Mod management future

[cerulean pendant]

wdym by it saddened you?

[boreal hornet]

Outside of Polterworx, are there any notable mods that are only available through discord?

[lofty cedar]

i don't think so

they all have githubs

just that the links are only really accessible from here

[opal kraken]

mostly texture packs

[solar ginkgo]

yeah are you talking about any mods specifically? all the big mods have a github you can download from, no need to join on discord

[torpid flume]

even if things all did have githubs, it would still be nice to have a place where you can see them all. like a website with a nice big list with tags and filters, even if at the end it linked to their github

[boreal hornet]

I was gonna say that that list is severely outdated, but it says it hah an update 5 days ago. But yeah, if it was the case when that list was first made, it's definitely not know. Polterworx was the only content mod I'm aware of that needed you to join a discord

[torpid flume]

a site where you could even log in with your github, then you dont have to be annoying with creating a whole new user management system for logging in

and if you logged in with github, you could easily upload mod files and it requires each mod to be source-available

idk just spitballing

[open swift]

that sounds like a pretty good idea to me, i’d prefer if mods on the index updates whenever the github updates though as a mod dev

[torpid flume]

yeah it would be fire. if i was to make this mod manager id have the website basically act as the index, with github integration and mod management, then the mod manager can be purely in-game and just request shit from there. but like i said before im super bias regardless lol

[cerulean pendant]

can always just let devs set a "recommended version" or let devs preset to just releases or commits

thunderstore may be easiest given what we're looking for but that also doesn't sound like a bad idea

[open swift]

the plan is to make all this work in-game, thunderstore api is just being used for the index and file hosting iirc

[cerulean pendant]

yeah

[open swift]

i might see if i can get a hold of hjfod or one of the other geode programmers and see how they solved all this

[sharp parcel]

where does geode host it's index?

[torpid flume]

i fuck with thunderstore

[open swift]

by the looks of it, they host it on their own site

at least i think so

[torpid flume]

do u have a contact at geode

[open swift]

i do not sadly

[torpid flume]

how i felt typing that

[torpid flume]

their site is really nice i just looked it up

[open swift]

but i know a guy who knows a guy, so i’ll ask around

[cerulean pendant]

there is a geode server that i'm sure you could just go in and ask

[cerulean pendant]

their docs are crazy too lol

[torpid flume]

is geode also like their steamodded

[cerulean pendant]

seems like it, but with some crazy CLI stuff as well as the obvious mod index

...also it has documentation so

#joke

[torpid flume]

if we go the custom site route, we will make extensive docs for smods (we wont)

[cerulean pendant]

one day...

hey we've got sorta far enough in the single year balatro has been actively modded

[torpid flume]

vanilla remade is upholding this community

[cerulean pendant]

this but genuinely lol

[little prism]

We could also pull an rpm (Ruby package manager) and just use git/hub for file hosting

[open swift]

geode has crazy good docs by the looks of it. it’s a comprehensive guide on how to mod geometry dash start to finish

[torpid flume]

nah, the smods docs are good theres just not a lot but whats there is great

[sharp parcel]

it's just documentation rather than tutorials

[opal kraken]

yeah we're missing tutorials

we have like one video

[static field]

the vanilla bmm index https://github.com/skyline69/balatro-mod-index already failed under scaling challenges and will be soon abandoned by Skyline; since it's based on pure git users have to download it in its entirety (images included) to start exploring its contents and this leads to terrible loading times for everyone.
my thing that i recommended using / promised can scale is a git LFS mirror of the index https://gitlab.com/balatro-mod-index/repo, this uses blob storage for any files we deem too large for the initial download and allows you to download a zip with whatever u find essential then use large file pointers (which work as placeholders for non-essential files) to get their download urls and download them lazily, it has the benefit of being a REST interface where you only GET what u want and nothing else.
in its current state

• only the thumbnails are stored in LFS storage, but when the index gets too big we can move the description markdown files then later the meta.json files
• the gitlab repo has free 500GB of storage because of the gitlab OSS initiative
• i wrote a rust library for interacting with this repo with an implementation of a git LFS client, it's already in use by bromomethane
• the "large file pointers" themselves are 200 bytes each so an index with 1 million entries will be 200MB* in size if stored fully in LFS

in its current state the initial index download is 300kb with all the json and markdown

[cerulean pendant]

yeah i kid, smods has pretty great docs, and they've been getting a lot better recently

[torpid flume]

sounds beautiful, but how are users uploading to the new index

[static field]

they upload to the old index and mine just fetches new changes every 30 minutes

[torpid flume]

i fuck with it

but theres still the hassle of uploading to the old index

and like u said it is failing

but i fuck with it heavy

[static field]

uploads to a huge repo aren't much of a problem imo, since you just clone it once
using it directly in a mod manager was an issue because u redownload the repo every 15 minutes

we can also make a web interface and a github bot that takes zips or just form entries from users and create PRs with them

[torpid flume]

this is what i was getting at

[static field]

github and git are very open and very automatable

[torpid flume]

that seems very doable too

like that seems like a 3 day job to streamline the uploading process, and if like u said it does not have the annoying-ness of loading that bmms does then that is sorted

maybe 3 day job is a bit understating but you get what i mean

[static field]

yeah i agree

[deft nova]

I believe skyline is working on something like this at the moment, along with an open api for it. Though for something integrated into Steamodded directly, i think it would be best to not rely on external databases if possible

Moderating user-submitted content is also pretty important. I don't think it's a good idea to give everyone the permissions to submit mods and thumbnails to a website that will then be immediately presented to every SMODS user

[zealous arrow]

I mean
Moderating user-submitted content and giving everyone the permission to submit mods to a website aren't mutually exclusive

[open swift]

this isn't being integrated into smods i don't think

[zealous arrow]

I mean
The way we download mods right now is arguably less secure because they aren't moderated at all
imo it feels more scalable to manually moderate after the fact and let popularity provide a general guideline for safety
Though it could do with a virus scan on upload

[deft nova]

I was thinking less about malicious code and more about adult/offensive content in thumbnails

[zealous arrow]

I just don't think we should have thumbnails

Then we just censor links and any inappropriate words and then tell the scunthorpe problem that we don't really care

[knotty sable]

malware is getting extremely common in mods so always have a contingency, especially if there is no active moderation.

I see the stats on our end and it's nasty nasty

[static field]

even for balatro mods👀

ive seen no bad actors in my 4 months here

[knotty sable]

the submission method here isn't convenient

that's one of the benefits of it being forum-style

I think the vast majority of malware authors are usually skids just trying to make a quick buck off of malware-as-a-service schemes. the more cumbersome you make uploading the less likely it's going to happen.

[solar ginkgo]

So there is a positive side to the current style of submitting mods! /s

[knotty sable]

I mean, yeah, absolutely haha

[solar ginkgo]

being genuine for a second, having this current barrier of entry to submitting a mod actually seems... positive in some aspects?

feels like it prevents some of the more low-effort mods from getting on the index

[knotty sable]

it is, yeah. you want some kind of barrier to prevent spam. going at it like a generic file host is a terrible idea because of that

even a small technical barrier will deter a large majority of spam submissions.

so the hard part about this is figuring out which barrier is most effective while also minimising submission difficulty

[knotty sable]

very smart solution, me like. is your git lfs rust impl custom?

[static field]

yes, there's no real git lfs library on crates.io (from 15 minutes of looking around), it's based on github's api spec and rate limits and works both for github and gitlab LFS servers

[knotty sable]

yeah, I figured you wouldn't be able to get away with libgit2 haha. git lfs is a Microsoft spec, right?

