People are absolutely nuts

[Cingal]

14 minutes ago, Diff said:

No API changes were made to the game to support this anticheat behavior. No core game code was modified at all in relation to this issue, the responsible code was contained entirely within the affected mods. Maltiez's code, while well-hidden under the bones of a dependency, was not obfuscated. The additions were confined to one source file on top of what was checked into Git, "AdditionalStuff.cs." It's relatively short and its operations can be well-understood quickly. 

How do you know?

We know Maltiez is a developer of Vintage Story.

Unless somebody has taken to time to look through all the code changes that have been made since his hiring, you cannot say that there is nothing suspect or further malicious in the code of the base game.

 

Sure, you can trust that the team wouldn't do that. But, trust varies from person to person, and once betrayed it's pretty hard to simply believe what somebody is telling you. Especially when it's come to light that they were aware of these things since February, but simply opted not to tell the community. 

[lizardsprint]

25 minutes ago, Diff said:

Woah now, friend, where is any of this coming from? And that is a genuine question, I would very much appreciate knowing where you came to this understanding.

No API changes were made to the game to support this anticheat behavior. No core game code was modified at all in relation to this issue, the responsible code was contained entirely within the affected mods. Maltiez's code, while well-hidden under the bones of a dependency, was not obfuscated. The additions were confined to one source file on top of what was checked into Git, "AdditionalStuff.cs." It's relatively short and its operations can be well-understood quickly. 

Hi. Perhaps I misunderstood the Vintage Story team's public messages regarding the situation there re: core API changes, especially after they said they were confident in the code he submits "does he says it does", but then later backpedal and admit they were deceived and his code was doing more than he let on.

However, this is an ongoing situation that has contradicting information from various VS staff/devs, and his contributions to the actual game's code, no matter the intended purpose/what he was hired for, should be re-reviewed with more scrutiny, so it's impossible to say for certain he didn't do this, or even possibly something else/worse, until all of his code has been re-reviewed.

I understand the actual malicious code was in the mod(s). However, I never claimed it was obfuscated, in this thread or in the other thread. I said it was hidden. If you could link AdditionalStuff.cs that'd be helpful, as checking Config Lib's code there's a very deliberate entry in the .gitignore to ignore anything with "AdditionalStuff". I also couldn't find AdditionalStuff.cs in other repositories/dependencies, but maybe I missed one.

Edited 10 hours ago by lizardsprint

[MKMoose]

11 minutes ago, Cingal said:

How do you know?

The code is significantly older than his employment at Anego, and it was explocitly confirmed by other developers that similar code would have never made it into the game through their vetting process.

Edited 10 hours ago by MKMoose

[icesharkk]

5 minutes ago, Cingal said:

How do you know?

We know Maltiez is a developer of Vintage Story.

Unless somebody has taken to time to look through all the code changes that have been made since his hiring, you cannot say that there is nothing suspect or further malicious in the code of the base game.

 

Sure, you can trust that the team wouldn't do that. But, trust varies from person to person, and once betrayed it's pretty hard to simply believe what somebody is telling you. Especially when it's come to light that they were aware of these things since February, but simply opted not to tell the community. 

i agree completely. i just want to note its still a bit unclear what specifically was known by whom since February. i think theres a good chance of telephone game coupled with maltiez lying by ommission to them that would significantly reduce my outrage with regard to "them knowing since february." though trust is also a thin commodity right now

[lizardsprint]

8 minutes ago, Cingal said:

How do you know?

We know Maltiez is a developer of Vintage Story.

Unless somebody has taken to time to look through all the code changes that have been made since his hiring, you cannot say that there is nothing suspect or further malicious in the code of the base game.

 

Sure, you can trust that the team wouldn't do that. But, trust varies from person to person, and once betrayed it's pretty hard to simply believe what somebody is telling you. Especially when it's come to light that they were aware of these things since February, but simply opted not to tell the community. 

At least someone here understands. He is objectively being deceptive, so who knows what all changes he made to game for his own benefit after being hired, regardless of whether the mod's code is older than when he was hired.

