Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[ComeAves]

I found out about this drama very recently.
I get the idea behind his totally benevolent anticheat that definitely only does exactly what he says it does, but why hide it? I trust it about as much as I trust Microsoft code to definitely not be doing anything with my data.

The current response honestly feels like "yeah, we know about it, and we don't really care." Maybe I'm overreacting, and I know nobody really cares about my opinion since I'm not active in the community, and Anego already has my money.

I won't be updating the game anymore, and I won't be recommending it to any of my friends (Wow, Anego didn't make another €20). I don't trust Maltiez, and at this point I don't trust Anego to take this kind of thing seriously.

Sorry for adding more fuel to the drama. I know the community is divided between shills and dramaqueens and nobody cares about me in particular but I just wanted to vent off because I love the game.

[Mushroomancer]

1 hour ago, ComeAves said:

I found out about this drama very recently.
I get the idea behind his totally benevolent anticheat that definitely only does exactly what he says it does, but why hide it? I trust it about as much as I trust Microsoft code to definitely not be doing anything with my data.

The current response honestly feels like "yeah, we know about it, and we don't really care." Maybe I'm overreacting, and I know nobody really cares about my opinion since I'm not active in the community, and Anego already has my money.

I won't be updating the game anymore, and I won't be recommending it to any of my friends (Wow, Anego didn't make another €20). I don't trust Maltiez, and at this point I don't trust Anego to take this kind of thing seriously.

Sorry for adding more fuel to the drama. I know the community is divided between shills and dramaqueens and nobody cares about me in particular but I just wanted to vent off because I love the game.

In regards to whether or not the code hides other malicious features, they can read his code and know exactly what it did after it's been poured over for a week now. It wasn't particularly sophisticated, really, and was essentially a parcel loaded in two parts: one to identify and crash with a manufactured incompatibility, and one to misdirect the source of the crash to obfuscate the code causing that incompatibility.  The three points of contention regarding the code are 1.) The code was not disclosed to users who installed it onto their system. 2.) The code's means of identification allowed it to target unintended mods as bycatch primarily because Maltiez seemed to be under the impression other mods would not obfuscate (technical term this time) code when publishing to an open-source database as it means something could be hidden inside that can't be reviewed by the community. And 3.) The code did not match the easy-to-read open-source repository file meant to communicate the actual things that the mod was doing, instead being sideloded onto the Mod DB to, again, delay the discovery of what was causing the initial incompatibility.

These last two are the more severe breaches, in my opinion. The second, because it was somewhat sloppy even if no meaningful alternative was available. And the third because it's where the actual deception is occurring. It IS what someone looking to smuggle more harmful code into a mod could do if they so choose to bypass the community's open-source security. It's also a security issue that most community driven modding spaces have, unfortunately. It is also somewhat a testament that Maltiez was not attempting to do something more malicious, because if he were, he would have done it well before this point of discovery considering how long the 'crash code' was active. 

What Anego knew about the situation before it blew up is still somewhat unclear, it seems like the most likely scenario is that when they tapped Maltiez for assistant development, he confessed/boasted to creating anti-cheat.The issue is that they did not actually look into the vehicle and methods that the anti-cheat employed, choosing to have faith in Maltiez, rightly or wrongly. You could argue that was their primary failure to do due diligence, as the DB is hosted on their official site. How they've responded after seems to be based on their personal assessment of the damage done and the risk of more or worse damage happening in the future (which, to be clear, is kind of the standard that most legal systems use when deciding judgement in these kinds of cases, as well.)

If you don't trust them, I would say the best action you can take is to request a refund and move on to other games, especially if after ten years this has so fully eroded your faith in them that you have no hope they can steer things back in the right direction. I'm not saying 'if you don't like it leave', just that it's the best option as far as personal comfort and sense of safety.


Edited for language clarity and further context.

Edited 8 hours ago by Mushroomancer
More language clarity. Whoops.

[ComeAves]

1 hour ago, Mushroomancer said:

In regards to whether or not the code hides other malicious features, they can read his code and know exactly what it did after it's been poured over for a week now. It wasn't particularly sophisticated, really, and was essentially a parcel loaded in two parts: one to identify and crash with a manufactured incompatibility, and one to misdirect the source of the crash to obfuscate the code causing that incompatibility.  The three points of contention regarding the code are 1.) The code was not disclosed to users who installed it onto their system. 2.) The code's means of identification allowed it to target unintended mods as bycatch primarily because Maltiez seemed to be under the impression other mods would not obfuscate (technical term this time) code when publishing to an open-source database as it means something could be hidden inside that can't be reviewed by the community. And 3.) The code did not match the easy-to-read open-source repository file meant to communicate the actual things that the mod was doing, instead being sideloded onto the Mod DB to, again, delay the discovery of what was causing the initial incompatibility.

These last two are the more severe breaches, in my opinion. The second, because it was somewhat sloppy even if no meaningful alternative was available. And the third because it's where the actual deception is occurring. It IS what someone looking to smuggle more harmful code into a mod could do if they so choose to bypass the community's open-source security. It's also a security issue that most community driven modding spaces have, unfortunately. It is also somewhat a testament that Maltiez was not attempting to do something more malicious, because if he were, he would have done it well before this point of discovery considering how long the 'crash code' was active. 

