There are now a hundred and forty mods on the Cultist Simulator Steam workshop. The numbers exploded since we enabled DLL modding that is to say, we allowed modders to run their own code as part of a mod, changing fundamental game behaviour rather than just adding new narrative content and images. Four of the top five mods are DLL mods. Any time you run someone elses code on your machine, theres a risk. In theory, a modder could include malicious code in a DLL mod. The risk is very low AV programs may notice it, Steam will block malicious modders and the same applies to games anyway theres nothing in principle to stop a game developer from putting malicious functionality in their work. But there was an incident earlier this year where a modder did include malicious code in a Cities: Skylines mod. It was trivial it just interfered with other mods as part of some sort of community drama, it wasnt ransomware or anything. It was spotted within days. And it only affected about fifty people. But it did happen. (A few months later we got an email from a security researcher pointing this out.)
So from the beginning of next year, were making it slightly harder to enable DLL mods. All youll need to do is install a gatekeeper mod, Ghirbi, and all Ghirbi does is show you a notice making you aware of the theoretical risk. This is basically the same as making the user tick a box to say I am OK with this but most people tick most checkboxes without reading the notice, especially when theyre playing games. [You wont need to download or install Ghirbi to use DLL mods until after our next patch, NEMESIA, but you can install him now to save hassle. If you dont use Steam, you can download Ghirbi here.] Honestly I think the risk here isnt traffic-accident low, its hit-by-a-meteorite low. But if someone was hit by a meteorite because theyd installed our game, then even if it was a bizarre accident, wed feel bad about it. So were adding a meteorite warning its impossible to ignore. Happy Christmas.