Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[icesharkk]

34 minutes ago, Teh Pizza Lady said:

Anything can be true if you can't find evidence to refute it.

Sure but I was expecting a more solid stance like: "he will not have access to the code" or we are terminating his employment effective immediately. instead what we got is we'll keep an eye on him, trust us (just like you trusted us from november till now when we didnt keep an eye on the situation we apparently knew about), And we told him not to talk on discord anymore. 

im going off how tyron is framing the consequences. and anego has run out of goodwill for me to give benefit of the doubt on this. they need to be clear and firm or i am going to assume anything not explicitly covered will continue as it has up till this point. And how it has been up till this point is unacceptable.
 

 

2 minutes ago, Aresthor said:

You should start banning people who perpetuate this drama. Good luck to all the Redditors from USA or wherever they live within their fantasy realms of moral high ground. Thinking they can get a court in The Hague to conduct a hearing for business malpractice over a publicly available, free modification. I hope you all leave us be; we don't want you. There is minecraft and lego for you, or even jenga. Go play that and leave us alone. Malware is when "obfuscated" "code" "malpractice". You have yet to develop an understanding of words and objects, let alone concepts in programming, or European Law concerning the sale and distribution of software. My call to moderation is to immediately remove these people from every server and forum, and ban them from the game. It does not differ from mass reporting, review bombing, or outright trolling in effect. They deserve no say in this, especially after all the "evidence" proving them to be wrong. Egotistic moralising of people who contribute nothing and consume FREE content greedily for this game, brought to you by kind modders who devote their time and life for the benefit of others, should not be heeded or encouraged. I guarantee 95% of the player base has not been affected. 
I hope your computers explode; Bill Gates pushes a Windows 11 update that will fry your computers so that we can never hear from you again. 

Ah yes, censor all who disagree with you! with that take you sound more American than i do

Edited September 4 by icesharkk

[icesharkk]

36 minutes ago, Diff said:

I see this suggestion a lot, but it really wouldn't work. You compile the same code twice on two different computers, even twice on the same computer, you end up with two different DLLs. Just getting the code to compile is non-trivial and either wide open for abuse or harshly limiting to mod developers.

The security guarantees on that are also weak enough that I'd say they'd be worse than nothing, and certainly not worth the effort it'd take to make it happen. A false sense of security is worse than no sense of security.

bzzzt false. there is some technical truth in what you are saying that is conveniently misleading and sidestepping the fact that you absolutely can have a secure ci/cd pipeline and you can have verification that compiled code is based on the repository. 

we cant garuntee that the code isnt malicious until it is thrid party verified. but at least it stops the sideloading that maltiez was doing. which undermined the suposed safety of the exiting transparancy

 

Edited September 4 by icesharkk

[KekkusMaximus]

6 minutes ago, Aresthor said:

You should start banning people who perpetuate this drama. Good luck to all the Redditors from USA or wherever they live within their fantasy realms of moral high ground. Thinking they can get a court in The Hague to conduct a hearing for business malpractice over a publicly available, free modification. I hope you all leave us be; we don't want you. There is minecraft and lego for you, or even jenga. Go play that and leave us alone. Malware is when "obfuscated" "code" "malpractice". You have yet to develop an understanding of words and objects, let alone concepts in programming, or European Law concerning the sale and distribution of software. My call to moderation is to immediately remove these people from every server and forum, and ban them from the game. It does not differ from mass reporting, review bombing, or outright trolling in effect. They deserve no say in this, especially after all the "evidence" proving them to be wrong. Egotistic moralising of people who contribute nothing and consume FREE content greedily for this game, brought to you by kind modders who devote their time and life for the benefit of others, should not be heeded or encouraged. I guarantee 95% of the player base has not been affected. 
I hope your computers explode; Bill Gates pushes a Windows 11 update that will fry your computers so that we can never hear from you again. 

