I would like to ask reviewers for extensions platform to be a bit stricter on which tags they allow extensions to use.
Currently there are extensions that clearly do not belong to all the categories they specified which makes filtering by tags useless.
2 Likes
Small announcement:
We did a last minute change on the manifest schema in regards to the permissions.
# Old schema:
permissions = ['files', 'network']
# New schema:
[permissions]
files = "Reason why it requires files access"
network = "Reason why it requires internet/network access"
The latest schema is already what you see on the documentation:
1 Like
I would like to ask reviewers for extensions platform to be a bit stricter on which tags they allow extensions to use.
Could you please share specific examples? Either here or directly at #extensions-moderators.
1 Like
Why did you disable the repository? What were you trying to acchieve?
Depending on the reason I think having a dedicated Add-ons tab for the installed add-ons would help you. Which is something (time permitting) we are planning to do (or at least to try it).
They are back 
You can filter based on tags now
Maybe not developed, but still all sitting in the clear with the rest of the Blender code and likely looked at or at least reviewed when any changes are made.
O I have no doubt, Iāve worked in education and community environments and frankly, people do some really stupid things.
But, everything you have said isnāt going to change, just that now extension platform(s) are added to it. Thereās even the potential to make it worse. Let say Rigify is left out of the base download. Now you get a whole mass of people that are just as likely do a general āgoogleā search for Rigify in order to get it back.
At which point, the hope is that they first find and hit the official extension platform, but what if they instead find all those random Gumroad pages or github or some other website that some hacker/scammer has setup to try and capture all those people now looking to get Rigify back.
Still, none of this is new, itās just the way the world/Internet is now and basically unavoidable unless you just donāt use the Internet.
1 Like
Although now if you want to see just one category you have to turn off all the other ones. In my opinion, either gets implemented isolating tags (ctrl/alt + click) or along with the filter tags we get a drop-down menu for selecting a specific category or all, like before.
Some questions were asked by @JanErik that needs answers as well as FALSE ASSUMPTIONS that needs corrections.
"In fact, many pre-installed add-ons have not been updated for years, which could theoretically even lead to more security problems. "
FALSE! - the existing python add-ons supplied by blender arenāt time bombs, they are not gonna magically change the way they act, they will work same same way till the end of time or maybe a function will become deprecated or blenderās internal handling will change resulting in it not working but it wonāt become unsafe suddenly.
Unless python 3.12+ will decide to change dictionaries or what not to require online connection, a dictionary will always act the same way it wonāt change all of a sudden.
What do you expect? Itās just another way to install the same code. There is no āsecurity reviewā for a manual download either. And what should Blender do? Check every change in every extension for possible misuse?
FALSE - I do , as proof : i once downloaded an āanimation layerā python add-on and before testing it, i reviewed the source code and found out there is a self update functionality there and i got rid of it manually.
What do you expect? Itās just another way to install the same code.
FALSE - When i download a new version of blender, i can use monitoring system to see what files it opens , what registries are read, if any online connection is made, and a follow up to read / write operations to files, I can also try it sandboxed.
I will NOT try blender sandboxed in production and i will not be able to test things if i get them in a form of rolling-release or auto-update, the idea of my tests is to check if everything works BEFORE i run blender in a closed environment, this online method prevents me of doing so.
How is online functionality merely existing preventing you from doing that? You can still go to the extensions download any addon manually and inspect the code before using āInstall from diskā to install it.
1 Like
I do not know how the system works yet, i am waiting for things to finalize, this is a discussion in theory of the potential of possible threats (Yes sir, i have read the drafts).
You donāt know how it works, but youāre already certain itās preventing you from doing things? Thatās ā¦a littleā¦ odd?
6 Likes
I did ask for a little bit of leeway and not pushing this to the next version but wait for things to finalize first and then check; but my request was denied.
Edit : the context we are discussing here is updating through blender and not manually.
But yes for manual download, we can still review the way python scripts work.
*Also : Note, that downloading directly via blenderās add-on manager updater does not invalidate any of the points i made above (But it does render some of my points moot if downloaded and installed manually).
But, everything you have said isnāt going to change, just that now extension platform(s) are added to it. Thereās even the potential to make it worse. Let say Rigify is left out of the base download. Now you get a whole mass of people that are just as likely do a general āgoogleā search for Rigify in order to get it back.
The rabbit hole goes deeper than that, heard of the gimp phishing incident with google?
Letās put it out there anyway to educate others.
