Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[icesharkk]

4 hours ago, williams_482 said:

Here's what's happening, over and over again in cycles:

- Person #1 comes in here with an angry take about Maltiez that is based on misunderstanding a technical term, or simply factually incorrect information.

- Some people in what we'll call group #2 respond to them, clarifying the misunderstanding or correcting the incorrect information.

- Some other people in group #3 accuse the people in group #2 of making pointless pedantic arguments in Maltiez's favor. 

Most members of group #3 are well aware of the facts of the case, and have come to an informed judgement that they feel Maltiez should be fired. That's totally legitimate! This is a highly subjective thing and we can all agree on the facts and come to different conclusions, and there's plenty of argumentitive ground to be worked over that doesn't contest established facts. 

Person #1 does does not have all the facts! If they're going to come to an informed judgement themselves, they need to have those facts! It seems to me (from my inevitably biased perspective) that group #3 disagrees with this position, purely on the ground that person #1 already agrees with group #3, and they feel the important thing is not person #1 making an informed judgement, but person #1 continuing to agree with group #3. 

This is a complicated, technical issue and the facts are relevant. There is also a large subjective component and plenty of people are going to disagree on those grounds. Can we stick to informing people of those facts and arguing about the subjective aspects here?

I will take this under advisement. its a good point about the group dynamic. 

overall I have found myself correcting in both directions. though the ratio is hardly even. perhaps in the last day or so i've gotten more snippy about it and should adjust.

[williams_482]

Just now, icesharkk said:

I will take this under advisement. its a good point about the group dynamic. 

overall I have found myself correcting in both directions. though the ratio is hardly even. perhaps in the last day or so i've gotten more snippy about it and should adjust.

Obviously we don't agree on this topic and have argued several times, but I just want to say you seem like a very pleasant, thoughtful, and reasonable person. 

[Thorfinn]

6 hours ago, icesharkk said:

even if you did verify all of the mods before adding them to your game

I do verify them, plus anymore I mostly run on a virtual machine with nothing on the physical drive but OS and games. The extra effort to verify is why I usually skip code mods unless it's something I really, really want. Which is not configuration software. Run the mod briefly once, look at ModConfig and see what options there are. Not that hard.

 

6 hours ago, icesharkk said:

Its another thing entirely to say that you should decompile and reverse engineer every piece of code that you install

I would never do that. Way too time consuming, plus if the standard is to supply source, and this is an exception, that's a red flag all by itself. (Note: that's not what happened here, but it is implicit in your hypothetical.) That's why I said give the source a quick look-see for anything that sticks out, then compile and compare. If they don't match, I don't bother.

 

6 hours ago, icesharkk said:

Your argument dismisses the problem and shuffles all of the blame onto the consumer

I don't dismiss the problem, but, yes, what goes on your machine is your decision. No one forced you to download anything against your will.

Quote

..we could look at this drama as an opportunity to figure out what we can each do with our particular skills to improve things..

@Bruno Willis, Exactly. And in this case, @Diff says it would have been pretty easy. Compile and compare. Bzzzzt.

Edited Monday at 01:46 AM by Thorfinn

[Mushroomancer]

49 minutes ago, icesharkk said:

I will take this under advisement. its a good point about the group dynamic. 

overall I have found myself correcting in both directions. though the ratio is hardly even. perhaps in the last day or so i've gotten more snippy about it and should adjust.

It can be good, I had to take a step back and reassess early on and my conclusions changed, and I now find myself falling somewhere in the middle of the arguing groups here, and for it a lot less charged. Usually. There are still moments. 

[Diff]

 

9 hours ago, Sadi89 said:

--> scans all game files loaded? but doesn ot look through the pc's files

Technically not every game file, "Assemblies" in this context means "The DLLs (code) currently loaded by VintageStory". And yes, it never interacts with your PC's files.

9 hours ago, Sadi89 said:

knows hash values of certain mods and has them saved on a list to detect them when lookign through tge loaded mods 
---> targeted specifc mods the author deems "bad". possibility of false positives? what is it looking for exactly? 
can we have the list?

MKMoose got this one. I also have no idea what the source for that list of names is, but regardless it seems to be accurate and in the same order as they are in the code if anyone wants to spot check it. I only checked the first two, Aimbot (3606486923) and InstantShot (3515110866).

9 hours ago, Sadi89 said:

--> second part is about how the dll then proceeds to crash the game after a random length of time 
when one of the two search methods gave a positive reading, which is maybe good for keeping it hidden 
but doesnt really help people getting abused by said cheats if the crash can take several minutes to execute.

Yes. It can do one of a number of many things.

