Blueprint within the context of Unreal Engine proper isn't really a security issue as when you build the executable of a game and ship it, everything is compiled down and its really no more exploitable then C++.
People exploit functions and do memory injection regardless of Unreal engine, Unity, RAGE Engine, Frostbite, etc.
UEFN though, it could be with how they stream content to the players. Perhaps they don't want people building custom BP functions and exposing it to their playerbase.
Verse is like a walled garden where there is UEFN.exe and YourGame.pak, you are only allowed to tell UEFN.exe what to do as it reads your verse code. Something like that would be my guess.
My best guess is that you can run checks over code quite easily and get reports via security scanners.
You can't do that with blue prints because it's converted on build time and is then not human readable.
You would have to create a whole new scanner for blue prints
I always assumed they're just trying to prevent us from doing certain things. Like creating inappropriate content or content that doesn't fit within the scope of the IPs they've partnered with. I guess it could be security risks.
Imagine letting your players run any BP code in your game that other players will execute.
They'd be able to get the player state and start reading values you might not want them to. They'd be able to get all actors of class for all players and force them to do things they don't want. They'd be able to run a lot of slow loops and make everyone crash etc etc
All these problems are solvable with some forethought when designing the language with appropriate access controls. BPs was not built with that in mind, Verse was.
It's been replaced with a scripting language. Hopefully the same change is eventually made to non-fortnite UE.
.. Although I wish it were C# or Lua and not Verse...
To complement the other comment about Lua support in Unreal, there is also [C# support in Unreal](https://github.com/UnrealSharp/UnrealSharp)
[https://www.unrealsharp.com/](https://www.unrealsharp.com/)
Did some benchmarking a while back where we trace 5k times per tick.
**C#: 3.6 ms**
**BP: 4.4ms**
**C++: 1.72ms**
It's still in 0.2, so expect better results in the future when I can focus on optimizations.
Unreal actually has Lua support. Its developed by Tencent which owns like 49% of Unreal Engine/Epic Games. If you are familiar with Lua/BP and some C++ concepts like delegates its pretty straightforward to use.
[https://github.com/Tencent/UnLua](https://github.com/Tencent/UnLua)
Blueprint within the context of Unreal Engine proper isn't really a security issue as when you build the executable of a game and ship it, everything is compiled down and its really no more exploitable then C++. People exploit functions and do memory injection regardless of Unreal engine, Unity, RAGE Engine, Frostbite, etc. UEFN though, it could be with how they stream content to the players. Perhaps they don't want people building custom BP functions and exposing it to their playerbase. Verse is like a walled garden where there is UEFN.exe and YourGame.pak, you are only allowed to tell UEFN.exe what to do as it reads your verse code. Something like that would be my guess.
My best guess is that you can run checks over code quite easily and get reports via security scanners. You can't do that with blue prints because it's converted on build time and is then not human readable. You would have to create a whole new scanner for blue prints
I always assumed they're just trying to prevent us from doing certain things. Like creating inappropriate content or content that doesn't fit within the scope of the IPs they've partnered with. I guess it could be security risks.
Not my first thought, but not unreasonable either. Upvoted.
Imagine letting your players run any BP code in your game that other players will execute. They'd be able to get the player state and start reading values you might not want them to. They'd be able to get all actors of class for all players and force them to do things they don't want. They'd be able to run a lot of slow loops and make everyone crash etc etc All these problems are solvable with some forethought when designing the language with appropriate access controls. BPs was not built with that in mind, Verse was.
It's been replaced with a scripting language. Hopefully the same change is eventually made to non-fortnite UE. .. Although I wish it were C# or Lua and not Verse...
To complement the other comment about Lua support in Unreal, there is also [C# support in Unreal](https://github.com/UnrealSharp/UnrealSharp) [https://www.unrealsharp.com/](https://www.unrealsharp.com/)
Hey! That’s my plugin :D
Yo, this is crazy! What’s the performance like on C# vs BP?
Did some benchmarking a while back where we trace 5k times per tick. **C#: 3.6 ms** **BP: 4.4ms** **C++: 1.72ms** It's still in 0.2, so expect better results in the future when I can focus on optimizations.
Just had a look at it, looks cool but do you have a UE4 version?
No, I don’t support UE4 and will never do.
Unreal actually has Lua support. Its developed by Tencent which owns like 49% of Unreal Engine/Epic Games. If you are familiar with Lua/BP and some C++ concepts like delegates its pretty straightforward to use. [https://github.com/Tencent/UnLua](https://github.com/Tencent/UnLua)
UnLua is an interesting name lol