Comment by snickerbockers | Hacker News Reader

Comment by snickerbockers | Hacker News Reader

Parent Full thread

I'm not familiar with lua, but when it's embedded as a scripting engine is it really just allowed to import whatever packages it wants and have full access to the host computer's resources? If so it seems like a really poor fit for any game that intends to have user-created mods (and yes I'm aware that it's one of the most popular scripting engines in gamedev-land and has been for about two decades).

I remember when FPS games first embraced the mod community back in the late 90s many of them had their own dedicated scripting engines (QuakeC, UnrealScript, later quake 3 arena had "real" c programs but they were compiled to a custom bytecode interpreter) that didn't have free reign over anything but the game state and that seems like a much better way to do things. Games used to have options to let you automatically download requisite mods from servers and it was safe to do so, at least in theory. I have no doubt that at some point in time there was a ROP vulnerability that could've been used to turn this into a devastating malware vector but at least then the scripting engine wouldn't be functioning as designed.

You can lock down Lua, but you need ffi to achieve really good performance. This is what BeamNG.drive does, and that does theoretically open up the sandbox quite a bit. Suddenly you allow Lua to call C++ functions, and naturally vice versa. That could be a problem, and that's not the end of it, the Lua standard library (if you wanna call it that) contains io, command execution, etc. so you need to be selective about what you allow mods to do, while still making it possible for people to make mods.

In short; you need to give Lua power over your program in some way, and that's the weak link. Lua itself can run with zero access to the world, but then you have nothing more than a calculator or config file.

Pretty sure it was not safe, people just cared less.

Indeed before online banking and widespread online shopping there wasn't much to care for in computer security. Also before ransomware were invented. I guess the biggest application was stealing passwords (and an occasional credit card #), botnets for DDoSing game servers and such, in which case user wasn't much affected. Nowadays specially with crypto wallets you can get crazy essentially unbounded prizes, maybe millions. Don't do cryptocurrency, kids (unless losing all your funds is the least of your concerns[0]).

[0] Like you're some kind of activist or maybe in an oppressive regime

Reply on news.ycombinator.com