Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[icesharkk]

1 hour ago, Mushroomancer said:

The issue is that technicalities do matter in regards to the exact behavior of the code and are relevant to the discussion so using the two interchangeably is another factor muddying the waters. Obfuscation is the perfect word to describe the code's behaviors of misdirection and tampering, true, but given how much confused information is already swirling around and being nitpicked over, I can understand the argument for precise language.

I don't think it's actually particularly relevant, personally. The exact details of how the poison pill behaved as far as hiding itself aren't actually the issue for me because the real question is WHY it was using deceit and if that reasoning is mitigating or aggravating to the situation at hand.I think the only mitigating factor is what kind of damage and to who the code did, but even that is an argument of personal morality and not professional ethics.

i think pushing back on the "um actually its not obfuscated code" arguers is important because their quibble is, either intentionally or not, distracting from the overall suite of behaviors and circumstance that show Maltiez as an actor was deliberate, evasive, malicious, and unrepentant. most of all he felt morally justified to act unethically. thats a very bad combo

at least thats why i keep pushing back against it. its the same reason i push back against the definition of malware nitpicks. Both of these arguments are simply the only good arguments people have to minimize the situation and if you strip those away defensibility of the situation goes out the window. again in my opinion. clearly if that sentence could magically change peoples minds there wouldn't be a debate to be had.

[Mushroomancer]

4 minutes ago, Diff said:

Maltiez was targeting a specific modder, the creator of the paid cheat mod.

Apologies, I wasn't meaning to imply that a specific mod wasn't being targeted, only that Maltiez's code wasn't identifying it because of anything unique to that mod. Which is why it was an incredibly sloppy and short-sighted method to use for an already unethical act of what seems to be ego or spite driven vigilantism.

[Diff]

Just now, Mushroomancer said:

Apologies, I wasn't meaning to imply that a specific mod wasn't being targeted, only that Maltiez's code wasn't identifying it because of anything unique to that mod. Which is why it was an incredibly sloppy and short-sighted method to use for an already unethical act of what seems to be ego or spite driven vigilantism.

Ah no need to apologize, we're saying the same thing. I didn't spot your answer to that part of genderBiohazard's question when I read it through the first time.

[Mushroomancer]

2 minutes ago, icesharkk said:

i think pushing back on the "um actually its not obfuscated code" arguers is important because their quibble is, either intentionally or not, distracting from the overall suite of behaviors and circumstance that show Maltiez as an actor was deliberate, evasive, malicious, and unrepentant. most of all he felt morally justified to act unethically. thats a very bad combo

at least thats why i keep pushing back against it. its the same reason i push back against the definition of malware nitpicks. Both of these arguments are simply the only good arguments people have to minimize the situation and if you strip those away defensibility of the situation goes out the window. again in my opinion. clearly if that sentence could magically change peoples minds there wouldn't be a debate to be had.

I suppose I also contradicted myself a little by saying it 'does matter' and it 'doesn't matter'. The reality is that the details of technicality are an important discussion to have as far as discerning the scope and morality of the actions taken, but not the ethics or professional regard for the actions taken. What Maltiez did was obfuscation in the literal sense even if it wasn't in the technical sense and it's the best word for Maltiez's actions regarding how he delayed detection.

My other points is that linguistic nitpicking is pointless as a means of defending Maltiez, not necessarily deconstructing those defenses just because whether or not Maltiez's actions meet a criminal threshold for 'malware' or the technical definition of 'obfuscation' in regards to programming doesn't really change the fact that the principle actions taken were unethical. The question then becomes what is the justified recourse for that lack of ethics and regard for users?

I wouldn't say I'm satisfied with what's been done, but I also have faith that Anego is doing what they believe is best and that they aren't willing to risk their project being used to smuggle malware. My trust is harmed, but it isn't broken, and I am willing to take on faith that things will continue to improve and that they can handle Maltiez if they believe they can and will part ways with him if they believe they can't.

[Mushroomancer]

13 minutes ago, Diff said:

They didn't specify which part of the community is the part engaging in bad faith, but I'm going to risk putting words in their mouth and say I don't believe Mushroomancer thinks this is it.

