The configlib/maltiez Incident so far.

[icesharkk]

Here are the most relevant statements (in my opinion) from within discord, for any users who do not or choose not to use discord, presented in a clear thread with no inflammatory title. there is a lot of struggle going on with PR so please be civil in this so that it doesn't also get lock or deleted.

if you are just hearing about this issue here is  a summary per user LitchManWithAIO on reddit whose summary is probably simplest explanation I've seen:

Quote

Here is a writeup for those interested:

Eight releases shipped hidden code that could crash or disconnect your game client. It was removed in 1.13.1. If you are on the current version, you are fine.

Affected: 8 releases
1.10.9
1.10.10
1.10.12
1.10.13
1.10.14
1.11.0
1.11.1
1.12.0

Not affected
1.13.1 and later
1.10.7 and earlier

What the code did:

It ran automatically when the mod loaded, then checked every other mod and library loaded into your game, looking for signs of cheat software: scrambled internal names, and specific names like Aimbot, KillAura, Esp and Nuker.

If it found a match, it waited a random 1.5 to 16 minutes, then broke your game client at random:

• Forced disconnect, or kicked you to the main menu

• Killed the client outright, or froze frame timing

• Wiped the interface, loaded creatures, or all server communication

• On the 1.10.x versions only: fired fake keyboard and mouse input every frame, and made your character attack itself

Note: Only multiplayer clients. Dedicated servers and single-player worlds were never affected.

Worth knowing:

• The code was not in the public source repository. It existed only in the released downloads.

• It was disguised as part of YamlDotNet, a normal library bundled inside the mod.

• It did not steal data, touch files, or contact network. (The effects were confined to crashing the running game.)

Maltiez is a long time mod author and recent hire to the dev team on Vintage Story
 

And here is the haste bin link deep dive on the discovery: https://hastebin.com/share/uqeyuhirof.markdown

Edited yesterday at 06:17 PM by icesharkk

[Sparticus247]

Can we just get a single Master thread on this topic if it's going to be kept in this discussion board, and not moved to another? 

I'm not against having any discussions around it, I just don't want to see 15 topics on the same thing with "up to the minute news coverage" thread spidering out.

I'm not on the discord, but Reddit is absolutely overwhelmed.

[Khondza]

From the looks of it they not only pulled the wool over those who downloaded the mod but the dev team themselves. Its a little funny to me because if they had just made a "target X hacked client anti cheat" mod they would have avoided all of this. If any of the Anego team is reading this i still trust you guys to make the right choices. The terms of use for the mod-db are the rules which govern to safety of those who use it, if it can be broken for the "right cause" or the "right people" it is worthless to us. Im not going to try and say what should be done, but if actions like this are allowed to continue on the mod-db ill probably just stay with vanilla. 

[icesharkk]

6 minutes ago, Sparticus247 said:

Can we just get a single Master thread on this topic if it's going to be kept in this discussion board, and not moved to another? 

I'm not against having any discussions around it, I just don't want to see 15 topics on the same thing with "up to the minute news coverage" thread spidering out.

I'm not on the discord, but Reddit is absolutely overwhelmed.

i asked for one. but there hasnt been any response or action taken.

[VANTABlack2000]

55 minutes ago, icesharkk said:

Here are the most relevant statements (in my opinion) from within discord, for any users who do not or choose not to use discord, presented in a clear thread with no inflammatory title. there is a lot of struggle going on with PR so please be civil in this so that it doesn't also get lock or deleted.

if you are just hearing about this issue here is  a summary per user LitchManWithAIO on reddit whose summary is probably simplest explanation I've seen:

Maltiez is a long time mod author and recent hire to the dev team on Vintage Story
 

And here is the haste bin link deep dive on the discovery: https://hastebin.com/share/uqeyuhirof.markdown

I think this is a good summary of everything. It does a good job of getting everyone on the same page, so we aren't arguing about misinformation. I would like to see a response from the devs, but things are crazy right now, so I am not sure what is going to happen. I am still going to give the devs benefit of the doubt though considering this thread isn't locked.

[Diff]

Just now, Khondza said:

if they had just made a "target X hacked client anti cheat" mod they would have avoided all of this

Wouldn't have avoided this unfortunately. Making it a dedicated, separate mod would have made it laughably easy to bypass. Patching out the checks of an anticheat mod like that is something you could accomplish following the generic "Quickstart" Harmony tutorial with 0 modding experience. It only works if you don't know it's there. Shouldn't have been done at all, but doing it any other way would have been pointless.

[LadyWYT]

4 minutes ago, icesharkk said:

i asked for one. but there hasnt been any response or action taken.

