Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Diff]

1 hour ago, Thorfinn said:

Merging what @Teh Pizza Lady said, this allows one add new permissions or something? Just make it harder for the server to distinguish between a valid and invalid request? Abusing the updating routines? Adding a block that rots into redstone or something after one day? Not sure I see why short names would do that, but it would make it harder for a human to track.

Separate things. Short names are just what ConfigLib hunted for and targeted. And specifically, short class and type names. Short variable names were beyond what it was looking at (Assembly.GetTypes()). The cheat mod, separate from its short names, operated by exploiting the fact that the server just kinda trusts clients to tell the truth. The cheat mod lied and said "why yes, I mined all 470 blocks in the vicinity in the past 0.1 seconds." "Hey, server, I just killed everything within a 10 block radius." The server doesn't check to make sure that's sane or possible.

[Mushroomancer]

2 hours ago, Abdoola said:

 

Cannot say for others, but I personally don't want revenge, or Maltiez rotting in jail. What I do want though, is Maltiez not allowed to touch the game code anymore. I don't trust in Tyron's pinky promise to keep an eye on him, as: 1) there were accounts of malware being snuck through a code review, and 2) Tyron seems to be on "whatever not a biggie" stance. So, until Maltiez is removed from a coding position, or an authoritative 3rd party gives their verdict "everything is fine", I consider the base game itself as potentially compromised. And I don't have time or desire to decompile VS and run it via Procmon / Burp Suite / Ghidra you name it every time they ship a minor patch, just to check if it is still safe. I have a life to live. So, it goes into a quarantine for a time being.

You literally came into this thread with your first or second post on the forum, ever, being smugly declaring you were 'reporting them to the authorities.' I feel it's a little hypocritical to back off and say you're just concerned about your own system's safety now. Grow up. You and everyone like you are assuming what Maltiez's potential motives are and are acting like a person cannot internally justify something and draw the line somewhere for themself. Why stop at this low-damage, low-collateral approach when he still had free reign over his code? Why not push something more aggressive and harmful when he still had the change? You act as though it's inevitable now that he will be shoving worms into Vintage Story. You have a perspective of human morality equivalent to a children's cartoon villain. If Tyron had a 'whatever no biggie stance' there would be no consequences at all for Maltiez. They wouldn't have declared that they were going to be particularly careful with Maltiez's code. They wouldn't have bothered to ban him from the community database and community interaction. "They just did that to placate the community." Anything they do is to placate the community. If they fired him tomorrow without anymore information coming out, it would be to placate the community, not because they were taking a principled stance. You have had zero trust and faith in this dev, before the situation unfolded, or you're being performative with your outrage for your own vindication. 

If you're really that concerned, then getting rid of Maltiez will never make you trust Anego. If you think this is the case, how do you know it wasn't just Anego firing Maltiez to get the controversy to go away? What if they're letting worse things slide behind the scenes cause they just don't care? Your own conclusions indicate you cannot ever trust Anego again, and if that's the case, get the refund they offered.

 

5 hours ago, VANTABlack2000 said:

This addition is disappointing. It still doesn't really feel like the player's affected by all this are being considered just Anego's side and AFAIK we haven't gotten any sort of official response here on the forums just on Discord which not everyone uses Discord, so leaving information like that there is another disappointing decision IMO. It's really making me consider if I want to continue recommending this game to people.

 

Unfortunately on the mark of 'only on the Discord', that seems to be a disappointing standard for a lot of things. Discord is where they have the majority of traffic, and it's what a lot of companies and communities now use in the place of forums in general. Considering they have forums, albeit a lot less active than their Discord, seeing something here would be ideal- But the information also immediately made its way here, anyway. I would rather they publish their official statements here, but it's possible they want to reserve the news threads here for specifically content and development related information.

[tiggerbiggo]

3 hours ago, Teh Pizza Lady said:

They won't be satisfied even if he rots in jail and is buried in an unmarked grave. Look at what mob justice did to Jacopo de' Pazzi. 

I'll be satisfied if he's removed from any development role. Acting like literally anyone wants him to rot in jail is hyperbole.

[tiggerbiggo]

Honestly you guys would be a great team to hire to astroturf for me if I ever have a "lapse in judgement" and publish malware to public mod sites, you're great at downplaying the severity of bad actors. It's actually concerning how many of the takes in here don't see the clear line that's been crossed and want to try to push the narrative that anyone who has a problem with this is just out for blood.

And nobody has anything to say about the fact that most programmers hold themselves to higher standards than what's been shown here. This black mark isn't going away.

[l33tmaan]

2 hours ago, Sparticus247 said:

And being banned from making mods and contributing to mods in perpetuity, and having all of his work he has spent an extent amount of time on taken from him and given to others.

Don't forget that part.

