Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[icesharkk]

28 minutes ago, Vaoth said:

... It is understandable Maltiez may not be terminated of his employment due to local labor laws ...

local labor laws has already been debunked. in latvia you can terminate an employee that poses a technical threat to your company. discovering that an employ is guilty by admission and analysis of distributing malicious code to thousands of your own products users via your own moddb and mislead you as to the nature of his mod is easily grounds for technical threat to the company. 

ask yourself this: if this had come to light before he was employed would any dev studio have willing hired a developer they themselves had to ban from the moddb for distributing malware to their users? absolutely not.

Edited September 4 by icesharkk

[icesharkk]

looks like the moniker malwarestory is popping up in areas completely unconnected to the actual game now. I can't even in good conscious disagreee with them if tyron is going to retain him. 

 

ask yourself this: If maltiez had applied for a job at anego studios after he was caught distributing malware through their moddb, and compromising thousands of systems leading to thousands of manhours of troubleshooting and server maintenance, would they have hired him? no. I think not.

[icesharkk]

I completely agree with op. People are absolutely nuts defending Anego for choosing to retain a developer guilty, by admission and analysis, of distributing malicious code to the company's userbase, covering it up, and lying by omission to them about it.

 

If this had occurred before he was hired by Anego would they have chosen to employ him?

Latvian employment law accounts for the ability to fire an employee who is a technical risk to your company without waiting the 30 days, I'm sick of seeing the latvian employment excuse.

[ATTESTEDJON]

The main issue I have with this is that people miss that in their Development Update Anego states that he is there to advise them on the combat update due to him having made Combat overhaul which with the concept art given seems to mostly be the layering of armor rather than anything with the source code not him being a dev with access to code, as they also stated that CO would still have a purpose even after the update so he probably didn’t have much if any access to the code rather simply advising them based on the layers of armor that he has in CO

[Rainbow Fresh]

In case some of our fellow forum dwellers do not know yet, there has been the "official response" by Tyron to whole situation. It's over here, on reddit. https://www.reddit.com/r/VintageStory/comments/1w6iuqm/official_statement_regarding_the_configlib

This has already sparked plenty new threads talking about it already, as this response clearly failed to put out the wildfire but seeing as most threads have or are already turning back into back-and-forth bickering between "defenders" and "witchhunters" I feel like rather opening my own to say my opinion on this. Tyron officially invited criticism as long as it doesn't break the rules, so here I am. And I see several problems with this statement that make it seems like it's still just a panicked flail more than a collected response (at best, or something much worse at worst.)

EDIT: This post was apparently merged by a moderator with an older, existing thread without notice. I take no responsibility for things being in the wrong context now.

1. Communication

A response was necessary. It is the only thing that could possibly try and do any meaningful amount of damage control at this point and the only thing with a chance to calm things down properly. Yet it is kinda ironic that the response itself is still not really well communicated. Part of the reasonable complaints during the time of prime escalation was the lack of organization in responses and more precisely, that the forums got the short end of the stick. The party happened in Discord, including all somewhat meaningful attempts by moderation to explain and calm things down while reddit turned into an unmoderatable warzone. While the forums were completely ignored. People here, who neither use Reddit (good choice) nor the Discord (can understand that), essentially lived a happy life until all the people banned on Discord moved over to voice their complaints here instead and the only thing, bar more or less out-of-context quoted screenshots of cherry-picked messages from the Discord, we saw from Anego is locking and even temporarily hiding threads talking about this entirely. If you already know the shitshow that was unfolding in real time those actions could make sense, if you just live a happy, ignorant life until someone comes barreling down the door screaming about a big government conspiracy before said government publicly executes that person before you - not a good impression.

And now look at the statement again. It was solely posted on Reddit. Merely linked on Discord. And the official Vintage Story forums run by Anegos Studios themselves? Ignored once more. We don't even get an official post in News that link to the darn thing. I understand that Anegos is a small, inexperienced Indie studio currently at their wits end on how to deal with all this. I appreciate one of the conclusions drawn is that the entire handling of this situation was a colossal PR disaster and that literal "significant" funding is being devoted for better training of the team to prepare for things like this in the future. But future good intentions only go so far when the here and now is important too. The road ahead is long but that doesn't justify ignoring the bread crumbs in front of you right now. Posting the whole thing on Discord and the forums aswell, in full not linked, would have been the extra work of all of a whopping 30 seconds. If funding goes into better PR and crisis management training, the little extra effort of maintaining all three posts simultaneously should they actually need updating should be the least of your investments. Putting information out there to only one part of your community is not helping the image here, at all.