In fairness, it's only been what...24-48 hours since the controversy blew up? It's a little difficult to make an official announcement/mega-thread when you're still scrambling to uncover the facts yourself, find and neutralize the problem mod code, and deal with the community running wild with speculation(especially when the community keeps creating multiple threads about the same thing) at the same time. And of course, with everyone piling on at once, in multiple places, it gets very hard to sort out the actual questions people have from the general mess of comments.

I expect as soon as Anego Studios figures out what the heck happened, there will be an official statement providing the facts about what happened, how the problem was handled, how the offending parties were handled, and what measures will be taken to help ensure such things can't happen as easily in the future. Until we have an official statement, I would say it's a good idea to be very careful about speculating. It's perfectly fine to be concerned, and politely air those concerns in the appropriate designated space, but it's also very easy to get carried away and wind up muddying the waters.

[icesharkk]

7 minutes ago, LadyWYT said:

In fairness, it's only been what...24-48 hours since the controversy blew up? It's a little difficult to make an official announcement/mega-thread when you're still scrambling to uncover the facts yourself, find and neutralize the problem mod code, and deal with the community running wild with speculation(especially when the community keeps creating multiple threads about the same thing) at the same time. And of course, with everyone piling on at once, in multiple places, it gets very hard to sort out the actual questions people have from the general mess of comments.

I expect as soon as Anego Studios figures out what the heck happened, there will be an official statement providing the facts about what happened, how the problem was handled, how the offending parties were handled, and what measures will be taken to help ensure such things can't happen as easily in the future. Until we have an official statement, I would say it's a good idea to be very careful about speculating. It's perfectly fine to be concerned, and politely air those concerns in the appropriate designated space, but it's also very easy to get carried away and wind up muddying the waters.

you misinterpret my statement. i asked for a megathread where we could all safely discuss this without spilling into a half dozen threads. I have no expectation to rush the official statement regarding the incident or the consequences.

[LadyWYT]

4 minutes ago, icesharkk said:

you misinterpret my statement. i asked for a megathread where we could all safely discuss this without spilling into a half dozen threads. I have no expectation to rush the official statement regarding the incident or the consequences.

Yeah but that's kind of my point--a proper mega-thread, at least in my opinion, would be some kind of official statement, along with the known facts, would it not? Likewise, it's one thing to start a mega-thread, but another thing entirely to both keep it civil and get users to post in that thread instead of making duplicates and running wild everywhere else. It's a common problem when it comes to forums and drama in general, not just this specific forum and circumstance. That's all.

[icesharkk]

3 minutes ago, LadyWYT said:

Yeah but that's kind of my point--a proper mega-thread, at least in my opinion, would be some kind of official statement, along with the known facts, would it not? Likewise, it's one thing to start a mega-thread, but another thing entirely to both keep it civil and get users to post in that thread instead of making duplicates and running wild everywhere else. It's a common problem when it comes to forums and drama in general, not just this specific forum and circumstance. That's all.

oh i see what you mean. not that wasnt what i had in mind. just a collapse of the threads on the topic and basically say "be civil and keep it in here until we have our own statement on the topic." this came up because earlier this morning all of the threads on the topic were getting locked and removed and there was no where to reference the info or continue discussion. it was not a good look for the company and it was relatively quickly undone but the threads remained locked.

[WrenFox]

1 hour ago, icesharkk said:

Here are the most relevant statements (in my opinion) from within discord, for any users who do not or choose not to use discord, presented in a clear thread with no inflammatory title. there is a lot of struggle going on with PR so please be civil in this so that it doesn't also get lock or deleted.

if you are just hearing about this issue here is  a summary per user LitchManWithAIO on reddit whose summary is probably simplest explanation I've seen:

Maltiez is a long time mod author and recent hire to the dev team on Vintage Story
 

And here is the haste bin link deep dive on the discovery: https://hastebin.com/share/uqeyuhirof.markdown

I've just now heard about this whole drama (whatever you want to call it) I've also heard of this from a YT video, I don't really know how else to respond but "yikes".

The fact that Maltiez could've hid something else in that obfuscated code is really concerning to say the least, I'll leave it at that.

[Diff]

19 minutes ago, WrenFox said:

The fact that Maltiez could've hid something else in that obfuscated code is really concerning to say the least, I'll leave it at that.

Maltiez's code wasn't obfuscated, just hidden under the bones of a bundled dependency. Hidden well. Even knowing it existed, it took me a while to find it.

But once found, it's easily read. We can speak confidently about what the code did and didn't do. From my own research into it, the summary in the OP is pretty comprehensive. It mentions things I have found in the code myself and that I've seen missing from other summaries of the mod's behavior.