What Anego knew about the situation before it blew up is still somewhat unclear, it seems like the most likely scenario is that when they tapped Maltiez for assistant development, he confessed/boasted to creating anti-cheat.The issue is that they did not actually look into the vehicle and methods that the anti-cheat employed, choosing to have faith in Maltiez, rightly or wrongly. You could argue that was their primary failure to do due diligence, as the DB is hosted on their official site. How they've responded after seems to be based on their personal assessment of the damage done and the risk of more or worse damage happening in the future (which, to be clear, is kind of the standard that most legal systems use when deciding judgement in these kinds of cases, as well.)

If you don't trust them, I would say the best action you can take is to request a refund and move on to other games, especially if after ten years this has so fully eroded your faith in them that you have no hope they can steer things back in the right direction. I'm not saying 'if you don't like it leave', just that it's the best option as far as personal comfort and sense of safety.


Edited for language clarity and further context.

Hey, thanks for the reply.

My main issue is that Anego knew about it. Credits to Maltiez, he was allegedly at least a bit transparent about it, but nothing was done about it until it blew up. So either Anego knew he was breaking the ModDB rules and the players trust, or they didn't do the bare minimum to look into it properly.

This is the type of behaviour I expected from Ubisoft or other corpominded AAA studio.

I don't really use Discord, but apparently the moderation there also acted terribly about this whole drama.

All in all, no, I won't be refunding the game. This is not a money thing, and I believe the time I've spent with the game was worth it. It's not like €20 is going to hurt Anego, and that's not my point anyway.

This needs to be addressed properly, if it has where is it in the oficial forum or website news section? I don't use nor should have to use discord to know about important stuff like this.

[Mushroomancer]

9 minutes ago, ComeAves said:

Hey, thanks for the reply.

My main issue is that Anego knew about it. Credits to Maltiez, he was allegedly at least a bit transparent about it, but nothing was done about it until it blew up. So either Anego knew he was breaking the ModDB rules and the players trust, or they didn't do the bare minimum to look into it properly.

This is the type of behaviour I expected from Ubisoft or other corpominded AAA studio.

I don't really use Discord, but apparently the moderation there also acted terribly about this whole drama.

All in all, no, I won't be refunding the game. This is not a money thing, and I believe the time I've spent with the game was worth it. It's not like €20 is going to hurt Anego, and that's not my point anyway.

This needs to be addressed properly, if it has where is it in the oficial forum or website news section? I don't use nor should have to use discord to know about important stuff like this.

To be fair to moderation, who did get perhaps overzealous, the 'tone' of this entire event started and remained relatively uncharitable and vitriolic from the start. Everything said, no matter how reasonable, has been picked apart for the worst possible interpretations that could be pulled from it, and added as fuel onto a very intense fire that sprung up overnight.

Like a pit kiln buried in a peat bog.

While I do think a response on the forums would be appropriate, I don't personally believe that a response somewhere like the devlog is necessary for Anego, who clearly wants to maintain that space as a point of discussion for progress and development news. I think it also, in part, comes from a belief that this isn't as big a deal as it's been made of. Their assessment of the damage does not 'justify' a sweeping response. My only issue with that potential logic is that the community reaction alone DOES justify that level of clear communication and transparency.

Admittedly, it could also be that the discord is more irreverent and fast moving, and this can all be moved on from there much faster. Personally, I am content with Anego's response and Maltiez's punishment, though I do wish they would communicate to the entire community engaged in this discussion and not just the discord where it was at its briefest and most intense. (Although I do believe a Reddit post was made.)

Edited 7 hours ago by Mushroomancer
Small spelling mistake, insert Louisoix being obliterated here.

[Sparticus247]

17 minutes ago, ComeAves said:

This needs to be addressed properly, if it has where is it in the oficial forum or website news section? I don't use nor should have to use discord to know about important stuff like this.

You can see the stickied official response below with the last update being on 08 Sep 2026 as of the time of this reply.

 

[Teh Pizza Lady]

23 minutes ago, ComeAves said:

nothing was done about it until it blew up

to be fair, ConfigLib wasn't his only mod to contain this anti-cheat code. He just forgot to remove it (according to him) and did remove it from the others once he felt its job had been done. It was never about creating a universal anti-cheat, it was about stopping that ONE mod. So to him, his method of detection and delivery was worth the repercussions if it meant that one mod author stopped trying to not only make others cheat, but also make money doing it since the cheat mod was a paid mod at that time. People either seem to forget this or are just ignorant of this fact, either by choice or not, but the information is out there and it is relevant in this case since it relates to WHY Maltiez did it.

3 hours ago, ComeAves said:

the community is divided between shills and dramaqueens and nobody cares about me in particular

That is a very polarizing way to put it that is likely to earn you very polarized responses. At the very least it's going to make the statement itself come true in that people will add you to their "ignore" lists so anything you say on the forums goes rightfully (in their minds) ignored. Basically what I'm saying is that first impressions are everything and this isn't a good one.