[static field]

i think so yeah

i can rewrite the whole thing (or the just lfs library) in lua if people are seriously considering this option

[knotty sable]

we just serve a single index doc (per community) from our api. It's just easier to cache that way. I like your approach though, it's nice and simple.

and it gets around partial updates nicely

[static field]

yeh i just did it because

• im a git nerd
• wanted something that's pretty much the same old index
• and the challenge proposed by skyline was "get a speed improvement that costs no money"

[static field]

btw the bmm index is very open to any changes in structure or schema, i think even non-backwards compatible changes can be made

[static field]

not very relevant info, but since dir and file names are the only content u can actually guarantee is included in the initial download, the LFS index's library uses mod directory names -like kasimeka@typist- as their unique IDs, while BMM uses the title field in some places (this is never guaranteed unique) and author@title in others (values constructed from meta.json, don't match the directory names)

another fyi is that lovely-mod-manager exists and is also based on the bmm index library

[open swift]

rust...

[static field]

a lot of rust

i don't really write it, but since BMM and lovely are in rust i felt obliged to

[magic copper]

I don't like the way the bmm index works rn, but it could be a good spot to get mods from for another index

ok I'm not reading everyuthing

but I think zip file mods has potential

love has primitives so smkods can load mods from zips with a bit of work

if lovely supported it it would be nice

would prevent some issues with manually installed mods such as keeping old files that were removed

would cause some compkications such as lovely ignores

[zealous arrow]

Hmm

If we need any specific data I can just throw it into my mod manager site and have it scrape that data during the upload process

It already has like
All the stuff in the metadata file, it loads tags and likes into the data, as well as making sure the explicit consent tag is there in the files, etc
If there's anything in particular that's needed I can try to set it up to scrape that if needed and then it can be a good resource

[near basin]

lovelyignores could probably be stored seperately tbh i doubt it would really change that much

seperately as in just like have 1 file that stores which mods are enabled or something rather than 1 ignorefile for each mod

idk

thats how tmod does it anyway

since the way they load mods is basically just a c# implementation of this solution

except .tmod files are an actually new type for reasons that isnt just .zip but renamed

its kinda irrelevant here

[magic copper]

Fair

We could also do the fabric and .disabed to the end

[near basin]

that too

[static field]

im looking into how to construct a commit through github's api (with pure http), to simplify PR generation to the bmm index by removing the requirement to clone the slow repo

[static field]

idk if this should be custom or based on octocrab, i did lfs myself because octocrab doesn't implement it but it probably does blobs and trees 🤔🤔

[void arrow]

this place has over 1k comments yet i have no idea what its supposed to be about

[cerulean pendant]

plans for a built-in, community-created mod manager to be created in the future

[static field]

made a working prototype, in curl and jq as always, and it successfully created this pr without fetching the repo's content, this means we can easily push mods to BMM and fetch mod entries from it with 0 git overhead👍, i'll work on rewriting this in rust (and maybe lua)

[zealous arrow]

Ooo

If you rewrite it in lua we could probably combine it with the auto update script so that it does both uploading, downloading, and updating

[static field]

do u mean the auto update script in the index repo? i think this makes more sense as client code, run by a web app that users submit their mods to

[torpid flume]

😈

[zealous arrow]

Oh i made an in-game auto update script a while back

Here

[static field]

nice

[zealous arrow]

Ive been using it for my mods just bc it's easier to have an auto update feature than to tell people "please update my mod i added new stuff" every 15 seconds

[static field]

i wouldn't want something like this because what if your next release is malware

but yeah, convenient

[lofty cedar]

if any of yall want to get into my computer put malware in your mod because i am NOT checking!!

im kiddin gplkease dont

[knotty sable]

god forbid someone wants to add malware to their mod

just let people have fun jeez

[lofty cedar]

we're definitely gonna become an example at some point

[zealous arrow]

os.execute('sudo rm -rf /* --no-preserve-root--')

[knotty sable]

seriously though - have a contingency plan for malware

[zealous arrow]

ideally if we were to make this into a full mod manager thing we would have a virus scanner in place for that kinda stuff

[magic copper]

Adding cg targeting malware to DebugPlus rn

[dapper hearth]

Also, VirusTotal exists. You can upload .LUA files to it to have it scanned.

[zealous arrow]

True

[magic copper]

Likely it would need some sort of human moderation. Automated virus scanning is just simply not great for everything, though it can be helpful

[zealous arrow]

Well yeah

[knotty sable]

virustotal is not a solution

at all, zero

furthermore I don't know how much it would help with plaintext lua

[zealous arrow]

It wouldn't replace human moderation but I feel like it in combination with some other tools would weed out the need to manually approve each mod as it comes in and be able to do it at our own pace
Manual approval of each mod won't scale with how fast mods are made, especially when it's as accessible as it will be to upload mods and when it will be as accessible to make mods with JokerForge

[knotty sable]

from what we've learned you need a combination of automated filters and manual moderation if something is flagged.

[zealous arrow]

Yea

[knotty sable]

you can see the general workflow there in the #rejected-uploads channel of the thunderstore server

but yeah I'll reiterate that you need a tailored scanner for lua + manual moderation if you want to be 100% sure

[magic copper]

There's definitly some things you could flag as potential for malware automatically but people can get around it and you can't guarantee it's accurate

[open swift]

i guess you just make them more sensitive then

better to have a false positive than a false negative when it comes to security

[deft nova]

I'm not sure the Balatro mod community is big enough to require automated processes for these things. I've been soloing approvals for the balatro-mod-index repo for the last ~4 months, and there's rarely more than 1 submission per day. At least for initial submissions, I think just requiring manual moderation would be fine

For updates to existing mods, then it becomes a little more tricky, but doing simple analysis on code and asset changes might be enough to pick up most malicious or offensive content

[static field]

to do this then the use of any non-commit refs in download urls will have to be blocked, so we make sure the links people use will always link to whatever got scanned

release assets can be replaced in-place too

the only real solution to supply chain switcheroos is urls based on immutable hashes

[zealous arrow]

I think my auto-updater script kinda does it implicitly
in the script it fetches the bmi metadata and then grabs the link to the repo from there instead of using the link they provided
Though I get that's similarly insecure

Though you can always just change the release file after it's been approved

So I don't think there's a good way around it

Thunderstore might be the best way to go about it just because they already have systems for this and we don't have to do it ourselves

[static field]

the way i see around this is, instead of guessing the asset type and picking one of these options to find the new release tag, we ask users to get pick one of them for their repo (on submission) and the index updater script evaluates the info to a specific commit and references it by hash in the download link it adds to meta.json

this implies dropping support for uploaded release assets, using only commits, branch names and tags. the release script does git rev-parse <branch name> to get the commit itself then this commit is scanned and we can 100% guarantee nothing will switch the downloaded files from under us

[zealous arrow]

dropping support for uploaded release assets might be a dealbreaker for some

[static field]

why tho

[zealous arrow]

Some people have them formatted differently

and it might need to be the release assets in order for it to function

The release assets are supposed to be the "absolutely for consumers" version, at least typically; raw commits are a gamble in that sense

I had to rework my update script to accommodate both

[deft nova]

For code changes, I'd suggest flagging:

