Fire Maltiez

[chk1]

3 hours ago, Teh Pizza Lady said:

Well clearly you just want to engage in bad faith arguments so I'm dipping out. Read what I wrote. Read all of it. Try to understand it. I won't reply to further comments or mentions in this thread.

Respectfully, you are the one who appears to be arguing in a pretty logically inconsistent manner, and even if I don't believe you entered this conversation in bad faith, I have to take issue with the whole "I don't need to explain why I'm right because I'm right" tone.

3 hours ago, Teh Pizza Lady said:

Ah, see my code of ethics doesn't care with the names involved, just what the action was and whether it benefits more people than it hurts. It is a type of Utilitarianism-type of ethics

You start off by implying that they somehow only care about this situation because they have it out for the particular person who was accused, or something to that effect. Sorry, but I can't see how this is anything but a strawman. How did you come the conclusion that they "care about the names"? Why make a point of this otherwise?

Further, you framed this as a philosophical discussion, where you (by your own account) arrived to an opinion about this discussion from your base (utilitarian or similar) philosophical principles (i.e. "whether it benefits more people than it hurts").

4 hours ago, Teh Pizza Lady said:

  Quote

what the action was and whether it benefits more people than it hurts

3 hours ago, Teh Pizza Lady said:

You didn't read the whole thing:

 

Your logic doesn't hold up since stealing is illegal.

However, you later clarify that "what the action is" is also one of your base principles, and it apparently implies that stealing is bad. You did say "illegal" instead of "bad", which is quite strange, since the accusation being made here is "spreading malware", which is also illegal pretty much everywhere. If this was your concern, why even bring up utilitarianism and all that other stuff? Why make suddenly conditional on an innocent person being negatively impacted?

If we disregard that interpretation, from an outside perspective, "what the action is" is so vague in the way that you have defined it, to the point that it can seemingly mean literally anything depending on your actual underlying opinion of the matter. I.e. it seems like your utilitarian-like principle actually doesn't have much bearing on your decisions or opinions, since it can always be trumped by the earlier clause. At least that looks to have been the result for every example listed in this discussion. What other conclusion is anyone supposed to make here?

4 hours ago, Teh Pizza Lady said:

slippery slope much there?

By your logic, no territory or colony should have fought for freedom from the British Empire because if they could commit treason, then what else might they do?

The slippery slope fallacy doesn't really apply here. They're just taking your self-declared code of ethics and deriving possible moral decisions from it that match your criteria. This is literally the singular point of having a code of ethics. If you aren't willing to take the decisions that flow from it, you aren't really conforming to the code of ethics, are you now?

Meanwhile, a slippery slope fallacy is when you use the fact that someone took a certain small decision to assert that they must also necessarily take some series of increasingly extreme decisions that are in a similar vein. An important distinction is that you are, in effect, assuming their code of ethics based on one decision, and using that to infer what further decisions they will make.

In the first case, no one had to assume what your ethics were, since you told everyone your code of ethics (or at least, an outline of it), they just took it to its logical conclusion.

 

[icesharkk]

wonderfully articulated. and thank you, i thought i was losing my darn mind.

[Sparticus247]

Eh, this would never slip into the game proper in a sneaky way due to "code review" before deployment. Sure hotfixes to adjust side affects happen, but this would get sniffed out quick, and would have bigger professional repercussions.

I'm not a heavy mod user so this doesn't really affect me. Partially because running C# DLL files from people I don't know kinda spooks me as a software dev, if I can't see the GitHub code or something. You can do A LOT with that and I don't trust the public with it if they don't let me look at the source.

[Vyh06]

I mean yeah this ain't good and something should be done but why are people considering LEAVING the game for something small like this? IMO people are overreacting and over exaggerating WAY too much

[icesharkk]

29 minutes ago, Sparticus247 said:

Eh, this would never slip into the game proper in a sneaky way due to "code review" before deployment. Sure hotfixes to adjust side affects happen, but this would get sniffed out quick, and would have bigger professional repercussions.

I'm not a heavy mod user so this doesn't really affect me. Partially because running C# DLL files from people I don't know kinda spooks me as a software dev, if I can't see the GitHub code or something. You can do A LOT with that and I don't trust the public with it if they don't let me look at the source.

why take the chance when maltiez himself originally said he did nothing wrong and doesnt have to explain himself? A mindset that does not respect the rules he doesn't agree with will violate them again.

[VANTABlack2000]

I am not sure on the specifics of all this because I don't use Discord anymore, but if this doesn't get resolved I may have to refund the game. Sucks because I am really starting to love the game, but if the devs are fine with malware level anti-cheat being snuck in without user's consent then I just can't defend that. If someone makes a MOD that people can CHOOSE whether or not to use and SAYS it is kernel level anti-cheat that's fine because at least they are transparent, but this is crazy.