Found the alt account of Maltiez

[Gandorf]

I'm worried that someone affected in EU country reports it to CERT, and devs get an even bigger issue on hand, devs screwed up from negligence, but keeping Maltiez at this point is bad, not just because it's wrong, but because it might be legal liability, which would be the worst-case scenario, and the topic was brought up on Reddit, so there is risk already hopefully no one will bother but on internet you never know 

Edited September 4 by Gandorf

[williams_482]

1 minute ago, Aresthor said:

Ban drama queens, sell drama queens to Nadiyan traders for rusty gears, put drama queens into bell shiver spawners, chuck golden ornate spears into drama queen player characters, delete drama queen player accounts, segregate drama queens into different servers, ban drama queens from entering the Discord, put liberty caps into drama queens stews, chuck refractory bricks into drama queens chicken coops, lower the light leves of drama queens builds below 5, obfuscate drama queens code, malpractice drama queens into a "eu law violations", ignore drama queens forum posts, put drama queens characters into bear traps with no ladders, prevent drama queens from transporting water blocks, make drama queens' tools and weapons shatter on every quench at 100% chance, spawn bronze locusts in drama queens beds, teach elks to eat drama queens flax fields.

That seems... dramatic

[Aresthor]

People are so boycott brained is insane. YOU DO NOTHING HERE. You don't like the game? LEAVE. I hope 20 Maltiez mods spawn in your house and obfuscate your code so your reddit smart fridge starts performing "eU lAwS" violations for a freeware that's readily downloadable from the internet. 

[Eruannon]

5 hours ago, Diff said:

These claims are confusing and very off-base. The Mod API is not the perfect position to recreate this in main code. It's really confusing that you would say this, because the Mod API would in fact be the single worst place for it. The API is mostly data types and glue, and it's all public on GitHub. Not much business logic you could hide anything in. If he's in the modding API, to be honest that's mostly going to be just documentation.

There's so little relation to supply-chain situations like NPM that I struggle to understand what possible connection you're drawing. I can see the connection when it comes to the ModDB. Anyone can upload any old nonsense to NPM. Anyone can upload any old nonsense to the ModDB. A fault in a dependency spreads through that. That makes sense.

It makes no sense to try and apply it to Vintage Story itself. Anything that enters VS's codebase undergoes code review by at least a minimum of Tyron, and a mix of others. When they review, they're looking for correctness, they're looking for style, they're looking for bugs. When the code you're supposed to be writing is just a list of available properties and plain-English explanations for what each is, it's going to be really obvious if all of a sudden you start scanning all loaded assemblies for matching CRCs and queuing up timers that submit random input events, disconnects, and crashes.

Let me explain then.

First - what better position, outside of higher up the chain of command, to recreate malware introduced in modding library mod (or if You prefer - Modding API mod) is there, than Modding API programmer for base software? And fun fact - source code for his mods on GitHub, publicly, didn't have the code in question. It was bundled in the release versions instead. 

The malware was introduced in moddb versions of library mods - i.e. dependency mods, that are required by other mods to works as designed (which in turn can be required by even different modifications to work). This is so-called 'supply chain attack'. 

I used npm supply chain attack as direct comparison, as while the main software that user wanted to install wasn't compromised - underlying dependency - was, making high profile threat example of what supply chain attack CAN do - check Shai-Hulud supply chain attack, if You're interested in how it happened.

As per claim for verification - supposedly the existence of the code was known to devs, and even description of it triggered no warning lights for scrutiny of the code that was deployed to moddb. I'm not entirely sure if this reassurance gives me any respite, especially as Tyron seems to condone the actions of Maltez.

EDIT: quick addendum, as I have realized You may be under the wrong impression. What You see in the github You linked is... not an API. It is part of it. Specifically - public side endpoints of VS API. There is also call handler on the software side. Clone the github You linked and You will get definitions of how you can call the VS, but it will not tell You how the calls are handled on the VS side.

Modding API programmer role does not limit anyone to public side only, but the handling of those calls. Handling which lies in core VS code, which I am pretty sure is not public.

Edited Friday at 05:10 PM by Eruannon

[Gandorf]

Just now, Aresthor said:

People are so boycott brained is insane. YOU DO NOTHING HERE. You don't like the game? LEAVE. I hope 20 Maltiez mods spawn in your house and obfuscate your code so your reddit smart fridge starts performing "eU lAwS" violations for a freeware that's readily downloadable from the internet. 

You are completely missing the point. I like this game; that's why I'm urging the dropping of Maltiez from the team. The last thing I want is for devs to get into legal trouble because someone on Reddit decides to throw more fuel on the fire

[ImHereToProcrastinate]

22 minutes ago, Gandorf said:

I'm worried that someone affected in EU country reports it to CERT, and devs get an even bigger issue on hand

I'm from EU and your worry is completely divorced from reality. I promise you that I could report this incident to any and all EU agencies a nobody would give a fuck.