Edited yesterday at 08:33 PM by Diff

[Teh Pizza Lady]

16 minutes ago, WrenFox said:

could've hid something else in that obfuscated code

could have, but didn't, so speculating on it is useless and in line with the actions that got other forum members silenced/sent to vacation island.

[WrenFox]

1 minute ago, Diff said:

Maltiez's code wasn't obfuscated, just hidden under the bones of a bundled dependency.

Oh, my apologies.
Maybe I've just read from the wrong sources and stumbled upon some false information as the drama is still very much ongoing (looking at the VS subreddit) and I was recently notified about this, still I hope this drama doesn't get too out of hand.

[greed23]

7 minutes ago, Diff said:

Maltiez's code wasn't obfuscated, just hidden under the bones of a bundled dependency. Hidden well. Even knowing it existed, it took me a while to find it.

But once found, it's easily read. We can speak confidently about what the code did and didn't do. From my own research into it, the summary in the OP is pretty comprehensive. It mentions things I have found in the code myself and that I've seen missing from other summaries of the mod's behavior.

I think a lot of people are using obfuscated incorrectly, but mean "obscured" or "hidden".  I understand that's not what it actually means, but the sentiment when people say he "obfuscated his code" is that he did something to make it really hard to find, far harder than it should be, and omitted it from public git

[VANTABlack2000]

3 minutes ago, WrenFox said:

Oh, my apologies.
Maybe I've just read from the wrong sources and stumbled upon some false information as the drama is still very much ongoing (looking at the VS subreddit) and I was recently notified about this, still I hope this drama doesn't get too out of hand.

It seemed out of hand for a while, but I think things have calmed down now. Lot's of things were thrown around and it got confusing, but I think this thread is better now. I will admit I was part of the problem in all of the chaos trying to figure out what was going on and commenting in threads.

[Banch]

As someone who doesn't play on servers, this incident is the first I'm ever hearing of the cheat client this code was apparently in there to stop. It feels weird and unnecessary that I've had this "feature" in my singleplayer worlds the whole time...

[A_British_Lass]

insane that he's not been banned from the mod db yet 

 

[-Glue-]

Thank you for the clear and concise rundown. Its hard to piece everything together through all the disjointed forums, as someone who is not on the Discord.

I think while the actions Maltiez took were morally understandable, in that they were attacking cheaters, the way they went about it was absolutely reprehensible, and a major breach in trust. It would be one thing if they were just a modder. People could simply make the choice to stop using their mods or not. However, the fact they are now an official developer at Anego, and this information was kept hidden, does damage the trust in the studio as a whole.

I know Tyron and the rest of the team would never do, or allow anything to negatively affect their game, or the user experience. However, the way this whole situation was handled was just awful, and does significantly damage trust. Instead of simply making an official announcement, laying out the facts, and informing us of what is happening/being done, they chose start hiding forums. Apparently even banning people from the Discord as well. Which only serves to further damage trust, and let the issue fester.

This is where my issue lies. Moderators chose to try and cover up the issue, instead of simply clear the air with facts. The only post I have seen from a moderator, or dev themselves, was Tyron saying he wasn't going to allow inflammatory titles, before locking and hiding posts. Which simply does not look good under any circumstances. It comes across as sweeping the issue under the rug, denying the problem.
If this was handled better by the mods and devs here, I don't think it would have been blown out of proportion quite as much.

As for Maltiez. I'm not sure. I don't think they would be so bold as to do something like this in an official update, but I don't feel as comfortable having them on the team now... I really just want to hear from the team to know what is being done, what they are thinking.

[Teh Pizza Lady]

2 hours ago, greed23 said:

I understand that's not what it actually means, but the sentiment when people say he "obfuscated his code" is that he did something to make it really hard to find, far harder than it should be, and omitted it from public git

this is accurate

55 minutes ago, Banch said:

As someone who doesn't play on servers, this incident is the first I'm ever hearing of the cheat client this code was apparently in there to stop. It feels weird and unnecessary that I've had this "feature" in my singleplayer worlds the whole time...

An understandable position to have!

29 minutes ago, A_British_Lass said:

insane that he's not been banned from the mod db yet 

 

From what I've heard because so many mods rely on his (PMLib, ConfigLib to name the biggest two), banning him would effectively cripple the modding community. I'm sure Anego has something planned for him, but until something official is released, we can only speculate which is useless in this thread and in line with what got others sent to vacation island.