On a similar note the game SEEMS DRM-Free at first until you realize you need an account to play the game, so I don't think the game is playable offline unless you are already logged in potentially which is an issue IMO as well.

[icesharkk]

4 minutes ago, VANTABlack2000 said:

I am not sure on the specifics of all this because I don't use Discord anymore, but if this doesn't get resolved I may have to refund the game. Sucks because I am really starting to love the game, but if the devs are fine with malware level anti-cheat being snuck in without user's consent then I just can't defend that. If someone makes a MOD that people can CHOOSE whether or not to use and SAYS it is kernel level anti-cheat that's fine because at least they are transparent, but this is crazy.

On a similar note the game SEEMS DRM-Free at first until you realize you need an account to play the game, so I don't think the game is playable offline unless you are already logged in potentially which is an issue IMO as well.

reasonable. i must note that while i am quite the vocal member right now pointing out the inconsistencies and doublespeak going on, we have not gotten a proper official response from the studio itself nor and list of consequences/next steps. please wait to see what happens next before you decide on your future involvement with the game. this may simply be resolved decisively and cleanly. Vintage story is one of my most beloved games and if i have to drop it because the studio cant be trusted that will be a very sad day. we are not at that point yet. its a lot of confused and angry people trying to damage control and inadvertently covering up the issue instead of resolving it.

[VANTABlack2000]

1 minute ago, icesharkk said:

reasonable. i must note that while i am quite the vocal member right now pointing out the inconsistencies and doublespeak going on, we have not gotten a proper official response from the studio itself nor and list of consequences/next steps. please wait to see what happens next before you decide on your future involvement with the game. this may simply be resolved decisively and cleanly. Vintage story is one of my most beloved games and if i have to drop it because the studio cant be trusted that will be a very sad day. we are not at that point yet. its a lot of confused and angry people trying to damage control and inadvertently covering up the issue instead of resolving it.

Thanks for the kind words. I am in an emotional spot and I am more worried than at a point where I would quit playing RIGHT NOW.

I hope I don't have to and this gets resolved, but they are just on thin ice. I know I need to understand the whole situation before I do anything too drastic.

Thanks for the words though for those who are considering refunding or leaving the game entirely right this second.

[greed23]

13 hours ago, Teh Pizza Lady said:

I'm not seeing the issue... he put anti-cheat into config lib. maybe don't use cheat software while playing a multiplayer video game? idk doesn't seem that hard a concept to follow.

"I'm not seeing the issue... the next door neighbor put (a hidden) anti-criminal rocket launcher in the park (that he didnt tell anyone about).  Maybe don't be a criminal while using the public park? Idk doesn't seem that hard a concept to follow"

 

This presupposes that:

1. The neighbor only targets actual criminals

2. The rocket launcher never falsely blows up innocent people

[Dilan Rona]

From what I understand, the code was obfuscated, and undeclared. And was added as an anti cheat measure, on a plugin called configlib. A library that has nothing to do with anticheat in the first place, and is meant to making config changes easier.

Any one of these alone (obfuscated code, undeclared code, anticheat code placed in mods where they dont belong) would be bad enough. Put them alltogether, and I see why people would regard that as malware. Especially if it causes the client to crash (which can and will be seen as malicious intent if it wasnt an anticheat plugin to begin with).

So starting today, i'll be going through my mod list. And the first mods on the chopping block is Config lib - Vintage Story Mod DB, ImGui - Vintage Story Mod DB, as well as any mod that relies on those mods. Its a real pity that the mods portal doesnt let us search through mods via a dependency search box. And those mods affected will remain removed until a suitable replacement for Config lib, and ImGui is available.

This is the second time I am encountering a situation where a mod added functionality that wasnt declared, that affected gameplay. And it was bad enough that when a complaint that I raised was ignored and I was called ignorent, I removed the mod from my list, and refused to install it again. And that was after the author made changes to accommodate the complaint. By then it was too late.

[MKMoose]

1 hour ago, Dilan Rona said:

From what I understand, the code was obfuscated [...]

The code was never obfuscated - it could be viewed freely in the decompiled code, and was omitted from the public source repository.

Its purpose was to detect obfuscated code, and that's why it triggered on the few mods that used it aside from the targeted cheat client.

