The configlib/maltiez Incident so far.

[Trace]

Just got word of all this, and decided to uninstall VS.  If this dev team is going to circle the wagons over this extremely shady behavior, well, it's been fun but my free time is short and my backlog of games is long.  I'll seek my entertainment elsewhere from more reputable sources.

[Paruza]

"Many game companies have hidden malware in their code that breaks the game if you pirate it."
Depends what you mean specifically by "hidden". Games that have invasive anticheat definitely are very clear about what general capabilities it has, and you are agreeing to that when you install the game, accept the ToS, etc. The intent is not at all hidden. One could debate about the details, and there's plenty to be said about how problematic kernel level anti-cheat is, but those are different topics.

"Yes it wasn't something that should've been done, but it's not like it was harming people's computers."
He did significant actual harm here. The core issue is one of trust. He abused his standing in the community to install malicious software without disclosing that functionality. It's harmed VS's reputation, this is going to turn people away from the game, it's going to create a press shitstorm. He demonstrated his willingness to behave in this way, so you can't trust anything he claims about the rest of his code. So now people are going to have to comb through all of this and verify if he is in fact telling the truth now. The amount of time he's ultimately costing people picking up the pieces from this is going to be huge.

Aside from that, the people affected would definitely disproportionately not even be the intended targets. A tiny percentage of people play VS play on public servers. The VAST majority play either solo, or on private servers with some few friends. That's not an environment where hacking is a relevant point of discussion. I don't know the details on what circumstances would cause crashes and D/C's however I can say I've run a private server myself for my own use and used xray mods to learn how prospecting works and various other things. Nothing wrong with that, do you think I would want to be dealing with that bs? Do you think the developer that ultimately had to dig into his code to fix the problem it was causing wanted to be spending his time on that?

I could go on. They really need to make an example of him, I don't care what mods he made, we can move on without him.

Edited 20 hours ago by Paruza

[Dilan Rona]

I'm going to continue playing Vintage Story. I still trust the devs, and will wait for proper feedback. As far as Maltiez and his mods, I removed them from my modlist, and will not be installing them again. Mods that rely on config lib and imgui unfortunately had to be removed as well, due to their dependency on config lib and imgui.

 

[Compressed12Times]

58 minutes ago, Teh Pizza Lady said:

First it's about trust. Maltiez is on the VS team, hired by Anego, to advise them on the combat update. When a company hires an individual and then the individual does something bone-headed while on the payroll, that person, being an extension of the company, actively harms that company by doing so. Maltiez lied by not communicating clearly what his code was doing, broke the ModDB TOS, and actively harmed people's gameplay by coding his widely-downloaded core library mods to have anti-cheat code in them that was falsely flagging mods that weren't being used for cheating. Maltiez broke that line of trust by his actions and while he is still employed by Anego, he is harming the line of trust that we have in the company to produce a good video game and deliver on their promises. If we cannot trust the employees, we cannot trust the company.

Second it's about the legality of what he did. Had he gotten approval from Anego via the proper channels instead of misconstruing what his code did either accidentally or deliberately and thus misleading the game devs about what it did, then his malware could be considered a feature. Many game companies have hidden malware in their code that breaks the game if you pirate it. It's very effective and hard to detect because the game still allows you to play somewhat but your experience will be harmed until you play a legit copy of the game. That said, Maltiez didn't get approval to do this. His code did not affect only the users of the cheat mod, it affected innocent bystanders. Two mod authors independently came to him because their legitimately obfuscated code was tripping his detection and breaking their mods. He whitelisted them and left the detector running for everyone else. At that point it stopped being a feature that misfired and became code he knew was hitting the wrong people and shipped anyway. That is not allowed and breaks a few laws concerning malware in different areas of the globe.

Third his attitude around the whole thing was lacking. He acted as if he had the right to make the decision to combat the cheat mod himself. His anti-cheat was targeted, and poorly at that, against a single known cheat mod. When eventually caught he was flippant, and even blamed the person who caught him out for ruining his work. He dismissed accusations with "Oh well, it worked so I'm happy." as if that solved the problem of the code existing in the first place and then when pressed, he relented and removed the code or so he claimed. He only removed it from a few editions that contained it, not all of them. ModDB moderators had to go through his released and pull many versions themselves. 