Rarely (0.565%), it'll spam random key presses, buttons, and mouse clicks every game tick. Very rarely (0.196%), your player will attack itself. The rest are various flavors and varieties of freezes, crashes, disconnects, and normal exits.

12 hours ago, Sadi89 said:

What is the time frame coded into the dll?

There's two. The first one, MKMoose mentioned. That's the one that triggers in response to obfuscation or string matches. The other one is (5±4) * 107471, between 1 minute 47 seconds and 16 minutes. This one triggers if any of the types contain nonprintable characters in their name, I suppose another obfuscation check, but neither of the two false positive mods I inspected would have triggered this one... maybe the original cheat mod was using a particularly wacky kind of obfuscation that inspired this?

12 hours ago, Sadi89 said:

--> Those alterations can cause crashes, disconnects, networking problems, UI problems, and other unpredictable behavior. 
    Not just simple crashes

No, the networking, UI, and other tomfoolery should only produce direct crashes and freezes. For the UI for example, your UI won't glitch out, instead it's is set up to be the trigger for the crash. It sets the list of GUI Composers to null, so the next time something goes to grab a Composer, it'll crash. There's some behavior I can't personally predict without testing it, one of the random options is telling the game client to Start() when it's already started. I'm not sure what exact effects that has, but I do imagine it's quite consistent, and most likely just crashes. Might also freeze. Based on what I read before giving up, I can't imagine it's subtle.

12 hours ago, Sadi89 said:

--> hides/alters error logs to make you unaware what caused said DCs networking issues or crashes, 
blaming other mods, server owners, you ISPs or your own hardware.

Like I mentioned in the last one, it doesn't really hide or alter error logs. It leaves banana peels strewn in the main walkway and waits for someone to take themselves out. In all the logs I've seen so far, it's the game itself that trips over it rather than a mod. This also aligns with my expectations based on the code.

However, it is still "blaming other mods" in that if you remove the mod that upset it (false positive or true positive), it will stop crashing. That does implicate the other mod, if not for being bad code, then for being incompatible in some way with another mod.

[OBAMFSpike]

Yes I am here to say it.

You know whats giving me a bad taste for Vintage Story?

All the whining and complaining. 

I won't stop playing. Im not that easy. NOPE. 

But how many days of complaining until the beast is satiated and good enough can lay to rest? I sure am glad to only have access to the Forums here. 

It's rather comical all the people slandering each other like they are the moral authority in all of this. 

Whoever has never done wrong throw the first stone, ya know. 

[greed23]

2 minutes ago, OBAMFSpike said:

Whoever has never done wrong throw the first stone, ya know. 

Well, I've never injected malware into a mod that got distributed to thousands of computers... nor have I ever proceeded to praise that malware's effectiveness and say that it only effected cheaters when it effected many innocent players and servers... so....

[Voicelessflu]

Why don't this work for the "Cheaters"? I did not  throw  any stones the dev did .

[OBAMFSpike]

You need a cheese with that wine?

Literally both replying accounts have contributed nothing but complaints concerning this. I'm sure you've been heard. The person in question has been dealt with. What more do you want to do other than argue on a forum? 

Edited Monday at 02:11 AM by OBAMFSpike
Cause I can.

[LadyWYT]

4 minutes ago, OBAMFSpike said:

But how many days of complaining until the beast is satiated and good enough can lay to rest?

Eh...it's to be expected. People have good reasons to be upset about what happened, and have a right to politely voice those concerns. That's not to say that everyone has expressed their thoughts in that fashions, but anyway...

When stuff like this happens, tensions are going to run high, and there's not really a condition where everyone "wins". There's always going to be a section of the playerbase that just will not accept ANY kind of apology and walk away as a result. There's always going to be a section that feels the solution chosen wasn't the best one, and be upset about that. And the studio associated with the mess, regardless of whether or not the studio was ever actually at fault, is going to be left holding the bag and have to rebuild trust with their playerbase, because even the satisfied players are going to be a little skeptical of things going forward.

As far as drama goes it's the worst I can recall seeing in the VS community, but not the worst that I've ever seen on an online forum. That award still goes to what I can only dub as the "Great Intercontinental Roleplaying War" that happened on the WoW forums several years ago.

[OBAMFSpike]

You a very well represented individual in the forums and are greatly appreciated by myself and many others I am certain. 

I simply had to complain in my own way. It's all ugly you are right. But it still stands to show a spine in the face of blowing winds. 

(I suppose I should add that I think a code to drop cheaters on their face is awesome, sad it didn't work that way)

Edited Monday at 02:23 AM by OBAMFSpike
Cause I still can

[icesharkk]

eh the conversation can end when the resolution is sufficient. im glad you're satiated. many are not.