No this is my fault, I should not have used 'Bad Faith' and stuck to 'uncharitable'. Although I'm sure there are bad-faith actors, I do not think they're the majority here at all on either side of the discussion and notably the most vitriolic bad faith actor we've seen on the forums yet was a defender of Maltiez. The reality is that emotions are high and everyone still engaged with this discourse is feeling raw from all that's happened and that can lead to a lack of willingness to hear out the other side on their terms. A couple days ago I was in the same boat.

I do think Anego and their community moderators have a higher standard that they should be adhering to in this regard, as they are in the professional position and should be acting that part, but I also understand that's easier said than done when you're on the receiving end of community outrage. Especially for a community that hasn't had the same traditional buffers between the developers and customer base you'd see in larger operations.

I think the speed with which this all happened has also only aggravated things. 

[LadyWYT]

7 hours ago, icesharkk said:

people who wont read the Wikipedia

In all fairness, Wikipedia isn't a particularly trustworthy source of information since anyone has edit access. Or at the very least, it was banned as a relevant source of research material for papers when I was in college for that reason and others. It can be an okay starting point to find a general overview of a subject, and other sources about that subject, but it's not really something you want to be citing as the sole source of information.

[Dark Thoughts]

7 hours ago, MKMoose said:

As much as I can understand some concerns, we've seen so much worse on the Forums, not to mention Discord and Reddit. Do you really think that a reasonably level-headed, careful expression of what is clearly your own opinion, with not a trace of insults towards other members and no bad-mouthing Anego, posted under the apporpriate topic, would be reason enough for a ban?

100% yes. They literally told me off regarding an argument that was settled (and instigated by the other side) weeks / months (can't remember exactly) after it already was over / resolved. Like, they just had to shove that in there and push their authority onto me, even though I didn't even do anything (I just reported something that a mod author somehow found offensive and then got snappy). They also deem even the slightest harsh language as offensive, to the point where you're not even sure what words might be illegal or not, or not flowery enough. Moderators here also do not like being told off / to be wrong, which is why they're very vindictive and ban you for simply arguing back or questioning their moderator actions. They also love to protect certain trolls, like the one you're quoting / arguing with up there. This isn't even unique to this specific forum / community, but observable behavior across the internet. Either fall in line or you're toast, regardless if it is justified or not. Just look at some of the Discord bans that have been posted elsewhere (luckily I don't use Discord, as I have a strong opinion against it).

Even this comment I would not be surprised to see removed & punished, just for what I said - and most of your would none the wiser if that would happen.

[icesharkk]

38 minutes ago, LadyWYT said:

In all fairness, Wikipedia isn't a particularly trustworthy source of information since anyone has edit access. Or at the very least, it was banned as a relevant source of research material for papers when I was in college for that reason and others. It can be an okay starting point to find a general overview of a subject, and other sources about that subject, but it's not really something you want to be citing as the sole source of information.

sigh. see this is my point. If the best defense available is "wikipedia is unreliable" that isn't really even interacting with the point I'm making. its argumentative distraction.

I do get you're bringing up that maybe they brushed the argument off for this reason but i dont think so. The arguments i've seen range from "the degree of harm is insufficient", "the intent wasnt malicious/target was justified", "i made up my own definition that deliberately excludes this case as malware", "its PUP",  using the term malware makes it sound worse than it actually was, to "yUo MuSt Not WoRk iN iT". 

• Sufficient harm simply isn't criteria in the the definitions of malware,
• justification of targe is not in the definition and it was malicious by both definition and admission
• the third argument is for trolls and fools,
• either it can be PUP and still be malware or it isnt PUP. PUP is just another quibble to minimize
• how it sounds because of the definition it meets is not relevant
• and the last argument is ad hominem so irrelevant.

 

Incase you need them here are some concrete sources:

Quote

"Definitions:  Hardware, firmware, or software that is intentionally included or inserted in a system for a harmful purpose."
- https://csrc.nist.gov/glossary/term/malware

"Malware: See Malicious Code.
Malicious Code: Software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of a system. A virus, worm, Trojan horse, or other codebased entity that infects a host. Spyware and some forms of adware are also examples of malicious code."
- NIST.SP.800-12r1

'Software designed to interfere with a computer's normal functioning"
- Merriam Webster's dictionary

If someone cant accept the NIST definition then I simply cannot help them. i.e. I can explain things to you I cannot understand them for you.