So not only did he lie to the VS team, he lied to us, broke laws, and acted like we were the problem, not him.

That is not the kind of dev you want on your team.

My exact feelings about this whole shmuck, you couldn't encapsulate it better.

There definitively need to be more repercussions other than pulling some releases of configlib though.

[Elias Ainsworth]

not touching the game nor suggesting it to others until this loser is removed from the company, i expect a video to be posted on the VS YT channel discussing what happened and a fully transparent detail on what happened with him after he was removed, the team needs to do their job and be open with the community who was affected by this

[Elias Ainsworth]

44 minutes ago, Dilan Rona said:

I'm going to continue playing Vintage Story. I still trust the devs, and will wait for proper feedback. As far as Maltiez and his mods, I removed them from my modlist, and will not be installing them again. Mods that rely on config lib and imgui unfortunately had to be removed as well, due to their dependency on config lib and imgui.

 

thats an annoying part, so many ppl trusted this losers mods that they built theirs off of it and i feel so bad for them bc they are gonna have to go back through and re-code them, bc nobody is going to use this losers mods anymore 

[lizardsprint]

56 minutes ago, Trace said:

Just got word of all this, and decided to uninstall VS.  If this dev team is going to circle the wagons over this extremely shady behavior, well, it's been fun but my free time is short and my backlog of games is long.  I'll seek my entertainment elsewhere from more reputable sources.

Same. I've bought so many copies of the game for people, too, which is sad. I ran a server for all those friends, but have decided to shut it down tonight after learning of this, will warn all of them and others, and uninstall the game myself.

Sure, in terms of malware, what's currently known is rather tame in the grand scheme of things, compared to actual malware that scans for personal documents, cryptocurrency wallet keys, etc., but what else is there that we can't see, especially in builds of VS itself given he works at the company?
Their downplaying, odd choice of wording ("we trust all his other code does exactly what he says it does" especially after already knowing about the malicious code), and backpedaling/contradictions is all very shady, and I just don't want to deal with that broken trust or have their code running on my systems. I have plenty of other games from much more professional developers in my library.

[Vratislav]

As I have written in next thread, I am waiting for solid official response oriented particularly on the future approach to mods and code review. 

Until then, just some comment on forums moderation and approach to community. I have some experience with such situations from the other side, from a NGO with team about 20 people, that is, I assume similar size as the studio. Guilty or not, to react to such public backlash properly is not easy if you are not trained for it and if you have not prepared procedures for this beforehands. Even experienced moderators and Tyron himeslf may make mistakes if there is not clear guidance. That's why I am not angry much, as what I see from the studio's people reactions, there is no bad intent, they are just desperately trying to keep situation under control, when missing proper tools or guidance. This is also not against community, do not take it like way to fool you people. Good damage control approach must be set up with the fanbase and its trust in mind, otherwise it is not good.

Rules of communication in crisis are in fact, quite simple: There must be clear, what exactly to communicate. The main message must be "we are making steps that we announce as soon as they will be prepared or implemented." . All channels must communicate the same message or be silent until the message is specified. There must be somebody, who is in charge on communication, who coordinates all communication, formulates answers for the most serious concerns, and prepares factual reactions to mininfomration - and who is ready to do it full time in such situation, so the role cannot be joined, e.g. with team leader, who has own problems. If you have no such structure prepared before the crisis hits... God help you.

And this is the reason I cannot be angry much for clumsy way of handling the forums now. Just pity that the collateral damage is getting larger.

[Angius]

Since this seems to be the closest thing to a megathread, lemme crosspost my mod provenance suggestion. tl;dr: there are ways to guarantee that the mod files uploaded to the moddb have been built from the exact specific code in a public repository.

One of the reasons the whole ConfigLib conundrum feels so malicious, is that the "anticheat" code did not exist in the public repository. This time it was something somewhat benign, yes, but what's stopping someone from uploading a zipbomb? Some sort of provenance system is, IMHO, necessary.