Edited 10 hours ago by lizardsprint

[lizardsprint]

7 minutes ago, MKMoose said:

The code is significantly older than his employment at Anego, and it was explocitly confirmed by other developers that similar code would have never made it into the game through their vetting process.

Never say never. Every vetting process has holes, and people make mistakes all the time. This is like saying _____ is unhackable, or unsinkable.

[Diff]

22 minutes ago, lizardsprint said:

Hi. Perhaps I misunderstood the Vintage Story team's public messages regarding the situation there re: core API changes, especially after they said they were confident in the code he submits "does he says it does", but then later backpedal and admit they were deceived and his code was doing more than he let on.

In that case I understand how you came to that conclusion. Those are two separate statements regarding two separate events. All code that goes into the game is reviewed, this is a standard software development procedure just to catch bugs and unintended behavior.

As far as the mods, Maltiez let at least some people on the team know about his anticheat code inside his own mods, but not the full extent.

There were no modifications to the core game API. And we can be relatively confident about that. If he inserted supporting anticheat code in the core game... why didn't the anticheat code it was supposedly supporting actually make use of it? It used normal methods, and I can think of nothing in there that would even benefit from being included in the game. As others have noted, the anticheat code predates him advising on the game.

No statements, comments, or public evidence indicate that any anticheat code was added to the game, or any supporting functions or features to enable the anticheat code in Maltiez's mods.

 

For accessing AdditionalStuff.cs, I can only recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

Edited 9 hours ago by Diff

[Jose Alfredo Ramos]

What is happening here? Tell me; I don't understand.

[lizardsprint]

8 minutes ago, Diff said:

In that case I understand how you came to that conclusion. Those are two separate statements regarding two separate events. All code that goes into the game is reviewed, this is a standard software development procedure just to catch bugs and unintended behavior.

As far as the mods, Maltiez let at least some people on the team know about his anticheat code inside his own mods, but not the full extent.

There were no modifications to the core game API. And we can be relatively confident about that. If he inserted supporting anticheat code in the core game... why didn't the anticheat code it was supposedly supporting actually make use of it? It used normal methods, and I can think of nothing in there that would even benefit from being included in the game. As others have noted, the anticheat code predates him advising on the game.

No statements, comments, or public evidence indicate that any anticheat code was added to the game, or any supporting functions or features to enable the anticheat code in Maltiez's mods.

 

For accessing AdditionalStuff.cs, I can only recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

I know what code review is. I deal with it all the time; no need to explain it to me especially after I've already given my background.

I also didn't mention changes to the game solely related to "anti-cheat" code. I also mentioned that his contributions to the game could be doing other, or even worse, things, which YOU have no way of knowing yet until all of his code has been re-reviewed. So you are just speaking out of your ass here.

 

Quote

For accessing AdditionalStuff.cs, I can only recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

So you lied then, and my original claim was 100% accurate wrt him hiding it from the git repo. The source code never had AdditionalStuff.cs, because he hid it from the git repo, and it was only in compiled builds.

Not responding any further; I don't deal with liars and people who make strawman arguments (like claiming I said the code was obfuscated, when I never did).

Edited 9 hours ago by lizardsprint

[Diff]

8 minutes ago, lizardsprint said:

I know what code review is. I deal with it all the time; no need to explain it to me especially after I've already given my background.

Wasn't intending to talk down to you, I included that bit for the benefit of the other fellows in here who don't know and are asking similar questions.

8 minutes ago, lizardsprint said:

I also didn't mention changes to the game solely related to "anti-cheat" code. I also mentioned that his contributions to the game could be doing other, or even worse, things, which YOU have no way of knowing yet until all of his code has been re-reviewed. So you are just speaking out of your ass here.

We have no way of knowing until a statement has been made. We have no way of knowing even after that if we think ill of Anego. We have no way of knowing anything our computers do can ever be trusted if we want to get philosophical about it.

We have no evidence that this thing, which you claimed is happening, has happened. That is an ass-pull far greater than claiming "We have no evidence of that."

8 minutes ago, lizardsprint said:

You also refuse to link AdditionalStuff.cs for some reason.

