Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[lizardsprint]

5 minutes ago, williams_482 said:

Herpetology error. Their username clearly indicates that they are a lizard. 

My username is literally just the words from the auto-generated alias email I made that I originally used to register (lizard.sprint<numbers>@<email.tld>).

Edited September 3 by lizardsprint

[Lukas Marty]

Your framing is incredibly bad faith, this is why I am calling you a false snake. This is only about Maltiez and even that is totally overblown. And you people now destroyed this community. I would never want interact with this absolutely toxic community ever again and I am sure many normal people feel the same

 

[lizardsprint]

Just now, Lukas Marty said:

I would never want interact with this absolutely toxic community ever again and I am sure many normal people feel the same

 

No offense, but I simply do not care about your opinion on this. And the community has literally nothing to do with the situation when the situation centers around the developers of the game (one malicious one, and the others for not reviewing his code as thoroughly, at the bare minimum). Your (obviously emotionally-charged) opinion on the situation and "the community" is completely irrelevant and doesn't change the facts.

[lizardsprint]

If anything, you immediately resorting to insults instead of trying to listen to other's concerns, is EXACTLY the toxicity you claim to want to avoid. You are objectively a hypocrite.

[Lukas Marty]

You guys brought the toxicity. I am only reacting

[lizardsprint]

8 minutes ago, Lukas Marty said:

You guys brought the toxicity. I am only reacting

I said "maybe they shouldn't have broken that trust" because (at the very minimum) Maltiez objectively did, who is also a Vintage Story developer, and some team members did, in fact, downplay the situation. Nowhere in this thread or the mega-thread did I throw insults around. I've explained my concerns as reasonably as I can, especially from my perspective of a software developer myself.

Your response to that was to deny everything that happened, and immediately call me a "whiny child" and a "false snake", and say I'M the one in bad faith. Then, when others also called out your behavior, you claim to want to avoid this toxic community, when YOU are part of the problem. You are a hypocrite.

Not responding to you any further; you are clearly too emotional right now to have a serious conversation, and I don't deal with hypocrites.

Edited September 3 by lizardsprint

[icesharkk]

36 minutes ago, MKMoose said:

Obfuscation in software has a very specific meaning. I would expect you to respect that when trying to argue about technical details, especially in a context where actual obfuscation is a critical part of the equation as that is what Maltiez' code was detecting.

apologies. My background deals in concealment and obfuscation but at the user behavior level. e.g. hackers. his actions overall are a combination of concealment and obfuscation from a technique standpoint. but i see how it does not meet the definition of code obfuscation now. still consider the overall behavior obfuscation. This is the sort of behavior I have seen APTs do when poisoning repositories and attempting to maintain persistence/establish a foothold on a network.

Edited September 3 by icesharkk

[Teh Pizza Lady]

4 hours ago, Zaldaryon said:

Just an fyi, while it's what people think, there is no proof he was hired to touch the combat system. afaik I've read in the public Discord, it's not about combat at all.

Well I was sourcing this from here:  

Quote

6. The 1.23 update
This it the big one. Believe it or not lads, the team has decided that Combat should be a focus for the next big update. Here's what we want to look into: Tighter, more visceral hit detection; More varied attack animations; Possibly rework of armor- and weapon tiers; A few more types of weapons; and more! The combat changes will be in good hands - we have Maltiez, author of the mod Combat Overhaul, on our team to advise us, we abducted the infamous SaltyWater to help us with animations and conveniently we just received new combat hit detection tech from the Glint team as they are also currently working on combat \o/
(For clarity, we will not integrate Combat Overhaul into the vanilla game. CO will still have a reason to exist after this update)

So maybe a lot of us misunderstood Tyron on this, but I definitely took it to mean that Maltiez was hired into an advisory role to direct the combat update, not necessarily have a direct input on the code itself. If someone from the VS Dev team could clarify this, it would help immensely to know instead of assuming.

[Lukas Marty]

Yeah, we will never see eye to eye. You totally misrepresented the situation Maltiez is not just "a dev". He was only just hired for the battle system changes in 1.23

But as I said, I also dont want ro interact with this community any longer.

Amazing game, Anego! Unfortunately the community apparently is bad.

Edited Monday at 12:50 PM by Zaldaryon
removing cursing words

[Teh Pizza Lady]

Children, please, just hover each other's usernames and click ignore before both of you get spanked by the moderators.