EDIT: And I don't mean this as a takedown or attack, I just want to make it absolutely clear that this is not something you need to worry about.

Edited Friday at 05:26 PM by ImHereToProcrastinate

[TeaJay]

On 9/3/2026 at 5:42 PM, Lukas Marty said:

Your framing is incredibly bad faith, this is why I am calling you a false snake. This is only about Maltiez and even that is totally overblown. And you people now destroyed this community. I would never want interact with this absolutely toxic community ever again and I am sure many normal people feel the same

 

If anyone destroyed the community it's Maltiez and the VS devs. They have spent years building up goodwill and wrecked it all because of what? In defense of some modder who put malware in the game, lied about it and then was a smug asshole about it. This is a person they chose over the community. I think in some time they will look back on this and realize it was not worth alienating a huge part of the community. 

It's incredibly hard to build trust but very easy to lose it. And even harder to regain it. They had the chance to do a proper response, but they didn't. I'm personally incredibly disappointed since I've played this game for a while, recommended it to a lot of people and now? A lot of people I know are saying they don't feel like playing anymore and I can't disagree with them. 

[Gandorf]

22 minutes ago, ImHereToProcrastinate said:

I'm from EU and your worry is completely divorced from reality. I promise you that I could report this incident to any and all EU agencies a nobody would give a fuck.

EDIT: And I don't mean this as a takedown or attack, I just want to make it absolutely clear that this is not something you need to worry about.

Ok that's one less worry. Though there are other issues with keeping him on, but that was pointed out hundreds of times already 

[icesharkk]

22 minutes ago, ImHereToProcrastinate said:

I'm from EU and your worry is completely divorced from reality. I promise you that I could report this incident to any and all EU agencies a nobody would give a fuck.

EDIT: And I don't mean this as a takedown or attack, I just want to make it absolutely clear that this is not something you need to worry about.

I concur. this degree of harm and the impacted individuals probably does not raise this to the level that it would actually see investigation or prosecution. the grounds would be tenuous because of the relationship between user and accepted liability for installing third party mods. No the bigger issue is how Anego is handling this and protecting maltiez ruins my ability to continue supporting or trusting the studio. Anego is allowing the fact that our servers were impacted, our purchased application was hijacked, and manipulated to go without mention or meaningful consequence and they are retaining the malicious actor responsible for it on their staff.

[icesharkk]

4 minutes ago, TeaJay said:

If anyone destroyed the community it's Maltiez and the VS devs. They have spent years building up goodwill and wrecked it all because of what? In defense of some modder who put malware in the game, lied about it and then was a smug asshole about it. This is a person they chose over the community. I think in some time they will look back on this and realize it was not worth alienating a huge part of the community. 

It's incredibly hard to build trust but very easy to lose it. And even harder to regain it. They had the chance to do a proper response, but they didn't. I'm personally incredibly disappointed since I've played this game for a while, recommended it to a lot of people and now? A lot of people I know are saying they don't feel like playing anymore and I can't disagree with them. 

exactly the rightfully outraged customer is not the responsible party here. These are the consequences of Maltiez' and Tyron's actions and statements.

[ImHereToProcrastinate]

1 minute ago, Gandorf said:

Though there are other issues with keeping him on

For sure, some people here and on reddit have quite thoughtfully expressed a number reservations they have with the way Anego responded to the whole situation. I even agree with some of the points they have made, but legal consequences just aren't on the table. This just isn't something that even registers on the legal scale.

[Aresthor]

OP should be contained on an empty desktop with AI ads and calculator as the only available app. 

[icesharkk]

1 hour ago, Mushroomancer said:

In this case, kind of, yes? Maltiez did not do anything particularly impressive to hide the killcode, from what I understand, it was there for plain reading as soon as people knew where to look and if someone else was reviewing that code before it was released, then it would have been caught. To pretend that Maltiez is going to be slyly pushing malicious code into the base of the game seems to disregard formal publishing processes.

On top of that, there is actually a difference between what Maltiez did and publishing malware that, say, steals bank account data or personal details or damages hardware/software by design. What Maltiez did was wrong, absolutely unethical and potentially illegal depending on what actually occurred and how much the fervor has exaggerated or staff have downplayed. It was ego-driven vigilantism, absolutely.