[wutamidoing]

Just ban them and their mods from the mod website and fire them. No point in tainting your game over someone like them. 

[VANTABlack2000]

2 hours ago, Vratislav said:

As I have written in next thread, I am waiting for solid official response oriented particularly on the future approach to mods and code review. 

Until then, just some comment on forums moderation and approach to community. I have some experience with such situations from the other side, from a NGO with team about 20 people, that is, I assume similar size as the studio. Guilty or not, to react to such public backlash properly is not easy if you are not trained for it and if you have not prepared procedures for this beforehands. Even experienced moderators and Tyron himeslf may make mistakes if there is not clear guidance. That's why I am not angry much, as what I see from the studio's people reactions, there is no bad intent, they are just desperately trying to keep situation under control, when missing proper tools or guidance. This is also not against community, do not take it like way to fool you people. Good damage control approach must be set up with the fanbase and its trust in mind, otherwise it is not good.

Rules of communication in crisis are in fact, quite simple: There must be clear, what exactly to communicate. The main message must be "we are making steps that we announce as soon as they will be prepared or implemented." . All channels must communicate the same message or be silent until the message is specified. There must be somebody, who is in charge on communication, who coordinates all communication, formulates answers for the most serious concerns, and prepares factual reactions to mininfomration - and who is ready to do it full time in such situation, so the role cannot be joined, e.g. with team leader, who has own problems. If you have no such structure prepared before the crisis hits... God help you.

And this is the reason I cannot be angry much for clumsy way of handling the forums now. Just pity that the collateral damage is getting larger.

The more I see things go on with this drama the more it feels like things were just done clumsily not maliciously. There are some bad screenshots of certain people on the Discord, but at least on the forums I think it's been just trying to get things in control before making a proper response and trying to figure things out.

Though I think a big part of the problem is that many announcements were made on the Discord, but not here, so it seems like you have to be on the Discord to get information which IMO isn't a good choice because Discord is starting to lose users for shoving Nitro and Ads everywhere. If the Forums was the main way to get information on VS over the Discord then things would have been a lot more open IMO since the forums ARE Vintage Story it isn't owned by someone else if that makes sense.

I am not going to do anything rash like requesting a refund right now and am just going to wait and see if they issue a response here.

[Dilan Rona]

10 minutes ago, VANTABlack2000 said:

Discord is starting to lose users for shoving Nitro and Ads everywhere

Or like their mass ban hammer purge of a lot of users for the "crime" of wrong think. Lots of people never got their accounts back after it was stolen and deleted by Discord T&S. Announcements need to be on the forum, where they belong.

And I agree, this whole situation could have been handled better, instead of just banning people off the vs discord, and sweeping the matter under the rug.

Edited 17 hours ago by Dilan Rona

[Vesk Aida]

I have been a fan of Maltiez's Vintage Story mods for many years: he is an excellent modder with a high standard for quality content along with him being a Vintage Story team-member makes this betrayal shocking. This is case is far more severe than that of a similar case of malicious code inserted into mods for the game "Star Sector", the "Lost Forest" mod feuding with the "RJW" in Rimworld, or others.

1. It is completely inexcusable to include malware (deliberate crash code) in software you are transmitting to other users who are not both aware of and consenting. The fact that Maltiez freely admits to this in Discord and commit notes is shocking.
   1. This is not 'white hat' code, e.g. crashing the Vintage Story program if it detects an infinite loop, memory leak, or similar serious problem with functionality. Protecting the user from harm.
   2. This is not 'grey hat' code, e.g. 'defensively' crashing a program to stop hackers from accessing a server. Causing harm for justifiable reasons, e.g. 'ends justify the means', or in legally/morally vague ways.
   3. This is clearly 'black hat' code, since it is undocumented, obfuscated, and can operate on legitimate paying Vintage Story customer's devices simply because of their modding choices, let alone any bugs which may have caused the malware to fire inappropriately. Causing harm deliberately and consciously, for harm's sake. Yes, this malware merely causes 'a hard crash', so it is not particularly severe outside of disrupting the Vintage Story application, but either is it excusable..
2. To deliberately add this code to multiple versions of a mod shows a clear pattern of intent that this was intended behavior.
3. To hide the existence of this crashcode (not documenting it) shows clear understanding that this behavior is unethical and 'needs' to be hidden.
4. Obfuscating the code shows further proof this author knew their behavior was unethical. Edit: Does not appear any of the mod's code was obfuscated.
5. The fact Maltiez defended his actions shows a clear lack of repentance and level his commitment to this behavior.
6. That Maltiez described his intent to add further code which would have harvested and/or transmitted client-side data, despite his inability to implement such a feature, shows a clear violation of user's privacy and trust, as well as potentially violating laws. Edit: This was merely discussed, with no proof it was ever developed or implemented. Though given the lack of transparency about this crash code, perhaps that should be taken with healthy skepticism.