[Dilan Rona]

Emphasis would then be on advice. Not that he is a part of the vs team itself. But because of what happened, any existing code he contributed will be checked again, and all future contributions will be picked with a fine tooth comb.

[Dilan Rona]

I agree. Before this topic gets locked like the rest.

[MKMoose]

9 minutes ago, Teh Pizza Lady said:

So maybe a lot of us misunderstood Tyron on this, but I definitely took it to mean that Maltiez was hired into an advisory role to direct the combat update, not necessarily have a direct input on the code itself. If someone from the VS Dev team could clarify this, it would help immensely to know instead of assuming.

The conversation @Zaldaryon is referencing may be this:

It's not crystal clear exactly what Balduranne meant here, but my guess is that Maltiez might be working on combat broadly, but not on the armor overhaul specifically.

[Diff]

40 minutes ago, lizardsprint said:

Look, I'll even cut the rest of the team some slack and play ball with the idea that Maltiez is solely responsible, and that he did in fact lie to the rest of the team (what they're now claiming) in order to get these API changes into the game so that Config Lib could use those changes (hiding the Config Lib code that does this from the public git repo is another issue).
What other changes of his got past code review into the game itself, that doesn't do exactly what he said it did?

Woah now, friend, where is any of this coming from? And that is a genuine question, I would very much appreciate knowing where you came to this understanding.

No API changes were made to the game to support this anticheat behavior. No core game code was modified at all in relation to this issue, the responsible code was contained entirely within the affected mods. Maltiez's code, while well-hidden under the bones of a dependency, was not obfuscated. The additions were confined to one source file on top of what was checked into Git, "AdditionalStuff.cs." It's relatively short and its operations can be well-understood quickly. 

[LadyWYT]

3 minutes ago, MKMoose said:

It's not crystal clear exactly what Balduranne meant here, but my guess is that Maltiez might be working on combat broadly, but not on the armor overhaul specifically.

Redram's comment in the wishlist thread may shed some light here. Specifically:

Quote

What we will *not* be doing is dozens of individual armor locations in the style of combat overhaul.

 

[Cingal]

14 minutes ago, Diff said:

No API changes were made to the game to support this anticheat behavior. No core game code was modified at all in relation to this issue, the responsible code was contained entirely within the affected mods. Maltiez's code, while well-hidden under the bones of a dependency, was not obfuscated. The additions were confined to one source file on top of what was checked into Git, "AdditionalStuff.cs." It's relatively short and its operations can be well-understood quickly. 

How do you know?

We know Maltiez is a developer of Vintage Story.

Unless somebody has taken to time to look through all the code changes that have been made since his hiring, you cannot say that there is nothing suspect or further malicious in the code of the base game.

 

Sure, you can trust that the team wouldn't do that. But, trust varies from person to person, and once betrayed it's pretty hard to simply believe what somebody is telling you. Especially when it's come to light that they were aware of these things since February, but simply opted not to tell the community. 

[icesharkk]

17 minutes ago, Dilan Rona said:

Emphasis would then be on advice. Not that he is a part of the vs team itself. But because of what happened, any existing code he contributed will be checked again, and all future contributions will be picked with a fine tooth comb.

there's a lot of contradictory information. multiple staff have referenced his future code commits. some staff say he's advisory. i dont feel comfortable assuming one way or the other until the official statement or post mortem explains wtf his actual impact to the game will be moving forwards. As well as validate whether he has had any impact on 1.22. everything else is supposition for unreliable statements.

[Dilan Rona]

good point

 

[lizardsprint]

25 minutes ago, Diff said:

Woah now, friend, where is any of this coming from? And that is a genuine question, I would very much appreciate knowing where you came to this understanding.

No API changes were made to the game to support this anticheat behavior. No core game code was modified at all in relation to this issue, the responsible code was contained entirely within the affected mods. Maltiez's code, while well-hidden under the bones of a dependency, was not obfuscated. The additions were confined to one source file on top of what was checked into Git, "AdditionalStuff.cs." It's relatively short and its operations can be well-understood quickly. 

Hi. Perhaps I misunderstood the Vintage Story team's public messages regarding the situation there re: core API changes, especially after they said they were confident in the code he submits "does he says it does", but then later backpedal and admit they were deceived and his code was doing more than he let on.