2. The structure

Or in more plain terms, how this response nearly failed to even be read by me. I understand that completely firing Maltiez might not be the best course of action just because the internet wants to see blood. Or might not even be legally feasible and that no one wants a long, drawn out court fight over this. However the circumstances though, the fact still remains that damage was done and this needs to be a damage control and cleanup job. This response reads more like a "Yeah, something might be going on we'll look at it don't worry". Not to mention how tone deaf the opening paragraph reads. Like I said, I am aware that taking the action the people want might not be the right choice. However, one thing should have been pretty much clear: That Maltiez did something wrong is not up to discussion. That something needs to be done about the whole situation is not debatable. Most people who don't belong to one of the two most vocal factions of crusaders who were waiting for an official response to finalize their own judgement of Anegos Studios in this whole regard were not waiting to hear if something will be done - just for what will be done, as doing nothing would have been the death sentence. So the whole official response opening with a big paragraph that tl;dr reads as "There was a bad guy selling cheats, and Maltiez took it upon himself to mess with that guy, the end" is basically an insult. It is downplaying at best and defending at worst what was done, making the whole "steps taken" later feel just as much as an empty "I am sorry because people demand me to say it" response as Maltiez' own apology. It is, at this time of writing, still missing crucial information that shows the actual scale of damage done and conveniently just highlights the good intentions of Maltiez while claiming not being involved with the whole ordeal on sides of Anegos, apologizing for not being more involved to stop it. If people don't atleast force themselves to continue reading in hopes there is more to it, this part alone could very well be "all I needed to hear", and not in the good kind of way. I hope the reason here is that this response was attempted to be written objectively, without judgement or feeling, stating facts - but even then, like many, many people already pointed out, it is missing rather important facts.

3. The conclusion

As I said above, steps needed to be taken. We just wanted to hear what these steps are. And the steps Anegos Studio is officially promising to take? Are a good first step in the right direction, but ain't it. I'm not talking about "Boo, they are keeping Maltiez". Once more, the whole employment situation is likely to be much more tricky than that. Him being banned from modding and his rather impactful work taken over by Anegos themselves until someone else can take over for good is, for all I care, good enough. I have enough base trust in Anegos left to believe that their code review process for official additions to the game is solid and Maltiez couldn't sneak random hidden malware into the game even if he wanted. After all, in any half decent build pipeline some lower employee like Maltiez wouldn't even get near the build process so sneaking things not mentioned in the pull requests in is not going to happen.

However, this isn't about that. The actions against Maltiez are as reasonable as I can legally judge it (which is not at all, I am not a lawyer) and the promise to invest in better PR and crisis management is direly necessary. No, this is about what wasn't mentioned as part of the steps moving forward at, the actual true elephant in the room. What happens to ensure something like this cannot happen again. "We will write clearer rules/disclosure standards for mods maintained by Anego team members." This bullet point might not even exist that's how useless it is. There were already rules in place. As of time of this writing, the official ModDB ToS, point 2 of claims to mod uploading, states "You warrant that the mod contains no harmful or malicious code, no material which is defamatory, bullying, offensive, obscene, or pornographic, and no breach of copyright of any other person." Even if we were to argue this doesn't count as "harmful" (which it does for innocent false-positive users) or malicious (because of his good, good intentions), there is also point 5 "A mod must have a clear explanation of its function in the English description." This pretty much excludes smuggling in not document out-of-scope features. I checked with the Wayback machine on a snapshot of the ToS from August in case it was already updated. So yes, there were rules that are reasonably clear enough. And by all means, "...for mods maintained by Anego team members" is equally as pointless - Anegos team members should abide by the same quality and integrity standards as everyone else. It shouldn't be a bigger deal worth mentioning separately of how "Anegos team members" should behave versus "the common mod developer". They all should follow the same rules. This shitshow only escalated so badly fueled by the fact that "even an Anegos team member" broke the rules so blatantly and questionably.