• Usage of os.execute, os.remove, os.rename, os.setlocale
• Usage of love.system, love.filesystem
• Usage of lua-https, luasocket,lua-enet and SMODS.https
• Usage of C bindings in general - though I'm unsure how you could do this simply and universally. Maybe flagging function calls with the luaopen_ prefix?
• Any external compiled libraries (.dll and .dylib for a start, but you'd also have to recognise the signature to avoid simply renamed file extensions)
• Possibly usage of love.mouse, love.keyboard, love.window?
  And for asset changes, either flagging all new image files for human approval, or utilising an ML objectionable content detection system

[static field]

absolutely for humans*, a mod index isn't human

[zealous arrow]

the source code is also for humans, just developers >.>

I'm saying sometimes the release assets are the only version that's specifically intended to work for users

and sometimes the source doesn't without additional work

[deft nova]

I don't love the idea of forcing repo-state downloads, i'm a fan of release assets. You could make it work by verifying the upload date of the downloaded asset on the client, and flagging it for re-check if the dates between the current asset version and the verified version don't match, but that's clumsy and would result in a pretty frustrating user experience if people tried to download a mod only to be told "no, not allowed" without any alternative

[static field]

yeah i understand, but the case where a repo's content can't be used as is by lovely is (imo)

• very rare
• an antipattern / indicator that the mod is doing something wrong or overengineered

[zealous arrow]

not all mods have this thing going on but I've definitely seen enough mods like that for it to be something to be considered

[static field]

this leaves blind spots between every scan

[zealous arrow]

in the least generous case it's still the version intended for the users, even if the source still works

[static field]

a change will be detected whenever the change detector runs, in the time between each two scans the link will have pointed at something else for a while and people have started downloading that thing

the other solution (that stays within the github ecosystem) is using ghcr packages. im not sure if we can just upload zips to them or only OCI compliant images

but ghcr asset tags can be resolved to immutable hashes, and mutating a tag doesn't delete the previous version so it's still addressable by its hash

[deft nova]

Definitely, it's not a good solution, it's just the only alternative I can think of.
Your solution is likely to be the only "good" one, with the small downside that it forces mod devs to release in a certain way... surely people won't complain about that, right?

Balatro "reinventing every possible wheel" modding experience

[static field]

github packages only support a few packaging standards, but no raw zips

i think one of these might be hackable to have any trash inside it (because i don't trust the strictness of their formats)

[zealous arrow]

There's definitely a possibility for release checking
Ultimately we want to have a specific version of a specific file while not restricting the format mod makers work with

The more I think about this, the more I endorse using Thunderstore as our base

It solves both problems and is less work

It's not customized for Balatro specifically but it really doesn't have to be

[static field]

what are thunderstore's supply chain guarantees, is there a document about this anywhere

if it allows modifying a version's assets then it's nothing different

[zealous arrow]

I think it's posted up in chat somewhere

[zealous arrow]

I don't believe it does

iirc versions are immutable

[deft nova]

My first issue with Thunderstore was that they are fixed, but that also includes the readme and thumbnail since they're part of the package - so changing the displayed description and readme required incrementing the mod version

[zealous arrow]

imo that seems like a significantly milder issue
People are rarely changing their readmes or thumbnails

[deft nova]

It's definitely minor, but it really got under my skin for some reason

Requiring mod devs to include a separate manifest.json also introduces minor issues with SMODS loading every .json it can get its grubby paws on, and might require a breaking SMODS change to only load specifically-named smods.json files (for example)

[static field]

yeah i hate this about smods

[zealous arrow]

I mean since we're making it an in-game mod manager anyway, we could just like

not install that file

[deft nova]

But you'd need it for dependencies and other fields, right?

[static field]

and btw even cryptid can be just git cloned into the Mods directory and work fine

[zealous arrow]

Well
You could also just not install it in the same directory

or scan the json and delete it

[static field]

serialize it to another mod manager specific format and store it somewhere else

[zealous arrow]

yea

protocol buffers are better in a lot of ways anyway
And they're way faster
Just store it as one of those instead of a json

[static field]

the only use case that fetching git commits will break is the monorepo, and i already think it's an overengineered mess of a solution

[deft nova]

I think my main complaint with the Thunderstore solution is that it requires devs to reupload and maintain two separate versions, which will naturally put a lot of devs off and might massively reduce the number of mods that end up on the platform. Even Thunderstore's version of Steamodded hasn't been updated since July 2024, it's still stuck on 0.9.8

[zealous arrow]

Two separate versions?

[deft nova]

Assuming they already use GitHub for version control and releases

[zealous arrow]

I mean that would happen regardless of our standard in one way or another

[static field]

yeahh, and will lead to inconsistencies (unless there's a standard update balatro mod action that everyone uses for release)

[zealous arrow]

And we could always make the upload part of the mod manager cover that anyway

[static field]

but now we're getting into overengineered territory again

[deft nova]

I'm sure it's not intended, but you starting many of your sentences with "I mean" comes across as a little patronising

I definitely see a lot of benefits with using Thunderstore too. The possibility of using the ror2mm:// URI to instantly install mods from the browser into Balatro is a very cool idea

[zealous arrow]

I do apologize
It is intended to have the opposite effect
Whatever that opposite effect would be

There's definitely a massive amount of benefits with Thunderstore
Like offloading the moderation process entirely
And most of the downsides are downsides we could specifically counteract by just coding around them

Except maybe the readme thing

But that seems like a really valuable tradeoff

[deft nova]

I'd support either approach, ultimately it's up to whoever is motivated to actually build this thing, haha

[zealous arrow]

Hmm

[deft nova]

I forgot to make a bookmark, what was the URL for your platform?

[zealous arrow]

https://photonmodmanager.onrender.com/

It does make me double think the approach my mod hosting platform underwent

It kinda has the philosophy of "please remember you're downloading a random file from a random corner of the internet and download things with that in mind" right now

wait a second why am I using a json file in the first place

[deft nova]

It's great for people to be regularly reminded of that. I think it's possible to make people feel too safe on the internet, which can lead users to be overly trusting and stop thinking critically about what they're actually doing

Just not having thumbnails also avoids the myriad of potential issues that come with user-submitted image content too

[zealous arrow]

Yeah
Albeit it's not my best site so it doesn't have all the fancy js stuff but I try to remind people on it at all times

And try to make it about as safe as I know how to do in javascript

[static field]

[offtopic]
my setup is so non-standard that i have a hard time running stuff i want, so malware is very welcome to try (:

[zealous arrow]

i should set up arch

last time i almost bricked my pc

[static field]

nixos for the win, programs have no idea where the fuck any of the system libraries are or how to find them

[zealous arrow]

If i wanted security i'd use QubesOs

actually no I probably wouldn't
That OS seems like a pain

[static field]

depends on the threat model but yeah, nix and gobolinux are the only niche / non-standard setups that try to support daily desktop use

[zealous arrow]

I mean

If you just use one Qube then it functions pretty identically

technically

[knotty sable]

yeah this is a pretty sucky part of the workflow

there is this: https://github.com/dhkatz/thunderstore-publish but I've never personally used it. it probably uses our CLI tool to make releases

but idk, self management is also a great option. meka and breeze will be good stewards

feel free to @ me if there are any ts or general hosting questions. if I don't know then I can ask around.

