Fire Maltiez

[Dilan Rona]

Thank you for the update. That should have been posted to the forum as well though, from the start. Not everyone is on discord, and people have their reasons.

[VANTABlack2000]

17 minutes ago, Demoncyborg said:

i feel like these messages just need to be here, there's been an insane amount of misinformation spreading around about this issue.

edit: the first message is in the Vintage story news channel, second is in the vintagestory chat in Vintage story discussion, it is pinned.

Thanks for this. This does raise concerns raised by another person on the thread though that too much info goes only through Discord. Makes me wish more stuff was here on the forums since I quit using Discord because it has gotten far too corporate.

This also highlights that we need to not jump the gun on anything on be suspicious at best.

[Stoney Martyr]

Would like to note: We have no evidence of this “anticheat” working correctly either.

 

vintage story has what, a max of 250k players? Less so playing online in community servers. He’s attacking a statistic that has a chance of being less than one whole person, while dragging the whole community along for a ride.

 

These are all community lead servers, just ban cheaters and rollback their contributions if it was that bad. Theres not enough to warrant any form of anticheat measure. Just grow tf up and ban em

[VANTABlack2000]

1 hour ago, Stoney Hawk said:

Would like to note: We have no evidence of this “anticheat” working correctly either.

 

vintage story has what, a max of 250k players? Less so playing online in community servers. He’s attacking a statistic that has a chance of being less than one whole person, while dragging the whole community along for a ride.

 

These are all community lead servers, just ban cheaters and rollback their contributions if it was that bad. Theres not enough to warrant any form of anticheat measure. Just grow tf up and ban em

What makes this even worse is I wouldn't be surprised if there is a significant portion of people that play VS because they say they are No Mictrotransactions, No DLC... etc, so you get people like me who are anti-corporation. Anti-Cheat in that manner is more of a corporate move and goes against people with privacy concerns and not wanting software to interact with core levels of their computer. Edit: I forget where I saw Kernel Level Anti-Cheat, but from the info going around the anti-cheat was still implemented in a shady manner.

Edited Wednesday at 03:22 PM by VANTABlack2000
Correcting some misinformation.

[Stoney Martyr]

10 minutes ago, VANTABlack2000 said:

What makes this even worse is I wouldn't be surprised if there is a significant portion of people that play VS because they say they are No Mictrotransactions, No DLC... etc, so you get people like me who are anti-corporation. Anti-Cheat in that manner is more of a corporate move and goes against people with privacy concerns and not wanting software to interact with core levels of their computer.

This is essentially just some grass allergic guy goin “WAHHHH I DONT LIKE CHEATERS IN MUH SINGLEPLAYER NONCOMPETITIVE GAME” and screwing everyone else over, then causing a massive blow up for the team he’s attached to all because he has an ego. Then the discord mods are continually sweeping for what he admitted was actual Malware.

Edited Wednesday at 01:45 PM by Stoney Hawk

[MKMoose]

33 minutes ago, Stoney Hawk said:

Would like to note: We have no evidence of this “anticheat” working correctly either.

That you have no knowledge of it working correctly does not make it ineffective. Its purpose, design, successful effects and reason for false positives were all confirmed by multiple other devs.

 

13 minutes ago, Stoney Hawk said:

“WAHHHH I DONT LIKE CHEATERS IN MUH SINGLEPLAYER NONCOMPETITIVE GAME”

The controversial code was only active on multiplayer clients, possibly also on self-hosted servers in certain cases.

 

23 minutes ago, VANTABlack2000 said:

Anti-Cheat in that manner is more of a corporate move and goes against people with privacy concerns and not wanting software to interact with core levels of their computer.

Painted as an anti-cheat or not, every game that facilitates play on a public server requires protection from griefers and cheaters. Different methods can be better or worse, but having that protection is a basic necessity, not some kind of shady corporate move. VS has plentiful protections of this kind built into the game, and they are ensured to be as unintrusive as possible.

The controversial code did not tamper with the system outside of the game in absolutely any way, and all the misinformation and fearmongering is causing unnecessary unrest and panic.

 

1 hour ago, Dilan Rona said:

Imo, asking for a refund is a bit of an overkill, but it is probably the only way to get the attention of the devs when the mods on the vs discord is actively banning people from discussing the problem in the first place.