However, this is an ongoing situation that has contradicting information from various VS staff/devs, and his contributions to the actual game's code, no matter the intended purpose/what he was hired for, should be re-reviewed with more scrutiny, so it's impossible to say for certain he didn't do this, or even possibly something else/worse, until all of his code has been re-reviewed.

I understand the actual malicious code was in the mod(s). However, I never claimed it was obfuscated, in this thread or in the other thread. I said it was hidden. If you could link AdditionalStuff.cs that'd be helpful, as checking Config Lib's code there's a very deliberate entry in the .gitignore to ignore anything with "AdditionalStuff". I also couldn't find AdditionalStuff.cs in other repositories/dependencies, but maybe I missed one.

Edited September 3 by lizardsprint

[MKMoose]

11 minutes ago, Cingal said:

How do you know?

The code is significantly older than his employment at Anego, and it was explocitly confirmed by other developers that similar code would have never made it into the game through their vetting process.

Edited September 3 by MKMoose

[icesharkk]

5 minutes ago, Cingal said:

How do you know?

We know Maltiez is a developer of Vintage Story.

Unless somebody has taken to time to look through all the code changes that have been made since his hiring, you cannot say that there is nothing suspect or further malicious in the code of the base game.

 

Sure, you can trust that the team wouldn't do that. But, trust varies from person to person, and once betrayed it's pretty hard to simply believe what somebody is telling you. Especially when it's come to light that they were aware of these things since February, but simply opted not to tell the community. 

i agree completely. i just want to note its still a bit unclear what specifically was known by whom since February. i think theres a good chance of telephone game coupled with maltiez lying by ommission to them that would significantly reduce my outrage with regard to "them knowing since february." though trust is also a thin commodity right now

[lizardsprint]

8 minutes ago, Cingal said:

How do you know?

We know Maltiez is a developer of Vintage Story.

Unless somebody has taken to time to look through all the code changes that have been made since his hiring, you cannot say that there is nothing suspect or further malicious in the code of the base game.

 

Sure, you can trust that the team wouldn't do that. But, trust varies from person to person, and once betrayed it's pretty hard to simply believe what somebody is telling you. Especially when it's come to light that they were aware of these things since February, but simply opted not to tell the community. 

At least someone here understands. He is objectively being deceptive, so who knows what all changes he made to game for his own benefit after being hired, regardless of whether the mod's code is older than when he was hired.

Edited September 3 by lizardsprint

[lizardsprint]

7 minutes ago, MKMoose said:

The code is significantly older than his employment at Anego, and it was explocitly confirmed by other developers that similar code would have never made it into the game through their vetting process.

Never say never. Every vetting process has holes, and people make mistakes all the time. This is like saying _____ is unhackable, or unsinkable.

[Vesk Aida]

4 hours ago, Rainbow Fresh said:

Source? I re-read this entire supposed "ground truth mega thread" and didn't find any mention of this yet.

Its been mentioned a number of time, though from what I've seen even Maltiez has never attempted to implement any such feature. Though, given the inherent lack of transparency about code being present, maybe 'that' should be taken with a grain of salt: but I've yet to see any evidence it was ever acted upon: merely mentioned as a possibility.

[Diff]

22 minutes ago, lizardsprint said:

Hi. Perhaps I misunderstood the Vintage Story team's public messages regarding the situation there re: core API changes, especially after they said they were confident in the code he submits "does he says it does", but then later backpedal and admit they were deceived and his code was doing more than he let on.

In that case I understand how you came to that conclusion. Those are two separate statements regarding two separate events. All code that goes into the game is reviewed, this is a standard software development procedure just to catch bugs and unintended behavior.

As far as the mods, Maltiez let at least some people on the team know about his anticheat code inside his own mods, but not the full extent.

There were no modifications to the core game API. And we can be relatively confident about that. If he inserted supporting anticheat code in the core game... why didn't the anticheat code it was supposedly supporting actually make use of it? It used normal methods, and I can think of nothing in there that would even benefit from being included in the game. As others have noted, the anticheat code predates him advising on the game.

No statements, comments, or public evidence indicate that any anticheat code was added to the game, or any supporting functions or features to enable the anticheat code in Maltiez's mods.

 

For accessing AdditionalStuff.cs, I can only recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

Edited September 3 by Diff