Can't be linked, it doesn't have a public home. It's excluded from Git. You know this, I know this. For accessing it, I recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace. If you want it uploaded directly here, just say so and check back in a few hours. I accidentally left my laptop disconnected from Tailscale this morning when I left the house.

Edited 9 hours ago by Diff

[MKMoose]

10 minutes ago, Diff said:

17 minutes ago, lizardsprint said:

You also refuse to link AdditionalStuff.cs for some reason.

Can't be linked, it doesn't have a public home. It's excluded from Git. You know this, I know this. For accessing it, I recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

Accessing it through a decompiler can be difficult in that the mod versions which contain it have been removed from ModDB. Maltiez has also shared it here, if that is of interest. Confirmed to be the same as the decompiled code, as far as I know.

Edited 9 hours ago by MKMoose

[ImHereToProcrastinate]

7 minutes ago, lizardsprint said:

like claiming I said the code was obfuscated, when I never did

But nobody claimed that you said that, as far as I can see. Diff simply stated that the code was not obfuscated. The way he stated it didn't imply that you claimed it was. Despite this, you feel comfortable saying 

22 minutes ago, lizardsprint said:

I don't deal with liars and people who make strawman arguments (like claiming I said the code was obfuscated, when I never did).

Who are you referring to here?

[Diff]

38 minutes ago, lizardsprint said:

So you lied then, and my original claim was 100% accurate wrt him hiding it from the git repo. The source code never had AdditionalStuff.cs, because he hid it from the git repo, and it was only in compiled builds.

Not responding any further; I don't deal with liars and people who make strawman arguments (like claiming I said the code was obfuscated, when I never did).

I'm not interested in misrepresenting you or strawmanning you, that was not my intent. I will admit I'm not sure how I have managed to give you that poor impression. I never claimed it wasn't excluded from Git, so I'm not sure how I "lied," either. But I would be interested in continuing the discussing if you ever change your mind.

Edited 9 hours ago by Diff

[lizardsprint]

8 minutes ago, Diff said:

I'm not interested in misrepresenting you or strawmanning you

You

34 minutes ago, Diff said:

We have no evidence that this thing, which you claimed is happening

Also you

 

Please re-read my message:

Quote

I also mentioned that his contributions to the game could be doing other, or even worse, things, which YOU have no way of knowing yet until all of his code has been re-reviewed.

It is impossible to know, because all of his code/contributions to the core game HAVE NOT BEEN RE-REVIEWED YET. Please learn what "could" means. "could" != "is".

 

When you get back from reading the dictionary, and quit strawmanning, then we can continue this discussion. Until then, I have no interest in discussing with dishonest individuals.

Edited 9 hours ago by lizardsprint

[Diff]

2 hours ago, lizardsprint said:

in order to get these API changes into the game so that Config Lib could use those changes

This thing specifically you claimed was happening with no hedging. There is no evidence of that happening and it is quite a claim to make without evidence. You laid this claim out specifically as if it were a concession on your part, an uncontested point to build off. It's not. Your misunderstanding is not a strawman.

Edited 9 hours ago by Diff

[imtsubaki]

While it's completely understandable for people to be suspicious after someone has violated the community's trust, I think some of the concern around Maltiez' contributions to the game itself is getting a bit detached from how development actually works.

Maltiez did not have direct push access to the game's master branch. His contributions went through merge requests and review like other developers, so he could not simply slip something into the game independently or replace a compiled binary with something different from the reviewed source.

Most of his work has also been around the modding API. That code is directly forked and published on GitHub, meaning the same source being used by the game is publicly available for anyone to inspect. There isn't really an equivalent here to hiding functionality inside a third-party DLL distributed with a mod.

I'm sure his previous MRs will be looked over again given the circumstances, and I think that is a perfectly reasonable precaution. But there is a pretty large difference between reviewing his past work to be safe and assuming the game itself may have been compromised. Based on how those contributions are submitted, reviewed, and distributed, there isn't much reason to believe there is anything malicious hiding in them. Unlike what is possible on the ModDB where the mod author is directly responsible for uploading the binaries.