No, what really is missing here is lack of any plan on protecting the ModDB from this in the future. Because for all the personal opinion one can have about Maltiez and what he did now, there is one objective goal he most certainly achieved even if involuntarily: He opened the public's eyes, the hard way, on how much of a mere honor system the ModDB is and how scaringly easy it is for anyone to add actually destructive malware and distribute it. Today Maltiez added crashcode targeting cheaters. Tomorrow someone uploads a real sleeper trojan bundled in an inconspicuous food mod. And there are no mentions about any improvement to ModDB security and integrity of uploads. No checks, no automations no nothing that could prevent this from happening again but in worse, no that people know how easy it is to pull of.

 

So in summary, this official response was necessary. And I appreciate it happening sooner rather than later. I also appreciate some positive lessons being learned from this and that Anegos is investing into a more prepared future. That said, however, the rest of this is falling way short of I expected to a degree that is borderline harmful again. I am not going to request a refund out of spite. I am not going to demonstratively deinstall the game from my PC. I was already out of motivation to continue playing before due to 250+ hour burnout and will hence not touch the game for a couple years, just like it always happens with Minecraft. I am, however, not sure if I want to invest the time and effort into further making mods myself seeing as the new world created by this blast will be one of distrust and I have too little knowledge to apply this "provenance" stuff myself without official guidelines or requirements on how. And I'll go see about how bearable these forums become when things maybe, hopefully, calm down for good.

Edited Tuesday at 06:12 AM by Rainbow Fresh
Could have atleast said *something* about merging threads

[icesharkk]

Just now, ATTESTEDJON said:

The main issue I have with this is that people miss that in their Development Update Anego states that he is there to advise them on the combat update due to him having made Combat overhaul which with the concept art given seems to mostly be the layering of armor rather than anything with the source code not him being a dev with access to code, as they also stated that CO would still have a purpose even after the update so he probably didn’t have much if any access to the code rather simply advising them based on the layers of armor that he has in CO

a pointless quibble. they are still choosing to retain an proven bad actor that they never would have hired if the order of events were reversed. the fox ate some hens so he is band from the yard but he is still allowed in the henhouse under supervision. 

[ATTESTEDJON]

 

2 minutes ago, icesharkk said:

a pointless quibble. they are still choosing to retain an proven bad actor that they never would have hired if the order of events were reversed. the fox ate some hens so he is band from the yard but he is still allowed in the henhouse under supervision. 

Im not saying that him staying is good, I am merely pointing out the most people say that he is a dev when Anego has stated that he isn’t and is only there to advise

[ATTESTEDJON]

Also quoting from the post directly: we have Maltiez, author of the mod Combat Overhaul, on our team to advise us, we abducted the infamous SaltyWater to help us with animations and conveniently we just received new combat hit detection tech from the Glint team as they are also currently working on combat 

maltiez is there to advise and anything that has to do with code has come from a team that isn’t involved in Vintage Story’s development 

Edited September 4 by ATTESTEDJON

[Vratislav]

4 hours ago, LadyWYT said:

though excluding compensation for the false positives simply because...well, I don't really know what would be appropriate for individual compensation, or how to sort out the legitimate false positives from those who are only taking advantage of the situation and claiming to be such

The same, I have no clear idea, how a possible compensation should look like. A full or partial refund? Free additional game key? There are not many other feasible possibilities.

About the identification of players affected, I am surely not expert. I may only assume that there is probably not straightforward way. There may be server owners, who can prove running that unfortunate combination of mods had they public lists of mods used on their servers, or by providing logs, or I don't know. They may provide lists of players affected. I'd be quite generous in this case if it is feasible financially. Also, I can imagine that some a..holes, particularly from the "dark side" using rogue clients would be happy to fake proofs for such compensation and then laugh it out how they overplayed Maltiez and the studio. Still, if there are "false positives," they should be on the side of the compensation, though.

[icesharkk]

great. get a new advisor. 

[icesharkk]

18 minutes ago, Vratislav said:

The same, I have no clear idea, how a possible compensation should look like. A full or partial refund? Free additional game key? There are not many other feasible possibilities.

About the identification of players affected, I am surely not expert. I may only assume that there is probably not straightforward way. There may be server owners, who can prove running that unfortunate combination of mods had they public lists of mods used on their servers, or by providing logs, or I don't know. They may provide lists of players affected. I'd be quite generous in this case if it is feasible financially. Also, I can imagine that some a..holes, particularly from the "dark side" using rogue clients would be happy to fake proofs for such compensation and then laugh it out how they overplayed Maltiez and the studio. Still, if there are "false positives," they should be on the side of the compensation, though.

we can see how many downloads of the compromised configlib code occurred and a quick look shows its north of 300,000. i didnt bother checking the other two mods download counts 300,000 was way more than I thought and just staggers me. 

