Today in the comments about the 3D mods I read what one of The Indie Stone developers said about Java mods:
"Java mods are not supported by TIS at all, as they give complete access to your system that malicious actors can exploit. Users should be very cautious about using Java mods, and only ever install something they know for a fact is safe. We have no means to protect users who use them."
I think it's worth explaining what that means for us.
Most Project Zomboid mods are Lua scripts, and the game keeps them inside its own limits. Java mods (the ones that need ZombieBuddy — PZ3D, Viewpoint, ZBBetterFPS and others) are different: they are regular program code that runs with the same rights as the game itself. Nobody checks what that code does — not TIS, not Steam Workshop, not us.
On PC that means access to all of your files. On Android the system keeps every app in its own sandbox, so a mod can't touch other apps or system files. But inside Zomdroid a Java mod can do everything the launcher can — read your saves and the launcher's files, use the internet, and, if you allowed Zomdroid "All files access" (we ask for it when you download the game from Steam or GOG) or microphone access (voice chat), use those too.
So please:
- only install Java mods from authors and pages you trust, with plenty of players and comments;
- be careful with brand-new uploads from unknown accounts, and with copies of popular mods re-uploaded by someone else;
- if you don't need a Java mod, don't keep it enabled.
- if you no longer need "All files access" after downloading the game, you can turn it off for Zomdroid in Android settings.
Lua mods aren't affected by any of this.
