Vaporware DRM - A solution in a technique

[Jeoshua]

Ownership of Formats and Description of Intent:

Mod theft is a terrible thing. For this reason, I have collected postings describing a technology that can be implemented into any mod which will increase the professionalism of the mod, protect it from mod theft, provide legal standing with which to challenge pirates, and to provide ultimate piece of mind.

 

First of all. I'm sorry. I love you Bethesda, but I really need to say something. I know it's not your fault. You wanted to give us a game that everyone could enjoy and that people on the console could finally enjoy the true depths of. Modding games on console is a revolution and you finally delivered. Unfortunately, your lawyers botched the job. They gave us such an unconscionable document that we needed to agree to, just in order to use your modding platform. I know. The lawyers made you do it. I know, you didn't know that there would be so many problems at launch. I know, you had no idea that since modding on consoles had been possible this whole time, it had attracted a crowd already that didn't care one fig about intellectual property. But many modders are afraid that their content is going to be stolen.

 

This can fix that.

 

Zenimax has made, and indeed can make, no claims on ownership of the PEX format, any more than they can make claims of ownership of the PA32+ format which the engine itself runs on. Files like these are code, running on a particular format, and don't immediately become the sole property of Zenimax unless created within the Creation Kit. Crucially in this case, F4SE mods must have their PEX created by a third party utility, and acted upon by another third party utility. The Script Extender's PA32+ binary format cannot be downloaded through Bethsoft.net, will not work on PS4, and is not allowed to be run on the XBone. And while you have to provide a PEX file for the engine to run, you don't need to provide a PSC file for the user to read. In fact, not providing the PSC file of this technology removes the possibility of anyone else claiming any ownership of your source code, because they never had it. This last fact is the key.

Central Module:
Create a holotape using a terminal script, containing a menu. This menu shall contain, but is not limited to:
- A list of credits of people the modder wants to thank and/or damn.
- A Digital Signature of the modder generated in whichever manner they see fit.

- (Bonus module) A Public key half of a Public/Private key pair to be used with this digital signature, with the public in your original copy of the source code. Do not compile the private half into the code, and keep it separate from the source code entirely. Provides double security as even if they decompile your script, they do not have the rest of this key. Bonus points for using this key to encrypt something.
- (Triple word score module) So named because console versions do not have the code words necessary to run it. Encode any command in an F4SE way, and you make this script only work on PC. Note that this does not require your mod to run F4SE code otherwise, and does not prevent usage on Bethsoft.net for mods which DO work on console.
 

Name the holotape with an item tag of [DRM] before the name of your mod. You want people to see this because it lets the thieves know what they're getting themselves into, but it doesn't require that they even see it.

ex: [DRM] Clean Deluxe

 

And here is the most important bit. You don't need to provide this PEX in your main file. You don't even need to link to it. It literally just needs to be in your download. None of your other scripts need to be altered to use this technology, and it stands alone. Actually providing a working terminal script is required, but needing the user to run it is unnecessary. Non F4SE mods will not suddenly be forced to have the whole main file be reliant on external libraries, and those who need to assure that F4SE is installed for proper compatibility with scripts that DO have F4SE requirements can place the checks for their mods in this module file, which can later be disabled when it is not needed. The files remain in the original download and on the user's install, even if disabled on console. These files remain with the downloader of a Bethesda.net file downloader even if the mod they are taken from is pulled from the Nexus.

 

Keep the source sacred:
By withholding the source code used to create the PEX Fragment script which this holotape will display, you eliminate the possibility of there being anyone else who could have created this file. This provides you with legal standing to prove, beyond the shadow of a doubt, that you are the party who compiled that file. Do not share this file with anyone, excepting possible members of your modding company. Keep your source code off of the internet at all times, and do not share it with anyone for any reason. I'll state it one more time, just for good measure. I'll even bold it. Don't Share The Source. Don't use anyone else's either. The point is that it's supposed to be yours. To make this work, you have to write it. I'm sorry. I want to provide you with a working module, but by its very nature, you have to write this yourself.

 

Other code can have its source shared, if you so wish. Nothing is preventing you from allowing people to view the source code of any other modules. The extent to which you want to have your mod be open source is completely in your hands, since you are the one creating this DRM. Outside of the actual Holotape itself, none of the other script matters to this scheme, and you can either share or withhold that as you deem fit. The same goes with any Blender or 3DSMax object files, Photoshop or GIMP files, Audacity files, or other source that you feel that you should or should not share with the general public. The only thing that matters is the holotape fragment script, and that is your key to all of this, along with the upload dates. More on that, later.