I don't think it's ideal to retain Maltiez, I generally agree that they should be sacked if for no other reason than they have shown a significant lack of regard for the community in both actions and words, however this entire greater conversation is starting to feel like temper tantrums with the name slinging and declarations that Vintage Story is now malware.

If your trust is so broken that you cannot believe that Anego will be able to handle this, then get your refunds and ward people away by all means. The issue is no longer about Maltiez for you at that point, it's about Anego as a whole and that's fine, that's your right. 

there is nuanced difference between the malicious logic maltiez distributed and other more egregious acts of malicious logic. true
I agree that Maltiez should not be retained. this is not because the intent or outcome of what he did wasn't severe. it is because the action take to achieve it is incompatible with trusted opensource software development.

[Crackomint]

Hi, I really love this game and don't know where to post this.

The official response from Tyron about this situation is incredibly disappointing. The section on the impact of Maltiez's anti-cheat completely ignores that it was discovered because it was flagging false positives from other mods and causing intermittent crashes with deliberately misleading logs. The statement that only about 100, cheating, users were affected by ConfigLib is false, and I find it hard to believe Tyron is ignorant of that fact. It feels deliberately deceptive and makes me think less of him as a person.

Keeping Maltiez on the dev team in any capacity is also deeply frustrating. I don't believe he's going to secretly insert malware into the code, and I believe Tyron that any contributions he makes will have other eyes on it. But the simple fact is that keeping a known malware author on the dev team damages the trust and reputation of the devs and the game.

I don't have any illusions that this is going to lead to a court case or legal repercussions. I do think this is going to hurt the game and the community. In the immediate term, I know people requesting refunds, mod authors quitting developing mods, and those who no longer will recommend this game to their friends. Is it really worth keeping Maltiez around when, for the foreseeable future, anyone who mentions this game can be responded to with "Don't play it, there's a malware author on the dev team"?

I know chasing growth has never been Tyron's priority, that's why the game's not on Steam. But surely this isn't the association he wants for a project he's worked so long and so hard on.

I really don't know what I'm going to do. I think it's lame to request a refund on a game I've played for hundreds of hours. But this makes me not want to play any more. Maybe the devs won't care because they've already got my money. But this feels like such a bitter end to something I've really loved and enjoyed.

[Aresthor]

1 minute ago, Crackomint said:

Hi, I really love this game and don't know where to post this.

The official response from Tyron about this situation is incredibly disappointing. The section on the impact of Maltiez's anti-cheat completely ignores that it was discovered because it was flagging false positives from other mods and causing intermittent crashes with deliberately misleading logs. The statement that only about 100, cheating, users were affected by ConfigLib is false, and I find it hard to believe Tyron is ignorant of that fact. It feels deliberately deceptive and makes me think less of him as a person.

Keeping Maltiez on the dev team in any capacity is also deeply frustrating. I don't believe he's going to secretly insert malware into the code, and I believe Tyron that any contributions he makes will have other eyes on it. But the simple fact is that keeping a known malware author on the dev team damages the trust and reputation of the devs and the game.

I don't have any illusions that this is going to lead to a court case or legal repercussions. I do think this is going to hurt the game and the community. In the immediate term, I know people requesting refunds, mod authors quitting developing mods, and those who no longer will recommend this game to their friends. Is it really worth keeping Maltiez around when, for the foreseeable future, anyone who mentions this game can be responded to with "Don't play it, there's a malware author on the dev team"?

I know chasing growth has never been Tyron's priority, that's why the game's not on Steam. But surely this isn't the association he wants for a project he's worked so long and so hard on.

I really don't know what I'm going to do. I think it's lame to request a refund on a game I've played for hundreds of hours. But this makes me not want to play any more. Maybe the devs won't care because they've already got my money. But this feels like such a bitter end to something I've really loved and enjoyed.

You are emotionally distraught and should immediately seek a therapist and a consolatory blicky. This is a video game meant to be a comfort activity not a human rights violation convention.

[Cetasaya]

The devs have circled the wagons around this guy and have lied and been cagey and have omitted information that has since come to light from other players.  The trust is gone.  that code is malware and loading up malware decietfully is super illegal as well.