4 minutes ago, -Glue- said:

I think while the actions Maltiez took were morally understandable, in that they were attacking cheaters, the way they went about it was absolutely reprehensible, and a major breach in trust. It would be one thing if they were just a modder. People could simply make the choice to stop using their mods or not. However, the fact they are now an official developer at Anego, and this information was kept hidden, does damage the trust in the studio as a whole.

It'd debatable whether the responsibility of action fell in Maltiez's hands. If it did not, then his actions fell short of morally upright because he took matters into his own hands. I do not care for cheaters. They have no place in multiplayer games. Something must be done, but it must be done right and through the proper channels. Otherwise all we have is anarchy in the name of the greater good.

7 minutes ago, -Glue- said:

This is where my issue lies. Moderators chose to try and cover up the issue, instead of simply clear the air with facts. The only post I have seen from a moderator, or dev themselves, was Tyron saying he wasn't going to allow inflammatory titles, before locking and hiding posts. Which simply does not look good under any circumstances. It comes across as sweeping the issue under the rug, denying the problem.
If this was handled better by the mods and devs here, I don't think it would have been blown out of proportion quite as much.

As for Maltiez. I'm not sure. I don't think they would be so bold as to do something like this in an official update, but I don't feel as comfortable having them on the team now...

You're missing a LOT of context from the VS discord then. I won't get into all the details of it because I feel @icesharkk has done a good enough job summarizing it here. Plus we still don't know all the details, just what ShadowFox could tell us in her brief QA session on the Discord. However, the facts remain that damage was being done against the names of Maltiez and Anego by people who weren't in a position to do said damage. Any damage done to Maltiez should be done by Anego. Anego doesn't bear the blame for this because they simple were not given all the information until it was too late. Given how rabid things became, I think shutting down the discourse before it turned into a full-blown doxxing witchhunt was the right call.

As for Maltiez, he only ever was officially an advisor to the devs and only for the combat portion of the 1.23 update. I don't think he had access to the code. ShadowFox has already assured us that any code he does submit will go through rigorous review before it is allowed to be part of the game.

[-Glue-]

3 minutes ago, Teh Pizza Lady said:

You're missing a LOT of context from the VS discord then. I won't get into all the details of it because I feel @icesharkk has done a good enough job summarizing it here. Plus we still don't know all the details, just what ShadowFox could tell us in her brief QA session on the Discord. However, the facts remain that damage was being done against the names of Maltiez and Anego by people who weren't in a position to do said damage. Any damage done to Maltiez should be done by Anego. Anego doesn't bear the blame for this because they simple were not given all the information until it was too late. Given how rabid things became, I think shutting down the discourse before it turned into a full-blown doxxing witchhunt was the right call.

As for Maltiez, he only ever was officially an advisor to the devs and only for the combat portion of the 1.23 update. I don't think he had access to the code. ShadowFox has already assured us that any code he does submit will go through rigorous review before it is allowed to be part of the game.

This is exactly why I think the first thing that should have been done was an official post about the issue. There is so much misinformation and bias being flung around, its hard to know exactly what is happening. All I do know, is hiding forum posts about the topic was the WORST thing that they could have done here. The intention of the action does not matter here. What matters is the communities perception of said action. In this case, it was perceived as hiding information and minimizing concern to save face. Because in most cases, thats how companies would handle something like this.
I'm not saying that IS what's happening, but its how people will see it under those actions. They need to appeal to the emotions that people are feeling. Trying to simply put out the flame will only be seen as an attack.

[Paruza]

It's a really rough situation for VS honestly.

It's absolutely not acceptable to be posting binaries on the moddb that do not reflect the published source. It's not acceptable to post things on moddb that take actions that are hard for users to understand or have nothing to do with the mods stated purpose. And, of course, it's not acceptable to knowingly post malicious content on moddb. All of this put together is absolutely grounds for an immediate lifetime ban.

I am no expert but some of this may cross into overtly illegal territory in some areas:

The United Kingdom: Computer Misuse Act 1990 (CMA)
https://www.cps.gov.uk/prosecution-guidance/computer-misuse-act#:~:text=Section 3%3A Unauthorised Acts with intent to,will do one of the things set

The United States: Computer Fraud and Abuse Act (CFAA)
https://uscode.house.gov/view.xhtml?req=(title:18 section:1030 edition:prelim)#:~:text=(5)(A) knowingly causes the transmission of a,damage without authorization%2C to a protected computer%3B

The secret part of this is important. People thought they were downloading a ConfigLib, not an "anti-cheat". Practically speaking, is someone going to come after him for damages for any of this? No, this is small potatoes, but it is almost certainly illegal in many places.