 

Customization:
Further modifications can be made to the DRM Holotape, such as mod settings (if you have them), change logs (please guys), shout outs (or damnations), instructions (definitely), jokes (if you're funny), cheats (if you need to git gud), or anything else that the user wants to put onto this holotape. It can be made a quest item so it cannot be dropped, you can use F4SE commands to ensure that it's PC only, and if you're really inventive you could make it as an ingestible if you can figure out a way to make it entirely in script (but seriously, why aren't more modders using the damned holotapes? I'm sick of eating my settings configurators! Bethesda gave you an integrated way to make menus on the Pip Boy, this time! USE IT!)

Extra Modules:

By implanting a private key of a private/public key pair for all to see in an in game menu, and keeping the public key privately held away from either the source code or the executable, you provide double strength protection against decompilation attacks. If the compiler never sees the private key, it cannot be extracted later on. Software capable of achieving this is easier to get than you think, and much easier to use.

 

By linking one's mod into F4SE, using the debug code to turn something crucial on only if on PC, and not providing source code for that feature, you prevent the mod from being used solely through Bethesda.net. Anyone wanting to steal that mod would have to actually be a modder to understand what had been done and how to remove it. A decade of experience from the Nexus shows that modders can steal other modders work, but that it is highly unlikely and will be the source of much controversy and public outcry against the perpetrator, and rarely damages the reputation of the person who has been the victim.

This is optional, and does not prevent Bethesda.net downloaders from installing your mod while on PC, as they can install the Script Extender like sane people too from its website, they just can't use Bethesda.net to install it for them any more than one used to be able to use the Nexus to do the same. Note that while this may break the menu on console, it will not break any other content, so can still be used to implant the digital signatures on your running mod. This content would not run on console but it would remain present in the files.

 

You can also use the F4SE option to specifically encode your F4SE menu options, so there is your Triple Word Score.

Upload widely:
Armed with a mod that contains data only you could have created, you should upload this file as widely as possible. Your signature within the mod declares it to be yours, and the source in your hand proves it. Even if you do not intend your mod to be used on console, it is recommended to upload it there, as well, and set it to private. This ensures that your signature is distributed widely, and that anyone stealing your mod will not be able to claim that they got there first. Remember, you're not giving out your source, so you're not giving them the keys to your kingdom.

Vaporware DRM:
This technology is merely a technique, and due to its nature no running file or source code can be provided, and only examples given. A template could be created at some point, but the recommendation for proper usage is to create one's own, make it theirs, and never show anyone the exact source code they used to make it. This personal and unique ownership of the source code is both the point of this technology and it's mechanism. Make it your own.

Note:
This does not prevent mods from being stolen by capable modders who understand the technology and its use. A Decade of experience in the Bethesda modding community shows that these people will be dealt with swiftly and harshly upon discovery. It does however prevent anyone from being able to claim your work as their own in a convincing manner, whether that party is a mod thief, a console kiddie, an elite modder, Bethesda, or even Zenimax. No matter what rights you have to sign away to make your mod, this technique will provide legal standing to prove that you are the creator, because you have the key.

Licensing and Copyleft:
I hereby release this technology to the people of the Nexus, to all Bethsoft.net subscribers, to all Lovers, to all scripters, to all console peasants and PC doucebags, and to all modders everywhere, with love, in perpetuity, for ever and ever, Amen. Full rights are given for redistribution and modification of this technology without limitation and without credit, just so long as you're not a douche about it. You know who you are, just drop the bomb and back away.

FAQ:

Q: Will you be making this as a release in some form?
A: No. The very nature of this technique absolutely precludes the possibility of anyone else making it for you. You can use a template of some form, but you must do the scripting and compilation yourself for this to work right.

Q: But I don't know how to script!
A: Learn. The scripting level required to create a basic, working example of this technique is extremely minor. You can learn it within a day, and do it without needing anything more than a text editor and the basic modding tools you already needed to create your mod in the first place.

Q: What if my mod only changes game settings or weapon damage? Will this still work?
A: You haven't changed anything that you can even set claim to. The only thing that you would be claiming is the DRM Holotape, itself. It still proves that you made that mod, but simple changes to the game settings aren't exactly representative of a huge amount of work on your part. You really don't need this technique, that's not your IP anyways.