I do want to stress that banning obfuscated code, which a nontrivial number of people have been calling for, would also affect the mods that Maltiez' code unintentionally affected as well. By saying that obfuscated code is "bad enough", it can be assumed that you're effectively admitting that the anti-cheat feature did target suspicious code which should not have been obfuscated and possibly should not have been allowed on ModDB at all. One of the mod devs who obfuscated their code claims to have done so to protect their intellectual property (a fine-tuned cave generation algorithm), but I don't know what the situation is with other obfuscated mods.

Edited Wednesday at 10:47 AM by MKMoose

[Dilan Rona]

You got a point there, @MKMoose. I myself are not against obfuscated code (Especially with valid use cases). I am however against the method used by Maltiez. obfuscated the cause of the crash, and using a known and TRUSTED mod to do the dirty work, instead of doing it the proper way by means of a dedicated anti cheat plugin.

If server owners dont want players to cheat, then install an anti cheat plugin. End of story. Authors that feel the need to add an anti cheat to a plugin that has absolutely NOTHING to do with detecting obfuscated code, or cheat mods in the first place is clearly crossing the line. And if not for this forum topic, I would have been oblivious to the drama and arguments.

Maltiez may have had good intentions with that version, and to highlight a very real concern (cheat mods). He should have done it the right way with an anti cheat mod. Not shoe horn it into a mod intended to make config files easier.

[Dilan Rona]

For example, here is an example of an anti cheat mod, done the Right way (Yols Ore Obfuscator (Anti-Xray) - Vintage Story Mod DB).

Here is another one (ModIntegrity — allowlist client-only mods - Vintage Story Mod DB).

Edited Wednesday at 11:03 AM by Dilan Rona

[Jem8883]

Man, I've put in over a thousand hours into this game through multiple saves, but the deal breaker for me is the duplicity of the situation and lack of accountability being taken or even acknowledged by the individual committing this scandal. This entire situation hurts as a huge fan of the game. a quote i think fits very well here "the road to hell is paved with good intentions", Just because he intended well, isn't good enough.

[Dilan Rona]

I for one will always play vintage story. But I will from now on be a lot more carefull with installing new mods from the mod db. As for maltiez? Any mod made by him will be nuked from my installs, and will not be installed on my server. Any mods using config lib will be affected as well unfortunately, as I will be looking for alternatives to those mods.

[Sparticus247]

7 hours ago, icesharkk said:

why take the chance when maltiez himself originally said he did nothing wrong and doesnt have to explain himself? A mindset that does not respect the rules he doesn't agree with will violate them again.

Don't get me wrong, I'm not defending the behavior of the mod whatsoever. I'm just saying there's a difference between doing this on a mod as a regular old person in the past, compared to doing it actively on software as an employee.

I also don't know the employment laws of the country. In the United States, for instance, in many states you can pretty much get fired because of the vibes, and no other real reason needs to be given. In many European countries that could never fly. Getting fired for doing something outside of work not related to the actual activities in the office possibly may not be viable.

Looking into this though, it sounds like he mentioned wanting to put something like this in the game proper, and the other devs completely shut him down. There's no way he'd be able to deploy this change without going through the development team cycle, and the fact the other devs and the business has already made it clear they don't want something like this in the game, then it's not going in the game.

Something like this was bound to happen in the modding community eventually, I'm at least happy it wasn't something far more malicious like what has been going on with the npm community on repeat. Mods like primitive survival was square in my focus for example, as for a fair amount of time, it added all sorts of features that were completely undeclared and surprised users. They weren't malicious, they were fun, but people did not consent do those features when downloading the mod. At the moment most of those features are toggles that can be turned on and off. There are other mods that have similar problems.

At the end of the day, I think it is a bit of an overreaction to stop playing the game that's on your computer right now, as that is not a compromised thing. You can even not update it with any updates if you're truly concerned, as I'm still a few patches behind myself, but I saw no reason to install them at the moment. I'm quite sure that the dev team is fully aware of the backlash, and since they already said no to adding that suggested change to the proper code base of the game, the reaction from them will be far more severe if any attempt from a Dev happens to try and sneak things past code review.

[Stoney Martyr]

8 minutes ago, Sparticus247 said:

At the end of the day, I think it is a bit of an overreaction to stop playing the game that's on your computer right now, as that is not a compromised thing. You can even not update it with any updates if you're truly concerned, as I'm still a few patches behind myself, but I saw no reason to install them at the moment. I'm quite sure that the dev team is fully aware of the backlash, and since they already said no to adding that suggested change to the proper code base of the game, the reaction from them will be far more severe if any attempt from a Dev happens to try and sneak things past code review.

The discord is practically required to gain access to certain information for the game. Mod support, patches, etc, fast community support for issues, etc. As it stands multiple people have been banned and deprived from what has sadly become a somewhat critical component of the game.