[icesharkk]

2 minutes ago, Aresthor said:

You are emotionally distraught and should immediately seek a therapist and a consolatory blicky. This is a video game meant to be a comfort activity not a human rights violation convention.

that is the Russian word for gun. arresthor appears to be recommending self harm.

Naturally please do not listen to them. your emotional well being is much more important than any game and that individual has essential resorted to name calling in all threads. You have a right to be upset  at this situation.

[Aresthor]

1 minute ago, icesharkk said:

that is the Russian word for gun. arresthor appears to be recommending self harm.

Naturally please do not listen to them. your emotional well being is much more important than any game and that individual has essential resorted to name calling in all threads. You have a right to be upset  at this situation.

Yes i AM ARRESTOR I WILL ARRESTOR YOU WILL MY RUSSIAN ZOG MACHINE BLICKY MUAHAHHAHA. I HOPE YOU GET BLICKY PACIFIER PUTIN EVIL ZOG MACHINE ABLIEIST OPRESSORATORY ARRESTORY DEVICE!!!!!

[Diff]

1 minute ago, Angius said:

Sure it's not easy, but it's very doable. Offer a basic Github action that builds the code and submits it to moddb. Any mod submitted that way gets a nice little checkmark badge. That way, the binaries the players install are guaranteed to be exact to the code contained in the repo (which should be required to be public and at least source-available, if not open-source outright).

You know I like this idea, I actually really appreciate it, unfortunately GitHub Actions offer no guarantees. There's no secret path to the ModDB that can't be forged. Even if there were, you can just edit the GitHub action to be malicious itself and cover your tracks afterwards. It's an untrustworthy environment.

Extra unfortunately, even if every problem with building and reproducing mods was solved, the guarantees offered by it are really weak. Nobody's going to look sideways at a PNG that's 204KB instead of 200KB. But in a couple easy-to-stash lines of code, you can pop a hidden DLL out of that PNG and run whatever you want, endorsed by a green checkmark that people won't understand the nuance of. And nobody's going to find those 5 lines stashed away in a dark corner of a little-used file in a messy, sprawling codebase.

[Crackomint]

5 minutes ago, Aresthor said:

You are emotionally distraught and should immediately seek a therapist and a consolatory blicky. This is a video game meant to be a comfort activity not a human rights violation convention.

What a bizarre response, lol. You read way more into my words than what I put in them. Are you normally this weird and hostile? I assure you, I'm fine.

There are lots of video games out there. I guess Vintage Story just won't be one of them for me. Judging by the dev's responses to this whole thing, they're fine with that. It was my mistake to post here.

[Cetasaya]

2 minutes ago, Aresthor said:

Yes i AM ARRESTOR I WILL ARRESTOR YOU WILL MY RUSSIAN ZOG MACHINE BLICKY MUAHAHHAHA. I HOPE YOU GET BLICKY PACIFIER PUTIN EVIL ZOG MACHINE ABLIEIST OPRESSORATORY ARRESTORY DEVICE!!!!!

incredible

 

mods.  please please please do NOT ban this guy im losing it

Edited Friday at 06:04 PM by Cetasaya

[icesharkk]

2 minutes ago, Diff said:

You know I like this idea, I actually really appreciate it, unfortunately GitHub Actions offer no guarantees. There's no secret path to the ModDB that can't be forged. Even if there were, you can just edit the GitHub action to be malicious itself and cover your tracks afterwards. It's an untrustworthy environment.

Extra unfortunately, even if every problem with building and reproducing mods was solved, the guarantees offered by it are really weak. Nobody's going to look sideways at a PNG that's 204KB instead of 200KB. But in a couple easy-to-stash lines of code, you can pop a hidden DLL out of that PNG and run whatever you want, endorsed by a green checkmark that people won't understand the nuance of. And nobody's going to find those 5 lines stashed away in a dark corner of a little-used file in a messy, sprawling codebase.

wut.

if the code is validated against the public repository then the logic needed to "pop a hidden DLL out of that PNG" would be present in the repo to be discovered by independent review. thats the entire point of independant review. you're right that this sort of transparency doesnt stop immediate malicious code distribution but it goes a long way to improving the security of the moddb and specifically prevents the exact mechanism that maltiez used to to secure 300,000 plus downloads of his poisoned library over a multi month period.