search

probable-basilisk / cheatgui

The Noita cheat gui mod, now in its own repo
MIT License
69 stars 11 forks source link

"Extra privileges"? #5

Closed kenny-evitt closed 5 years ago

kenny-evitt commented 5 years ago

I just cloned the latest version. When I enabled the mod in Noita I got a prompt:

This mod has requested extra privileges.

If enabled, it has full access to your computer,

even without using possible exploits in the game code.

Are you sure you want to trust this mod?

Yes No

That's a pretty scary warning and I'm not sure I do trust the mod. (I would bet it's fine.)

What's with the extra privileges? Are they necessary? What about the mod needs full access to my computer? Are there no intermediate privilege(s) between the default and full access?

probable-basilisk commented 5 years ago

There's a section right in the readme, with the heading "Note about scary warnings".

But basically it needs those privileges in order to tell what you're typing, in order to do the very-convenient type-to-search thing in the giant lists of materials, spells, etc. There's no intermediate level of permissions: the low-level APIs that let you do harmless things like "know what keys are pressed" are bundled with the APIs that let you do things like create/delete files, etc.

You can look at https://github.com/probable-basilisk/cheatgui/blob/master/data/hax/superhackykb.lua if you want to see the specific usage of the restricted APIs; it uses the luajit ffi to access SDL (the windowing, keyboard, and mouse handling library that Noita uses) in order to get the current keyboard state, because that isn't exposed in Noita's built-in mod interface. If you were really paranoid you might ask "isn't that basically installing a keylogger", and the answer is no-- like a normal application it only detects keypresses when you have the Noita window in focus, it has no clue what you're typing anywhere else.

The readme explains how to disable this permission if you want, and everything should mostly work, except obviously you won't be able to search any of the menus.

kenny-evitt commented 5 years ago

@probable-basilisk My bad! I totally missed the section in the README. (I just submitted a PR with some proposed changes to the README to clarify this.)

Thank you for detailed explanation. I totally understand. I figured there might not be other privilege levels.

Beyond adding text GUI controls for mods, maybe the Noita devs could expose the keyboard state instead.