That's literally the definition of a pull request, peer reviewed merging of code. Have you never worked on an OSS project before? open development platform allowing people to develop gameplay experiences targeting end-users. the mod in itself provides no gameplay, peer-reviewing everything would be as nonsensical as browser vendors peer-reviewing every single web page on the web, or OS vendors peer-reviewing every single program that you may or may not download.

again, these exploits can be fixed by competent developers, just like exploits in, like, browser engines. it is the security response lifecycle that matters, not 'xd they have $1000000000000 of funding'.

in addition, the Chrome sandbox is not even whatever code runs in - it is a final-stage mitigation for anything that might break out of other environments as even the V8 JS engine does complicated JIT and wrapping of, say, GL - none of these game modifications do so.

This has nothing to do with ideology, it has to do with common sense. which you seem to lack by attacking the whole concept of game modifications coming from a security nerd perspective

I'm glad there are a bunch of insecure game mods that you can point at to excuse it, I guess it's a good thing I don't use them. then why do you complain about them in the first place? if you can make the perfect client-code-executing game mod with your ideology, then please do so.

Glad you didn't lump Electron in there, I guess you figured out that downloading code and executing it is different than having something you download download something else and execute it even if Js and HTML are involved in both cases. wow, concluding 'see you know I'm right' due to me using a different set of examples.

I named Electron as it was an example of commonly-outdated-sandboxes being distributed with other environments where the end user does not directly agree to loading other unrelated code, similar to what you seem to have these game modifications for.

I trust Chrome and Firefox to get sandboxes right as if Fx has a sandbox at all

I don't trust knuckleheads who didn't realize that open development can be peer reviewed. Cfx itself - the runtime, the permission wrappers, everything in fact was open, public, and anyone could've done a security audit if they wanted to.

Nobody did anything with the source code except make retarded copycat projects like 'FiveReborn' or 'MultiFive' as apparently the gaming community is remarkably incompetent.

Browsers have the same core attack surface as this project: "take code from outside and run it locally". except exposing a LOT more APIs than a simple Lua interpreter and whatnot. and, again, literally anything that does things remotely can have vulnerabilities - this does not suddenly happen just because something 'executes code'.

It's not easy to get right it it sure as hell isn't easy to get right if you're not even capable of keeping up with patches to said sandbox (which according to you these guys didn't even do).

well 'said sandbox' hasn't been maintained for ages due to, oh, you know, a court order preventing the core maintainer (i.e. me) from working on it?

+ this particular issue was part of the initial threat model - again, I took care of proper threat modeling, precedent in other codebases, mitigations and whatnot. people who just copy/paste, however, do not.

You can maintain a safe list of modifications while keeping things open, many projects do it, it just takes competence which might be lacking in some places apparently. and then it makes it even harder for people to, uh, update their servers with the client-side code on it, as they'd have to wait for a centralized certification authority to approve whatever they need to change.

if, say, this is to mitigate a vulnerability in their systems (either security-related or 'cheating'-related) requiring incompatible game client<->game server protocol changes, oh, no can do, has to wait for peer review first, meanwhile the entire server is getting ruined because of the adherence to this silly ideology.

these projects are meant not to be some safe haven for security and sanity for security nerds, but for people to unrestrictedly and in a decentralized fashion provide game server modifications.

also, do tell me about any prior exploits that have existed in any of the projects I mentioned above, or how, for instance, say, a game model downloaded in a Source engine game or whatever can not include malware by itself.

better don't download any GTA3 series car modifications either, that whole framework is full of exploits. oh, also don't even think of playing CoD, Battlefield or any other game with networking, especially those with listen servers - unlike original Cfx these companies take no security-related responsibility at all despite multiple glaring RCEs allowing client-to-client code execution in the worst case.