Solved Security of new .cs plugins

Hi!

Today I asked my gamehost Multiplay to please update some of their addons since they are outdated.
First I got an answer that this could take some time because of the multiple patches and that she would come back to me. Now 9 hours later I contacted them again and asked, then I got the quoted answer below:

Is there really a potentially massive security risk by allowing csharp addons instead of .lua?
If so this is a gamebreaker for people hosting modded servers on Multiplay servers.

 

We are indeed in the process of reviewing supporting the new types of plugins.

As I'm sure everyone will appreciate we don't want your servers going offline for extended periods due to potentially malicious plugins so we wanted to perform due diligence on the functionality before allowing their install.

 

read what sandboxie does, then you'll realise your safe

 

With C# it could well be its possible to bypass that, we need to validate the hypothesis though hence the DD.

 

true but as far as i know its all vritual meaning its safe from accessing hosts operating system, you could simply have one dedicated server testing it and allow your customers at there own risk use c# but migrate to another dedicated server for testing purpose

 

im talking about oxide being sandboxie

 

What multiplay are afraid is that one person uses the plugins to fuck an entire server as they are probably using shared machines.
So with 1 malicious plugin they are scared to fuck 30 other customers.
But again ... Can't éven use (lock) in c# xD

 

This ^^

 

But only 1 thing i dont get is that all plugins are the ones posted on this forum, you only have à couple personnal plugins there, why not only accept plugins posted on oxide?

 

Who is legally responsible for reviewing those to ensure they aren't malicious?

 

This would require adding each plugin on this forum on a plugin site and then not allowing uploading plugins for the customers themselfes, as you could easily fake the name of the Plugin - File if you only restrict it after names ?

Edit:

As far as i know oxide hasn't any api like "Bukkit" with its "BukGet" to install all plugins from their site, or am i wrong?

 

Légally no one, but wulf goes around every plugins to make sûre they arent malicious.
Someone posted à:
using System.IO;
And we all looked into it to make sûre he wasnt doing something malicious,
But as it's sandboxed, that person can add : using System.IO but he can't use it as it's blacklisted from oxide.

 

just to clarify, nobody can hook something outside oxide to for example damage the system ? Like deleting folders etc. pp. ?

I guess every hosts nightmare is when someone can upload their own .cs - Oxide plugin and with this plugin damaging the whole server, like deleting every customer folder or even changing the password or making the server unbootable.

 

well if you let anyone edit oxide .dll files yes they can do anything ... but again they could install anything.
as long as you don't let players edit the .dlls there can't (shouldnt or what ever XD) be any bad surprises.

 

@Wulf @Reneb

does someone have a "test code" ?
[DOUBLEPOST=1423848279][/DOUBLEPOST]Seems at least not to be a problem for me, every server is running with its own user for it's directory, exactly the way @Wulf said with sandboxing.

 

Test code for what? If you mean testing the sandbox then it might take a bit because the code would need to be made for each language oxide supports. The funny thing is there was massive exploits in the lua sandbox for over a year and none of the host said a word.

 

i guess because not everyone heard about it ? It's the first time for me