The configlib/maltiez Incident so far.

[MKMoose]

Tyron has posted an official statement regarding the situation. Sharing it here myself as official communication hasn't reached the Forums yet.

 

Edited 5 hours ago by MKMoose

[Grish]

They knew we were downloading malware,priceless.

What a joke at this point.

Zero respect for this entire company 

[Meiiolri]

yep. the response as it is, is not a worst one.
Though not adressing the thing going on with Maltiez when the malware came to light, and his doubling down on the uploading version again after deleting it is a mistake.
the whole thing hit few good points, but it is lacking far more in others.
lack of addressing that Maltiez malware detected false positives in other mods is another issue unaddressed.
Keeping Maltiez on tighter leash, i do not know how to feel about this one. it won't rewind the damage he did up to this point, and it might lead towards more animosity.
I can say only future will tell how this will affect the Vintage Story and Anegos Studio.

[Stellarbone]

Yea with this lackluster response, not even mentioning the false positives, keeping Maltiez, I can't in good conscience keep playing or recommending the game to friends. 

[Venseer]

The response was fine and I couldn't care less to what happens to Maltiez but could you guys at least have the gut to acknowledge the code did stuff it wasn't supposed to and apologize to the affected mod developers and users that had problems due to it? To anyone reading this from outside they have zero idea of what problems this caused to users.

 

All the modders getting false error reports confused to what was happening and users trying to figure out why they were crashing until this came to light, this entire clown show wasted so much collective time out of the community you should at least ackowledge and apologize for it.

[Handbananasplit]

Not mentioning the false positives when they are the only reason any of us know about this is a choice I guess. Trust is broken, obvious lies in your mea culpa is crazy.

[Meiiolri]

Time will tell what will happen in the coming days and future.
as i mentioned in my previous response, some of most important parts of the whole ordeal were not adressed.
eh gotta see the next response (at least im hoping this will not be the last response of Anegos Team regarding the recent events.)

[Eruannon]

Frankly I think it is high time I added my two cents here, as frankly I'd like to double check if I understood the statement by TyronX correctly.

1. Maltinez performed what could be argued illegal acts as per Directive 2013/40/EU, by adding malware to his library mods.
And yes, I am using Malware with full intent and meaning behind it - specifically code which intentionally interferes with whole or part of information system (in this case - client) without right (i.e. without user's authorization, as each and every single of those mods were listed as library mods, rather than anti-cheat mods, which is classic example of supply-chain attack, recently shown also in one of linux libraries, where additional payload was added after normal commits by same user), more than that - code was reportedly NOT included in official source files for the mods, making the deception and intent extremely clear.

Also - before this argument is used - no, 'but other mod was worse' is NOT an excuse in civilized world. Whitelisting of both users and mods is possible, and creation of mods that would facilitate it is possible as well. Vigilantism, unlike what comic books would like people to believe - is not legal in most, if not all, of Europe. 

2. Worse yet - Dev team KNEW of the illegal acts in question, at least partially, and never bothered to check if by chance the 'anti-cheat' measures don't cross from 'ok, good, let's address it' to 'dude, you are aware it's literally illegal right?'

3. Even given benefit of the doubt completely, and ignoring the point 2 for now - once the scope, scale and manner was made quite clear to the community, including Maltinez' own admission of it being effectively malware - the Anego Studios will STILL continue cooperating with known malicious actor, under supposed supervision (which already has failed given moddb was supposedly curated as well) on the main codebase, rather than just on mods [ironically - I'd be willing to make a claim that You have the reaction backwards. He should've been removed completely from main project first and foremost as known malicious actor, and maybe consider removing him from mod projects, as his own reputation would follow him, rather than other way around].

4. The official perspective of TyronX is that the execution in question (malware) is 'no big deal, as the correct targets were affected'. And here, I'd like to confirm, with TyronX preferably, whether his official stance is 'as long as correct targets were affected' it was fine with infecting large number of computers with malware via supply-chain attack, thus performing literal cybercrime, just because other malicious actors (with admittedly worse code effects, though again - we're talking malware here) were hit by it?

 

Whether Anego studio styles themselves as group of nerds or a company, it does not change the fact that as it stands currently - representative of the company/group is condoning criminal (malware distribution via supply-chain attack) acts, just because the excuse is noble. 

Honestly speaking I am fed up with how many people in various communities seem to consider that 'not a big deal', whenever this, or something similar happens. people try to excuse effectively criminal behaviour. Every single covert and semi-covert supply-chain attack begins as 'fix', 'security update' 'anti-tampering', 'testing kit' etc. Once the presence of such code is expected and stops being verified, the actual payload is then inserted, OR users get tricked into installing that update by claims of benign code. It baffles me, how much people give allowance to those actions, as long as the perpetrator gives good enough story to cover his back after they get caught. Usually by messing something up - such as here - giving a ton of false positives. It is especially egregious due to Maltinez being official part of the team working on the VS.

