Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Jose Alfredo Ramos]

What is happening here? Tell me; I don't understand.

[lizardsprint]

8 minutes ago, Diff said:

In that case I understand how you came to that conclusion. Those are two separate statements regarding two separate events. All code that goes into the game is reviewed, this is a standard software development procedure just to catch bugs and unintended behavior.

As far as the mods, Maltiez let at least some people on the team know about his anticheat code inside his own mods, but not the full extent.

There were no modifications to the core game API. And we can be relatively confident about that. If he inserted supporting anticheat code in the core game... why didn't the anticheat code it was supposedly supporting actually make use of it? It used normal methods, and I can think of nothing in there that would even benefit from being included in the game. As others have noted, the anticheat code predates him advising on the game.

No statements, comments, or public evidence indicate that any anticheat code was added to the game, or any supporting functions or features to enable the anticheat code in Maltiez's mods.

 

For accessing AdditionalStuff.cs, I can only recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

I know what code review is. I deal with it all the time; no need to explain it to me especially after I've already given my background.

I also didn't mention changes to the game solely related to "anti-cheat" code. I also mentioned that his contributions to the game could be doing other, or even worse, things, which YOU have no way of knowing yet until all of his code has been re-reviewed. So you are just speaking out of your ass here.

 

Quote

For accessing AdditionalStuff.cs, I can only recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

So you lied then, and my original claim was 100% accurate wrt him hiding it from the git repo. The source code never had AdditionalStuff.cs, because he hid it from the git repo, and it was only in compiled builds.

Not responding any further; I don't deal with liars and people who make strawman arguments (like claiming I said the code was obfuscated, when I never did).

Edited September 3 by lizardsprint

[Diff]

8 minutes ago, lizardsprint said:

I know what code review is. I deal with it all the time; no need to explain it to me especially after I've already given my background.

Wasn't intending to talk down to you, I included that bit for the benefit of the other fellows in here who don't know and are asking similar questions.

8 minutes ago, lizardsprint said:

I also didn't mention changes to the game solely related to "anti-cheat" code. I also mentioned that his contributions to the game could be doing other, or even worse, things, which YOU have no way of knowing yet until all of his code has been re-reviewed. So you are just speaking out of your ass here.

We have no way of knowing until a statement has been made. We have no way of knowing even after that if we think ill of Anego. We have no way of knowing anything our computers do can ever be trusted if we want to get philosophical about it.

We have no evidence that this thing, which you claimed is happening, has happened. That is an ass-pull far greater than claiming "We have no evidence of that."

8 minutes ago, lizardsprint said:

You also refuse to link AdditionalStuff.cs for some reason.

Can't be linked, it doesn't have a public home. It's excluded from Git. You know this, I know this. For accessing it, I recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace. If you want it uploaded directly here, just say so and check back in a few hours. I accidentally left my laptop disconnected from Tailscale this morning when I left the house.

Edited September 3 by Diff

[Grish]

Announcing a suspension from the team may have legal issues for them and that part is understandable.

There is absolutely nothing wrong with them announcing his ban from moddb,

but

They have not addressed anything because they knew about it, its there in the messages ,and they still trusted him.

This is actually the most concerning part of the whole matter for me.

They did not care about allowing us to download malware,and quite frankly our privacy and safety.

I don't care what happens to this game at this point,the lack of integrity lets me know exactly what they think of me.

 

 

[MKMoose]

10 minutes ago, Diff said:

17 minutes ago, lizardsprint said:

You also refuse to link AdditionalStuff.cs for some reason.

Can't be linked, it doesn't have a public home. It's excluded from Git. You know this, I know this. For accessing it, I recommend a decompiler. I like Rider, ILSpy is also cool. It's hiding in the "SettingsBuilder" class in the Yaml decoder's namespace.

Accessing it through a decompiler can be difficult in that the mod versions which contain it have been removed from ModDB. Maltiez has also shared it here, if that is of interest. Confirmed to be the same as the decompiled code, as far as I know.

Edited September 3 by MKMoose

[Vesk Aida]

I hope it doesn't have an impact on Vintage Story's development, sales or reputation (e.x. "that game which had malware in it"). Overall I feel this crash code situation would not have been serious or even worth mention had Maltiez been honest and transparent about documenting the code and its function, or even making it as a feature for a stand-alone mod (e.g. "Maltiez's Anti-Cheat"). The deliberate lack of documentation to hide this 'feature', and by his own admission with the purpose of the code 'being' crash code is pretty inexcusable.