Furthermore

1. It is particularly frustrating to see so much sustained and juvenile behavior from the official Vintage Story server's Discord Moderators. Harassing and insulting users who are acting reasonably and are understandably upset about this situation is inexcusable; including telling users to stop discussing this malware situation in a thread dedicated 'to' that mod, accusing them of being "off-topic", etc. Frankly, these moderators should resign, be fired, or be re-trained to a much higher standard. Very unprofessional and completely tone-deaf to the situation and seriousness, for the sake of 'internet moderator' "I'm an important person on the internet" bawking.
2. It is also painful seeing users in the Vintage Story official Discord server defending Maltiez's actions, especially antagonizing, trolling, and harassing other users. I understand some of these users may not have the technical understanding or context of what happened here, or are acting merely out of emotion for a beloved mod author, but this behavior is completely out of touch and shows serious ignorance to what has transpired and should be condemned. It upsets me that most of these conversations are still present in the Discord server, and there seems to be no moderation action taken against them.

In Conclusion

The Vintage Story community deserves a clear and direct response from Tyron once the team has decided upon a course of action.

I feel strongly that:

• All of Maltiez's mods should be removed from the official Vintage Story website, if only temporarily pending manual code review. But until then the risk and severity of this case is too high for an author who so deliberately hide crash code from his own userbase over such a long period of time.
• All of Maltiez's contributions to vanilla Vintage Story should require a manual code review. Anything less would seriously undermine the community's trust in that product.

 

Edited 9 hours ago by Vesk Aida

[Zaldaryon]

6 hours ago, Teh Pizza Lady said:

Maltiez is on the VS team, hired by Anego, to advise them on the combat update.

Just an fyi, while it's what people think, there is no proof he was hired to touch the combat system. afaik I've read in the public Discord, it's not about combat at all.

[Rainbow Fresh]

29 minutes ago, Vesk Aida said:

The fact that Maltiez described his intent to add further code which harvested/transmitted client-side data, despite his inability to implement such a feature, shows a clear violation of user's privacy and trust, as well as potentially violating laws.

Source? I re-read this entire supposed "ground truth mega thread" and didn't find any mention of this yet.

 

31 minutes ago, Vesk Aida said:

To obfuscate the code shows an even further level of malice, and further deliberate intent of unethical behavior.

It wasn't obfuscated, just hidden, which is your previous point.

[VANTABlack2000]

47 minutes ago, Zaldaryon said:

Just an fyi, while it's what people think, there is no proof he was hired to touch the combat system. afaik I've read in the public Discord, it's not about combat at all.

Sorry if this is out of touch or something, but is it possible Maltiez is advising on stuff for the update, but not specifically the combat system? Though tbh I am assuming the "Combat Update" is the next major update, but it's been a while since I have seen specific names to a VS update just some seen some stuff that is supposed to be added. No need to answer if that is private Anego information too I should add.

I tend to pay close attention to wording, so I noticed they said "Combat Update" not "Combat System" though with how often I have seen that said I wouldn't be surprised if others said "Combat System"

Also thanks for coming in and fact checking some things.

[williams_482]

7 hours ago, Trace said:

Just got word of all this, and decided to uninstall VS.  If this dev team is going to circle the wagons over this extremely shady behavior, well, it's been fun but my free time is short and my backlog of games is long.  I'll seek my entertainment elsewhere from more reputable sources.