Q: I hate console kiddies. I want them to die. Will this technique help me achieve that?
A: NO. It will not. You're a monster for asking. Seriously, put down the bomb.

Q: This mod broke my game.
A: No, you broke your game. Do you see the difference?

Q: What if Zenimax tries to say the mod is theirs? I'm afraid my content will be stolen for another Bethsoft game.
A: Then they won't be able to use your scripts, because that would mean they would have to include your name. Load your Holotape with something that you would need to get your mod working. Consider the source. They probably won't try to steal your content anyways, but they might get inspired by your ideas. Nothing will ever protect you from someone flattering you through imitation.

Q: Can't this all just be removed?
A: Yes, and that is why you need to make this yourself, keep the source code sacred, and upload the compiled holotape script to as many places as you can. This technique is all about providing you, the content creator, with legal standing to prove that your claim on being the creator is genuine, unique, and solid.

Q: Should this thread be stickied?
A: I think so, just so long as the comment section doesn't devolve into too much flaming. People aren't going to "like" this, but I hope enough people use it to make it worthwhile. If even one person uses this technique in a mod, I'll be happy.

 

Q: What happens if a really capable modder comes along, and puts his own DRM module on? Does that mean he now has standing?

A: No. You have the earlier file. If you have the source, and it's definitely older, and you can show that you made the mod first, and you have your standing. That said, anyone smart enough to do that would not be crazy enough to think it would work.

 

Q: But why should I add a [DRM] tag? None of the mods which tag your items contain that tag!

A: Not yet, anyway. Plus, this tag notifies any potential thieves of what you've done and why they should reconsider.

 

Q: Couldn't someone just decompile the PEX file and then grab the original key?

A: Yes they can decompile, no that doesn't give the same exact file. This would provide a way to remove your signature, but as long as you've uploaded this mod first, you still have proof that yours is the true claim. This isn't just a Holotape, it's a Holotape, the Source, and the date of upload that are the three key factors that ensure you have the ability to prove that your claim to the mod is the true one.

 

Q: Does this go against the spirit of free exchange of information?

A: The DRM can be as permissive or as restrictive as you want. You can even add an entry to the Holotape that declares what you would and would not like to happen with your mod. You can allow free distribution. You can allow modification. You could even claim that it's completely cool to steal your file and ask for donations from it without giving you any credit, if that's what you want. Anything you want to claim in that, you can. Depending upon what you claim, it may or may not be legally binding, but the entire point of this is to provide you with proof that something foul has occured, and therefore the means to do something about it.

 

Q: Are the bonus modules necessary?

A: No, but their usage is highly encouraged. Both are platform agnostic, can be used effectively on any platform, and in the case of the Public/Private key pair completely impregnable for the purposes of asserting Authorship over a file. You don't even need to share your mod to assert authorship if the private key and your copy of the source are kept safe enough.

 

Q: This isn't FOSS friendly.

A: I just linked you do a GNU product didn't I? What do I have to do, grow a neckbeard? Oh wait. I did.

 

Q: Does this require any external files, mods, or products?

A: No. You do not need to link your files to anything made by Bethesda, Valve, Zenimax, GNU, or ENB. You do not need to link to F4SE binaries unless attempting a PC-only build. You do not need to link any DLCs. If you use an external compiler, you don't even need to link to Fallout4.esm. You just need the DRM PEX file in your download, and to keep the source to it sacred.

 

Q: Does this hurt Bethesda or the Bethesda.net mod community in any way?

A: I sincerely hope not. In fact, it is my sincerest hope that Bethesda.net finds this technology useful in detecting and eliminating piracy and mod theft, and that the moderators of their download site find it useful in identifying and managing their mod collections.

[Ep1cL3w7z]

• Your concept of what is "legal" and not is skewed.

Placing EULAs in your mod will accomplish nothing.

You're using Bethesda's Papyrus compiler even outside of the CK. There are third-party compilers, but chances are you're not using one.

Pex files can be decompiled.

Your suggested [DRM] tag is entirely pointless. It's just an "About this mod" holotape.

Not sharing is incredibly against the spirit of modding.

[Jeoshua]

Is the spirit of modding letting randoms upload anything you create to Bethesda.net and claim it is theirs, and you can't prove that it's yours?