Given to Anego Studio's newest and most friendly staff member to date... Zeitlam! 

(I don't think they will actually let him continue working on his mods but I'm sure people will be watching Github to make sure he isn't)

[LadyWYT]

49 minutes ago, Stellarbone said:

I mean telling your customers you don't care about their opinions and then telling them to leave isn't the brightest business strategy. 

Important to note that there is a distinction between this, and simply making a decision that some of your customers don't like and offering them a refund if they'd like to take the money they spent to businesses that they trust more. Anego Studios falls solidly into the latter camp, based on the official announcements. If they didn't care about anyone's opinions, I highly doubt they would have given as much information in their statements as they did, let alone offered refunds to the unsatisfied regardless of when said customers made their purchases.

[greed23]

The abysmal response from Anego over the Configlib Malware situation has now done Irreparable harm to VS's reputation.

 

The Reddit, Discord, and forums are going to naturally be filled with the more dedicated fanbase, and that fanbase overwhelmingly agree that Tyrone's response was, effectively, to do nothing and acknowledge none of the false positives or even that the program was indeed malware.  If your most dedicated base feels that way, then how do the more casual players on the periphery react?

 

I'll tell you: "Well, Vintage Story was fun while it lasted."

 

Among my friends who casually play VS in phases every few months, the universal reaction to hearing about the malware situation and lack of actual action taken against it has been to completely write off Vintage Story.   This stain will continue to spread and choke the growth of the game and its reputation.  Your blueprint was clear; Project Zomboid, Starsector.  How do you fumble this so badly?

[Teh Pizza Lady]

6 minutes ago, tiggerbiggo said:

It's actually concerning how many of the takes in here don't see the clear line that's been crossed

No, what's concerning is that we DO see the line that has been crossed and trust Anego to make the right call with the benefit of the game in mind and that you act like buying it in early access gives you a parasocial relationship in which Tyron and co actually give two rat poops about what any of us think of their decisions. They're making the game they want to play. We're just here along for the ride. Time to grow up and accept that the decisions have been made and they didn't align with what you thought was right.

I'm getting so fed up with people assuming they know what I think and how I feel about this when their assumptions are WRONG and directly contradict what I've already said before!

Edited Tuesday at 07:14 PM by Teh Pizza Lady

[Mushroomancer]

4 minutes ago, tiggerbiggo said:

Honestly you guys would be a great team to hire to astroturf for me if I ever have a "lapse in judgement" and publish malware to public mod sites, you're great at downplaying the severity of bad actors. It's actually concerning how many of the takes in here don't see the clear line that's been crossed and want to try to push the narrative that anyone who has a problem with this is just out for blood.

And nobody has anything to say about the fact that most programmers hold themselves to higher standards than what's been shown here. This black mark isn't going away.

Oh yeah. We definitely don't have any internal universe or drew our own conclusions on this .We are definitely just here as paid actors astroturfing our opinions. We are all NPCs next to your wise and masterful first-person perspective. Forgive us for ever questioning you, the main character.

[tiggerbiggo]

Just now, LadyWYT said:

Important to note that there is a distinction between this, and simply making a decision that some of your customers don't like and offering them a refund if they'd like to take the money they spent to businesses that they trust more. Anego Studios falls solidly into the latter camp, based on the official announcements. If they didn't care about anyone's opinions, I highly doubt they would have given as much information in their statements as they did, let alone offered refunds to the unsatisfied regardless of when said customers made their purchases.

The information that's been given in their responses comes across as dismissal simply because they have so much of a focus on talking about how the code attempted to only target certain mods. It hasn't talked about the capacity for the mod to interfere with unreleased in development mods, and its focus on downplaying the impact isn't what people want nor is it really relevant. They are trying to cover themselves rather than do the right thing.

[tiggerbiggo]

1 minute ago, Mushroomancer said:

Oh yeah. We definitely don't have any internal universe or drew our own conclusions on this .We are definitely just here as paid actors astroturfing our opinions. We are all NPCs next to your wise and masterful first-person perspective. Forgive us for ever questioning you, the main character.

When you have people like teh pizza lady outright trying to claim that detractors want to see him rot in jail, completely ignoring real arguments? Astro turfing or no, you're defending the indefensible.

Third (fourth?) time's the charm? If I or any of my colleagues did this, we'd be fired, why is this any different?

[Sparticus247]

5 minutes ago, tiggerbiggo said:

The information that's been given in their responses comes across as dismissal simply because they have so much of a focus on talking about how the code attempted to only target certain mods. It hasn't talked about the capacity for the mod to interfere with unreleased in development mods, and its focus on downplaying the impact isn't what people want nor is it really relevant. They are trying to cover themselves rather than do the right thing.

I know tempers are high all around, but "the right thing" is subjective in this case, and ultimate control and judgement falls on Anego. A number of us in the thread here think that the current judgment is good enough as is.

