Several of those mods are on the front page of Nexus, and thousands of players are already using MWSE in their game. Those are users openMW has lost due to its lack of support.

On top of this, NullCascade has been absolutely killing it, working directly with modders to add new features as they are requested. At the moment MWSE feels far more like the original promised land than openMW does. Just yesterday I seen a mod maker request a scripting function and have it implemented, playable, and releasable in less than an hour. It seems MWSE is only going to continue to grow, and if openMW does not keep up then it will wedge the community farther and farther apart. If this trend continues I expect that when the coveted openMW 1.0 finally does drop, most users will simply not care and continue to use the original engine that actually supports their favorite mods.
User avatar
psi29a
Posts: 5355
Joined: 29 Sep 2011, 10:13
Location: Belgium
Gitlab profile: https://gitlab.com/psi29a/
Contact:

Re: MWSE, Lua and OpenMW compatibility

Post by psi29a »

Perhaps you should have a look here Jad: viewtopic.php?f=6&t=5224
User avatar
AnyOldName3
Posts: 2666
Joined: 26 Nov 2015, 03:25

Re: MWSE, Lua and OpenMW compatibility

Post by AnyOldName3 »

We're not just blindly copying MWSE as that would involve blindly copying all of the restrictions of MWSE, many of which are inherited from the original engine and can't be removed, but never applied to OpenMW in the first place. Now that there actually is evidence of malware being disguised as mods, the security concerns Zini's raised actually have some merit, so blindly copying the additional freedoms of MWSE isn't a good idea either.

There are definitely major OpenMW contributors who want to ensure that OpenMW becomes the undisputed best way to play Morrowind, myself included, but that can't happen if we jump headlong into things that will have major consequences in the future. Most of what both we and NullCascade are up against are short-term design decisions made by Bethesda over a decade ago, and if they'd been made with 2018's Morrowind players in mind, everything would be much easier. Making something amazing takes longer than making something good, especially if you want it to continue being considered amazing (or at least good) years into the future.
NullCascade
Posts: 121
Joined: 16 Jan 2012, 07:58

Re: MWSE, Lua and OpenMW compatibility

Post by NullCascade »

psi29a wrote: 14 Jun 2018, 11:49About the security concern, both DarkElfGuy and yourself are quoted as saying that no viruses have ever shipped as mods and that the virus scanner on Nexus was due to popular consensus and not from anything that has happened.

...
Interesting, I hadn't heard of that. But it proves my point, it doesn't weaken it. The files were targeted because they were popular, and viruses were delivered through normal downloading. It had nothing to do with OBSE, SKSE, etc. Arbitrary code was not to blame, the site getting hacked and downloads being injected were to blame. Even when a hack was performed, did they decide to deliver via engine plugins? No.
Chris
Posts: 1625
Joined: 04 Sep 2011, 08:33

Re: MWSE, Lua and OpenMW compatibility

Post by Chris »

NullCascade wrote: 14 Jun 2018, 17:40 The files were targeted because they were popular, and viruses were delivered through normal downloading. It had nothing to do with OBSE, SKSE, etc. Arbitrary code was not to blame, the site getting hacked and downloads being injected were to blame.
Doesn't SkyUI use DLLs through SKSE? I know it at least requires SKSE. It also uses flash, which has consistently proven to be vulnerable to arbitrary code execution. Simply downloading a file won't infect your computer, you have to run something for it to start propagating. Maybe in those instances the packages were simply replaced with viruses masked as installers, but it could've been a lot more hidden if they cared to try.

Besides which, security isn't the only concern. A big point of OpenMW is its cross-platform compatibility. There's nothing to say it's running on Windows, or even an x86-based processor. If a feature is widely desired for a mod, it would be strongly preferable to get built-in support for it so everyone can benefit, rather than jumping right to an external library simply because its the path of least resistance thereby making the mod platform-specific.
Jad wrote: 14 Jun 2018, 14:19 I recall a time when openMW was sold as way to empower mod makers, to let us finally do the things that the old engine wouldn't allow.
That is still a goal. However, it's also been stated that we're not going to see any serious enhancements until we properly fully support vanilla with 1.0. After that's done, we can work out where to best go from there.

In regards to MWSE, there are advantages and disadvantages to supporting its features. It's been stated that there's no real issue with supporting the easy-to-add, non-intrusive functionality (math functions, certain x* method variants, etc). MWSE as a whole will present an issue though because it has (necessarily) been designed around the vanilla engine internals -- quirks, limitations, and all. OpenMW is built from scratch, with a completely new design. The internal plumbing that MWSE is built on and relies on is very different, so supporting all the same functionality would be difficult at best, and at worst, could edge against copyright infringement (it's one thing to imitate behavior necessary for playing the same vanilla content, it's another to duplicate designs and other creative aspects of the engine that have little to do with interoperability).

In any case, if there are enough people around that actually care, the modding community is resourceful enough to make something work if they really want it. For instance, a tool to convert "incompatible" MWSE mods to whatever is decided for OpenMW.
The only thing OpenMW has done for our community is to drive a wedge into the already small userbase.
It has brought in more (non-Windows) users. New capabilities and enhancements are still on the horizon. Nobody ever said making improvements will be smooth and painless. Sometimes, if you want to fix fundamental issues a transition is necessary, and such transitions aren't necessarily pretty. But if it's truly for the better, the community will be stronger for it in the end.

It is interesting sometimes the number of parallels I see with the Doom/GZDoom community in these respects.
NullCascade
Posts: 121
Joined: 16 Jan 2012, 07:58

Re: MWSE, Lua and OpenMW compatibility

Post by NullCascade »

Chris wrote: 14 Jun 2018, 19:13
NullCascade wrote: 14 Jun 2018, 17:40The files were targeted because they were popular, and viruses were delivered through normal downloading. It had nothing to do with OBSE, SKSE, etc. Arbitrary code was not to blame, the site getting hacked and downloads being injected were to blame.
Doesn't SkyUI use DLLs through SKSE? I know it at least requires SKSE. It also uses flash, which has consistently proven to be vulnerable to arbitrary code execution. Simply downloading a file won't infect your computer, you have to run something for it to start propagating. Maybe in those instances the packages were simply replaced with viruses masked as installers, but it could've been a lot more hidden if they cared to try.
It requires SKSE, but that wasn't the attack vector. It'd be silly to do it that way. You've already convinced someone to download and run something, you don't need a DLL that runs when the game is launched.

The whole "if" and "maybe" bullshit would be a lot less eye-rolly if it weren't equally likely that someone puts out a malicious fork of OpenMW, or if someone hacked the systems used to make OpenMW's builds/RCs/whatnot. It is possible that OpenMW is delivering viruses? Sure, technically. Is that something I think the average user ever needs to be concerned about? No, of course not.

It's all just a bunch of hoopla that misses the point.
Post Reply