 

The spirit of modding is that people have things they want to create, that they want to share, and sometimes they don't want people taking it, claiming that it's really theirs, and asking for donations. This might sound odd to you, but these things are happening. Loverslab mods generally don't have to worry about this, because adult files are already banned there, but many modders here don't make just adult files, and some of them are making stuff for Bethsoft.net.

 

The theft is real, it's happening, and this technique has the potential to stop it dead in its tracks.

 

This technique doesn't prohibit you from making your source for other parts of the mod available for use in whatever manner that you see fit. The license to this technology is freeware under the Don't-Be-A-Douche License, meaning you can modify it because you created it yourself, and it can be as restrictive or as permissive as you wish. Someone else might make a version of it that goes against your defintion of the spirit of modding, but you are fully in control of how it works at all times. Literally the only thing needed is the e-signature, and you have proof that you made the mod. Everything else is up to the person using the technology.

 

Remember, this is not just the Holotape! It is also the source. Even if decompiled, you have the source code that originally made the file that was originally uploaded. Dates on upload sites cannot be changed like they can on locally, and you having the source and the file that source code makes already having been uploaded proves that it's your mod.

 

As far as decompillation, that is a concern that other people have voiced, and that is why I tried as best I could to cover this. Yes, they can decompile it. No, that doesn't change anything. You still uploaded it first, that means that if someone is stealing your work, you can prove that. What you do from that point is up to you. You can even let them do it, if that's your prerogative. You can help them, if you want. Or, if you are concerned that this might damage your reputation in some way, you can make moves to have your work taken down in whatever manner you see fit, with the full legal backing to do it.

 

If this kind of stuff is against the spirit of free exchange of information, then so is GNU. They make demands on what you can and cannot do with a file way more restrictive than anything this technique recommends, and they're lauded as the saviors of the FOSS community.

[darkconsole]

"keep all source code"

 

no thanks. a good reason why i even bother releasing my mods is so that other people can learn about the clusterfucks i had to go through to get to the working product, and therefore spare them that pain in the future.  else i would just keep the entire mod for myself.

 

and without other peoples source, i never would have done anything, because the documentation is poor (skyrim creation kit wiki) or non existant (fallout 4 creation kit (i made the first several pages myself...)). "how did joe blow do a simliar thing im trying to do? oh i cant see and im not famous enough for him to reply? fuck it ill just go back to playing world of warcraft."

 

i ain't in it to become internet famous. don't want to whore the top files slot with my EndUnrelatedNexusCircleJerkRant(); and lord over the realm with me being the only one who can push for change. plus if i get ran over by a bus tomorrow since i dont have children i'd like something of me to live on.

[Jeoshua]

Then release your source code. Put a clause somewhere in your readme or your holotape that says whatever you need it to say in order to make people know that you're not some guy trying to keep your goodies for yourself. Give them instructions on how and what to do if they want to use your code. The sky is the limit, and this system does not limit your freedom, and does not require that you limit the freedom of others. The only thing it does is provide evidence, should you need it, to prevent your mod from being stolen on Bethsoft.net and you not being able to do anything about it.

 

If you're cool with people downloading your mod, claiming it's theirs, and asking for donations, then by all means, don't use this. Or DO! Do use it and place a clause in it that says you're cool with it. It truly is up to the mod author.

 

But you make a good point. I did not mean all source code of the mod. I meant all source code of the DRM module. I will amend the original post to reflect that.

[darkconsole]

https://opensource.org/licenses/BSD-3-Clause is what i use personally. no point inventing complex strategy in a community based on sharing. plus your entire first paragraph was a scare tactic of holding on to the source.

plus, bethesda just posted this.

 

Additional Security for Mod Uploads to Bethesda.net

 

Creation Kit users will be required to own Fallout 4 to upload mods to Bethesda.net via a Steam-linked Bethesda.net account. Steam-linked Bethesda.net account will not be required to download or use the Creation Kit itself, only to upload to Bethesda.net. Users found to be breaking our Terms of Service or Code of Conduct will investigated by our Moderation team and may have their Bethesda.net accounts banned.

 

https://bethesda.net/#en/devnotes/fallout-4-mods-summer-roadmap

 

so at least now jackwagons will have consequences to their actions. i wish they would go farther to be able to get the entire steam account locked so they lose their licences.