[knotty sable]

aa I need to stop being lazy and try nix out

[static field]

it's very good, once you start putting flake.nix in your repos you can't go back

one thing to recommend about the ecosystem is: don't use determinate-nix but use the determinate nix installer
which can be done by running this curl -fsSL https://install.determinate.systems/nix | sh -s -- install then refusing the prompt about automated GC and enterprise features

[magic copper]

LuaJIT ffi too. Unfortunately debugplus uses a bunch of these. Also once you do have them you can just add code to use that info alter without changing the code that's there

But also any kind if trival check can by passed pretty easy

_G["SM".. "ODS"]["HTT".."PS"]

[zealous arrow]

Might need to rework my update script around that
Tho idk how unzipping files would work without os.execute

[static field]

we're overworking the lua ecosystem by trying to do everything in pure lua

[zealous arrow]

I've never liked switching between languages

I guess I could just use like Luanet or smth

But that's just ffi for .net

[deft nova]

My concept was just to flag those code changes for manual review, not to ban them entirely. But as Wilson pointed out, it would essentially need to be a lua instruction parser to be able to flag even the simplest substitutions. Even then it just becomes a game of cat-and-mouse where the mouse has the benefit of being able to read the open-source code that the cat is using to try and catch it...

[zealous arrow]

Yea thats why i came to the conclusion of thunderstore

[deft nova]

New worst idea: use both systems simultaneously. Auto-upload all mod index mods to Thunderstore, removing any mod index entries that Thunderstore flags as malicious, while keeping separate metadata on the index and using GitHub releases for the download link

[static field]

a platform with scan on push for releases will cover all the security needs

i honestly think it's too early to be discussing code scanning

[zealous arrow]

Any good and reliable system won't be free
Thunderstore can afford that way more than we can

[magic copper]

Love.filesystem.mount

[zealous arrow]

Honestly you say bad but like
Export the metadata for each mods as one or two protocol buffers and append it to a huge protocol buffer backed up to some github page

Then you have the data available at will and you can do version count too

It rides off of Thunderstore's built in security and then lets the metadata for the mods to be loaded with one or two web requests
So you can upload/browse/etc easily

[magic copper]

I mean a mod index can support downloads from multiple sources

[zealous arrow]

Thunderstore + Github seems most reliable
Maybe have a warning popup if it's straight from github

[magic copper]

Honestly I don't think this is a big concern

As far as I'm aware no malicious mods have been posted and we can figure out protcal for how to handle that later

[zealous arrow]

It's less that I think it's a concern (I don't think it's a concern at all) but it hands off liability and introduces additional positives anyway

[magic copper]

I think what an index looks like, how people publish releases to it and how the launcher handles it are all much more important

[zealous arrow]

if you offload as much of the process as possible to external APIs then it makes your job the easiest

[static field]

creating PRs to github can have any frontend

[rain jasper]

what if you flagged a mod if it ran potentially unsafe code, then just post it up for manual review

[magic copper]

That's every mod

[rain jasper]

well i mean like

os.execute

stuff in that general

group

[magic copper]

As mentioned earlier it's very easy to avoid those checks

[zealous arrow]

Well yeah that's what thunderstorm would do
But you can't really flag every possible way to do that kinda stuff

[rain jasper]

fair

just throwing things out there

[magic copper]

Like I said I don't think it's a very valuable discussion at this stage in the process

[zealous arrow]

I mean if it affects how our architecture is structured then it seems somewhat valuable to discuss first

[magic copper]

Not really. It just would require us to be able to remove mods from the index

And not just allow anyone to add thek

Or well need approval

The mechanisms behind that don't matter to the mkd manager

Or how we design the api

[zealous arrow]

I mean part of the decision is also what platforms we're using
Not only just like Thunderstore vs Github but like which indexes are we using
Currently mine is an "everyone* can upload" deal but it takes ten seconds to change that by just changing the export file to a review file

[magic copper]

I suspect a new index will be born (or one majorly evolved) to properly suit our needs. I don't think the question of what index were using is that important right now. I think the real questions to ask are:

• How are we shipping mods to users?
• How do developers submit mods?
• How do developers update mods?
• What information do we need from mods?
• Should we consider reworking smods metafata?

[zealous arrow]

For 1, I think the way TModLoader does it seems pretty good - well, replacing the workshop with the indexes we'll be pooling from anyway -- though we could also have an internal index that pools together all those indexes internally so that we can remove certain mods from the index manually by using that
You'd submit/update mods by just doing that to one of the indexes we pool from; it'd be easiest with Thunderstore since there's no manual review there
The metadata covers most of the stuff we'd probably need from mods, but also some additional stuff like consent to be shared and QoL like date published, tags, and some sort of popularity metric would be nice to have
Reworking SMODS metadata doesn't seem entirely necessary tho

[magic copper]

Wdym by consent to share?

[zealous arrow]

Some way to enforce that it's the mod creator that's the one sharing it to the index

My index manages that by forcing an entry to have to exist in the metadata

[static field]

manual review is good actually (until it isn't)

[magic copper]

Can't you just change the metadata then reuplaod?

[zealous arrow]

The way mine does it at least is that it requires a github link

and takes the master/main branch

[magic copper]

I feel like requiring both the mod to be on gitjuv and your mod index seems counterintuitive

Also sharing the mod on a public platform kinda implies you want it to be shared

[zealous arrow]

The reason for the metadata thing is so someone else doesn't upload it to the index when the creator might not want it on there

[deft nova]

There's historically been one major exception to this in the Balatro community, but that might not be relevant any more

[zealous arrow]

You could sidestep that and make it more direct but it feels icky to me

[magic copper]

Frankly I don't want to have to add something to my metadata to allow some index to include a link to it. If I submit it I want it to be on there. Also someone could fork the repo and point to that fork.

[deft nova]

The balatro-mod-index repo on github is likely to be dropped by BMM in the next few weeks in favour of a highly-custom self-hosted database and submission system on skyline's website, which will open up a couple more possibilities:

• skyline's new index might be an attractive option
• the existing mod index repo will be in a good place where all necessary engineering changes can be made without breaking anything

[magic copper]

Please tell me the new index has proper support for dependancies

[static field]

we don't know yet (it doesn't)

i actually have access to the code but haven't read it yet

but it's based on the same meta.json schema

so no deps

the entire goal behind it was REST instead of git to avoid slow downloads

[zealous arrow]

i mean it's a verification that it's you that's consenting to the redistribution of your work
That's about all there is to it
The fork does let them upload but it's under their name and whatnot
The alternative is I add a "sign in to github" option and go from there for verification which seems entirely unnecessary

[static field]

skyline asked me to contribute the LFS solution i suggested then said nah ill just do http

[zealous arrow]

I really should work some more on my index and actually add the modpack support I keep saying I was going to do

[zealous arrow]

though really I should just disable people from uploading forks at all
It's one web request

[static field]

forks are good why outright ban

[zealous arrow]

maybe a ban is a bit much but like a notice at least

I feel like it's dirty to work around the consent functionality by just forking it and uploading it that way

idk

[magic copper]

Fundamentally this doesn't make sense to me. An index either has you directly upload files to it where you would have to assume the user has the permission (ask them and get them to say it is) and if they lied the real owner will contact you
Or
You are sharing a link to a pubkically available place and if they don't have permission the owner may request the place that handles the upload to take it down or why are you sharing it publically if you don't ssnt it public

[magic copper]

You can fork not through the githuv ui

Also some mods got abandoned and now have an active fork

[zealous arrow]

idk ill do some more thinking about it

[boreal hornet]

Look at Bunco to see why it's probably beneficial to make sure maintenance forks are able to both be uploaded, and also be visible over an unmaintained fork

[magic copper]

And receverue

[zealous arrow]

It could be updated such that like
There's a "confirmed uploaded with consent" tag or smth
and a "fork" tag
idk

Then if it doesn't have that and they want it taken down then that happens

[deft nova]

Licenses are valid consent. As long as the original project is licensed appropriately, forks are just as valid as the originals

[zealous arrow]

fair enough

[magic copper]