6 hours ago, lizardsprint said:

Same. I've bought so many copies of the game for people, too, which is sad. I ran a server for all those friends, but have decided to shut it down tonight after learning of this, will warn all of them and others, and uninstall the game myself.

I'd advise anyone to wait until they actually "circle the wagons" around this guy before deciding that this dev team (and by extension their game) are disreputable. This is a small team, likely lacking anyone with real public relations training, who just stumbled into an unexpected and very tricky situation. Here we have:

- A recently hired employee, and also creator of a large number of very popular, functionally load-bearing mods, who did something which is clearly bad and ill advised but with apparent good intentions, and reacted very poorly when this came to light.

- A large group of people who are justifiably angry, but have also whipped themselves into a frenzy over exaggerated claims of exactly what this guy did and why, and are demanding immediate and harsh action against them.

Anego knows this is a serious situation and they are taking time to get all the facts and make a careful, considered decision of what to do. Taking that time to make the best decision possible is clearly the correct process here. Judge them for their final decision when they've actually made one. 

[williams_482]

11 hours ago, Nossin said:

Maltiez distributed a malware through VS's mod database to thousands of users with malicious intent to target a specific group with little concern for any victims caught in the crossfire.

(Emphasis mine)

I want to be clear on something which is being obscured in this statement and others like it: that "specific group" which Maltiez targeted were the developer and users of a *paid* mod designed for the purpose of cheating on multiplayer servers. A "specific group" who either paid money for the ability to harm other players, or were happy to earn money facilitating that harm. The mod and developer have not been named because they are a cancer on the community and advertising for them does us all a disservice. 

Maltiez's actions were, in my opinion, ill-considered and both legally and ethically dubious. I am not defending the actions or the person. But I also think understanding the motives here is useful. 

[Paruza]

6 hours ago, Vratislav said:

Even experienced moderators and Tyron himeslf may make mistakes if there is not clear guidance. That's why I am not angry much, as what I see from the studio's people reactions, there is no bad intent, they are just desperately trying to keep situation under control, when missing proper tools or guidance.

I agree completely with this. I'm not angry with the VS studio  *yet* . It's easy to see how this can happen, it's easy to understand how the communication thus far could be misguided and fragmented. It's not optimal, but I'm fine with that. What matters is what they ultimately decide to do. Fortunately there's plenty of past examples of how you deal with this kind of thing, and the consequences for the studio if they don't handle it well.

[lizardsprint]

33 minutes ago, williams_482 said:

who just stumbled into an unexpected and very tricky situation.

...

Anego knows this is a serious situation and they are taking time to get all the facts and make a careful, considered decision of what to do. Taking that time to make the best decision possible is clearly the correct process here. Judge them for their final decision when they've actually made one. 

It's really not a tricky situation at all, and their actions so far have been showing the exact opposite of this, that they don't really think this is a serious situation. I don't deal with games, or developers of games, that intentionally harm/degrade the experience of players because of their own grudges or insecurities, whether it's with DRM like Denuvo, always-online connections/spyware, rudimentary "malware" like this one, or of course actual malware in games.

The "motive" does not really matter. The "motive" behind Flock/Axon cameras is to "stop criminals" but they are routinely abused for cop's or random 3rd party individuals with access own personal interests/motives.

I have plenty of other games in my library whose developers let me play how I want that don't have a track record of endorsing, or downplaying, harmful software in their game/mods, especially by one of their own developers. No need to bother with wannabe-arbiters of gameplay.

Edited 12 hours ago by lizardsprint

[Nossin]

8 minutes ago, williams_482 said:

(Emphasis mine)

I want to be clear on something which is being obscured in this statement and others like it: that "specific group" which Maltiez targeted were the developer and users of a *paid* mod designed for the purpose of cheating on multiplayer servers. A "specific group" who either paid money for the ability to harm other players, or were happy to earn money facilitating that harm. The mod and developer have not been named because they are a cancer on the community and advertising for them does us all a disservice. 