I will be watching further updates from the studio regarding the incident, and I honestly hope You get your stuff together and address the incident comprehensively. 'Tee heee, whoopsie' is not really acceptable response in my opinion, nor is 'yo he did good; he did it via malware, but he did it good, he got the worse guys', especially when we talk potentially criminal conduct as could be argued this incident is.

Edited 3 hours ago by Eruannon
added 'just because the excuse is noble." to condoning section.

[Vratislav]

1 hour ago, MKMoose said:

Tyron has posted an official statement regarding the situation.

I honestly believe this is not final statement on the situation. There was explanation and apology that I personally consider mostly acceptable. Still, the clarification was not responding to the the case of false positives, whose victims should deserve specific apology or some kind of compensation (if possible).

The most important: there are promises that shall be fulfilled ("We will write clearer rules/disclosure standards for mods maintained by Anego team members"). For me, this is rational approach if these rules will be made public after they are defined. 

Although I see it will be not good enough for many. I am not very sure if there even exist a response that would satisfy people, who want see the blood. I understand that various VS players have various values and differ in judging particular actions. There are people who value quality of the game more, there are people who value honor and purity of all contributors, there are people who have strong belief in particular principles that were clearly breached. Just for this reason, not everybody may be even theoretically fully satisfied with any outcome of this crisis. 

Finally, whoever is confident that some criminal activity happened in this case, he has full right (in fact, he is even obliged) to make appropriate announcement to the law enforcing authorities. However I am not really sure, if such approach will lead to better outcome for the quality of the game.

[Cicadas]

This exactly, as many other comments. Eruannon, sums it up greatly.

Maltiez deliberately produced Malware and distributed through a community repository. This is incredibly negligent and harmful. Regardless of the severity or justification of the intent. In laymen term, it would be like poisoning or tampering your favorite soda with a mild annoying flavoring that some people are affected by, and some others could potentially have severe allergic reactions.

Beyond that, the ignorant responses or the permissive behavior to Maltiez's actions is just astounding. No person I've worked with would do something like this and get away with it, they would be fired immediately and removed from the team.

[Cicadas]

Also to quote Tyron:

"As a result, all game servers using any of Maltiez’ 3 mods were effectively protected from malicious users attempting to use said cheat mod."

No they were not. It became another list item for me and my community admins, more development time from a server hosting perspective, of figuring out why certain mods were crashing. They did not protect my servers or my community from a would be boogeyman or modded hack client.

What genuinely has protected my servers and my community, is vetting and vouching for each other. Removing people who break our community rules. Self community moderation and building. Not vigilantism.

Edited 3 hours ago by Cicadas
Clarifying the affect and response by my community admins

[icesharkk]

I am severely disappointed with Tyron's response.  He spent 1/3 of his statement justifying the actions against the cheat dev, 0% of it is accountability for the impacted collateral damage, plans to continue employing the malware dev. that's it folks. I cannot with integrity fight back against the popular sentiment of "malware story". i hope the door hits my ass on the way out.

the only good thing is that maltiez's loses access to moddb and his mods will be transferred to custodianship other than maltiez. The latter doesn't matter the community already forked the code. that's a nothingburger solution. The former is good because we cant trust maltiez. unfortunately he is being retained to contribute on the base game but with oversight. "We have decided to retain the fox who ate your chickens, he no longer has access to the yard. He will however continue to have access to the henhouse. but with oversight!" 

I cannot in good conscious continue promoting this game or hosting servers for this game at this time. Three other unrelated communities I'm in have been referring to VS as malware story. I wont be sticking my integrity out by correcting anyone spitefully calling it malware story. That is the legacy wrought by these decisions

[KekkusMaximus]

1 hour ago, Cicadas said:

What genuinely has protected my servers and my community, is vetting and vouching for each other. Removing people who break our community rules. Self community moderation and building. Not vigilantism.

This is probably one of the things that enrage me the most about this whole debacle.

Maltiez justified their blatant disregard of both the community and the developers with the need to supposedly "protect game servers from cheaters" (even tho they themselves admitted of doing it more to mess with specific people rather than to protect the community at large) with something that is essentially incapable of actually doing that because it sets a delay between detection and repercussion, something that is reasonable to do in anticheats but that is fundamentally ineffective as an anti griefing measure since it leaves ample time to the cheater to do whatever they want with their cheats.

As always community servers need to focus on the actual solution to this kind of issues, which is building a solid community that is self immunizing against problematic individuals.

Maltiez essentially pushed malware down our throat because they thought they knew better and when it was made clear to them that what they did was having consequences outside of the intended scope, and not in a good way, their reaction was to feign superiority while throwing mod authors under the bus and calling the community toxic.