 

Edited Sunday at 02:16 AM by icesharkk

[LadyWYT]

1 minute ago, icesharkk said:

sigh. see this is my point. If the best defense available is "wikipedia is unreliable" that isn't really even interacting with the point I'm making. its argumentative distraction.

I do get you're bringing up that maybe they brushed the argument off for this reason but i dont think so. The arguments i've seen range from "the degree of harm is insufficient", "the intent wasnt malicious/target was justified", "i made up my own definition that deliberately excludes this case as malware", "its PUP",  using the term malware makes it sound worse than it actually was, to "yUo MuSt Not WoRk iN iT". 

I wasn't trying to debate word definitions  Just idly noting that citing Wikipedia usually doesn't make for the strongest position when it comes to debate and it can get you dismissed entirely depending on the context, especially if there are more credible sources in play. That being said, I do agree that the Wikipedia mention probably wasn't why you were getting brushed off in those circumstances. Debate is difficult, especially on the internet, and it's not unusual at all for internet denizens to completely ignore cited sources regardless of their quality.

[icesharkk]

4 hours ago, greed23 said:

So, like, why were none of the false positives addressed on the official announcement?

Why was the impact to regular users downplayed despite many, many people coming forward saying they were adversely affected by the malware?

Why was the malware actively praised for succeeding in "protecting servers" when Maltiez can be seen stating that wasn't its in intent, and when it was actively causing the inability for many servers to operate normally?

Why does the VS team refuse to acknowledge the malware as that, despite it fitting every common definition?

Why have we not seen an updated response despite everyone asking these questions?

Why is the reddit being actively censored just because there's an official response?

This frustration will continue to simmer.

Either They value his personal situation more than that of thousands of customers, they endorse his actions now, or they have no ability to fire him because they endorsed/okay'd the action in the first place and a wrongful firing lawsuit would expose them.

I'm not sure i see another option beyond the catch all "because dumb" and i dont think that's it/dont really want to insult them either. they're doing enough damage to themselves as it is. 

[archidoxal]

Hello guys, I came back after almost a year long break just to see something about a malware being part of the official game due to some newly hired dev going rampage, reasons that I do not know of yet.
Been reading a few threads so far but I still am left with some questions, who is this guy? Why did he add malicious code into the game and like, whats going to happen from now on, because I bought this game quite a long time ago to support it and I am quite saddened by the news.

Also despite the situation, I am confused by the amount of hatred towards the overall team just because of one dev. Also Tyron is the lead developer and knew about the code? Or am I just mistaken. I need like a brief explanation if possible. Thank you

[williams_482]

Short and sweet:

- There is not and was not malware in the base game

- A notable mod developer secretly placed code in some of their mods which would cause the game to crash if the player joined a multiplayer server while using certain other mods. That is the full extent of the malware you've heard about. 

- The mod the crash code was targeting was a notorious cheat mod, but it would also crash when using a few other legitimate mods. 

- After this mod developer put in that crash code but before anything was publicly known about it, they were hired to work on the game directly.

- When this came to light, the mod developer behaved very poorly.

- This modder had told other developers at Anego what they had done (unclear how clearly or completely), and Tyrone said in his statement that he and the other developers should have realized that there was a problem and taken action.

- Anego has now taken actions to make sure this mod developer no longer has access to their mods and cannot put malware in them. This developer also does not have direct access to the base game code, and anything they do will be watched carefully. However, they have not been fired. 

- At this stage, most of the controversy is over if this mod developer should have been fired. 

[icesharkk]

For background and discussion.

the game is currently safe. debate is ongoing about the ethical ramifications and trustworthiness of the company given the statement and declared next steps.

[archidoxal]

4 minutes ago, williams_482 said:

Short and sweet:

- There is not and was not malware in the base game

- A notable mod developer secretly placed code in some of their mods which would cause the game to crash if the player joined a multiplayer server while using certain other mods. That is the full extent of the malware you've heard about. 

- The mod the crash code was targeting was a notorious cheat mod, but it would also crash when using a few other legitimate mods. 

- After this mod developer put in that crash code but before anything was publicly known about it, they were hired to work on the game directly.

- When this came to light, the mod developer behaved very poorly.

- This modder had told other developers at Anego what they had done (unclear how clearly or completely), and Tyrone said in his statement that he and the other developers should have realized that there was a problem and taken action.

- Anego has now taken actions to make sure this mod developer no longer has access to their mods and cannot put malware in them. This developer also does not have direct access to the base game code, and anything they do will be watched carefully. However, they have not been fired. 

- At this stage, most of the controversy is over if this mod developer should have been fired. 

 

3 minutes ago, icesharkk said:

For background and discussion.

the game is currently safe. debate is ongoing about the ethical ramifications and trustworthiness of the company given the statement and declared next steps.

Thank you both for the info, love you

[greed23]

8 hours ago, Mushroomancer said:

I don't think that retaining him was the right thing to do and I don't think their statement was perfect, but I also think that parts of the community are intentionally engaging with their public statement in bad faith, or at least letting the emotional height of the entire controversy leave them with the least charitable interpretation. Given the closing section of the statement, I think it's clear that Anego recognizes that wrong was done and they carry a portion of the burden for that fact. I also think that they could have been clearer with laying out the reality of the situation but I suspect that they were attempting to strike a diplomatic tone and explain their reasoning for what they believed were mitigating factors to Malt's actions (I.E. not believing he is a further threat to the community because the intended targets of the code were themselves malicious actors). 

That diplomatic tone has clearly backfired, but I suspect the team is in a very heightened state of their own. The community has not exactly struck a reasonable and constructive tone of criticism over this and it has been a lot of fervor and fury on both sides.

There's nothing "bad faith" about recognizing that Tyrone praised the malware that was installed unknowingly on thousands of systems, and that effected many innocent users, and that his response failed to acknowledge any of that.

The thing is, people thought that, given a few days to formulate a response, Tyrone/Anego would put out an honest and fair assessment of the situation and a proper apology, with meaningful action.  None of that happened.  It's not bad faith, it's just the realistic response to fumbling the bag as hard as they did.

Edit:
Sorry I read your response after posting this.  Still, I think coloring this as a particularly emotional response is kind of underselling the, frankly, sheer incompetence at every level of the Anego team when it comes to community outreach.  The reaction, as I said, is something that should have been more than expected given the community grievances that were being aired even before the official response.

Edited Sunday at 07:06 AM by greed23

[l33tmaan]

One of the most damning aspects about this entire incident to me is Tyron's complete omission of any mods or innocent users who were affected by ConfigLib's, frankly, insidious coding practices. Concealing your own deliberately caused crashes indicates an unacceptable level of disrespect for the users of his mods and the community at large. Due to this deception, it's difficult to actually determine the scale of the damage inflicted, short of people going through and examining most mods to see if they met the threshold that would trigger Maltiez's vigilante code. How many hours of unsuspecting users and server owners have been wasted as a result of his unwarranted and unasked for actions? If you have sympathy for Maltiez, then please extend that sympathy to the hundreds, if not thousands of people who were affected by this entire debacle and went unaddressed in Tyron's post for whatever gross reason.

[Seravulpes]

8 hours ago, Diff said:

Undeniably caustic. Being caustic is externally viewable. Repentance comes from within.

What (if anything) would you (@anyone) accept as a genuinely repentant Maltiez? Would it even make a difference if he was somehow verifiably repentant?

It's fine if there's nothing and if it makes no difference, just trying to understand better. 

No worries, horse isn't going anywhere. Welcome to the forums!

"Repentance" looks like repairing the breach of trust with the community, but i dont think its entirely maltiez's burden. However you (general you) feel about the situation, this issue has clearly caused a schism in the community. Anyone arguing about this clearly cares enough about this game to be worried about its future, and the dev team has a responsibility to maintain the communities trust (though its a big ask). Malteiz's attempts at guerilla anti-cheat were undeniably misguided and reckless, and its understandable to be wary of their input for the team going forward, it would be a good look for both malteiz and the team at large for a completely above-the-board counter to cheats (or further development generally) with proper oversight **and transparency** to be implemented. I trust the devs enough to run their code on my system, it would be silly of me to think malteiz would (or would want to) sneak something malicious under their nose.

[Mushroomancer]

18 minutes ago, greed23 said:

Edit:
Sorry I read your response after posting this.  Still, I think coloring this as a particularly emotional response is kind of underselling the, frankly, sheer incompetence at every level of the Anego team when it comes to community outreach.  The reaction, as I said, is something that should have been more than expected given the community grievances that were being aired even before the official response.

My criticism is that an overbearing emotional response that borders on toxicity and abuse does not make anyone want to communicate. Considering this situation blew up five or so days ago, I'm somewhat impressed we got any response that wasn't 'We have ensured that the offending mods on our databse are reviewed and are further investigating, please wait for our official response, than you for your patience.' for a week first. Working in an already tense environment with a tight expectation of time and a horde of frothing mouths around you does not make for particularly candid nor well thought out PR moves. Especially considering that it seems like Anego doesn't have much in the way of formal PR and Community Management training.

This is probably, more than anything, a sign that it's time for that to end. I'm loathe to say it but whatever happens to Maltiez, I think the lesson that gets taken from this is to separate from the community and discourage any direct emotional contact or parasocial bonding as best as you can. It's not worth it to thread the needle between professional corporate conduct and leading community members especially when you're going to be criticized for being too corporate or too emotionally invested either way.

Anego has not reacted perfectly, probably not even 'well', but the community has also showed no patience or understanding even now that the immediate threat of compromised software is gone. Tyron and by extension Anego have spent a decade not just leading the community and developing the game but being involved in the community as well, and they're repaid for that with what is probably one of the least charitable and least courteous outrages I've seen in a good while. I'm sure it hurts to know your community will not afford you the opportunity to navigate forward. 

[Mushroomancer]

52 minutes ago, l33tmaan said:

One of the most damning aspects about this entire incident to me is Tyron's complete omission of any mods or innocent users who were affected by ConfigLib's, frankly, insidious coding practices. Concealing your own deliberately caused crashes indicates an unacceptable level of disrespect for the users of his mods and the community at large. Due to this deception, it's difficult to actually determine the scale of the damage inflicted, short of people going through and examining most mods to see if they met the threshold that would trigger Maltiez's vigilante code. How many hours of unsuspecting users and server owners have been wasted as a result of his unwarranted and unasked for actions? If you have sympathy for Maltiez, then please extend that sympathy to the hundreds, if not thousands of people who were affected by this entire debacle and went unaddressed in Tyron's post for whatever gross reason.

The fact that we can't determine the scope of the issue is probably a big part of the reason that Anego isn't making a statement. Tyron is not just a member of the community and Anego is not working on some obscure bespoke software project, they're a legal entity and have to use language that reflects that. Of course, that's speculation. It's also speculation to say Anego supports malware and is going to turn Vintage Story into a smokescreen for malware. It's also speculation to say they rushed a statement and didn't cover their bases under the community pressure they were feeling. It's also speculation to say that they're carefully picking their language for legal reasons until they have consulted with counsel and have a clear path forward.

We can read in whatever level of charity we want all day.

[greed23]

56 minutes ago, Mushroomancer said:

My criticism is that an overbearing emotional response that borders on toxicity and abuse does not make anyone want to communicate. Considering this situation blew up five or so days ago, I'm somewhat impressed we got any response that wasn't 'We have ensured that the offending mods on our databse are reviewed and are further investigating, please wait for our official response, than you for your patience.' for a week first. Working in an already tense environment with a tight expectation of time and a horde of frothing mouths around you does not make for particularly candid nor well thought out PR moves. Especially considering that it seems like Anego doesn't have much in the way of formal PR and Community Management training.

This is probably, more than anything, a sign that it's time for that to end. I'm loathe to say it but whatever happens to Maltiez, I think the lesson that gets taken from this is to separate from the community and discourage any direct emotional contact or parasocial bonding as best as you can. It's not worth it to thread the needle between professional corporate conduct and leading community members especially when you're going to be criticized for being too corporate or too emotionally invested either way.

Anego has not reacted perfectly, probably not even 'well', but the community has also showed no patience or understanding even now that the immediate threat of compromised software is gone. Tyron and by extension Anego have spent a decade not just leading the community and developing the game but being involved in the community as well, and they're repaid for that with what is probably one of the least charitable and least courteous outrages I've seen in a good while. I'm sure it hurts to know your community will not afford you the opportunity to navigate forward. 

I don't know.  I've been on the other end of PR before, granted for a much smaller development team and for a gamemode instead of an entire game, and there's an understanding that any team needs to have that, especially for security concerns, there's implicit trust that only goes one way.

 

Honestly, despite the small impact and relatively harmless nature, a security breach of this nature from a dev is about as bad as it gets in terms of eroding trust and goodwill from the community.  You have to expect it and you have to formulate a response that makes the community feel like they're actually being heard.  Anything less than that, and you're adding fuel to a fire.

Edited Sunday at 08:45 AM by greed23

[Vratislav]

I tried to clear for myself, what was the real extent of harm on gameplay and what are possible positions of people who lost their trust or are just commenting the situation. It it is incorrect in some aspects, let me know. I did not put the numbers into the plot, but I assume that ConfigLib with the payload was installed by up to 100 000 players, and the players who used mods triggering false positives were hundreds or thousands in maximum.

[Endeavour]

6 hours ago, williams_482 said:

Short and sweet:

- There is not and was not malware in the base game

- A notable mod developer secretly placed code in some of their mods which would cause the game to crash if the player joined a multiplayer server while using certain other mods. That is the full extent of the malware you've heard about. 

- The mod the crash code was targeting was a notorious cheat mod, but it would also crash when using a few other legitimate mods. 

- After this mod developer put in that crash code but before anything was publicly known about it, they were hired to work on the game directly.

- When this came to light, the mod developer behaved very poorly.

- This modder had told other developers at Anego what they had done (unclear how clearly or completely), and Tyrone said in his statement that he and the other developers should have realized that there was a problem and taken action.

- Anego has now taken actions to make sure this mod developer no longer has access to their mods and cannot put malware in them. This developer also does not have direct access to the base game code, and anything they do will be watched carefully. However, they have not been fired. 

- At this stage, most of the controversy is over if this mod developer should have been fired. 

This is a very good summary.
I would like to add:
The cheat mod was paid and designed to grief and destroy servers and there were some seedy practices around luring in customers. It was a cheat mod made with the goal of profiting off those with malicious intent.
The anti cheat worked by detecting whether a mod had more than 22% of its code obfuscated and would crash the game within 1-15 minutes with crash logs that hid the real reason of the crash
The anti-cheat was hidden inside a popular library mod.
True extent of collateral damage is unknown but it is presumed to be minor.

Edited Sunday at 09:55 AM by Endeavour

[MKMoose]

5 hours ago, Vratislav said:

I tried to clear for myself, what was the real extent of harm on gameplay and what are possible positions of people who lost their trust or are just commenting the situation. It it is incorrect in some aspects, let me know. I did not put the numbers into the plot, but I assume that ConfigLib with the payload was installed by up to 100 000 players, and the players who used mods triggering false positives were hundreds or thousands in maximum.

I'm not certain why the "gameplay affected" group doesn't include the cheat client? That could be seen as implying that the anti-cheat didn't actually trigger on the intended target, but it very much did.

 

One thing that is really missing from this whole discussion for me is actual analysis into how many mods tripped the detection. If we could run it on all mods on ModDB or even from outside of ModDB (separately on current mods and on mods from around when that code was first added) to see how many of them trip it, and while at it ideally also while controlling for whether the mod lists any of Maltiez' affected mods as a soft or hard dependency, then we would be able to justifiably say what the risk of false positives actually was at the time that the code was added as well as currently. I would do that myself but don't really have the time for it at the moment.

I've not yet come across any confirmation as to whether any mods trigger the detection besides:

• URL Radio (YT) - released ~1.5 months ago, currently 1349 downloads,
• Caves and Caverns - released ~one month ago, currently 1466 downloads,
• and one other mod, but no idea which - from several months ago, whose author apparently removed obfuscation after Maltiez contacted them.

Edited Sunday at 01:57 PM by MKMoose

[pigfood]

17 hours ago, Teh Pizza Lady said:

Again, the term "obfuscating." People really like to use words they don't actually know the definition of,

18 hours ago, Teh Pizza Lady said:

False. It was very easy to find it and figure out what it did once people knew it was there. Maltiez did not try to obfuscate his code. That is a programming term that means to scramble variable names and properties within the code so that anyone who decompiles it will have a very difficult time understanding what the code does. That is what obfuscating code means.

It's rather ironic that you are confidently wrong to a rather extreme degree. Obfuscation is far broader than what you claim.

He didn't use automated obfuscation tools. However, any semi-competent developer would recognize that the completely unnecessary usage of comparing strings against hash values is clear-cut obfuscation.

While his identifier naming doesn't match automated obfuscation tools, it is absolutely manual obfuscation with malicious intents.

\\

His obfuscation was pretty unsophisticated. It didn't take a large amount of skill to uncover. At the same time it was good enough to require a rather substantial debugging time effort to uncover.

\\

Would you mind posting your definition/source of obfuscation? You are making no sense whatsoever.

Edited Sunday at 11:12 AM by pigfood

[Sadi89]

Hello, I never posted on the forums since I never had the need to since the few questions I would need an answer for was always answered in the discord. But since neither onReddit nor on the discord I have had any progress on my query I will post my reddit response to the official statement reddit thread here.

Fore ease of conversation I will post it in text here as well:

Quote

 

Thank you u/TyronX for the response. Most of it makes sense and looks good moving forward.

There is one point though that is woefully underrepresented and needs further clarification in my humble opinion and that is the impact of said code.
In discord and in your statement it seems to paint a picture that it barely affected anyone but by the nature of the code and how it disrupts gameplay I dont believe we can make a blanket statement that it only affected <100 cheat users only.

I will now post a message from Pr0fesseur[Caves mod author] from discord and I want you to verify that this is how the code works in the dll, becasue if it is so - from my layman understanding - it did not only target the cheat mod but looked only for [obfuscated] code thus acting more like a shotgun targeting a specifc way to preserve selfmade work than a sniper to the specific cheat mod.

message:

Activates only when running as a multiplayer client.
Enumerates all assemblies loaded into the application's AppDomain.
Fingerprints loaded assemblies using hard-coded CRC32 values.
Performs an additional heuristic check for obfuscated assemblies by measuring the percentage of type and member names shorter than three characters.
When its detection conditions are satisfied, schedules execution after a pseudo-random delay.
Deliberately modifies unrelated internal Vintage Story client state in ways capable of causing crashes, disconnects, broken networking, corrupted UI state, and other intermittent failures.
Silently catches and discards exceptions throughout the detection path, making the resulting failures substantially more difficult to diagnose.

The disruptive routine can perform operations including:
setting ClientMain.disposed = true;
setting KillNextFrame = true;
forcing exitToMainMenu;
forcing exitToDisconnectScreen;
calling SendLeave();
corrupting the frame limiter;
setting GuiComposers to null;
setting ScreenRunningGame to null;
setting LoadedEntities to null; and
replacing the client's packet-handler collection with an empty array.

This is important for two reasons:

1. People dont actually know if their crashes or problems in the last 9 months were casued by this and will dogpile the discussion if you can not have definitive proof and clear official statements on what it actually did.

2. A lot of Server owners install up from 20-200 mods on their server so having a single mod that triggered it caused a lot of headaches, troubleshooting witch hunts, false accusations and other issues within the community. This was not mentioned and it further agitaes the community as they feel the issues are swept under the rug. [our server Admins had to go through a lot of troubleshooting in the last months - this has stoked my interest in this topic]

So please look into the code and tell us in an official statement what it truly does and how it may have impacted the users and dont act like it did not affect anybody.

I dont want to stir up any drama but the information needs to be published and the impact verified.

Thank you for your time.

 

So I want to use this thread and get to the core of the problem. I want every capable person to look into the code sincerely and honestly so we can all come to a conclusion on the real impact, since in the current state it is unsatisfactory. I dont want people to dismiss it outrigth as "it didnt affect anybody" but I also dont want people to blame everything on it either.