Preliminaries
Rules, capabilities, the boring stuff you need to read at least once.
IPC Rules and Terms of Service
The IPC is intended to be open, giving users more choice and variety without having to convince anyone other than the people using it of the merits of your creation. With that said, for the purposes of protecting both Snowcloak and the community at large, there's a few - largely common sense-based - restrictions.
The most important of these is to not use the IPC for anything that'll bring Square's hammer down on us. For example, do not use the IPC for plugins that go against the guidelines presented by Square Enix - these guidelines are broadly permissive, and quite reasonable. Syncs exist in a very grey area already per these rules, and the last thing we need is adding plugins that let users access emotes they haven't paid for.
Other than that, two additional rules apply:
- no plugins enabling the sexualisation of minors is permitted for obvious reasons.
- no plugins that send data to another sync service or server is permitted due to GDPR and related data transfer laws.
Barring these three rules, the IPC is open for any use until and unless something egregious happens that needs intervention.
On the admin side, the ability exists to simply drop plugin data from IPC packets if it's warranted. This form of banning will be applied judiciously if a plugin can't abide by the above.
IPC Capabilities and Limitations
The previous page outlined the permission sets available. These must be manually requested by your plugin; a guide on how to do this is on the next page.
For syncing data through Snowcloak, users are permitted to install up to 32 plugins that use the IPC. This limit may be raised in future based on how the ecosystem grows, and Snowcloak's capacity. These 32 plugins can each use 4KB of data. This is usually enough for most purposes. The exact format of this data is up to you - Snowcloak just moves it.
If you're doing something particularly interesting, let us know - we might be able to whitelist your plugin to be allowed to go over that 4KB cap.
Your data packet is owned by your plugin - put whatever you want in there, and it'll be sent in the next sync packet. Unless a plugin is banned, Snowcloak does not interfere with the data, and your plugin on the other user's end can do whatever it needs to do. If the other user doesn't have your plugin, the data is simply ignored.
Trust and Security Boundary
Snowcloak's IPC permissions are user-consent controls for what your plugin can read from Snowcloak.
All Dalamud plugins run in the same game process. A hostile plugin can use reflection, hooks, or native memory access to bypass another plugin's restrictions - Snowcloak is no exception to this, and so cannot securely isolate itself from malicious plugins. This applies to your plugins as well. As partial mitigations to this, the IPC:
- denies every operation until the requested permission is granted
- keys extension data to the caller's Dalamud InternalName
- receives exactly one data slot, even if it registers repeatedly
- filters out-of-range requests at the server-level to return only requested keys (out-of-range pairs do NOT send appearance data)
With this in mind, and the potential for hostile plugins, you should treat every remote extension payload as hostile input. A player's local install of your plugin cannot verify that the remote player's version of the plugin has not been tampered with. Validate schemas, lengths, versions, and values before displaying it or using it for in-game actions (or preferably, simply build a plugin that can't do anything too dangerous!)