[icesharkk]

11 minutes ago, imtsubaki said:

While it's completely understandable for people to be suspicious after someone has violated the community's trust, I think some of the concern around Maltiez' contributions to the game itself is getting a bit detached from how development actually works.

Maltiez did not have direct push access to the game's master branch. His contributions went through merge requests and review like other developers, so he could not simply slip something into the game independently or replace a compiled binary with something different from the reviewed source.

Most of his work has also been around the modding API. That code is directly forked and published on GitHub, meaning the same source being used by the game is publicly available for anyone to inspect. There isn't really an equivalent here to hiding functionality inside a third-party DLL distributed with a mod.

I'm sure his previous MRs will be looked over again given the circumstances, and I think that is a perfectly reasonable precaution. But there is a pretty large difference between reviewing his past work to be safe and assuming the game itself may have been compromised. Based on how those contributions are submitted, reviewed, and distributed, there isn't much reason to believe there is anything malicious hiding in them. Unlike what is possible on the ModDB where the mod author is directly responsible for uploading the binaries.

citation needed

[Handbananasplit]

Undeniably VS has lost out on some funding because of this situation but I'm sure the game will be fine. All they have to do is come down hard on this person. If they back him up and act like nothing bad happened the game will probably be a pariah. 

People acting like he's had access to the whole game and put a virus in it are misinformed but that's because there has been no public statement. They only have screenshots of Discord posts and Reddit misinformation to go from.

[greed23]

Guys, stop blowing this out of proportion! Please! Listen, I know an official Anego employee made malware for the game he's working on! And listen, I know he hid that malware from the GitHub! And listen, I know he hid the crash behind another mod in the crash logs! And listen, I know he doubled and tripled down on it! And listen, I know his code was running on thousands of computers because he's one of the most prolific modders of VS! And listen, I know at least a portion of those thousands of computers were unintentionally targeted by this dev-created, mod-hidden malware, but this is really just getting out of hand!

[Diff]

6 hours ago, lizardsprint said:

So you lied then, and my original claim was 100% accurate wrt him hiding it from the git repo. The source code never had AdditionalStuff.cs, because he hid it from the git repo, and it was only in compiled builds.

Wait a minute, I was saying this from my first post here, how did you even convince yourself I'm lying when I agreed with you? Meanie. >‍:(

7 hours ago, Diff said:

The additions were confined to one source file on top of what was checked into Git

Edited 3 hours ago by Diff

[Foolsirony]

8 hours ago, LadyWYT said:

Incidentally, this is usually why the ban hammer ends up coming down so harshly sometimes. When the community remains calm, there's not a need for strict moderation, because most everyone is being civil and you don't have a bunch of wild speculation leading to fights and rumors.

Just my two cents but this is a very slippery slope when said like that. Based on what I know of history, the side that has to justify things using language like "if only they were calm" or "we wouldn't have to do it if you just settled down" usually isn't remembered favorably.

Regardless, not my rodeo so I'm content to watch things from the sidelines. However there is one thing that actually bothers me about the official response. It was posted to Reddit (and probably Discord) but not the official forums. It says to me that they want to calm down the loudest in the places that have the most reach, not their core fans that use their official forums. It should have been posted here first or at least at the exact same time. It's the main thing that has me wary since that's like PR 101, post official responses in all places and don't forget your own official forums. 

[LadyWYT]

1 hour ago, Foolsirony said:

Just my two cents but this is a very slippery slope when said like that. Based on what I know of history, the side that has to justify things using language like "if only they were calm" or "we wouldn't have to do it if you just settled down" usually isn't remembered favorably.

Welcome to the forums! You're not entirely wrong here, however, do note the latter part of my post:

Quote

That doesn't mean that it's not okay to be upset at what happened or raise concerns about it. There's just a big difference between politely raising concerns and starting fights with those who don't hold the same opinion on the matter.

In other words, it's perfectly fine to criticize Anego Studios and express frustration, and one can be calm/civil while expressing such. What's not okay is running around whipping the community into a frenzy, starting fights with other users, and generally being abusive towards those you don't like/disagree with. And based on my general experience and observations, that tends to be why the ban hammer comes down. Tensions run high, people don't think clearly, and some outright break the rules and don't care.