 

My fear from all this drama and nonsense is that many/all of Maltiez's excellent mods (e.g. Maltiez's "Firearms" mod) might never get updated as VS continues to receive patches and support, and will inevitably fall by the wayside. Hopefully Maltiez either is allowed back into the community with more scrutiny/code checking, or a more transparent maintainer is able to keep the mods functioning.

Edited September 3 by Vesk Aida

[ImHereToProcrastinate]

7 minutes ago, lizardsprint said:

like claiming I said the code was obfuscated, when I never did

But nobody claimed that you said that, as far as I can see. Diff simply stated that the code was not obfuscated. The way he stated it didn't imply that you claimed it was. Despite this, you feel comfortable saying 

22 minutes ago, lizardsprint said:

I don't deal with liars and people who make strawman arguments (like claiming I said the code was obfuscated, when I never did).

Who are you referring to here?

[Diff]

38 minutes ago, lizardsprint said:

So you lied then, and my original claim was 100% accurate wrt him hiding it from the git repo. The source code never had AdditionalStuff.cs, because he hid it from the git repo, and it was only in compiled builds.

Not responding any further; I don't deal with liars and people who make strawman arguments (like claiming I said the code was obfuscated, when I never did).

I'm not interested in misrepresenting you or strawmanning you, that was not my intent. I will admit I'm not sure how I have managed to give you that poor impression. I never claimed it wasn't excluded from Git, so I'm not sure how I "lied," either. But I would be interested in continuing the discussing if you ever change your mind.

Edited September 3 by Diff

[lizardsprint]

8 minutes ago, Diff said:

I'm not interested in misrepresenting you or strawmanning you

You

34 minutes ago, Diff said:

We have no evidence that this thing, which you claimed is happening

Also you

 

Please re-read my message:

Quote

I also mentioned that his contributions to the game could be doing other, or even worse, things, which YOU have no way of knowing yet until all of his code has been re-reviewed.

It is impossible to know, because all of his code/contributions to the core game HAVE NOT BEEN RE-REVIEWED YET. Please learn what "could" means. "could" != "is".

 

When you get back from reading the dictionary, and quit strawmanning, then we can continue this discussion. Until then, I have no interest in discussing with dishonest individuals.

Edited September 3 by lizardsprint

[Diff]

2 hours ago, lizardsprint said:

in order to get these API changes into the game so that Config Lib could use those changes

This thing specifically you claimed was happening with no hedging. There is no evidence of that happening and it is quite a claim to make without evidence. You laid this claim out specifically as if it were a concession on your part, an uncontested point to build off. It's not. Your misunderstanding is not a strawman.

Edited September 3 by Diff

[Zaldaryon]

1 hour ago, MKMoose said:

The conversation @Zaldaryon is referencing may be this:

It's not crystal clear exactly what Balduranne meant here, but my guess is that Maltiez might be working on combat broadly, but not on the armor overhaul specifically.

Exactly that. I only referred to this public info. 

[imtsubaki]

While it's completely understandable for people to be suspicious after someone has violated the community's trust, I think some of the concern around Maltiez' contributions to the game itself is getting a bit detached from how development actually works.

Maltiez did not have direct push access to the game's master branch. His contributions went through merge requests and review like other developers, so he could not simply slip something into the game independently or replace a compiled binary with something different from the reviewed source.

Most of his work has also been around the modding API. That code is directly forked and published on GitHub, meaning the same source being used by the game is publicly available for anyone to inspect. There isn't really an equivalent here to hiding functionality inside a third-party DLL distributed with a mod.

I'm sure his previous MRs will be looked over again given the circumstances, and I think that is a perfectly reasonable precaution. But there is a pretty large difference between reviewing his past work to be safe and assuming the game itself may have been compromised. Based on how those contributions are submitted, reviewed, and distributed, there isn't much reason to believe there is anything malicious hiding in them. Unlike what is possible on the ModDB where the mod author is directly responsible for uploading the binaries.

[icesharkk]

11 minutes ago, imtsubaki said:

While it's completely understandable for people to be suspicious after someone has violated the community's trust, I think some of the concern around Maltiez' contributions to the game itself is getting a bit detached from how development actually works.

Maltiez did not have direct push access to the game's master branch. His contributions went through merge requests and review like other developers, so he could not simply slip something into the game independently or replace a compiled binary with something different from the reviewed source.

