Post

What surprises me is that a security company finds it "novel" that malicious code can be written with a programming language... And what will they discover next? That malware can steal sensitive information? 🤣

Perfect, and believe me, I understand that, but the same problem occurs with any other game engine, and for that, distribution platforms like Steam, Epic, or GOG already have security measures. If you download it from insecure sources, whose problem is it? The engine's or the platform's? 🤷‍♂️

Yes, those security measures are automated antivirus solutions that apparently fail to flag encoded GDScript. I doubt platforms have anything more than automated scans for user uploaded mods for Godot games.

Isn't that the case with all self-coded executables, e.g. games made in whatever? Frankly, I wonder why aren't all apps are automatically running in an isolated, Docker-like environment by the OS. (I don't know the solution, I'm merely curious.) Still, even that wouldn't help against PEBKAC.

Also, second major issue is that unsafe encrypted code is circumventing anti-virus scans, which would require antivirus software to be able to unpack and scan godot files (low probablility at the moment) or just flag every game as a threat (quite probable solution).

Games - yes. But if you download a game from Steam there's a legal entity behind that that is responsible. But mods? Proper scripting languages have sanitized API's, sandboxing and script validation.

actually this makes me wonder how to include mod support for a game without allowing for malicious mods, since modders can use OS.execute() at any time