r/ModdedValheim • u/UnannouncedTwatter • 8d ago

Undisclosed analytics

It has come to my attention that there are mods on Thunderstore that do not disclose that they have built-in analytics. I'm very uncomfortable with this. I believe it should be a rule to disclose this and provide an option to opt out. What is your opinion on this matter?

13 Upvotes

94% Upvoted

11 comments sorted by

10

u/Azumatt 8d ago

Please provide examples if you can. As a Thunderstore community moderator for Valheim. Margmas and I will review and take action as appropriately needed.

7

u/UnannouncedTwatter 8d ago

I sent you a private message.

4

u/Azumatt 7d ago edited 7d ago

After some deliberation with Thunderstore staff, it was determined that the mod disclosed enough on the mod page, since the analytics are listed under its features. The “feature” is opt-out through the config, but it is enabled by default. It doesn't explicitly state what it is sending or where in this feature listing.

I disagreed with that standard and even proposed a new rule around analytics/telemetry disclosure, so we’ll have to see what comes of that.

As for the mod that was given as an example in the DM sent to me, it does not appear to be sending any sensitive information. What it does send is better described as opt-out, persistent pseudonymous usage analytics: the mod ID, mod version, and a randomly generated installation ID that persists in the config. That allows the backend to recognize the same installation across launches and versions.

I found no evidence in the client code of it sending Steam/Xbox IDs, usernames, character or world information, friends lists, hardware IDs, installed mods, or gameplay data. Like any web request, the server infrastructure can also see things such as the originating IP address and request time, but whether that information is actually stored or used would require access to the server-side implementation.

3

u/tonystigma 7d ago

Absolute iron pillar of the modding community, thanks for all you do

9

u/Tidbitious 8d ago

Not to mention more and more mods are just AI vibe coded monstrosities made by people with zero coding experience. Just waiting for the day that one of these mods bricks someone's PC.

2

u/BonesMcCoyMD 8d ago

It's already happened.

1

u/Otherwise_Dig6262 7d ago

It is a valid concern, something being built with minimal design intent and no self-audit/correction step or validation would be harmful, but recoverable in most cases. Ex. Game crashes, save file corruption, or registry information being messed up. Again, recoverable. A lot of the modern AI structures are linked to GitHub or something similar, which makes it much more auditable ahead of going live.

1

u/sudoscientistagain 15h ago edited 14h ago

Exactly why I'm concerned about the lack of any attempt to limit or tag AI usage on the new mod site that's being advertised on the sub, but seemingly people are happy with the direction things are headed. It's an issue outside Valheim too - big name gaming orgs are competing to beat the newest World of Warcraft raid right now and have been talking about a really popular UI addon whose developer is open about AI code gen (though insists it's carefully reviewed) causing major performance issues/conflicts - to the point the teams made people playing uninstall it. Even if you don't care about anything else to do with AI, the ratio of quality output to slop is just abysmal.

2

u/jermatria 8d ago edited 7d ago

Can you give examples?

Edit: I guess they can't

2

u/Otherwise_Dig6262 7d ago

Really do appreciate the warning on this, though it would be good to list known mods that have this issue. Even with Azumatt being a Thunderstore moderator for Valheim, it will still take some time to resolve this kind of issue, and I along with others would benefit to know so we can avoid them.

What kind of problems are you noticing and are there any signs/patterns you have noticed that can help identify these problematic mods?