13 minutes ago, Stoney Hawk said:

Then the discord mods are continually sweeping for what he admitted was actual Malware.

The problem is being discussed quite fine in the Discord as well, minus the inevitable confusion, lies, misinformation, insults, overreactions, trolling - all par for the course, it would seem, so some people naturally get banned for breaking the rules and a couple people probably got caught in the crossfire. Some things were mismanaged and one moderator especially received flack for it, but there is no large-scale banning for daring to bring up the topic.

 

It is, on a side note, kind of sad that the Forums get somewhat neglected. I've seen many different forum sites for games, and almost invariably the players' participation in those forums is proportional to the devs' involvement in it. When most devs virtually never comment on the Forums and a large portion of news except development updates and changelogs is available in the Discord only, that just kind of begs the question of "why even use the Forums at all?" I find this place generally calmer and more pleasant than alternatives but for keeping up with the game and interaction with devs the official Forums tend to feel neglected.

Edited Wednesday at 01:58 PM by MKMoose

[PhotriusPyrelus]

20 hours ago, Teh Pizza Lady said:

I'm not seeing the issue... he put anti-cheat into config lib. maybe don't use cheat software while playing a multiplayer video game? idk doesn't seem that hard a concept to follow.

Maybe it's not his place to do that?
Maybe it's a matter for the individual server admins to address?
Maybe this top-down enforcement approach needs to die in the hell that spawned it?

[Nossin]

Some updates for those out of the loop and apologies for reddit links.

Breakdown of how the code works: code explanation

Screenshot link of Maltiez removing the malware and adding it back in: screenshot

Others have reported Maltiez's other mods contain the same code

 

[PhotriusPyrelus]

2 minutes ago, Nossin said:

Others have reported Maltiez's other mods contain the same code

So I'm confused, is this something he did just in his mods, or something that was added to the standard vanilla client after he was added to the dev team?

Or is the issue that his "anti-cheat" code in his mods violated the rules of what mods are and aren't allowed to do?

Edited Wednesday at 01:58 PM by PhotriusPyrelus

[Rainbow Fresh]

1 minute ago, PhotriusPyrelus said:

So I'm confused, is this something he did just in his mods, or something that was added to the standard vanilla client after he was added to the dev team?

Or is the issue that his "anti-cheat" code in his mods violated the rules of what mods are and aren't allowed to do?

He added it to three of his most wide-spread mods, silently at some point in the past. In two of which, according to himself, also silently removed in the past aswell.

Supposedly he pitched adding it to the base game but was shot down.

The uproar is mostly around the fact adding malware to mods with debatable "malicious" intent is against the ModDB's ToS and general common sense, aswell as a major breach of trust that only escalates further considering he is, by now, official member of the VS dev team and as such representative for the game as a whole - to a degree.

[Dilan Rona]

Still not fully in the loop myself. I stand to be corrected here, but from what I understand (it was said other places), maltiez wanted anti cheat measures in the client, and it was denied. So he added it in his mods (3 of them), which I add here had no business having that level of code. Its not the mods job, and should have been placed in a seperate, DEDICATED anti cheat mod. Then there would have been 0 flak, 0 fallout. Just a casual search yielded 3 mods for anti cheat.

The whole issue stems from maltiez shoe horning anti cheat code into mods that is not meant as anti cheat mods, and was trusted mods to begin with. Mainly meant for making managing config files easier for example. That is the purpose of the mod in question. Anything else is stepping out of its lane.

[PhotriusPyrelus]

Just now, Rainbow Fresh said:

adding malware to mods with debatable "malicious" intent is against the ModDB's ToS and general common sense, aswell as a major breach of trust that only escalates further considering he is, by now, official member of the VS dev team and as such representative for the game as a whole - to a degree.

Interesting.  I strongly suspect (but welcome correction) that if the VS Staff had known about this before hiring him, they would not have done so.  In which case, yeah, he probably should be fired or at the absolute least (I don't know about Latvian "LaBoUr PrOtEcTiOn" laws) removed from contributing code if they can't remove him from the company entirely.