[OBAMFSpike]

2 minutes ago, icesharkk said:

eh the conversation can end when the resolution is sufficient. im glad you're satiated. many are not.

If it's any consolation, I expected a reply from you. 

It's true, I am not bothered by it as it didnt change or mess with anything I was doing. It's harder to comprehend and understand something when it didnt happen to you. Yet I still find it hard to justify anger against something that was designed to root out cheats. This was the intention, correct?

[icesharkk]

45 minutes ago, Thorfinn said:

I do verify them, plus anymore I mostly run on a virtual machine with nothing on the physical drive but OS and games. The extra effort to verify is why I usually skip code mods unless it's something I really, really want. Which is not configuration software. Run the mod briefly once, look at ModConfig and see what options there are. Not that hard.

I would never do that. Way too time consuming, plus if the standard is to supply source, and this is an exception, that's a red flag all by itself. (Note: that's not what happened here, but it is implicit in your hypothetical.) That's why I said give the source a quick look-see for anything that sticks out, then compile and compare. If they don't match, I don't bother.

I don't dismiss the problem, but, yes, what goes on your machine is your decision. No one forced you to download anything against your will.

@Bruno Willis, Exactly. And in this case, @Diff says it would have been pretty easy. Compile and compare. Bzzzzt.

i think what i want out of this situation is a sfer environment that reduces teh individual burden on the end-user by implementing a more trustable pipeline between public reviewable code and compiled hosted mod.

Its not even about what i would or would not have gotten hit by based on my verification steps, its about what i expect the average user to do. the average user was exploited by maltiez towards his own ends and I want Anego to improve the supply chain so that is not as easy to perform for the sorts of users who are not going through all of the steps thorfinn outlines. because it isnt about us. its about the community as a whole. And im not willing to say its the user's fault for maltiez criminal actions or that the user is responsible for preventing this in the future. i.e. I guess the user shouldn't have dressed like that...

[icesharkk]

8 minutes ago, OBAMFSpike said:

If it's any consolation, I expected a reply from you. 

It's true, I am not bothered by it as it didnt change or mess with anything I was doing. It's harder to comprehend and understand something when it didnt happen to you. Yet I still find it hard to justify anger against something that was designed to root out cheats. This was the intention, correct?

per maltiez own admission this was not about protecting the community it was him vs the the cheat developer. Furthermore,  just because the target is justified does not make the action acceptable. --edit: removed an analogy that will just piss people off and not be productive--

What maltiez did is wrong. The target doesn't change the legality, ethics, or correctness of the action. and thats even if you believe he did it for the right reasons. which based on his own words I do not.

Edited Monday at 02:36 AM by icesharkk

[Diff]

There's really not a ton you can do to reduce the technical risk for the average person. In the end there's no substitute for code review, and the ModDB is explicitly unreviewed, as is every game's modding ecosystem. It's inherently reactive rather than proactive.

[Teh Pizza Lady]

18 minutes ago, icesharkk said:

eh the conversation can end when the resolution is sufficient. im glad you're satiated. many are not.

The resolution is sufficient. Anego weighed the severity of Maltiez's actions, his importance to the 1.23 updates, and the legals risks that come with firing him without notice in the EU and decided that keeping him on under observation was the better course of action. Seems resolved to me, sufficiently I might add. I'm terribly sorry that you're not getting your way, but you've grown from keeping a level head and only stating the facts to jumping on the "can him anyway" bandwagon.

disappointing...

Edited Monday at 02:41 AM by Teh Pizza Lady

[LadyWYT]

Just now, OBAMFSpike said:

Yet I still find it hard to justify anger against something that was designed to root out cheats. This was the intention, correct?

Kind of? As far as I'm aware, it's a case of Maltiez took matters into his own hands, added code to his mods to mess with the cheaters without being open about what he was doing(either with fellow players or Anego Studios). The cheaters apparently did give up on trying to maintain their cheats, but Maltiez's code was also catching innocent mods(like Caves N Caverns) in the crossfire simply due to how the "anti-cheat" worked(ie, it looked for a certain percentage of obfuscated code in loaded mods and then caused the game client to crash if it found one). The "anti-cheat" was added prior to Maltiez's involvement with Anego Studios. Anego themselves doesn't seem to have been aware of what was going on, aside from a few suspicious remarks from Maltiez that should have been questioned in hindsight.

As far as the full extent of Maltiez's intentions, I'm not entirely sure. He's certainly been accused of a lot of bad behavior by several people. Apparently he himself remarked that it wasn't exclusively about stopping the cheats. However, saying something doesn't necessarily make it true, and it's sometimes hard to maintain clarity in tense situations when emotions are running high.

My general take on the matter is that I'm glad the cheaters were stopped, and I daresay most players would probably agree on that note. However, that doesn't mean that the methods used were appropriate, even if they were effective, and I think most players would probably agree on that note as well. Regarding Anego Studios, unfortunately they get stuck in a no-win situation, given that they're going to get blamed for it by association, and there's no option they can pick that won't upset part of the community.

[icesharkk]

3 minutes ago, Teh Pizza Lady said:

The resolution is sufficient. Anego weighed the severity of Maltiez's actions, his importance to the 1.23 updates, and the legals risks that come with firing him without notice in the EU and decided that keeping him on under observation was the better course of action. Seems resolved to me, sufficiently I might add. I'm terribly sorry that you're not getting your way, but you've grown from keeping a level head and only stating the facts to jumping on the "can him anyway" bandwagon.

disappointing...

I don't believe my position has changed.

[OBAMFSpike]

Damn id of preferred the no tongue tied version of the reply but I wont push the envelope. I think this stuff should be taken up thru emails or a victims advocation or something of the sort. Its nasty business airing ones laundry out for everyone else to stumble through. Ive never even seen you on the threads before all of this. Thats what rings my spidey senses and not to be funny or rude it's just something ive done for over a year now. Nothing of what I'll have to say is going to fix anything for you. You've made yourself known. This is the Dead Horse part. 

[Mushroomancer]

51 minutes ago, icesharkk said:

per maltiez own admission this was not about protecting the community it was him vs the the cheat developer. Furthermore,  just because the target is justified does not make the action acceptable. --edit: removed an analogy that will just piss people off and not be productive--

What maltiez did is wrong. The target doesn't change the legality, ethics, or correctness of the action. and thats even if you believe he did it for the right reasons. which based on his own words I do not.

I'm kind of sick of seeing this. Maltiez's goal was not to provide protection to servers, absolutely correct. But there are multiple ways to read this statement. This reads, to me, like a justification for not making a stand-alone mod that servers could install on an individual basis especially because it would not protect vanilla only servers. The goal was not to put a bubble around any one server, it was to make the cheat author give up on cheating. Which, whether the purpose of that was to protect servers or the community or just to inconvenience and piss off one modder, the end result - the final goal, was that the cheating would stop and go away.

Edit for language clarity.

Edited Monday at 03:27 AM by Mushroomancer

[OBAMFSpike]

1 minute ago, Mushroomancer said:

the final goal, was that the cheating would stop and go away.

To hell with cheaters. Im slow to anger in the method of removal. In 2026 IVE GROWN RATHER SICK OF CHEATS. 

[Zaph42nd]

1 hour ago, OBAMFSpike said:

Yes I am here to say it.

You know whats giving me a bad taste for Vintage Story?

All the whining and complaining. 

I won't stop playing. Im not that easy. NOPE. 

But how many days of complaining until the beast is satiated and good enough can lay to rest? I sure am glad to only have access to the Forums here. 

It's rather comical all the people slandering each other like they are the moral authority in all of this. 

Whoever has never done wrong throw the first stone, ya know. 

Similar sentiments, I think the drama is very much being milked by some bad actors (blowing the whole thing way out of proportion) for attention or just to vent, some of it I admit is justified (because yes, your mods should do what they say on the tin, fighting an unbeatable problem like cheating is very much not on the tin) but a measured response (like the one we got) is appropriate and fair for this situation I believe. A lot of games go through these sort of ebbs and flows of drama, like I've probably mentioned in the past, very similar thing happened in Starsector's community a few years back. Ultimately though, none of this changes my desire to play or enjoy the game, my modded setup never even used ConfigLib and even if it did, would I have noticed? The answer is probably no

Edited Monday at 03:42 AM by Zaph42nd

[Mushroomancer]

13 hours ago, LadyWYT said:

Is that really necessary though? I mean it is one solution, but I'm not sure that becoming cold and distant from the community is a very healthy way to handle it. A better option, I think, is to perhaps re-assess whatever process is used to vet potential hires, and have some better documentation/training regarding public communications. Which it sounds like Anego Studios is looking into the training part. 

I'm not saying it's ideal, just that if I was on the other side of this, I could see how easy it would be to take that route and choose colder professionalism over the potential risk of this situation repeating. Maybe the training pays off and that doesn't need to happen, though.

[OBAMFSpike]

I know we are not alone. It's just a stand up and stretch the legs check on the ol inter webs.