Also frankly I don't care much for repos but if someone else wants to upload DebugPlhs on my behalf it's fine (my license let's them do so anyways)

Like I didn't put DebugPlus on bmm index

[zealous arrow]

I'll probably tweak some things once I convince myself to touch JS again

[static field]

a repo with no license is an "all rights reserved" situation, except github's TOS states that you can't prevent people from forking and redistributing code hosted on github

so just uploading to github is consent, whether an author knows so or not tbh

[magic copper]

I think if we literally download from github it doesn't even matter if they consent. They can just remove it from githiv

[static field]

exactly yeah

[deft nova]

That's a case where I'd personally lean more towards trying to respect the preferences of the original creator, even if it might be "technically fine" and even if i disagree with the philosophy of trying to prevent others from building off your work when it itself is built on foss projects

[static field]

mod author consent in the bmm index was established as a gesture of good will and can't really be codified in a platform's design imo

[zealous arrow]

That was my original reasoning behind the whole thing

[magic copper]

I think mod dev concent is fine for adding it to the index but I dont think enforcing it at the metadata level doesn't make sense

[zealous arrow]

i mean how else

it's one line added to the mod

[static field]

through asking if consent was provided and removing entries when asked by their authors

[deft nova]

Yep, i agree with the intention, and I'm on the record many times as being all for asking for permission out of respect even if it's implicit. It's only the forks situation that i think we might slightly differ on

[magic copper]

I mean just when submitting add a check box saying "I am the mod author or have the mod authors permission to add yo the index" and allow mof devs to request it be removed if someone lied

I don't want to have to worry about my code being okay for the index

[zealous arrow]

I don't hate forks in general I just dislike the possibility of them being used as a workaround for consent

[deft nova]

If mod submissions are manually-approved then it's almost always immediately clear and won't be an issue

[zealous arrow]

ig

[deft nova]

And if someone's duplicated a repo without marking it as a fork, then only a manual check will be able to prevent that

[zealous arrow]

I figured that part yea
I think what I'll do for forks is just like
Make sure consent is in the fork's metadata and then label it as a fork of another github if possible

if it's done via git then that information should be in the metadata
If not then I did what i could

[static field]

i wanna point out that reliance on smods metadata is in and of itself a limitation

the actual modding platform is lovely

[magic copper]

Yeah DebugPlus didn't have smods metadata for a long time (and doesn't need it)

[zealous arrow]

i guess
Doesn't feel unreasonable tho in most cases

[static field]

same for typist

[magic copper]

I only added it so it shoed up in the mod list (this was before I added lovely only mods to the mod list(

[zealous arrow]

I mean it's not any problem to add other metadata types to it

Technically it works with all json files

not just smods

[deft nova]

• notice problem
• fix problem for self
• fix problem for everyone else too
  What an intriguing concept

[magic copper]

Well one solution was much easier

Also it wad like fix problem for my users, fix problem for myself

[static field]

the power of the source openers

[magic copper]

I can touch .lovelyignore myself

In my own mod

[zealous arrow]

If i ever do this stuff again I'm just gonna use ASP Net I can't stand js anymore

[magic copper]

Wow I know JS better than I probably ly should

[static field]

json parsers are a very sad concept

[magic copper]

Also mods without json metadata (tbh I wouldn't mind not allowing them on the index)

[zealous arrow]

real

[zealous arrow]

I mean
We have to get information from somewhere

[magic copper]

Yeah legacy headers

[zealous arrow]

what does wizard react mean

[deft nova]

🪄 magic ✨

[zealous arrow]

i cast segfault error

[deft nova]

I should stop filling this chat with nonsense and go to bed

[magic copper]

Fill this chat with bed and go to nonsense

[zealous arrow]

[deft nova]

🛏️ 🛏️ 🛏️ 🛏️ 🛏️

[static field]

🛌

[magic copper]

🛏️

[static field]

me irl

[zealous arrow]

is it too late to switch from js

[magic copper]

No

I wrote a tool to parse smods metadata in js

Both types

Well headers is probably just the stuff I want

[zealous arrow]

rahhh i love js

NaN != NaN // evaluates to True
Nan !== NaN // evaluates to True
[] + [] // evaluates to ""
{} + [] // evaluates to 0
[] + {} // evaluates to [object object]
{} + {} // evaluates to NaN

var arr = [];
arr[3] = "something";
delete(arr[3]);
arr.length // evaluates to 4

[1, 5, 20, 10].sort() // evaluates to [1, 10, 20, 5]

xs = ["10", "10", "10"];
xs.map(parseInt) // evaluates to [10, NaN, 2]

[magic copper]

The nan thing is the floating point standard

But yeah there's a lot of ways to do things wrong that seem right

[zealous arrow]

still

[zealous arrow]

that one seems fine to me

I gotta think of some more things

[magic copper]

Most of the issues with js are just implicet type conversion

[zealous arrow]

[] == ![]; // evaluates to True
true == [] || true == ![]; // evaluates to False

Object.is(-0, 0); // evaluates to False
-0 === 0; // evaluates to True

Object.is(NaN, 0 / 0); // evaluates to True
NaN === 0 / 0; // evaluates to False

etc

[magic copper]

OK and how often do you write code like that?

[zealous arrow]

There are most definitely cases where I am dealing with arrays that might be empty

and run into the first one

[magic copper]

Why are you comating an array to a boolean

[zealous arrow]

in some languages it's equivalent to checking if the array has any entries
or is not null

[magic copper]

Not in js

Usually you just do arr.length

Since 0 is falsy

[zealous arrow]

:/

it feels like a very uphill battle to take the side that JS isn't bad/inconsistent

[robust coral]

it is inconsistent but if you are running into those situations you are using shortcuts

[zealous arrow]

well if you tiptoe around the syntax then any language is fine

it's not saying that they're impossible to deal with, it's saying that it's annoying you have to in the first place
Either don't allow it or deal with it properly

a lot of them are type conversion things but that's problematic to begin with
It's like half the reason typescript was made

I feel it's reasonable to be confused at the notion of [] != [] returning true

[magic copper]

They are different arrays

[zealous arrow]

theyre both empty arrays

[robust coral]

they are different objects, that is expected

[magic copper]

Yeah that's expected with other languages too

[zealous arrow]

i dont really see why

like

unless you're specifically comparing references then they're the exact same array

[magic copper]

Are arrays in that language mutable?

[zealous arrow]

yes

Well
It has both
But standard arrays are mutable

immutable arrays are a different type

[magic copper]

So can you put an array in itself and is it ewual to a different array with itself in it(

[zealous arrow]

wdym put an array in itself

[magic copper]

In js

const a = []
a[0] = a

[zealous arrow]

Ordinarily no you could not do that

But let me check with dynamic arrays

one sec my online compiler doesn't have that type yet lemme find a workaround

[magic copper]

Is it because the size is fixed or something else?