Edited September 4 by icesharkk

[Eruannon]

33 minutes ago, ATTESTEDJON said:

Also quoting from the post directly: we have Maltiez, author of the mod Combat Overhaul, on our team to advise us, we abducted the infamous SaltyWater to help us with animations and conveniently we just received new combat hit detection tech from the Glint team as they are also currently working on combat 

maltiez is there to advise and anything that has to do with code has come from a team that isn’t involved in Vintage Story’s development 

Funny... official website's 'about us' (https://www.vintagestory.at/aboutus.html/) says something else.

Maltiez
Mod API Programmer

You know... perfect position to recreate the supply chain attack in main code with sufficient skill and intent by pretending the code is actively used for something else. It's not like e.g. npm didn't have similar problem.

[Khondza]

1 hour ago, icesharkk said:

the question people should ask themselves is if this had happened before maltiez was hired do you think any dev studio, including Anego, would have hired him knowing the illegal thing he did to their user base and that he is already banned from their moddb in perpetuity.

I honestly dont think they would. maybe this is cope but Maltiez was probably only kept on so that he would agree to give the mods over to a custodian to take care of. Config lib, imGui lib and Overhaul lib all total around 1,000,000 downloads, for a more niche game like vintage story that is an insane amount of people who rely on these mods staying up and updated to the latest version. i dont make mods so idk but whats the alternative? hoping a fork of it is good enough for the community to codify as the new standard. if Maltiez mods weren't so load bearing they would probably be on the construction site given they left their last job for this.

 

man anyone remember when this game not being on steam was its biggest point of contention lmao. 

[Khondza]

1 hour ago, Rainbow Fresh said:

What happens to ensure something like this cannot happen again. "We will write clearer rules/disclosure standards for mods maintained by Anego team members." This bullet point might not even exist that's how useless it is. There were already rules in place.

I agree completely with this unless someone ether speaks English as their second language or is really really stupid the rules are clear as day. what could they possibly do to make them clearer use highlighter over it? 

[Vratislav]

1 hour ago, icesharkk said:

i didnt bother checking the other two mods download counts 300,000 was way more than I thought and just staggers me

Well, this makes virtually impossible to compensate everyone who downloaded ConfigLib (including, e.g. me on using it on singleplayer). Caves and Caverns and VSRadio have about 5000 downloads together, so damage on gameplay experience would be much more narrow and then addressable. However, I am afraid, that the compensation cannot reach to people who lost their trust, although they did not experienced broken game.

Edited September 4 by Vratislav

[greed23]

1 hour ago, icesharkk said:

great. get a new advisor. 

Beyond that, what's there even to advise about a combat overhaul?

 

CO as a mod doesn't really fix any of VS's combat issues.  Its just damage calculation and some different animations.  The real issues with VS combat is enemy hitboxes and animations desync.  Fix those, add right click to block, and then take some of the damage type modifiers and directional combat, and there, you've got a much better combat base than base game

 

[Vesk Aida]

22 hours ago, Lukas Marty said:

Just wanted to post, that the whole situation is blown way out of proportion. Some angry kids are absolutely nuts

Shockingly awful opinion. It is pretty disrespectful to call others "angry kids" and "absoutely nuts" when you clearly are either trolling or have no clue what has transpired. Crash Code is not inherently malware, but the implementation of it in this Maltiez situation is flagrantly malicious even by his own admission. Do some basic research in the future before spouting wild accusations about others. Rude.

[Narcosis]

As much as I love VS and will continue to do so... I cannot help myself to consider this blunder more of Anego Studios' fault, rather than Maltiez himself. People are really directing their anger at wrongly and while what Maltiez did is inexcusable - to a degree - what most miss is that he didn't do this by himself; Anego knew about it - and out of both good faith but also tomfoolery - they allowed him to proceed. The actual issue here is miscommunication and lack of proper transparency, particularly between devs themselves who are the core of the team, not the other way around.