[Jeoshua]

Yes, Bethesda is not going to lie down and just let their mod platform be taken over by houligans and ne'er-do-wells. This technique only strengthens any actions that Bethesda or Zenimax or even the modders have already taken. It provides a handle on which to hang all those legal claims, and never in the process does it limit anyone's pre-existing freedoms if that is what the implementer of the technique wishes to happen.

 

There is a secondary aim here, too. Why do people still use ingestible configurators? The scripting is so powerful a technique that not only can you make a menu entirely working within the Pip-Boy, integrated, immersive; you can also make a DRM system out of it, if you understand the concept of keeping back just that one thing and only releasing a binary blob of it which can't be decompiled back into the original code, just something that works the same.

 

And look. I know the word DRM is scary, but I'm not clamping it onto your files. You make it yourself, you decide how restrictive or permissive you want it to be, and as long as you're not actually claiming some right that you've already been denied, or something outright zany like someone's first born, it will stick.

 

Also, read the FAQ. I'm aware that there are external compilers, and there is the Creation Kit, and it really doesn't matter which one you use. The Signature and the Upload date are the only really important bits. Everything else is up to you.

[DoctaSax]

Frankly, I think there's too much paranoia driving the mod theft issue, which'll sort itself out without people bloating up their actual mods with eulas and other legalese.

[Jeoshua]

If you're not worried, then awesome. You don't have to worry about it anyhow. I've used (and like) your mods. They're not welcome on Bethsoft.net anyways, and not just because they use the Script Extender

[DoctaSax]

If you're not worried, then awesome. You don't have to worry about it anyhow. I've used (and like) your mods. They're not welcome on Bethsoft.net anyways, and not just because they use the Script Extender

 

I know, I know.

Still, even if some were, my first thought wouldn't be to demarbleize or plan on boobytrapping my mods or some of the other stuff I've seen talked about. I take a dim view of all that, runs counter to my modding ethics.

 

[Jeoshua]

Yeah. I wish I didn't think this was necessary to show to people, but this is quite honestly the most permissive, effective, and logical thing on the subject I have seen thus far, and I'm not just tooting my own horn, because I had some help with this (they choose to remain nameless so I can take all the blame if this becomes big). I've seen some horrible things being talked about on Nexus. Literal cyber-terrorism has been advocated by some of the real crazies, and people are starting to gravitate towards that. I'm trying to provide a better option that doesn't weaponize mods.

[Ernest Lemmingway]

You can never be too paranoid, Doc. 

[quin666]

You can never be too paranoid, Doc. 

 Well said.

[darkconsole]

thats fine that you're fine with our opinions, but with how blunt the original post is about the source and stuff, i cant help but think of how we would have 0 community if everyone followed your plan to the letter. it was the source that made everything work.

[Jeoshua]

thats fine that you're find with our opinions, but with how blunt the original post is about the source and stuff, i cant help but think of how we would have 0 community if everyone followed your plan to the letter. it was the source that made everything work.

 

Why would anyone, as a mod user rather than a creator, care deeply that the creator of the mod put their signature on it? If that were the case, where would art be? Comic strips? Does the signature there offend deeply? Or is it there to say "I was here, I am the artist, and I made this"?

 

And please. Read the FAQ. You're in control of how much of the rest of the source you want to share. Share all of it, even. Just don't share your signature file. Hell, even GNU Linux distributions have a public key/private key split. This is the same concept, in a nutshell. Hell... you could even use a public/private key setup as your signature.

 

Hmm...

 

Thanks for challenging this. I think you just made it perfect.

[Jeoshua]

Encoded two optional modules. Both are platform agnostic, one is decompilation safe.

[Jeoshua]

And both of the modules are still relevant after the Steam linked accounts thing. This technique doesn't even require usage on Bethsoft.net, Nexus, or Loverslab. It works if you just share it with your friends, and it works if you post it on your own website. This is the only technique that has thus far been discussed that works on all platforms, regardless of intent, usage of F4SE, is 100% decompilation safe when using the Bonus module, and is completely free for you to use. Nobody is holding this source code back from you, this time.

[Jeoshua]

Vaporware DRM is in no way related in any official capacity to ShoddyCast, Andy from ShoddyCast, or any other Youtue personalities.

 

Posts on this forum are provided for all to see. Reposting is allowed under the Don't-Be-A-Douche license, which I can't enforce anyways. So be one if you want. That's fine, too.

[Jeoshua]

And just so you guys know, this is a living document. I have edited it many times over, and continue to do so. I think its probably on version 10 or something by now.