I do understand that you and others don't though, and that's ok. Where you go from here is up to you.

Edited Tuesday at 07:20 PM by Sparticus247
Typo

[Teh Pizza Lady]

Just now, tiggerbiggo said:

The information that's been given in their responses comes across as dismissal simply because they have so much of a focus on talking about how the code attempted to only target certain mods. It hasn't talked about the capacity for the mod to interfere with unreleased in development mods, and its focus on downplaying the impact isn't what people want nor is it really relevant. They are trying to cover themselves rather than do the right thing.

Or you could accept that they have the tools and manpower to actually test the mods on the ModDB and verify whether Maltiez's code would have blocked any of them and trust that their conclusions are accurate. Tyron's post didn't downplay the situation, it just presented updated facts. ConfigLib crashed the game on only 3 mods which he listed. Maltiez was not an official spokesperson for the company. What he said wasn't the voice of the company as a whole. If you are unhappy with the game, they don't want to keep your money.

Where are you getting the dismissal from? Oh right because he didn't also announced that Maltiez was dragged through a field of broken glass before being dipped in salt water for his transgressions? Is that it?

[Mushroomancer]

5 minutes ago, tiggerbiggo said:

When you have people like teh pizza lady outright trying to claim that detractors want to see him rot in jail, completely ignoring real arguments? Astro turfing or no, you're defending the indefensible.

Third (fourth?) time's the charm? If I or any of my colleagues did this, we'd be fired, why is this any different?

Someone came into this thread with the statement they reported them to the authorities of Latvia. Someone else was having manic breakdowns about potential criminal liability. Early on, especially, there was a lot of waxing philosophical about potential prison sentences and legal consequences. About group actions and best practices in reporting.

I'm very glad to hear your anecdote for the... third or fourth time? 

Edited Tuesday at 07:23 PM by Mushroomancer

[Teh Pizza Lady]

4 minutes ago, tiggerbiggo said:

When you have people like teh pizza lady outright trying to claim that detractors want to see him rot in jail, completely ignoring real arguments?

I'm sorry? I thought that's what we were doing: ignoring facts and real arguments and making outlandish claims. That seems to be the trend here.

[tiggerbiggo]

Just now, Teh Pizza Lady said:

Or you could accept that they have the tools and manpower to actually test the mods on the ModDB and verify whether Maltiez's code would have blocked any of them and trust that their conclusions are accurate. Tyron's post didn't downplay the situation, it just presented updated facts. ConfigLib crashed the game on only 3 mods which he listed. Maltiez was not an official spokesperson for the company. What he said wasn't the voice of the company as a whole. If you are unhappy with the game, they don't want to keep your money.

Where are you getting the dismissal from? Oh right because he didn't also announced that Maltiez was dragged through a field of broken glass before being dipped in salt water for his transgressions? Is that it?

See, again. I've mentioned multiple times what i'd be happy with and you're not taking what i'm saying at face value.

I will be happy in any of the following scenarios:

1. I get a refund (Which hasn't happened yet, hence my engagement here in the hopes that one of the other 2 decisions are made instead)
2. Maltiez is removed from any code development role going forward
3. Maltiez shows any degree of understanding or remorse showing that they understand what they did wrong and why their code is malicious

I don't want anyone to rot in jail, I don't want anyone dragged through broken glass. That's just more hyperbole.

[tiggerbiggo]

1 minute ago, Teh Pizza Lady said:

I'm sorry? I thought that's what we were doing: ignoring facts and real arguments and making outlandish claims. That seems to be the trend here.

When did I once say that I want anyone to rot in jail? And you won't talk about my arguments so all you're doing is stirring the pot for no reason. I don't care if some random person you've argued with wants some arbitrary hateful consequence. If you really think my criteria (refund or Malt's removal) remotely equate to any of the things you've levelled at me, then I don't know what to say.

[tiggerbiggo]

3 minutes ago, Mushroomancer said:

Someone came into this thread with the statement they reported them to the authorities of Latvia. Someone else was having manic breakdowns about potential criminal liability. 

I'm very glad to hear your anecdote for the... third or fourth time? 

Yes because i've been making the point that I am held to higher standards than Malt, both to point out why this upsets me so much and also because IT'S TRUE. Nobody has addressed it, and i'm starting to think it's because nobody wants to believe that what they did is severe enough to warrant any further action being taken, which is up to your opinion but do you see how what i'm actually saying and the strawman that's being put up around it don't remotely match?

[Teh Pizza Lady]

Just now, tiggerbiggo said:

I don't want anyone to rot in jail, I don't want anyone dragged through broken glass. That's just more hyperbole.

It's necessary hyperbole because... wait, I nearly forgot... oh right, you just want his life ruined in other ways, which is what happens when people get fired from their jobs.