[zealous arrow]

arrays have to be a specific type in C#

[magic copper]

OK make an array array

Or pointer array

[knotty sable]

wtf

[zealous arrow]

I tried with an object array but object arrays specifically use reference equals because you're supposed to overwrite it

[zealous arrow]

an array isn't a type
an array that holds a specific type is a type

[magic copper]

OK well arrays are fundamentally different then in the two languages

[knotty sable]

an array is a type

[zealous arrow]

int[] is an int array type but [] is nothing

[magic copper]

So does [2] == [1+1]

[knotty sable]

oh wait this is a semantics argument nbm

haha

[molten carbon]

I thought this was some spaghetti nonsense in the making

[magic copper]

Were desiding if 2 different empty arrayd are different for our mod index

Very important

[zealous arrow]

I'm too lazy to open visual studio to see if an array formatted like that would result in a syntax error or not

[magic copper]

I don't know the formatting mean more the different values if stuff

I just did it that way so they were obviously different arrays

[zealous arrow]

I think it depends
though C# has really cleaned up their act lately

it used to be a lot worse in regards to that

[solar ginkgo]

No I agree with Corobo this ain't intuitive at all

[magic copper]

They are different objects

[zealous arrow]

then use a reference equality

[knotty sable]

comes down to how the eq operator is implemented for arrays

because if you just compare refs then no, they're not equal

but I feel like nowadays array comparisions are based on contents, no?

[solar ginkgo]

this is js all over again with ===

[zealous arrow]

This is about complaining about js

but C# typically uses a.ReferenceEquals(b) and a.SequenceEqual(b)

[magic copper]

So it should recursivly compare any 2 given objects when compading them

[solar ginkgo]

hey that's crazy, that's exactly what python does

>>> a = []
>>> a.append(a)
>>> b = []
>>> b.append(b)
>>> a == b
Traceback (most recent call last):
  File "<pyshell#6>", line 1, in <module>
    a == b
RecursionError: maximum recursion depth exceeded in comparison

[magic copper]

Didn't know that

[zealous arrow]

it should compare their value :<
At least compare their hashcode

[magic copper]

And what is their value?

""

[zealous arrow]

See python implementation

[magic copper]

does opython let you compare by reference?

[zealous arrow]

yes

a is b

or
not (a is b)

[knotty sable]

now compare two minecraft scoreboards

[magic copper]

intresting

[zealous arrow]

C# is more explicit which one is which but I respect python's for being clean and easy to use

[solar ginkgo]

you can use is not iirc

[zealous arrow]

yea i wrote that initially but i wasnt sure if it worked or not

its been a while

You know, back in my day, when we all wrote in assembly, we didn't have this problem

[opal kraken]

what day

[molten carbon]

Back in my day when we were writing in 🅱️ this wasn't an issue

[zealous arrow]

1960

[opal kraken]

oh I'm sorry I didn't respect my elders

[solar ginkgo]

I don't respect my elders if I've seen them meow in #⚙・modding-general

[zealous arrow]

I still have one of my CS textbooks that teaches you how to use a punched card computer

[zealous arrow]

meowwww :333

[opal kraken]

cats age more quickly

[molten carbon]

Wait you ARE ancient?!

I thought that was a joke

[solar ginkgo]

true, must've been very old in cat years

[zealous arrow]

lemme find the textbook

it's buried underneath the 50 pounds of analysis textbooks

Apparently that was my economics book
I mean it's still old it's from the 80s

[radiant anchor]

What is going on in this thread? I seen some js quirks discussions

[solar ginkgo]

you know how modding chat gets a bit off-topic sometimes

unless you're asking what this thread was supposed to be about

[zealous arrow]

We should all collectively switch to ASP.NET and Luanet 🙏

Trust

[static field]

watch me write my mods in F# and fennel (i seriously considered using fennel instead of lua to mod balatro and wrote a portion of typist in it)

[zealous arrow]

Ngl im genuinely considering modding my next mod in luanet

Tho ive wanted to learn F# too

Ive been procrastinating on learning it for like 2 years

[static field]

sometimes learning a language is boring, but interactive exercises make it better

i did these exercises to pick up the language, but my info of purely functional constructs (monads and stuff) came from previous experience with haskell

[zealous arrow]

I dont think learning new languages is generally too bad

For most languages I've found you're generally fine just guessing and looking up something if you really need it

Well
Get a general gist of how high-level/low-level it is first

[static field]

yeah, i think u need to learn one language from each family
i took C & matlab in college then started writing python, go, lua, java & rust
learned haskell and wrote F# (ML-like languages based on hindley milner type inference)
learned clojure and wrote fennel

[zealous arrow]

Yea

[static field]

css is a beast of its own tho

[zealous arrow]

I started with MIPS and C# and then moved onto C
Technically I also learned Java, JS, and Lua but I've only ever looked at documentation for those like single digit times at most; I've been running off vibes
I did also learn R and Python tho

Learned and forgot haskell

[static field]

mips as in the assembly for mips cpus?

[zealous arrow]

yea

I really wanted to mod Paper Mario 64 back in the day

and that was kinda the only option at the time

I think it's decomped into C now

[static field]

yeah https://papermar.io

[zealous arrow]

I didn't make anything really even decent back then when I was modding but that was more because I was a child and I was just like "I want to see super hard mod where goomba has 5X the HP and breathes fire and attacks like six times" as opposed to the difficulty of the language

Eventually moved onto C# when Unity 5.0 came out
Was awesome

[static field]

i never gave .net an honest try because microsoft don't take linux support seriously

[zealous arrow]

Fair

[static field]

and also the toolchain spies on you even with telemetry disabled

(sends system info with each request to nuget or similar tools)

[zealous arrow]

I think I tried Java after using C# for a couple years because I wanted to mod Minecraft
Tho I was still a child so I still had the "I want to see super broken mod where sword deals 10 million damage and explodes and gives me a million diamonds" mentality
Ended up dropping it because I got way too used to what Unity C# gave me that I couldn't handle Java

Everything else was kinda a blur; I mainly used MIPS, C, and C# from then onward

[zealous arrow]

Does it still? I haven't really paid much attention to it in recent versions

[static field]

my last attempt was a year ago, invocation of dotnet were failing because my os name was NixOS Vicuña and it was failing to concat that into an ASCII string for request headers

even tho request headers can be utf8

and even tho i had all disablable telemetry disabled

https://github.com/NixOS/nixpkgs/issues/315574
it was an unstable nixos release which they eventually renamed to "Vicuna" to avoid the dotnet toolchain bugs

(i get my nixos from master)

also not very high quality software when you're not sanitizing user data that users don't even know they're submitting

[zealous arrow]

fair

[static field]

i haven't written anything based on this yet because i didn't exactly know what to write, but i think this is best made into a lambda that takes a mod submission request and creates the PR
so it's a backend thing with access to a github token, and gets requests from any frontend
and i think lambda is suitable since we get 1 submission per day so we'd pay for like 5 minutes of compute a month

so this probably implies a javascript (or friends) implementation since it's the one ecosystem actually convenient to use with lambda

[zealous arrow]

Just figured I'd grab some feedback because I'm not actually sure about details but like

Is this fine for version notation
It's just set notation but it makes the most sense to me
I had to design it to work with subdependencies/subconflicts so I just ended up making it like this, I'm not sure if it's understandable or not
(It will look a lot more fleshed out if these dependencies/conflicts are actually added to the index because it'll do it recursively and make more sense as to why I did it this way)

[candid thicket]

I feel like using equality symbols makes more sense
e.g. Lovely - versions: >= 0.6.0

[zealous arrow]

I was going to do that originally but then I had to think of like

what if one of the subdependencies requires lovely to be less than 0.7.0 or something

It feels really weird putting them side by side

as opposed to doing [0.6.0, 0.7.0)

[opal kraken]

while I understand it I do agree it will confuse the average user

[candid thicket]

Does using the word 'and' help?
Like >= 0.6.0 and < 0.7.0

[zealous arrow]

i guess a bit

im a very math brained individual so it sticks out to me

[candid thicket]

I think that format is also hard to write if there's like 2 or more range of version

[zealous arrow]

wdym

[candid thicket]

2 < x < 3 or 4 < x < 5

[zealous arrow]