My question is - why not simply provide a simple transparency rule on mod db? No obfuscated code. If you don't like it, you don't post there and your mod is not officially supported and as such - if downloaded elsewhere its purely at user's behest, simple as. I know it's not what Tyron originally wanted, but it cannot be helped.

The thing is - it was inevitable to happen. I expected it to happen, the moment VS passed the threshold of becoming popular about a year ago. This means not only more people and growth but also more people with malicious intentions. It's inevitable. You can't change people, therefore solutions need to be found to keep both the game itself safe and it's community informed and while the former cannot and shouldn't be done in an authoritarian fashion, I think what truly helps in such cases is indefinite transparency and information sharing; to put it bluntly, you build trust between members of community and the devteam. It's very easy to kill trust and building it takes time but when done right, it helps preventing situations like the one that happened already, because a healthy community manages and moderates itself without the need of an 'omnipresent nanny' in the form of harsh community/db mods or god forbid - automated bots. A lot of people are now rightfully unhappy because that trust was eroded - even if many of them aren't knowledgeable or were misinformed; it's still not their task to know everything about the game and issues surrounding it; that's the devteam's job. In a way, Anego has failed the community more than Maltiez himself, because they didn't keep the transparency, didn't provide info they know about the malicious mods and instead of doing so and maybe even gaining more support - out of various reasons, financial perhaps? - they decided to keep quiet about it.

And honestly, this upsets me more than the entire 'Maltiez did malware' thingy. I have seen a lot of anger on community's part but that anger is absolutely misguided. It also upsets me because now I know, large part of the community seems to be incredibly ignorant and will jump to the first, easiest conclusion when in reality, things are far more complex behind and as I mentioned above - it truly doesn't help, when Anego Studios doesn't try to make it easier.

What a shame.

[VANTABlack2000]

7 hours ago, LadyWYT said:

This is my general thoughts on the matter too, though excluding compensation for the false positives simply because...well, I don't really know what would be appropriate for individual compensation, or how to sort out the legitimate false positives from those who are only taking advantage of the situation and claiming to be such.

I do raise an eyebrow at keeping Maltiez on board, as that's a rather bold move. I'm not sure I would make the same decisions if I were in Tyron's seat, but that's not to say that my decisions would be better either. We'll see how it plays out. As far as I'm aware, Maltiez is just in an advisory role, which is very different than handling the code itself, and Tyron himself reviews the code before it ever ships to players, so I'm not particularly worried about something slipping through the cracks(aside from the usual pesky bugs).

Regarding Maltiez's mods, I am happy about the custodianship thingy. It's one of the least disruptive options when it comes to the modding community, and to me at least it's better than trying to rely on forks that were, quite possibly, made out of spite.

The only thing I'm not particularly happy about is the fact that, at least at the time of writing this post, there has been no official announcement on the forums. I'm not really sure why that is, and it's possible that it got forgotten in all the kerfluffle or maybe just lost in the ether. But I avoid Discord(outside of talking to friends), and I don't trust Reddit at all, so the forums are the primary place I rely on for VS news, and I'm sure I'm not the only one.

Pretty much also how I see it, sadly. Ultimately, I think the game will be fine, though it's probably going to lose a chunk of the community over it(at least, I would be really surprised if the community didn't shed several players). Though I also don't think there's any response Tyron could have possibly given that wouldn't result in a chunk of the community leaving. It's definitely going to be rocky for quite a while, so like I said earlier--bold moves, we'll see how it all pans out.

Yeah I also rely on the Forums for my news because I don't like Reddit and I left Discord because I don't like subscriptions and ads being shoved down my throat, so the Forums is the best option. I am kind of sad that it seems like we are getting announcements everywhere else, but not here. I hope if they post an announcement here is more of a final announcement on the matter if that makes sense. I feel like here should be the main source of VS info though.

[-Glue-]

I feel like Tyron's response was well done. It gave all the required information and then some, plus they took full responsibility for how things went down, both before and after the events. They also gave plans for how they intend to improve. I think I am also happy with how Maltiez was handled. They are seemingly no longer associated with Anego, and are effectively banned from the mod DB and Discord, which a lot of people called for, but is still helping to further the game under more strict supervision.