The facts are, you'll get #1, #2 isn't happening any time soon and #3 is just asking for a fake apology which means nothing. Maltiez already agreed to step away from modding and to remove himself from the VS discord, which is a major part of the community. He wouldn't have agreed to that if he thought he was right. Innocent people don't lie down and roll over when accused of wrongdoing.

I don't take what you're saying at face value because you're arguing in bad faith. You've already requested a refund. Why are you still here? As soon as you get it, your forum account will be deactivated anyway.

At least I can infer what people actually mean from what they say to an extent.

[Teh Pizza Lady]

The main thread is this way: 

 

[LadyWYT]

13 minutes ago, Teh Pizza Lady said:

people assuming they know what I think and how I feel

Or people telling me that "No, you can't hold that opinion or feel that way because it's WRONG and I said so! You have to think XYZ way instead, which is the only correct way" without much evidence at all to back them up.

Like okay...no. I'm not keen on just taking someone's word for it, especially if it's someone I'm not at all familiar with. Show me some facts, so I can review the evidence myself and arrive at an informed conclusion. I might change my mind, but then again I might not. Even if I don't change my mind, there will at least be more information out there for others to use to form more informed conclusions of their own.

[Sparticus247]

12 minutes ago, tiggerbiggo said:

I will be happy in any of the following scenarios:

1. I get a refund (Which hasn't happened yet, hence my engagement here in the hopes that one of the other 2 decisions are made instead)
2. Maltiez is removed from any code development role going forward
3. Maltiez shows any degree of understanding or remorse showing that they understand what they did wrong and why their code is malicious

For what it's worth I hope you get #1 in the end. It's obviously personally bothered you enough that if they are offering, it should be taken. They did warn that it might take time, has refunds on purchases made so far in the past could come with some difficulty from payment processors.

I don't think you're going to get #2, but I wouldn't be surprised if they don't renew his contract after this big update. 

#3 All depends on maturity on his part down the road. Maybe in a few years he'll look back and think "boy that really was a bit stupid" but that's not up to us.

This whole thing boils down to you not understanding why we can't see things the way you do. Different experiences mold different people. I've decided to give a little bit more grace on the first go around due to circumstances in my life and colleagues I've worked with over the past 20 years. I can understand where you're coming from to a degree, but we'll have to agree to disagree on that one.

Edited Tuesday at 07:35 PM by Sparticus247
Yet another typo

[Teh Pizza Lady]

Also why is Tyron being forgiving towards Maltiez a bad thing?

Edited Tuesday at 07:35 PM by Teh Pizza Lady
someone DM'ed me and said the bold all caps was overboard, but doggammit I'm mad

[tiggerbiggo]

Just now, Teh Pizza Lady said:

It's necessary hyperbole because... wait, I nearly forgot... oh right, you just want his life ruined in other ways, which is what happens when people get fired from their jobs.

The facts are, you'll get #1, #2 isn't happening any time soon and #3 is just asking for a fake apology which means nothing. Maltiez already agreed to step away from modding and to remove himself from the VS discord, which is a major part of the community. He wouldn't have agreed to that if he thought he was right. Innocent people don't lie down and roll over when accused of wrongdoing.

I don't take what you're saying at face value because you're arguing in bad faith. You've already requested a refund. Why are you still here? As soon as you get it, your forum account will be deactivated anyway.

At least I can infer what people actually mean from what they say to an extent.

Again, you aren't taking what i'm saying at face value.

"Maltiez is removed from any code development role going forward"

Read that. I don't care if he's still working there in a non coding role. I don't want to run his code on my machine. And again, the thing you won't address, I WOULD BE FIRED FOR DOING THIS, so would any other developer in any other part of the programming world. You going to address that?

If you really think i'm arguing in bad faith, just remember that last point. I'm angry because standards are being applied unequally, and Malt's actions, as much as you want to excuse them, are inexcusable. That doesn't mean they are a horrible bad person who should rot in jail, as if I should even need to clarify that. But the current consequences not being good enough for me to be OK with the situation, and me not also wanting him to literally die doesn't seem to be something you can handle holding in your mind at once...

It seems to you either i'm ok with the current situation or I want him to go to hell. You're not arguing with me in good faith if that's your line.

"You've already requested a refund. Why are you still here?" Because as I said it hasn't been processed yet, and I was clear in my message to support that I would be happy to keep my account if Malt is removed, so i'm awaiting a decision and engaging with a topic that means a lot to me in this present moment because I really like Vintage and don't want to have to say goodbye.

[Teh Pizza Lady]

1 minute ago, tiggerbiggo said:

And again, the thing you won't address, I WOULD BE FIRED FOR DOING THIS, so would any other developer in any other part of the programming world. You going to address that?

I address that here: