Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Cetasaya]

1 hour ago, williams_482 said:

That seems... dramatic

nah.

let em cook.

[Diff]

13 minutes ago, icesharkk said:

wut.

if the code is validated against the public repository then the logic needed to "pop a hidden DLL out of that PNG" would be present in the repo to be discovered by independent review. thats the entire point of independant review. you're right that this sort of transparency doesnt stop immediate malicious code distribution but it goes a long way to improving the security of the moddb and specifically prevents the exact mechanism that maltiez used to to secure 300,000 plus downloads of his poisoned library over a multi month period.

Not wrong, but not usefully right. Because there is no independent review. The ModDB is unreviewed. Only time I review code from other mods is to see how they did X or Y. And if X or Y aren't "hide malware in a PNG," I'm not going to find it unless I get stupidly lucky tripping over it on my way to something else. I don't think it ultimately does stop Maltiez, because I don't think anyone would choose to dive into the SettingsBuilder class of a Yaml Serializer of a widely-used and well-trusted library that has a long history in the codebase.

It doesn't offer any guarantee or assurance or even a useful hint unless there is some sort of review. And I think the false sense of security would hurt more than it helps.

And I do want to remind that we already skipped past a plethora of issues by magicking reproducible builds into existence for this part of our thought experiment, ones that do themselves have deep practical and security implications. There's a reason there is no game in existence that does this.

This situation is difficult. Because everyone's looking for trust. The whole ModDB ran on trust, and now that it's broken, people are looking for assurances and guarantees. But we can't compute trust back into the equation.

Edited Friday at 06:22 PM by Diff

[Gandorf]

22 minutes ago, Aresthor said:

You are emotionally distraught and should immediately seek a therapist and a consolatory blicky. This is a video game meant to be a comfort activity not a human rights violation convention.

And you are just a troll.

The devs are really shooting themselves in the foot by keeping him, losing all those potential sales, damaging their reputation, and losing trust. Their response made things worse because of how bad it was 

[BlackCDown]

On 9/3/2026 at 10:34 PM, MKMoose said:

Obfuscation in software has a very specific meaning, and the controversial code does not meet the definition. I would expect you to respect that when trying to argue about technical details, especially in a context where actual obfuscation is a critical part of the equation as that is what Maltiez' code was detecting.

In icesharkk's defense, the last allegation can at least be considered obfuscation since it's a design decision to befuddle analysts during dynamic analysis (i.e. debugging). In this case, it's not making the code less readable by misleading readers or looking like gibberish, but misleading those debugging from accurately attributing a crash. Windows famously uses something like this as well to make sure that BSoDs from corrupted data structures cannot be properly attributed to the watchdog that detected them. But unlike the subject, Windows is (despite their best efforts) professional and know that false positives are unacceptable for their intended audience.

[Angius]

1. Anego releases a central reusable workflow in some `Anego/provenance` repo
2. Mod authors use that reusable workflow instead of an action they write themselves
3. The action uses OIDC to authenticate with the upload API
4. The upload API checks the `job_workflow_ref` claim in the JWT they get, and see if it matches the reusable workflow
5. If so, the built binaries are guaranteed to have come from the build action that only Anego has control of

One possible issue is the `.csproj` file of the mod containing some MSBuild tasks that do shady stuff, but:

• The `.csproj` file has to be in the repo for the code to even build, so anybody will be able to see any shady tasks
• Stripping them from the `.csproj` inside of the action is not all that hard to do
• For additional safety, the build can be called via `unshare -n` so it doesn't have network access besides localhost, and so it can't download any code from external sources during build

Provenance is a very solvable (and very solved: jsr.io and nuget.org for example) problem.

[Teh Pizza Lady]

Just a friendly reminder that troll behavior is not welcome in this space. We are here to discuss this matter civilly. Please do not pollute this space with conjecture, assumption, personal attacks, troll remarks or the like. If a user is combative or troublesome, just ignore them, report, or both.

EDIT: Or just wait and be patient and the moderators will take care of it for you.

Edited Friday at 06:27 PM by Teh Pizza Lady

[Gandorf]

There is a poll on Reddit that might be interesting to see how it turns out

 

[Teh Pizza Lady]

34 minutes ago, Cetasaya said:

nah.

let em cook.

Seems like some sort of screamo heavy metal lyrics for sure.

[Cetasaya]

Just now, Teh Pizza Lady said:

Seems like some sort of screamo heavy metal lyrics for sure.

its fantastic

would totally mosh pit with the bros to shit this fire 

[IAmMoss]

2 hours ago, Sparticus247 said:

You have every right to be angry, I just want to start with that, and I completely understand why you feel very strongly about this.

That being said, what Diff and others have said is valid as well, there really is no risk of him doing anything malicious to the VS codebase. I understand the reasons he did what he did to his mod library, but I also don't agree with it. I also understand that it was relatively benign, but also implemented it in probably the worst way possible, which also cost unnecessary hair pulling among server owners.

The studio has said they aren't terminating the relationship. They are terminating his stewardship of his mods that he spent so much time creating, and he will no longer be able to contribute mods in the future.

If you are still concerned that he's going to maliciously sneak things in the main code base after all this, and don't trust the studio at all, I don't think anyone is going to convince you otherwise. They have already stated they aren't terminating the relationship, so this is either something you can live with and keep playing the game and using mods, or you can move on.

Once again though you have every right to be upset about this, but I and others are also satisfied that this case is closed.

I feel like anyone demanding more simply wants blood. Nothing can feasibly done to fix this, past an apology. Depending on how maltiez is hired, his employment/ stay at the company could be conditional, or if he is contracted, there could be legal ramifications for terminating it. 

 

Honestly with how much the studio cares about us. Which they do. This situation doesnt challenge that, I wouldnt doubt if other devs share our animosity towards maltiez. Is actions and unapologetic reactions have greatly harmed community standing and im sure no one appreciates that. I've personally disliked him for the better part of the last two years.

[Diff]

1 minute ago, Angius said:

1. Anego releases a central reusable workflow in some `Anego/provenance` repo
2. Mod authors use that reusable workflow instead of an action they write themselves
3. The action uses OIDC to authenticate with the upload API
4. The upload API checks the `job_workflow_ref` claim in the JWT they get, and see if it matches the reusable workflow
5. If so, the built binaries are guaranteed to have come from the build action that only Anego has control of

One possible issue is the `.csproj` file of the mod containing some MSBuild tasks that do shady stuff, but:

• The `.csproj` file has to be in the repo for the code to even build, so anybody will be able to see any shady tasks
• Stripping them from the `.csproj` inside of the action is not all that hard to do
• For additional safety, the build can be called via `unshare -n` so it doesn't have network access besides localhost, and so it can't download any code from external sources during build

Provenance is a very solvable (and very solved: jsr.io and nuget.org for example) problem.

I like this a lot. Still quite the project, but at least like a theoretically manageable one. There's still a reason only massive registries bother with it all, but I like this a lot.

I hadn't heard of JSR before, how is this kind of workflow relevant to them? JS/TS aren't compiled, so you always have the readable source on your computer. I scanned their page on provenance, but what benefits does all this offer them over like pulling a specific commit hash out of Git?

You could still smuggle code into assets. Heck, you could smuggle code as code, I've seen some mods with native DLLs and SOs that couldn't be built from source with this kind of setup, you'd have to ship them compiled. And plenty of mods have dependencies from the open internet, cutting off net access cuts off those mods. Forcing a certain build process is also kind of a headache, but considering how ubiquitous the regular CakeBuild template is, probably not a big enough one to worry about. 

[Mushroomancer]

5 minutes ago, IAmMoss said:

I feel like anyone demanding more simply wants blood. Nothing can feasibly done to fix this, past an apology. Depending on how maltiez is hired, his employment/ stay at the company could be conditional, or if he is contracted, there could be legal ramifications for terminating it. 

 

Honestly with how much the studio cares about us. Which they do. This situation doesnt challenge that, I wouldnt doubt if other devs share our animosity towards maltiez. Is actions and unapologetic reactions have greatly harmed community standing and im sure no one appreciates that. I've personally disliked him for the better part of the last two years.

I think there are things that can be done going forward, steps that can be taken to make the ModDB a little more secure and transparent, best practices and communications training that can help prevent the miscommunications that escalated the situation further. Etc. Etc. But these things aren't going to 'fix' what has happened. They're definitely not going to convince anyone who is currently frothing at the mouth over 'broken trust' to trust again, and I suspect the only thing firing Maltiez will do in that regard is provide a much needed dopamine hit to a lot of people. I have sympathy for the community managers/moderators and for the Devs, and even for Maltiez in a way. There was a lot of heat and fire all at once all demanding drastic action on a very short time frame and unwilling to accept any hesitation or investigation or delay. Not everything was handled well.

Ultimately the stance I'm taking, personally, is to trust Anego to make the right movements going forward even if they don't always take what I consider to be the 'right steps'. And I think they will. 

[VANTABlack2000]

54 minutes ago, icesharkk said:

that is the Russian word for gun. arresthor appears to be recommending self harm.

Naturally please do not listen to them. your emotional well being is much more important than any game and that individual has essential resorted to name calling in all threads. You have a right to be upset  at this situation.

At this point when do we say that what they are doing is inflammatory? I don't know russian, so I am going to have to take your word for it, but if you are right would I be right in saying this has definitely gone a step too far? I am not sure how to ask mods to do something about it though. They are clearly here in bad faith and just trying to troll, but telling someone to shoot themselves is just too far.

[icesharkk]

4 minutes ago, IAmMoss said:

I feel like anyone demanding more simply wants blood. Nothing can feasibly done to fix this, past an apology. Depending on how maltiez is hired, his employment/ stay at the company could be conditional, or if he is contracted, there could be legal ramifications for terminating it. 

 

Honestly with how much the studio cares about us. Which they do. This situation doesnt challenge that, I wouldnt doubt if other devs share our animosity towards maltiez. Is actions and unapologetic reactions have greatly harmed community standing and im sure no one appreciates that. I've personally disliked him for the better part of the last two years.

At what point is it too much for his continued employment? when he reinstated the malware out of spite after caught? when he told the justifiably upset users to take their drama elsewhere? when he misrepresented the code to his current employer either out of ignorance or maliciousness? when he caused, through deliberated manipulation of the mod distribution trust relationship the installation of his malicious code on thousands of machines? when he admitted that this "was never about protecting servers" "the sole purpose was to make a specific cheat author waste enough time"?

this isn't about punishment or reform. its about baseline consequences for already taken actions.

[Karidwen]

8 hours ago, -Glue- said:

I feel like Tyron's response was well done. It gave all the required information and then some, plus they took full responsibility for how things went down, both before and after the events. They also gave plans for how they intend to improve. I think I am also happy with how Maltiez was handled. They are seemingly no longer associated with Anego, and are effectively banned from the mod DB and Discord, which a lot of people called for, but is still helping to further the game under more strict supervision.

Some people may not like that Maltiez is still working with Anego, but one thing I kept asking myself during this mess was, "How is this going to affect the games development going forward?" Sure, Anego could easily continue development without Maltiez, but they obviously saw them as an asset, so I believe they can, and will help the team make VS even better, faster. What Maltiez did was really, really stupid and short sighted, but it was obviously not done out of malice, or to harm the game or community. If anything it was to protect it. So, yeah, I do feel a little bad that things went this way for them. We are all human, we all make mistakes, but mistakes often have consequences.

The only thing I am not happy about is that Tyron seemingly made these responses everywhere EXCEPT the official forums... Which just feels really odd. Not everyone is in the Discord, and not everyone is on Reddit. I shouldn't have to be linked to an official response by a community member when I am already on the official forums... It often feels like this is the WORST place to have up to date info on the game. Also sorta makes me feel further detached from the community and team overall.

Honestly, I dont think Maltiez will stay on the team. Considering his character, he will most likely leave on his own. 

I dont know this, someone said he left his previous job for this, so he probably needs to scout a different place before leaving.

He is a self proclaimed saint who is now scorned. No way will he stay and be humble.

[Mushroomancer]

3 minutes ago, VANTABlack2000 said:

At this point when do we say that what they are doing is inflammatory? I don't know russian, so I am going to have to take your word for it, but if you are right would I be right in saying this has definitely gone a step too far? I am not sure how to ask mods to do something about it though. They are clearly here in bad faith and just trying to troll, but telling someone to shoot themselves is just too far.

I mean, even if that isn't the direct intention, definitely being inflammatory and nothing but.

[VANTABlack2000]

53 minutes ago, Crackomint said:

What a bizarre response, lol. You read way more into my words than what I put in them. Are you normally this weird and hostile? I assure you, I'm fine.

There are lots of video games out there. I guess Vintage Story just won't be one of them for me. Judging by the dev's responses to this whole thing, they're fine with that. It was my mistake to post here.

I don't think it was a mistake to post here. Everyone has their own feelings on what is going on and this is probably the best place to post your feelings other than the fact we have a rampant troll on the thread apparently.

I personally am conflicted about what to do with VS in the future because as a game dev myself I try my best to support devs I feel like I can morally support and if Anego doesn't care about the players then I don't care about them. 

[Compressed12Times]

Tyron's response is satisfactory in my opinion, all of this is happened on the mod side of things so Malitez getting banned from moddb, additionally discord for his blundered communication but him staying on the dev team (for however long they need him) AND them keeping eyes on him seems reasonable (I also do not know how much legally they can do). If they managed to keep the game drama (of massive size) free 10 years and got into one because of a third party behaviour, I think people's reaction to completely abandoning the support is ridiculous. On the topic of false positives, yes, they should've mentioned it in the Tyron's response that such instances happened. What can be blamed is the mismanagement of this shmuck but Tyron did take the blame so they know what NOT to do incase (and hopefully not) something bad happens again.

This is messy to say the least.

[IAmMoss]

On 9/4/2026 at 1:54 PM, icesharkk said:

At what point is it too much for his continued employment? when he reinstated the malware out of spite after caught? when he told the justifiably upset users to take their drama elsewhere? when he misrepresented the code to his current employer either out of ignorance or maliciousness? when he caused, through deliberated manipulation of the mod distribution trust relationship the installation of his malicious code on thousands of machines? when he admitted that this "was never about protecting servers" "the sole purpose was to make a specific cheat author waste enough time"?

this isn't about punishment or reform. its about baseline consequences for already taken actions.

I mean, I laid out why his termination MAY currently be unattainable. Dude, I am a maltiez hater, at least in terms of his character. Have been since I first interacted with him on the moddb. I do not like the guy. I still think there's more nuance to this past just kicking him out the front doors. Its not always that simple.

 

For those reading this later on. There is also the fact these actions were taken before his employment. i dont know the laws where anego or maltiez is based in, but this simply may not be something legally actionable because it happened before his employment ever started.

Edited Sunday at 12:26 AM by IAmMoss
Added the last paragraph

[williams_482]

This whole thing sucks, for very human, embarrassingly predictable reasons. 

The devs made the classic PR blunder of choosing empathy for a person they personally know and judge to be a useful contributor, along with practical steps to prevent them from doing anything like this again, over sating the bloodlust of an angry mob. You can just see the naive programmer logic here: we made sure this person won't do this again (in ways we tried to explain but can't directly demonstrate at this time), we're still doing our best to improve this game you all love, why are you all still mad at us?

A huge corporation would not typically make this mistake, because 1) they have expensive PR people on staff to handle this kind of thing, 2) huge corporations are big enough that the decision makers are generally not personally aquatinted with the accused (when they are, these mistakes are far more likely), and 3) they are usually far more concerned with perception and short term sales than with the long term quality of their product. 

It seems pretty clear that the folks here who understand software development do not see Maltiez's reduced role as a plausible vector for new malware in either the base game or any of his existing mods. Those who still want him gone are speaking on moral or general policy grounds, which is fair enough and an unsurprising theater for reasonable people to disagree. We don't know exactly why Anego doesn't want to cut Maltiez out completely, but it's probably some combination of familiarity with the project and valuing his perspective on design questions totally unrelated to vigilante malware injection. 

There's also a huge group of people in here who don't understand the technical aspect of this (because it's bloody difficult to differentiate expertise in an unfamiliar field from confident idiocy, especially with emotions running high as they are now) and want this guy gone because they think there is still a credible danger of Maltiez secretly infecting their computer. There is not, but the misconception is understandable.

Finally, we have people who are just angry. There are a lot more of them on Reddit than on these boards. Some of them are fans who feel betrayed and aren't worried about the details, some of them are just along for the ride because joining in with the mob and yelling about the failings of others is a pleasant distraction from the complicated problems of daily life. Nothing short of immediate, unambiguous, and complete separation from Maltiez was going to satisfy, and if that happened then that vitriol wouldn't even be gone, just focussed on Maltiez the individual villain. Which is worse, because it increases the small but believable danger of real wackos taking extreme steps against him. 