I mean it's a brand new datatype invented for it
In a case like that it tells the user that there's a conflict and recommends the highest version out of that list

[opal kraken]

[2, 3) U (4, 5]
:3

[zealous arrow]

:3

[zealous arrow]

erm it's a strict inequality so it should be round brackets

[candid thicket]

Ah right, there's also a symbol for or in math I forgot

[zealous arrow]

I essentially just made a datatype that treats version ranges like sets
And then if you have two dependencies that have the same subdependency but different versions, it just takes the mathematical intersection of those two ranges

so in a case like 2.0.0 < x < 3.0.0 and 4.0.0 < x < 5.0.0, the intersection would be empty and it would say "There's no consistent version among all the subdependencies, maybe try 5.0.0 and see how that works out"

[thorn herald]

How did I not know about this thread I'm part of the project 😭

[zealous arrow]

I mean this isnt specifically for Photon this is just potential mod managers in general

(On that note if anyone does want to assist then I'm down, I think I'm burnt out for the summer)

[cerulean pendant]

messaging here to keep the thread from not showing up

[torpid flume]

i think the first order of business is to think of a good name

[opal kraken]

JokerGorge

[torpid flume]

VanillaGremade

[boreal hornet]

I'm curious, as I'm both forgetful and not up to date, but where there any serious attempts at setting anything up, already? Or insights into what would be helpful for people wanting to make those steps?

[torpid flume]

i dont think so, nobody has done anything but theorise so far lmao

[open swift]

i like the names jokerful or jokerbox to be honest

[opal kraken]

i dont like the idea of naming it something joker related tbh, there are a ton of non-joker mods

[open swift]

still it evokes Balatroness

[torpid flume]

what about

balamod

[opal kraken]

what about steamodded (steam + modded)

[thorn herald]

i dont know whats been discussed here so im going to say everything i know about the project

corobo wrote code for updating mods as well as creating their own mod index
i will be implementing the update code and create an Index class

this class will represent things like the Balatro mod index (or Corobo's index Photon) and have methods for things like fetching mod info, files, etc

i will mostly be working on the frontend

with help from aiko and itll be reviewed by eremel too

and some of the behind the scenes stuff for now

this has all been discussed with breezebuilder from the balatro mod index team who has agreed to alter the index to add any features we need

someone has also made a more streamlined API for interacting with the index

i think thats basically everything?

i havent made much progress due to procrastination and lack of urgency

anyway so far through all of the discussion of this here and in the steamodded server noone has mentioned any previous attempts

and i see people coming up with names for this

so to clear this up

this is going to be an SMODS feature

mod management is going to be prioritised (updating and uninstalling from within balatro for example)

then an ingame mod browser

tl;dr

this is going to be an SMODS update with mod management, mod browser, and support for modders to add support for other mod indexes/sources
with me, corobo, aiko, breezebuilder and eremel involved

and another guy who made a cool API but i forgot their name cos its been so long since that discussion

[sharp parcel]

I thought we decided that it was going to be external from smods

[thorn herald]

we did?

when did this happen

because at least part of this was supposed to be integrated into SMODS

[zealous arrow]

Photon, no
Mod managers in general, probably yes but depends on implementation

The two possible avenues I could see for "yes" would be either essentially just patching it into smods or further cluttering the homepage, neither of which seems especially great

The argument I heard for making it external boiled down to it being a matter of it being a bit iffy if SMODS itself should extend that far

Though personally, it doesn't seem too far out of scope when you consider it is already a manager for local mods on file; this would just be adding the functionality of being a manager for mods on the server and adding further support (like auto-update support) for local mods

[torpid flume]

that will be so hype

[thorn herald]

Isn't this inverted? Unless I'm misunderstanding what external means

[sharp parcel]

I thought the general decision was that there’d be an installer that installs an in game mode manager that would then install smods from there, but I could be mistaken

[zealous arrow]

I think that was a different thing

[thorn herald]

^^^^

i dont think that was planned to be part of this project

[opal kraken]

I think that's what was discussed ealier in the thread

[thorn herald]

ah

i wasnt here for that

#1335002372933423144 message

this was the original plan that corobo and i came up with and put on the smods server
which is what ive been talking about in this thread

[sharp parcel]

yes and then as a community we had a big chat and changed the plan, no?

[thorn herald]

i dont remember this 😭

if i was part of that then i didnt intentionally/knowingly agree to that probably

although

i just reread your message

"as a community" im blind and keep convincing myself i can multitask

alright

[zealous arrow]

This wasn't for Photon tho
Like we were designing a much larger mod manager as a community that had a lot more capability, promise, and scope than what Photon is doing

I don't think there was ever any consensus on it one way or the other for the bigger mod manager tho

Photon's been in development far before this thread was a thing

If Photon was as large in scope as the collective mod manager then it would probably require some restructuring and might be too bulky individually to package with smods
Photon is more lightweight so it's a lot more feasible to package

[thorn herald]

i think i might need to be brought up to speed on everything 😭

[sharp parcel]

So what's the scope of photon?

[zealous arrow]

It still has the "downloading mods" aspect but it doesn't have any of the stuff we were otherwise thinking of implementing for the bigger manager like thunderstore support and extensive security verification and whatnot
Like it's a lot more barebones
The way I was hoping to implement it is as a modular mod manager more than anything else
So each mod hosting platform handles its own security and Photon just goes from there

[thorn herald]

just to be sure before i get too deep into it

the consensus is that the ingame mod manager and browser will NOT be part of SMODS and will instead be a standalone mod

[magic copper]

I thought it would be in smods but I haven't been too active in the recent stuff

But if it's sepsrtr it can be added in pretty simply

But having smods loader would be helpful

Also for integration

[thorn herald]

I agree that it would be better integrated

Apparently people want it external

I haven't backread enough to verify this but I'm going to trust that

I'm not going to work on it until I can get a definite answer on this

If one hasn't been done already can I do a poll

[magic copper]

The way I see it an in game option doesn't make sense if it's not smods because smods does half of what a mod manager does already

I think a poll isn't very useful as whoever implements it will do what they think is best

[thorn herald]

It's more like

I want to implement it into SMODS

There could be drawbacks cos of having to get all that info

And from what I understand it's not smth that everyone wants

And I'm guessing if that's the case then it doesn't matter how it gets implemented if people don't want it implemented

I might be wrong

[magic copper]

What do you mean by this?

[thorn herald]

One of the longer term plans was having an ingame mod browser

I don't know how that affects performance as that's not really my area

I'm also not sure what people's issues with this feature might be

I joined this thread way too late

[magic copper]

Well if it's not active it should effect performance

[thorn herald]

Wdym?

[magic copper]

A mod browser doesn't impact performance during gameplay because it's not going anything

[thorn herald]

I'm not too knowledgeable about this area

I'm primarily working on frontend

[magic copper]

It only has an impact when it'd being used

[thorn herald]

Yeah

Regardless

I need some form of confirmation about how to proceed

Probably from someone on the SMODS team

[magic copper]

I think the more important part about deciding here is how the mod index api looks like

[thorn herald]

It probably wouldn't be that much work to separate it out if they/the community decide they want it as a standalone thing but still, itd be easier to be sure now

[magic copper]

Different implementations of client and server can all be made but the api is really the most important

[viral hound]

What is this

[thorn herald]

Mhm
I haven't worked out the specifics but I believe that a given index should be represented as a class like Index
Which has a set of methods for things like fetching the entire list, getting specific parts of info for each mod, getting assets like thumbnails
As well as getting like the files for updating/installation purposes
And the person implementing a given index has to write the methods

Sorry if I'm not explaining this well 😭

[thorn herald]

There are plans to make an ingame mod browser, updater and manager
This thread is about deciding how that should work and what should be integrated into SMODS

[viral hound]

Oh

Ingame browser as a mod?