Most of his work has also been around the modding API. That code is directly forked and published on GitHub, meaning the same source being used by the game is publicly available for anyone to inspect. There isn't really an equivalent here to hiding functionality inside a third-party DLL distributed with a mod.

I'm sure his previous MRs will be looked over again given the circumstances, and I think that is a perfectly reasonable precaution. But there is a pretty large difference between reviewing his past work to be safe and assuming the game itself may have been compromised. Based on how those contributions are submitted, reviewed, and distributed, there isn't much reason to believe there is anything malicious hiding in them. Unlike what is possible on the ModDB where the mod author is directly responsible for uploading the binaries.

citation needed

[imtsubaki]

Maltiez was brought onto the team primarily as a Mod API programmer. A very large portion of his work has been bug fixes and changes to the API, either extending what mods are able to do or making certain things easier to accomplish without having to work around the existing API.

Because most of that work is in the API, the actual source involved is also publicly available through Anego Studios' GitHub. This isn't code that only exists inside some private build where nobody outside the dev team can see what is actually being shipped.

He also isn't overseeing or directing some large part of the combat update. Given his experience with his previous combat overhaul mod, it shouldn't be surprising that he has helped with parts of it or offered input where relevant, but much of his earlier work was focused more around bug fixing and changes or additions involving entities, animal AI, and the modding API in general.

I don't really want to get into internal development specifics beyond what is already publicly visible, but I do think there is a fairly distorted picture forming of what his role on the team actually was

[Handbananasplit]

Undeniably VS has lost out on some funding because of this situation but I'm sure the game will be fine. All they have to do is come down hard on this person. If they back him up and act like nothing bad happened the game will probably be a pariah. 

People acting like he's had access to the whole game and put a virus in it are misinformed but that's because there has been no public statement. They only have screenshots of Discord posts and Reddit misinformation to go from.

[OBAMFSpike]

Accountability and trust are major concerns the whole world wide right now everywhere a person OR seraph could chose to go. 

There are a lot of wise individuals in this thread.

[icesharkk]

46 minutes ago, imtsubaki said:

Maltiez was brought onto the team primarily as a Mod API programmer. A very large portion of his work has been bug fixes and changes to the API, either extending what mods are able to do or making certain things easier to accomplish without having to work around the existing API.

Because most of that work is in the API, the actual source involved is also publicly available through Anego Studios' GitHub. This isn't code that only exists inside some private build where nobody outside the dev team can see what is actually being shipped.

He also isn't overseeing or directing some large part of the combat update. Given his experience with his previous combat overhaul mod, it shouldn't be surprising that he has helped with parts of it or offered input where relevant, but much of his earlier work was focused more around bug fixing and changes or additions involving entities, animal AI, and the modding API in general.

I don't really want to get into internal development specifics beyond what is already publicly visible, but I do think there is a fairly distorted picture forming of what his role on the team actually was

citation required

[Paruza]

1 hour ago, Vesk Aida said:

I hope it doesn't have an impact on Vintage Story's development, sales or reputation (e.x. "that game which had malware in it").

It will unfortunately. But that can be mitigated by ultimately taking a hard line on this kind of abuse.

Quote

Overall I feel this crash code situation would not have been serious or even worth mention had Maltiez been honest and transparent about documenting the code and its function

This is 100% of the issue. You can make an anti-cheat mod if you would like, VS can add anti more official cheat measures if they want, All of this is fine as long as you are disclosing this activity and your customers are agreeing to it via a EULA. But stuffing malware "anti-cheat" into a mod that has nothing to do with that? That is straight up illegal and is a serious offence against supply chain trust. However much people like his mods, the right answer here is additional transparency and banning him from moddb. Followed up with a review of moddb policy as well if needed.

1 hour ago, Grish said:

They have not addressed anything because they knew about it, its there in the messages ,and they still trusted him.

I don't care what happens to this game at this point,the lack of integrity lets me know exactly what they think of me.

I wouldn't go quite so far as that yet. It's hard to know really how many people knew, and if at the time they really understood the gravity of these actions. I totally understand and forgive the disjointed response so far, it's easy to see how that can happen. Some team members knowing about a thing, but not really connecting with the problem, isn't the same as an official response by the company. Let them sort through it, and we will judge their actions after.

[VANTABlack2000]

2 minutes ago, Paruza said:

It will unfortunately. But that can be mitigated by ultimately taking a hard line on this kind of abuse.