This sort of thing has happened before in a lot of various ways, for various reasons. There was a case recently where intentionally buggy (effectively malicious in this context) code was submitted to the Linux kernel by some security researchers at the University of MN ostensibly to test the submission process, the whole school was banned from further contributions and an independent audit of everything they ever submitted to the kernel had to be conducted. Because when trust is broken... it's broken right? You don't know this is the only malicious thing he's ever done, he's demonstrated he's willing to behave in this way and now some people have to go over all his stuff with a very skeptical eye. There have been several cases of package maintainers taking similar actions in Linux repos, all banned. There have been various gaming modding authors doing various similar things, almost universally banned. There was a JS library author that published malicious code that destroyed data on computers that had geoip data pointing at Russia shortly after the war in Ukraine started. Totally understand that one honestly, but geoip isn't perfect and you bet people around the world forked that immediately.

The question of if you agree with any of these or not is far less relevant than the question of ongoing supply chain trust. Is Maltiez just an important special little snowflake that gets to violate the TOS while others don't? Will this behavior if left unpunished cause other potential "do-gooders" to do some good on your computer as well?

It's not *what* he did, it's that he did it in secret.

What makes this especially difficult is that it seems that some members of the VS team knew about it and did nothing. I don't care if he didn't violate *your* trust, it's *my* computer. 

Edited 22 hours ago by Paruza

[Nossin]

Maltiez distributed a malware through VS's mod database to thousands of users with malicious intent to target a specific group with little concern for any victims caught in the crossfire.

Just because the malware itself was tame, does not downplay the huge liability issues this created for VS

If VS cannot follow their own policies and terms of service, then we deserve the shitstorm that comes after.

[321BoltsOfLightning]

I'm a little confused as to why some people are reacting as strongly as they are. Yes it wasn't something that should've been done, but it's not like it was harming people's computers. It's also already been removed as of quite a while ago. No real harm done, imo. I worry that people are running with misinformation and/or letting their emotions be overly played on by others. 

Thanks for the compilation of information. 

[Teh Pizza Lady]

35 minutes ago, 321BoltsOfLightning said:

I'm a little confused as to why some people are reacting as strongly as they are. Yes it wasn't something that should've been done, but it's not like it was harming people's computers. It's also already been removed as of quite a while ago. No real harm done, imo. I worry that people are running with misinformation and/or letting their emotions be overly played on by others. 

Thanks for the compilation of information. 

As a software dev myself I can answer this.

First it's about trust. Maltiez is on the VS team, hired by Anego, to advise them on the combat update. When a company hires an individual and then the individual does something bone-headed while on the payroll, that person, being an extension of the company, actively harms that company by doing so. Maltiez lied by not communicating clearly what his code was doing, broke the ModDB TOS, and actively harmed people's gameplay by coding his widely-downloaded core library mods to have anti-cheat code in them that was falsely flagging mods that weren't being used for cheating. Maltiez broke that line of trust by his actions and while he is still employed by Anego, he is harming the line of trust that we have in the company to produce a good video game and deliver on their promises. If we cannot trust the employees, we cannot trust the company.

Second it's about the legality of what he did. Had he gotten approval from Anego via the proper channels instead of misconstruing what his code did either accidentally or deliberately and thus misleading the game devs about what it did, then his malware could be considered a feature. Many game companies have hidden malware in their code that breaks the game if you pirate it. It's very effective and hard to detect because the game still allows you to play somewhat but your experience will be harmed until you play a legit copy of the game. That said, Maltiez didn't get approval to do this. His code did not affect only the users of the cheat mod, it affected innocent bystanders. Two mod authors independently came to him because their legitimately obfuscated code was tripping his detection and breaking their mods. He whitelisted them and left the detector running for everyone else. At that point it stopped being a feature that misfired and became code he knew was hitting the wrong people and shipped anyway. That is not allowed and breaks a few laws concerning malware in different areas of the globe.

Third his attitude around the whole thing was lacking. He acted as if he had the right to make the decision to combat the cheat mod himself. His anti-cheat was targeted, and poorly at that, against a single known cheat mod. When eventually caught he was flippant, and even blamed the person who caught him out for ruining his work. He dismissed accusations with "Oh well, it worked so I'm happy." as if that solved the problem of the code existing in the first place and then when pressed, he relented and removed the code or so he claimed. He only removed it from a few editions that contained it, not all of them. ModDB moderators had to go through his released and pull many versions themselves. 

So not only did he lie to the VS team, he lied to us, broke laws, and acted like we were the problem, not him.

That is not the kind of dev you want on your team.

Edited 18 hours ago by Teh Pizza Lady
rewording a few things to be precise in what I mean