Some people may not like that Maltiez is still working with Anego, but one thing I kept asking myself during this mess was, "How is this going to affect the games development going forward?" Sure, Anego could easily continue development without Maltiez, but they obviously saw them as an asset, so I believe they can, and will help the team make VS even better, faster. What Maltiez did was really, really stupid and short sighted, but it was obviously not done out of malice, or to harm the game or community. If anything it was to protect it. So, yeah, I do feel a little bad that things went this way for them. We are all human, we all make mistakes, but mistakes often have consequences.

The only thing I am not happy about is that Tyron seemingly made these responses everywhere EXCEPT the official forums... Which just feels really odd. Not everyone is in the Discord, and not everyone is on Reddit. I shouldn't have to be linked to an official response by a community member when I am already on the official forums... It often feels like this is the WORST place to have up to date info on the game. Also sorta makes me feel further detached from the community and team overall.

[Dilan Rona]

I for one do not blame the devs of VS for what had happened. Could it have been handled better? Yes.

What everyone is forgetting is this is not an AAA company and cannot be held to the same standard. I'm literally seeing worse stuff coming from Sony, and Nintendo and all the other AAA companies that is a lot worse.

I am holding Maltiez responsible for what happened however. He did damage to his reputation, that of his mods, and by association that of VS devs (known, or not doesn't matter). It should never have been attached to foundation mods, that's on him.

But as far as I'm concerned, it's been dealt with. And I'm willing to let the matter rest now. I'll keep playing Vintage Story, will keep recommending it, and will get the supporter add-on as soon as I can.

Something like this was bound to happen sooner or later, so consider this a learning moment.

[Diff]

4 hours ago, Vaoth said:

As one of the server owners affected by this (you can see my crash report in the Radio mod, one of the confirmed affected mods, here), what I would like to see is at least official acknowledgement of the false positives and an apology for the lost troubleshooting time, as well as potential risk of lost world progress, given how the crashes kept happening for hours even after uninstalling the radio. Not because of any world corruption of course, but in the case I had needed to restore a server backup (luckily it didn't come down to this).

Really appreciate this, I can also confirm after taking a look at this that URL Radio does contain obfuscated code and would have set off ConfigLib. That brings us up to 2 confirmed mods caught in the crossfire between Maltiez and the cheat mod dude. Only weird thing I can't explain is that it kept happening after removing the radio. ConfigLib doesn't have any sort of memory, so don't know what's up with that.

4 hours ago, Vaoth said:

In any case, I would also love if measures were taken to make the moddb safer, by (1) making it mandatory for all mods to be open source and (2) using checksums to make sure the compiled binaries uploaded to moddb are the same as the ones compiled from the provided source code.

Right with you on (1) just because I like FOSS, (2) unfortunately isn't really easily possible. I just built two identical copies of one of my mods. Same computer, same compiler, same versions of everything, byte-for-byte identical source, but different checksums on the compiled DLL.

[Dilan Rona]

9 minutes ago, -Glue- said:

The only thing I am not happy about is that Tyron seemingly made these responses everywhere EXCEPT the official forums... Which just feels really odd. Not everyone is in the Discord, and not everyone is on Reddit. I shouldn't have to be linked to an official response by a community member when I am already on the official forums... It often feels like this is the WORST place to have up to date info on the game. Also sorta makes me feel further detached from the community and team overall.

It should have been posted to the forum as well. I agree.

[Angius]

2 minutes ago, -Glue- said:

They are seemingly no longer associated with Anego

Malwaretiez is still hired by them to work on the game in full official capacity. 

The whole official statement is weak and barely qualifies as a response. Not only was it not posted to the official forums, it also didn't mention the false positives, didn't acknowledge moderators tripping balls, claimed that Malwaretiez forgot to remove malware from ConfigLib where they removed and then re-added it... 

Tyron claims the Reddit post will be updated if he forgot anything. Well, it's been 12 hours now and no updates, so I think it's safe to assume they won't change anything.

To sum up: Tyron spent more time gushing over how righteous Malwaretiez was in their quest to thwart the bad chest developer, than he spent acknowledging issues, and Malwaretiez will be "punished" by being removed from the Discord (which they claimed was toxic anyway) and their mods (which they were tired with maintaining anyway) being transferred to Anego. 

[Diff]

4 hours ago, icesharkk said:

ask yourself this: if this had come to light before he was employed would any dev studio have willing hired a developer they themselves had to ban from the moddb for distributing malware to their users? absolutely not.

You're absolutely right, they would not have. But your thought experiment is not the reality they find themselves in and that does make a meaningful difference.