Fortunately, the entire internet relies on existence of fast, reliable, and secure VMs - specifically, for JavaScript on web pages.

Now, there are plenty of stories where VMs have been exploited to gain arbitrary code execution, so not just any VM will do. This is a lot of work, however, and I wouldn't even fully trust myself with something like this, so this would take a security expert hire to do this right.Ī better approach is to run the code in some sort of a VM. In that case, worst it can do is break something in the game.

Even an executable is reasonably safe, because if you create a separate process with no kernel modules, and only provide your custom API, which is carefully designed to prevent malicious operations, then all the code can do is talk to your API and perform actions in the game. The general approach is to create a sandbox for imported code. Unfortunately, I haven't looked at either Cities Skyline or Truck Simulator mods, so I can't comment on these specifically, but there are safe (to within reasonable definition) ways to distribute code with UGC. A bad actor with burner Steam account and KSP2 key could hit thousands or tens of thousands of machines with malicious software, and that will make it worth it for somebody.

With KSP2 reaching for wider audience and if there will be Workshop support, this all goes out the window. The reason this hasn't flared up yet is because KSP modding community is fairly niche and basically works on reputation. So downloading a stranger's KSP mod is a huge risk. In fact, in a lot of ways even worse, because it's easier to sneak a DLL file past antivirus software, as it might not match any known signatures, and malicious behavior is easier to obfuscate if you can use engine API for parts of it. That can contain absolutely anything and is about as secure as running an executable you downloaded straight off the internet. The problem with KSP mods is that they are distributed with a compiled DLL plugin. scs files, probably acting like archive for everything inside. Plus, at least in truck sim case, mods are just separate. I suppose they don't interfere with game code and just work on top of it.

I wonder how some mods for, let's say, cities skylines or truck simulator work then.

Download item from steam workshop ksp