And Anego chose to keep this person within their dev team.

And somehow we should be fine with that? No thanks.

Edited 2 hours ago by KekkusMaximus

[River Oak]

>The official response wasn't posted on the official forum.
I'm disappointed but not at all surprised.

[IAmMoss]

I think Tyron's response is fine. they aren't public relations experts, and im going to give the benefit of the doubt and say he just forgot to add details, as i still trust the dev team. I don't think he was justifying maltiez's actions. He very clearly called his actions foolish. Hes also leaving the community nearly in every way as well as will be heavily scrutinized, which is fair in my eyes.

 

In regards to maltiez, i honestly can't say i'm surprised. He's a very sanctimonious person and absolutely does not care about what any one else thinks, refuses to answer honest questions, etc, etc. if his current mods are safe to use then the past is the past. They are great mods, and i hope they are kept at least functional by the dev team, or whoever they decide to hand them off too. That being said, at least temp banishment from the community is fair. I hope maybe one day he stops and realizes he was in the wrong.

[Teh Pizza Lady]

2 hours ago, icesharkk said:

I am severely disappointed with Tyron's response.  He spent 1/3 of his statement justifying the actions against the cheat dev, 0% of it is accountability for the impacted collateral damage, plans to continue employing the malware dev. that's it folks. I cannot with integrity fight back against the popular sentiment of "malware story". i hope the door hits my ass on the way out.

the only good thing is that maltiez's loses access to moddb and his mods will be transferred to custodianship other than maltiez. The latter doesn't matter the community already forked the code. that's a nothingburger solution. The former is good because we cant trust maltiez. unfortunately he is being retained to contribute on the base game but with oversight. "We have decided to retain the fox who ate your chickens, he no longer has access to the yard. He will however continue to have access to the henhouse. but with oversight!" 

I cannot in good conscious continue promoting this game or hosting servers for this game at this time. Three other unrelated communities I'm in have been referring to VS as malware story. I wont be sticking my integrity out by correcting anyone spitefully calling it malware story. That is the legacy wrought by these decisions

That's kind of where I'm sitting mentally at this point. I will still play the game and I'm confident that moving forward the team will improve, but right now, it's not in a good place and there's nothing that we, as normal players of the game, can do about it except to vote with our wallets if we feel that's necessary. This pains me because it hurts the company, but sometimes things must be done for the greater good. I'm sure Maltiez would understand.

Edited 6 minutes ago by Teh Pizza Lady
clarified something.

[LadyWYT]

2 hours ago, Vratislav said:

I honestly believe this is not final statement on the situation. There was explanation and apology that I personally consider mostly acceptable. Still, the clarification was not responding to the the case of false positives, whose victims should deserve specific apology or some kind of compensation (if possible).

This is my general thoughts on the matter too, though excluding compensation for the false positives simply because...well, I don't really know what would be appropriate for individual compensation, or how to sort out the legitimate false positives from those who are only taking advantage of the situation and claiming to be such.

I do raise an eyebrow at keeping Maltiez on board, as that's a rather bold move. I'm not sure I would make the same decisions if I were in Tyron's seat, but that's not to say that my decisions would be better either. We'll see how it plays out. As far as I'm aware, Maltiez is just in an advisory role, which is very different than handling the code itself, and Tyron himself reviews the code before it ever ships to players, so I'm not particularly worried about something slipping through the cracks(aside from the usual pesky bugs).

Regarding Maltiez's mods, I am happy about the custodianship thingy. It's one of the least disruptive options when it comes to the modding community, and to me at least it's better than trying to rely on forks that were, quite possibly, made out of spite.

The only thing I'm not particularly happy about is the fact that, at least at the time of writing this post, there has been no official announcement on the forums. I'm not really sure why that is, and it's possible that it got forgotten in all the kerfluffle or maybe just lost in the ether. But I avoid Discord(outside of talking to friends), and I don't trust Reddit at all, so the forums are the primary place I rely on for VS news, and I'm sure I'm not the only one.

3 hours ago, Vratislav said:

Although I see it will be not good enough for many. I am not very sure if there even exist a response that would satisfy people, who want see the blood. I understand that various VS players have various values and differ in judging particular actions. There are people who value quality of the game more, there are people who value honor and purity of all contributors, there are people who have strong belief in particular principles that were clearly breached. Just for this reason, not everybody may be even theoretically fully satisfied with any outcome of this crisis. 

Pretty much also how I see it, sadly. Ultimately, I think the game will be fine, though it's probably going to lose a chunk of the community over it(at least, I would be really surprised if the community didn't shed several players). Though I also don't think there's any response Tyron could have possibly given that wouldn't result in a chunk of the community leaving. It's definitely going to be rocky for quite a while, so like I said earlier--bold moves, we'll see how it all pans out.