Some dude unrelated to the gimp project managed to buy ads on behalf of gimp on google and when you searched for gimp on google; you got his phising website first.
(Btw , from what i heard, people can still pull that even to-date)
Keywords to search on youtube : GIMP Users Targetted By Malicious Google Ads
*No folks, its not derailing, its actually addresses a valid point that was made here. .
Not to be confused with āThe Gimp Fishing Incidentā, which you probably shouldnāt google
4 Likes
Happens all the time on Facebook, fake investment ads with real video of locally well known people, with what they are saying altered using AI. Not all that easy to remove as it turns out (Facebook loves the Ad revenue). While everyday people are scammed for millions.
But like I said, just the way the world/Internet is now, if itās possible to bend/turn/exploit something, then someone will.
The thing which we can improve is to generate a GPG signature of extensions server-side, so that Blender can verify that nobody does DNS attack to redirect requests to a malicious website. However, this is not not really a new vector of attack, as someone might hijack downloads of Blender itself.
As for the extensions, they do undergo review, so from this perspective their quality is not different from the quality of add-ons which used to be bundled with Blender. And for add-ons which were not bundled, now there is a common place where they can be uploaded and shared, and people can have higher level of trust to them.
The online functionality existed in Blender for a long time, as part of Python. You could do import requests and do all sorts of things. It is very handy for studios to integrate into their pipelines, but surely one might try to abuse it for something else. Not much changed in this regard with the extensions platforms either: the code paths related to the online functionality will not be executed until user allows it in the preferences. Surely it might be more involved now to enable add-ons which used to be shipped with Blender while having online interaction disabled, but I donāt think itās that bad of experience either.
Besides, even if you remove all inline functionality, and someone manages to run custom code on your system, they can just use WinSock, or similar system-wide API directly. So stripping Blender is possible but it has limited affect.
In any case, I am not sure what the concrete proposal here is? As Iāve mentioned GPG could help, but maybe there is anything else?
I would really like to pivot this conversation to something more constructive and actionable.
2 Likes
I am unsure if this is the correct place but I must express how annoying it is that Blender Python CONSTANTLY receives breaking changes and does not really follow PEP-8 either. What else should one follow to write Python Add-Ons/Extensions that will not be affected by these changes?
Iām happy to see how fast BPY is moving forward making changes and optimizations but whatās up with straight up removing properties and methods? Is there really not a way to keep most of these in?
I am probably ignorant as I have not checked the code but just by simply looking at the breaking changes but why could not have for example use_auto_smooth become essentially a NO-OP for 4.2? Was this deprecated before?
For example the recent ārelative imports onlyā change with 4.2, I assume it is related to the new āExtensionsā stuff. (Add-ons - Blender 4.2 Manual)
This breaks MANY add-ons again and goes against PEP-8. (PEP 8 ā Style Guide for Python Code | peps.python.org)
ā¦ meanwhile the unbelievably hacky type annotation abusing syntax for properties is still hereā¦
2 Likes
It should come in a firejailed container running TempleOS.
Seriously though, I canāt think of more than GPG. Itās more or less the extent of what Arch does for the official iso (and Iām pretty sure that, for all the distroās reputation, few Arch users bother verifying it). Itās the sort of thing I was thinking when this discussion started up.
Itās more than most platforms, and unless there is another straightforward option Iām missing, maintaining anything more adds undue burden over and above the already ambitious plan of vetting every add-on.
The issue is that Blender is end user software first, programming API second. That means we donāt to postpone adding or improving end user features just because that breaks the API. While also not wanting to present the user with two different ways to accomplish the same thing, as that results in a confusing user interface.
Itās not really practical to keep those kinds of properties in general. If we change end user functionality then trying to hide this from the API can easily backfire, with things breaking more silently.
Existing legacy add-ons can continue to be installed so in that sense they donāt break, but indeed when making them extension changes are needed.
The PEP8 recommendation is not great for isolating extensions from each other. PEP8 says relative imports are acceptable for complex package layouts, which arguably is the case here with multiple extensions needing to coexist.
5 Likes
security was not the correct word, but unsafe is because in every release there are breaking api changes which could lead to unsafe/unstable addon executions and potentionally crashes. And even python version bumps could lead to this kind of problems. With the new system its easier now to maintain, review and report problems with the buildin addons and functional changes in new blender versions.
I doubt that even a fraction of users do manual addon reviews. And you and this small proportion of users can simply deactivate automatic updates or online features in general and continue to manually review and then install every add-on?
2 Likes
Just to remind again before things go slightly off course
1 Like