This is 100% of the issue. You can make an anti-cheat mod if you would like, VS can add anti more official cheat measures if they want, All of this is fine as long as you are disclosing this activity and your customers are agreeing to it via a EULA. But stuffing malware "anti-cheat" into a mod that has nothing to do with that? That is straight up illegal and is a serious offence against supply chain trust. However much people like his mods, the right answer here is additional transparency and banning him from moddb. Followed up with a review of moddb policy as well if needed.

I wouldn't go quite so far as that yet. It's hard to know really how many people knew, and if at the time they really understood the gravity of these actions. I totally understand and forgive the disjointed response so far, it's easy to see how that can happen. Some team members knowing about a thing, but not really connecting with the problem, isn't the same as an official response by the company. Let them sort through it, and we will judge their actions after.

At this point I think the best thing to do is try not to get too emotional and give the team a chance to explain themselves. it's easy to get emotional over the whole thing which is justified to an extent, but we need to have some trust in the team.

I got really emotional at first, but gave them benefit of the doubt that somehow this would end well and I think Tyron tried to keep things calm and now this thread is allowed to exist and even have a mod fact checking some things, so I think things are starting to calm down and in time we will know who knew what and things will get resolved. Just have to have some faith in the team IMO.

[imtsubaki]

13 minutes ago, icesharkk said:

citation required

Well there isn't really a public source I can cite for individual repo permissions and what not, you can see on the Discord channel 'rules-and-info' what his title is. But most of what else I said comes from looking through the repo myself and talking with other developers over time. I am actively contributing to the game as well, so I do have some direct context here.

Edited September 3 by imtsubaki

[icesharkk]

14 minutes ago, imtsubaki said:

Well there isn't really a public source I can cite for individual repo permissions and what not, you can see on the Discord channel 'rules-and-info' what his title is. But most of what else I said comes from looking through the repo myself and talking with other developers over time. I am actively contributing to the game as well, so I do have some direct context here.

then redact the unconfirmed information from your post here and on the other thread. we have absolutely zero information on his contribution to 1.22 and only vague and contradictory on 1.23. he has transgressed more than enough with the documented malicious code that there is no reason to falsify additional speculative involvement. it muddys the water and fearmongers. 

Edited September 3 by icesharkk

[MKMoose]

33 minutes ago, icesharkk said:

then redact the unconfirmed information from your post here and on the other thread. we have absolutely zero information on his contribution to 1.22 and only vague and contradictory on 1.23.

Tsu is a code contributor with access to Anego's private repositories, but even that barely matters in this case as virtually everything they have said is publicly available information.

Maltiez' role of the dev team is listed on Discord as "Mod API Programmer" and in game credits as "Bug fixing, Mod API". Tyron has stated that Maltiez advises them on the combat rework. Anything beyond that about his specific contributions is generally information private to Anego which they are under no obligation to share - they know what he contributed to and can investigate it themselves if they deem it as necessary. Although, inspecting his activity on GitHub would allow you to at least get an idea about which bugs he worked on. There is no reason to paint a small extra crumb of information from another contributor about what Maltiez has worked on as "falsified", "muddying the water" or "fearmongering".

Code going through review prior to merging is a practice fundamental to modern software development. The core mods and modding API (which are also what most bugfixing is centered on) are publicly visible, so all changes to it made for the public releases can be inspected freely. The remaining code which is not in the public repositories can be decompiled and inspected easily as well, as it is not obfuscated.

Edited September 3 by MKMoose

[imtsubaki]

1 hour ago, icesharkk said:

then redact the unconfirmed information from your post here and on the other thread. we have absolutely zero information on his contribution to 1.22 and only vague and contradictory on 1.23. he has transgressed more than enough with the documented malicious code that there is no reason to falsify additional speculative involvement. it muddys the water and fearmongers. 

I was inbetween customers IRL, so I apologize my answer was not the greatest and was a bit quick, MKMoose's reply right after hit's the nail on the head for what I was trying to cover.

[Meiiolri]

The whole situation started and moved poorly, from some part of community outrage, to Maltiez "i did the right" and doubling down deleting, readding and deleting the malicious code again. To the whole incidents on discord server (idk how it is there i do not use discord anymore). The main issue as of now is the wait from the dev team to address the issue. I understand that getting the facts right and checking everything is a good thing. Though the longer we do not get the official response there will be issues.

[MKMoose]

Tyron has posted an official statement regarding the situation. Sharing it here myself as official communication hasn't reached the Forums yet.

 

Edited September 3 by MKMoose