...which makes it very curious to me why they're defending him.  ::furrows brow::

[Demoncyborg]

just so everyone is aware here

all of the offending code in all of the mods has already been removed

it's a little confusing when you go back and see all the 'i added it back in' statements but the last official response  from Maltiez is that it is all gone, and it is confirmed to be removed.

[Stoney Martyr]

1 minute ago, MKMoose said:

That you have no knowledge of it working correctly does not make it ineffective. Its purpose, design, successful effects and reason for false positives were all confirmed by multiple other devs.

Only confirmed and reported because it wasn't working, it was bugging out and causing issues with other mods. Confusion that would have been avoided if he made it a separate mod instead of trying to introduce it as actual malware.

4 minutes ago, MKMoose said:

 

The controversial code was only active on multiplayer clients.

Even this was buggy. Still dont want the code on my computer. I play strictly singleplayer

 

10 minutes ago, MKMoose said:

Painted as an anti-cheat or not, every game that facilitates play on a public server requires protection from griefers and cheaters. Different methods can be better or worse, but having that protection is a basic necessity, not some kind of shady corporate move. VS has plentiful protections of this kind built into the game, and they are ensured to be as unintrusive as possible.

Live moderation and banning. Anticheat was developed to solve the problem of scale. There are not enough players to warrant this. Grow up and moderate your 15 player server.

 

12 minutes ago, MKMoose said:

 

The problem is being discussed quite fine in the Discord as well, minus the inevitable confusion, lies, misinformation, insults, overreactions, trolling - all par for the course, it would seem, so some people naturally get banned for breaking the rules and a couple people probably got caught in the crossfire. Some things were mismanaged and one moderator especially received flack for it, but there is no large-scale banning for daring to bring up the topic.

Multiple mods have thrown multiple tantrums over this. 
 

I know I’ll be seeking a refund if my ban for pointing out that mal is listed as a game dev now isnt reversed.

[Stoney Martyr]

9 minutes ago, Demoncyborg said:

just so everyone is aware here

all of the offending code in all of the mods has already been removed

it's a little confusing when you go back and see all the 'i added it back in' statements but the last official response  from Maltiez is that it is all gone, and it is confirmed to be removed.

Who knows if thats the case considering his initial response was to remove it then vindictively add it back in.

 

Forgot to mention the question “Why not make it a separate mod” answers itself. Dude did it this way on purpose. Configlib is used by so many different mods, not just his overhauls. Why wouldnt you sneak your vindictive malware into your most popular mod?

Edited Wednesday at 02:17 PM by Stoney Hawk
More to the comment

[PhotriusPyrelus]

10 minutes ago, Stoney Hawk said:

Live moderation and banning. Anticheat was developed to solve the problem of scale. There are not enough players to warrant this. Grow up and moderate your 15 player server.

Good grief, I miss the 90s and early 00s.  This was the order of the day.  Someone cheating on your server?  Ban him.  It wasn't <Developer's> job to do it for you.

[Dilan Rona]

5 minutes ago, Stoney Hawk said:

all of the offending code in all of the mods has already been removed

 

Does not in the least bit restore the trust that was destroyed in the first place. People lost trust in his mods as a result, and because he is on the dev team, the fallout is reflecting on the rest of the devs (known or not known doesnt matter either way), and as a result affects the trust in the core game itself.

This is something that should never have happened in the first place with that mod, and should have been done in a seperate mod, as any sensible person with a modest amount of coding skill should have known. Not shoehorn code that doesnt belong in a trusted mod to do a task said mod was never designed for originally, straying outside of its core function.

[icesharkk]

3 hours ago, MKMoose said:

The code was never obfuscated - it could be viewed freely in the decompiled code, and was omitted from the public source repository.

Its purpose was to detect obfuscated code, and that's why it triggered on the few mods that used it aside from the targeted cheat client.

I do want to stress that banning obfuscated code, which a nontrivial number of people have been calling for, would also affect the mods that Maltiez' code unintentionally affected as well. By saying that obfuscated code is "bad enough", it can be assumed that you're effectively admitting that the anti-cheat feature did target suspicious code which should not have been obfuscated and possibly should not have been allowed on ModDB at all. One of the mod devs who obfuscated their code claims to have done so to protect their intellectual property (a fine-tuned cave generation algorithm), but I don't know what the situation is with other obfuscated mods.

the code was obfuscated. it scrubbed its log footprint and obfuscated the crashcode execution timing through delays specifically to prevent attribution of the crashes to configlib. And yes it was not in the github repository maltiez injected it only into the packed moddb release. which further indicates that he knew what he was doing needed to be hidden.