Or…

[magic copper]

That's part of the discussion

[thorn herald]

im up to speed with everything now

from what i understand there are two projects here
the original one with me, corobo, etc
and a larger more ambitious one
if noone has any objections, we're going to continue on ours including integrating it into SMODS
and that can be used as the foundation for a larger mod manager later down the line

[sharp parcel]

is there a reason that it can't just be the larger mod manager from the start?

[thorn herald]

i mean maybe it can

i dont know the exact features that would have that this doesnt have planned currently

that was a clumsy sentence mb

point is yeah that would probably work, but i plan to be more involved in the stuff we planned originally

[sharp parcel]

I think it would be more backend stuff really, like where mods are going to be uploaded/downloaded from, and then how dependency stuff is resolved properly

but I would have thought those would need to be considerations in yours anyway

[thorn herald]

mhm

this is going to be made with the main index and Photon in mind

when a mod is installed, itll recursively get all dependencies (this isnt really my area tho)

corobo is more involved in backend

[sharp parcel]

the index is a key point though, I wouldn't want to integrate something that uses a different index to the final version

[thorn herald]

ideally itll be made in a way that allows indexes to be added easily

so if say we only want to include one index out the box, its easy to separate out the other one into a standalone mod/addon

[sharp parcel]

I'd be against multiple indexes, ideally we'd have one central index that everyone can put there stuff into

building support for multiple indexes seems mega jnak considering you have no control over how they're formatted or what they contain

[thorn herald]

I agree

I do also think though that it's worth doing it as like

A class with a fixed set of procedures

Or methods

Wtv the terminology

So it basically HAS to get everything in the correct format

Also it's unlikely multiple indexes would be included out of the box, it's more about enabling add-ons for those who want it

I'm p sure Photon was created with this project in mind, as loading mods with that is theoretically more efficient than with the current main index

[zealous arrow]

The way I'm picturing it in my mind is it's like a Chromium scenario
Like
You can use Chromium on your own and it'll work fine, but you can always install Chrome or Edge or Opera or whatnot and it'll build on top of Chromium to provide its own framework with higher functionality/security/stability/whatnot
In pretty much every aspect, a Chromium-based browser will be better than Chromium
So not so much as two competing standards as much as Photon can be a stepping stone for making more sophisticated mod managers

Like Brave is completely different in pretty much every way when it comes to UX and yet it’s still made with Chromium

[static field]

brave is just a chromium browser like every other chromium browser

[zealous arrow]

yea thats what i mean

its so much different from like edge or chrome and yet it still uses chromium
Like even if our things are fundamentally different the intent is to be customizable

[viral hound]

Gonna be real, i’m probably gonna continue to use regular smods

[thorn herald]

wdym?
like the goal is for most of this to be integrated into regular smods

[viral hound]

oh

I haven't been following

[thorn herald]

fair

[zealous arrow]

I found it
I didnt see the stack it was under

[thorn herald]

some quick updates about whats going on with this

over the next week i want to finish up a PR to add the following things

• individual mod management menu with info about dependencies/dependents, conflicts, etc, and some buttons for managing mods (uninstall, disable, eventually update + open repo/mod webpage)
• more features for managing mods (eg pinning mods to front of list, disable/enable all, lock button on mods to make them be excluded from disable/enable all)

after that, i think it was agreed that thunderstore is going to be used for storing mods

security being one of the main reasons

so updating using thunderstore as the source will be added in this update or shortly after

[viral hound]

I will quit modding if we use thunderstore.

I’m not even joking

[opal kraken]

why

[viral hound]

Thunderstore is a POS software

I even told methurel that I don’t want any of my content on Thunderstore when we had this discussion

[thorn herald]

then dont put it on there?

noones forcing you to put it there

and therell be support to add other sources

[opal kraken]

why is that

[viral hound]

There were many accusations of malware in Thunderstore

So yeah, if Thunderstore becomes the main way to get mods, I probably will take my leave

Oh and by the way. Back when Balatro modding started, we had a similar discussion about thunderstore being the main thing and everyone was against using it for the same reason

[opal kraken]

I'm sure I would have heard more about it if it were true
Also even then any other solution would be just as likely to have users upload malware, it's better to have a company that specializes on that do the job

I would prefer using Thunderstore and worrying about alternatives later than not having anything

[viral hound]

I’ve had personal experiences with them fucking up my PC, I’m never using them

[opal kraken]

Ok, that sounds more fair

[thorn herald]

i understand that

its not going to be made in a way that doesnt force you to use it

[viral hound]

I see.

I’m staying 100% Github if TS is optional

[knotty sable]

Please give me additional information about this so I can either forward it to the team or take relevant packages down. We don't host malware, nor would I put my professional weight behind a project that does host malware. Full stop.

[boreal hornet]

I don't think it'd be possible for there to be a way that forces people to not use GitHub to distribute, anyway

[viral hound]

It was years ago, I downloaded a minecraft modpack through overwolf, (a company that is with Thunderstore) and it was a trusted and popular modpack too, and next thing i knew, it put malware on my computer.

[knotty sable]

TSMM is distributed by Overwolf, but it in itself is just r2modman. We don't host Minecraft mods, nor does Overwolf own us.

You downloaded Minecraft mods from Curseforge and you're using that to imply that we, Thunderstore, redistribute malware.

Completely different entities with nothing to do with each other.

[viral hound]

People told me it was thunderstore

[knotty sable]

They were wrong.

[viral hound]

Shocker… Someone wrong on the internet

[knotty sable]

Yes, it seems so.

I can forward questions you have to our dedicated security guy. We do take it seriously.

[viral hound]

It’s okay

[knotty sable]

You should've told me the details earlier. This has been a sticking point for a while between you and I.

And I'm glad that I know the full story now.

[viral hound]

I always considered you the exception though.

I still probably will stay with github stuff since I’m used to it

[knotty sable]

Yeah that's totally fine, I don't think anyones wants to force you away from it. I prefer Github myself haha

[boreal hornet]

I looked into it when the topic came up when this thread was first made, just because while I trust meth, I don't wanna just take people at their word for this kinda stuff and not check, but I never came across any reports of issues with malware. Complaints I found were largely about ads, which wouldn't be relevant in this case

[knotty sable]

Yeah I think most important to the present discussion are the site and desktop app's ads. The solution to the former is an ad blocker, the latter is to use r2modman.

[viral hound]

My guess now is that it Could’ve been something that the modder replaced the mod with hidden malware after upload and the misinformed people blamed the overarching thing

[knotty sable]

We've had a couple instances where people have taken mods uploaded to TS, added malware, and then submitted them to non-TS sites.

[viral hound]

And considering it’s been years ago, the mod’s probably gone too

[knotty sable]

There was a bit of a scandal a while back where Curse distributed malware. Maybe it was that?

[viral hound]

Maybe

[thorn herald]

if this is settled then im going to bump my stuff from earlier

[thorn herald]

_ _

[torpid flume]

if u dont like r2modman theres always gale

[thorn herald]

I'm not sure if you read enough of the conversation 😭
The problem is thunderstore, which both pieces of software use
And anyway they resolved the issue I'm p sure

[torpid flume]

yeah i didnt read too much haha

i thought they had an issue with the mod manager itself my bad lol