Maltiez's actions were, in my opinion, ill-considered and both legally and ethically dubious. I am not defending the actions or the person. But I also think understanding the motives here is useful. 

If you want to go further:

Maltiez actually went to Anego and suggested an "anticheat". Ultimately this was not feasable for Anego and it was up to server hosts to manage their servers, whitelist, ban bad actors, etc. Then Maltiez added a malware to their mods after being told no. According to Maltiez themself, the malware was successful and the cheat mod maker had given up and discontinued their mod.

 

So then why keep the malware in? Why create a blacklist after other modmakers contacted Maltiez after figuring out their mods were causing issues instead of removing the malware?

Then Maltiez started doubling down and justifying themself. There is a reason vigilante behavior is not good, because ultimately taking down the "bad guys" became more important that protecting the victims

[Paruza]

10 minutes ago, williams_482 said:

Maltiez's actions were, in my opinion, ill-considered and both legally and ethically dubious. I am not defending the actions or the person. But I also think understanding the motives here is useful. 

It's not useful because it's not the important part of this. I don't care what his motives were, literally at all.

What he claims his motives to be, cannot be taken at face value at this point. His actions are costing a lot of people a lot of time auditing his code, forking it, etc. To say nothing about the admins having to do extra work removing his mods and dependencies, cleaning up their worlds, debating this on forums. And the damage and efforts the dev team themselves will have to go through to resolve this situation as well.

[lizardsprint]

5 hours ago, Angius said:

One of the reasons the whole ConfigLib conundrum feels so malicious, is that the "anticheat" code did not exist in the public repository. This time it was something somewhat benign, yes, but what's stopping someone from uploading a zipbomb? Some sort of provenance system is, IMHO, necessary.

It feels so malicious because this is what a lot of software developers that end up torching their reputation and putting actual malware (ones that will encrypt all your shit in exchange for Monero, and/or steal your wallet keys, ID documents, bank login credentials, etc.) into their software do. He's literally following in their footsteps, and it's likely he would've escalated had he not been caught.

[Jhoryn]

Howdy. I'm a quiet lurker and been reading everything in the hopes of reassurances, and understand a lot of the anger comes from the lack of clarity and loss of trust. Please note, the following is questioning the code/mod itself and not Mal/the mod dev. I won't attack a person I don't know and have never interacted with.

Bold is for TLDR

From a User/Player standpoint, the two biggest questions needing reassurance are

1. Is ConfigLib safe to use in its current version?

This event is a reminder that mods are code, and that code is shared on a basis of mutual trust. We players trust the mods to do exactly what they say they do and nothing more. Right now, that trust is shaky at best. In hindsight, Mal should have released the Anti-Cheat as a stand-alone download option. Let servers choose to use it, and it probably would've been as popular as the other mods. But, because that's not what happened here, people are understandably upset that a mod did way more than what they were told it did. Now, the safety of the code is being questioned. Can we trust a mod's code to do what it says it does?

2. If ConfigLib is safe, should we still use it, or should a new branch under new ownership be created?

Because ConfigLib (and the other mods) have become such a core feature of other mods, it can't simply be removed without adversely affecting other mod devs who have come to rely on it. It is, or was, a well built, useful mod. But, because trust has been lost, should a new forced branch of these questioned mods be created?

[MKMoose]

16 minutes ago, Jhoryn said:

1. Is ConfigLib safe to use in its current version?

Yes, it's entirely safe. It has always been safe* if you weren't also using a select few mods that had obfuscated code (most notably VS Radio and Caves and Caverns, apparently).

*Note that the current version is 1.13.2 (September 2nd release). If you haven't updated to it and are running a multiplayer server, then it is strongly recommended to do so, as it includes an important security fix.

 

16 minutes ago, Jhoryn said:

2. If ConfigLib is safe, should we still use it, or should a new branch under new ownership be created?

There is no practical reason to stop using it as of now, as it remains fully functional and safe. There is no substantiated reason to believe it will either stop working or become unsafe anytime in the near future, but if it does, it will be the result of an update, so you might simply want to be a bit more careful about updating it past 1.13.2.

Edited 12 hours ago by MKMoose