6 minutes ago, Rainbow Fresh said:

He added it to three of his most wide-spread mods, silently at some point in the past. In two of which, according to himself, also silently removed in the past aswell.

Supposedly he pitched adding it to the base game but was shot down.

The uproar is mostly around the fact adding malware to mods with debatable "malicious" intent is against the ModDB's ToS and general common sense, aswell as a major breach of trust that only escalates further considering he is, by now, official member of the VS dev team and as such representative for the game as a whole - to a degree.

the intent is not up for debate since the intent is completely irrelevant. the outcome he is responsible for is the installation of malicious code onto thousands of computers for his own purpose and to further his own interests without the consent of the user and owner of the computer that was compromised. 

further statements by seleksta indicate that they at least think hes not a risk on the team since the dev team already knew about this and therefore he didnt break the dev teams trust just the users trust and thats what matters. the truth is probably very complicated miscommunication between what was disclosed verses understood byt the dev team. but the interesting part to me is seleksta being fine with the users being compromised as long as the dev team knew about it. that adds another fool to the pile of anti consumer nonsense in this story.

[Dilan Rona]

So the sooner the devs get on this, to soothe the matter over, the better. And it cannot be on discord only, it has to be on the forum as well. And if the team maintains a reddit as well, it needs to be there as well.

[Mrozak]

I trust the responsible people at Anego have enough integrity to NOT fire anybody just because somebody on the internet demands it.
And i cannot help but deeply despise anybody asking for such action based on "the way i understand it", or "from what i gather", and "i think".
That's all.

[Stoney Martyr]

Just now, Mrozak said:

I trust the responsible people at Anego have enough integrity to NOT fire anybody just because somebody on the internet demands it.
And i cannot help but deeply despise anybody asking for such action based on "the way i understand it", or "from what i gather", and "i think".
That's all.

Fine then.
Fact: Maltiez Admitted to distributing Malware

fact: mal called it malware

fact: this is illegal in multiple jurisdictions

fact: malicious code is a TOS violation pretty much everywhere

[PhotriusPyrelus]

36 minutes ago, icesharkk said:

they at least think hes not a risk on the team since the dev team already knew about this and therefore he didnt break the dev teams trust just the users trust and thats what matters.

This is very simple to me.
Had they known all this before they hired him, would they still have hired him?
If no, kick him to the curb.
If yes, well then I guess for all their high talk about morals and community trust they're just as bad as EA, Micro$lop, and Nintendo.

Seriously, imagine thinking trust among the dev team matters more than trust with the users.  What a joke.  Oh well, I guess I got my $25 of fun out of it.

Edited Wednesday at 02:55 PM by PhotriusPyrelus
Misremembered the price. $25, not $15

[Dilan Rona]

@Mrozak is correct in this instance. We cannot ask that maltiez be fired. But what he did with some of his mods (the fact that he removed the code doesnt change what happened) cannot be ignored either. And cannot be allowed to happen again, especially since he is on the dev team, and is held on a higher standard.

[icesharkk]

1 minute ago, Mrozak said:

I trust the responsible people at Anego have enough integrity to NOT fire anybody just because somebody on the internet demands it.
And i cannot help but deeply despise anybody asking for such action based on "the way i understand it", or "from what i gather", and "i think".
That's all.

well, I for one am glad we cleared that up.

integrity is not harboring a known malicious actor and continuing allowing them access to the supply chain for a product your users expect to trust. no amount of oversight and code review is going to make the PR problem or supply chain risk defensible in a litigation circumstance.

[Mrozak]

Just now, Stoney Hawk said:

Fine then.
Fact: Maltiez Admitted to distributing Malware

fact: mal called it malware

fact: this is illegal in multiple jurisdictions

fact: malicious code is a TOS violation pretty much everywhere

You seem to have a very strange understanding of what the word "fact" means.