If I cant access the community forums on the discord to at least read through other’s troubleshooting I will be refunding the game. Standing by the bans means you standby maltiez.

[Vratislav]

7 hours ago, icesharkk said:

we have not gotten a proper official response from the studio itself nor and list of consequences/next steps

I am not concerned myself to the level of considering a removal of the config lib or refund the game itself. I feel like "he has his reasons, but generally fucked up. Still, problem was solved, so whatever." But I see how the trust was damaged for other players. This will require very clear steps from the studio (I am sure they are in the process of preparing proper public response that requires some procedural changes - which is the reason it takes time). I would wait for steps towards more thorough mod curation, and of course some more detailed statement about how the code is being reviewed inside the team.

I may make a bit speculation now. I have long time experience from scientific work close to SW development and also a non-profit work in small but steadily growing teams. I know there are limits to which extent the teamwork can be based mostly on trust. From some size of team or company, control mechanisms has to be established and trust based shortcuts, that worked as the most effective for smaller team or company, has to be cut. But the change of internal processes this way is not easy, and usually is not done, unless some incident (or series of incidents) happens.

I believe that we will be informed how the studio dealt with problem not only for this time, but - and this is the most important - for the future. 

Also, I must admit that I am exceptionally forgiving guy. In my 20+ years long working career I have seen too many people screw up with good intentions (including myself) to take it as the end of the game. If they teach from it, of course.

Edited Wednesday at 12:13 PM by Vratislav

[Dilan Rona]

Outright banning people from the vs discord is not the solution. It only draws more attention to the problem itself (Streisand effect). As @Stoney Hawk, and @Vratislav stated. some information can only be obtained on the discord (which is a major problem in itself).

29 minutes ago, Vratislav said:

Still, problem was solved, so whatever."

It hasnt been solved. Not by a long shot. Yes, the code that caused the drama was removed, doesnt change the fact that he did it, and that he is on the dev team.

29 minutes ago, Vratislav said:

This will require very clear steps from the studio (I am sure they are in the process of preparing proper public response that requires some procedural changes - which is the reason it takes time)

And you are right there, a proper response will take time. But the sooner the devs get a response out, the better cause the fallout will not stop, but accelerate.

Edited Wednesday at 12:41 PM by Dilan Rona

[Grish]

14 hours ago, icesharkk said:

so its fine that he breached our trust and run code on our machines without our consent because you knew about it in advance? im sorry no. without significant retraction and consequences i will not be endorsing vintage story moving forwards. this is is a completely f'd take by sekelsta.

 

edit: "furthermore this is a breach of the ModDB Terms of use page, Section 2 of Mod Uploads states: "You warrant that the mod contains no harmful or malicious code""

so sekelsta openly admits that Anego studios had prior knowledge of malicious code contained in one of the mod libraries in violation of their own moddb terms of use. Took no action. and is now claiming that it was okay because he didnt break the studio's trust? did i get that all right? or does another dev want to shove the foot further into their mouth?

Ya exactly.  

 After knowingly allowing malware to be be installed from their own mod db without informing us I currently do not think there is anything they can do to get me to trust them .It is actually quite concerning they thought this was ok. I can understand why people are done with it and want a refund.

[Vratislav]

11 minutes ago, Dilan Rona said:

But the sooner the devs get a response out, the better cause the fallout will not stop, but accelerate

They should say asap that they are preparing some steps they will announce in detail. That gives them few days of breathing time to prepare it the way it is not rushed to be wrong. 

[Dilan Rona]

Imo, asking for a refund is a bit of an overkill, but it is probably the only way to get the attention of the devs when the mods on the vs discord is actively banning people from discussing the problem in the first place. And what happened? It blew up on the forum. Getting the attention from those that are not on the discord as well.

[Koobze]

It is disappointing indeed to read this thread, to see that apparently a modder did something pretty shady and overbearing to address an issue he had with another modder. It sounds like he also works in some official capacity for Anego Studios, and additionally they were aware of the shady act, and were either supporting it or covering it up. I don't think I was ever impacted by his vigilante security measures, but this apparent breach of trust - especially by a studio that I saw as a trustworthy underdog - is not something that can be easily forgotten. 

Really a bummer.

[Dilan Rona]

I still trust the dev team and will continue to play VS. As far as anything mod related made by maltiez, his mods will never be used by me again, and in the unlikely event it does happen again, it will be a very long time. So unlikely.

[Demoncyborg]

i feel like these messages just need to be here, there's been an insane amount of misinformation spreading around about this issue.

edit: the first message is in the Vintage story news channel, second is in the vintagestory chat in Vintage story discussion, it is pinned.

Edited Wednesday at 01:06 PM by Demoncyborg
sources of the messages