Weather Factory

There are now a hundred and forty mods on the Cultist Simulator Steam workshop. The number’s exploded since we enabled DLL modding – that is to say, we allowed modders to run their own code as part of a mod, changing fundamental game behaviour rather than just adding new narrative content and images. Four of the top five mods are DLL mods.

Any time you run someone else’s code on your machine, there’s a risk. In theory, a modder could include malicious code in a DLL mod. The risk is very low – AV programs may notice it, Steam will block malicious modders – and the same applies to games anyway – there’s nothing in principle to stop a game developer from putting malicious functionality in their work.

But there was an incident earlier this year where a modder did include malicious code in a Cities: Skylines mod. It was trivial – it just interfered with other mods as part of some sort of community drama, it wasn’t ransomware or anything. It was spotted within days. And it only affected about fifty people. But it did happen. (A few months later we got an email from a security researcher pointing this out.)

So from the beginning of next year, we’re making it slightly harder to enable DLL mods. All you’ll need to do is install a gatekeeper mod, Ghirbi, and all Ghirbi does is show you a notice making you aware of the theoretical risk. This is basically the same as making the user tick a box to say ‘I am OK with this’ – but most people tick most checkboxes without reading the notice, especially when they’re playing games.

[You won’t need to download or install Ghirbi to use DLL mods until after our next patch, NEMESIA, but you can install him now to save hassle. If you don’t use Steam, you can download Ghirbi here.]

Honestly I think the risk here isn’t traffic-accident low, it’s hit-by-a-meteorite low. But if someone was hit by a meteorite because they’d installed our game, then even if it was a bizarre accident, we’d feel bad about it. So we’re adding a meteorite warning it’s impossible to ignore. Happy Christmas.