I'm not exactly overflowing with sympathy toward Maltiez myself right now, as he did make some dumb choices and has come across as a real asshole. Although, I can't help but wonder how the rest of us would come across if unexpectedly berated by hundreds for a questionable choice in our own pasts. 

I am feeling very sympathetic towards Tyrone and the rest of Anego, who were suddenly thrown into this whole thing and forced to make a very public decision which had no definitive right answer, and carries with it a terrifying range of unlikely but very serious dangers. 

The whole thing sucks.

[Karidwen]

1 hour ago, icesharkk said:

that is the Russian word for gun. arresthor appears to be recommending self harm.

Naturally please do not listen to them. your emotional well being is much more important than any game and that individual has essential resorted to name calling in all threads. You have a right to be upset  at this situation.

Yeah, already reported the post.

Some aggressive dude who is a fan of Malwaretiez apparently.

[icesharkk]

21 minutes ago, Compressed12Times said:

Tyron's response is satisfactory in my opinion, all of this is happened on the mod side of things so Malitez getting banned from moddb, additionally discord for his blundered communication but him staying on the dev team (for however long they need him) AND them keeping eyes on him seems reasonable (I also do not know how much legally they can do). If they managed to keep the game drama (of massive size) free 10 years and got into one because of a third party behaviour, I think people's reaction to completely abandoning the support is ridiculous. On the topic of false positives, yes, they should've mentioned it in the Tyron's response that such instances happened. What can be blamed is the mismanagement of this shmuck but Tyron did take the blame so they know what NOT to do incase (and hopefully not) something bad happens again.

This is messy to say the least.

if you ignore the part where Tyron and co were aware of parts of maltiez efforts for months, and you ignore that Tyrons response omits the hundred to thousands of innocent users impacted by maltiez code triggering with no cheats present, lacks meaningful consequence beyond status quo oversight, and goes on to paint maltiez' actions as targeted and successful. Then sure you can say this happened on the mod side of things.

The issue i have now is that with Tyrons tepid response is that he has shifted this beyond maltiez to erode my trust in Anego.

Edited Friday at 07:24 PM by icesharkk

[Compressed12Times]

34 minutes ago, icesharkk said:

Tyron and co were aware of parts of maltiez efforts

You are right-ish, Tyron did not pay much attention to this while other's on the team "skimmed" it and probably (bad to speculate, I am a type to give a benefit of the doubt) thought it harmless to non-cheaters, and maybe he disclosed it later on the mod page. It did cause harm and he did not disclose it, here we are. 

34 minutes ago, icesharkk said:

and you ignore that Tyrons response omits the hundred to thousands of innocent users impacted by maltiez code triggering with no cheats present, lacks meaningful consequence beyond status quo oversight

I mentioned the lack of mention of false positives which I thought would bring up to mind that people were affected, My bad. It clearly should've been mentioned in "What was the impact?" section.

Edited Friday at 07:56 PM by Compressed12Times
bad wording

[Gandorf]

This all comes down to the breach of Trust, which is easy to lose but hard to gain back, even if they go full Big Brother on Maltiez, keeping him on the team is bad for public relations, and decreases trust even further, and ultimately hurts the game 

[icesharkk]

15 minutes ago, Compressed12Times said:

I mentioned the lack of mention of false positives which I thought would bring up to mind that people were affected, My bad. It clearly should've been mentioned in "What was the impact?" section.

your good man. I'm not attacking you, merely expanding to include more complete list of the issues with Tyron's response. 
 

8 minutes ago, Gandorf said:

This all comes down to the breach of Trust, which is easy to lose but hard to gain back, even if they go full Big Brother on Maltiez, keeping him on the team is bad for public relations, and decreases trust even further, and ultimately hurts the game 

15 minutes ago, Compressed12Times said:

You are right-ish, Tyron did not pay much attention to this while other's on the team "skimmed" it and probably (bad to speculate, I am a type to give a benefit of the doubt) thought it harmless to non-cheaters, and maybe he disclosed it later on the mod page. It did cause harm and he did not disclose it, here we are. 

Tryon's response erased my remaining benefit of the doubt. they are choosing to stand by the problem, omit and erase the victims, and borderline praise the actions of the perpetrator.

My lack of benefit of the doubt is beginning to make me suspicious about the sequence of events. 
 

Edited Friday at 08:11 PM by icesharkk