22 minutes ago, Mushroomancer said:

Small spelling mistake, insert Louisoix being obliterated here.

Beastmaster is fun innit?

[LadyWYT]

38 minutes ago, Mushroomancer said:

While I do think a response on the forums would be appropriate, I don't personally believe that a response somewhere like the devlog is necessary for Anego, who clearly wants to maintain that space as a point of discussion for progress and development news. I think it also, in part, comes from a belief that this isn't as big a deal as it's been made of. Their assessment of the damage does not 'justify' a sweeping response. My only issue with that potential logic is that the community reaction alone DOES justify that level of clear communication and transparency.

I think this is the bit I'm saltiest about. I'm not saying that Anego should've dumped all the gory details onto the forums at once--it takes time to uncover and verify the facts, after all. But a simple heads-up of "Hey, we're currently investigating reports of ConfigLib breaking the TOS. This post will be updated as the situation develops" would have been really nice to have, since then everyone on the forums has a clear gathering point for discussion of such.

Instead what happened is that those of us who rely on the forums as our primary source of VS news got to find out about the situation via the angry mob pouring in and and posting rather inflammatory rants about it before any facts were really known. Which I get the distinct impression that several of those users had been booted from the Discord for bad behavior, which honestly isn't too surprising given how they were acting here. In any case, it muddied the waters even more for those of us just trying to figure out what the heck happened and what the actual facts are, because troublemakers aside, everyone else is screaming in your ears at once trying to pressure you one way or another.

27 minutes ago, Teh Pizza Lady said:

That is a very polarizing way to put it that is likely to earn you very polarized responses. At the very least it's going to make the statement itself come true in that people will add you to their "ignore" lists so anything you say on the forums goes rightfully (in their minds) ignored. Basically what I'm saying is that first impressions are everything and this isn't a good one.

Also why I'm miffed about some of the community reactions. I've never seen some of these people before. I can understand why they're upset, but I mean...I'm not really inclined to just take a stranger's word for it? Especially when they appear to be emotionally charged and happy to point the pitchforks at whoever happens to have a different opinion on the matter.

[ComeAves]

1 hour ago, Sparticus247 said:

You can see the stickied official response below with the last update being on 08 Sep 2026 as of the time of this reply.

 

Sorry I don't know how to use reddit, I tried browsing there but all I found was a discord screenshot which did not clarify anything...  I live under a digital rock this is why having an official post here, which is where I go to find stuff related to the game, is important specially for the ..... "techchallenged" like me.

[ComeAves]

1 hour ago, Teh Pizza Lady said:

That is a very polarizing way to put it that is likely to earn you very polarized responses. At the very least it's going to make the statement itself come true in that people will add you to their "ignore" lists so anything you say on the forums goes rightfully (in their minds) ignored. Basically what I'm saying is that first impressions are everything and this isn't a good one.

Sorry when I wrote it I was still mad and I saw people calling for Maltiez to be fired or the whole team be sued and people saying it wasn't big deal. it is a big deal but I honestly don't think Maltiez should be fired for it. 
 

[DarkGold]

10 minutes ago, ComeAves said:

Sorry I don't know how to use reddit, I tried browsing there but all I found was a discord screenshot which did not clarify anything...

I see an embed with a "Read More" drop down in it, so I don't have to go to reddit to read the post? I don't have a reddit account or any browser changes that should change the default experience for me, and this works in Firefox and Chrome on desktop. Do you see that or something different? Or do you just mean that you didn't previously organically discover this on reddit (me either)?

 

@Zaldaryon I presume it isn't possible to pin information at the top of this topic is it? Would that require @AtomicWinter (as the topic owner) to edit their original message?

@icesharkk's message has most of the info people who are trying to figure out what is going on might be interested in, but it's 6 pages into the topic, and the topic is +35 pages long now, so it's harder to find:

It would be helpful for people that hear about the news later if that was one of the first things they could read on this topic, unless Anego adds an even better source of information on the forums.

I imagine that it will still take a few weeks for people to get caught up (I know I've taken breaks from the forum for weeks), and this topic will probably stay active as long as people are discovering the topic and posting to ask what's going on.

Edited 5 hours ago by DarkGold
For clarity

[ComeAves]

4 minutes ago, DarkGold said:

I see an embed with a "Read More" drop down in it, so I don't have to go to reddit to read the post? I don't have a reddit account or any browser changes that should change the default experience for me, and this works in Firefox and Chrome on desktop. What do you see?

Yeah I can see that, what I mean is I didn't find the reddit post before Sparticus247 sent it. I knew there supposedly was a post explaning things there but all I found (sorry for not knowing how to use reddit I guess) was a discord print of tyron which did not explain anything.
this is why I say again... please make an official post here I don't know how nor feel like going after all the info about this whole fuss, it's just causing more confusion.

anyway that's enough of this drama for me. stay safe everyone and thank you for all your replies.

[Teh Pizza Lady]

32 minutes ago, ComeAves said:

this is why I say again... please make an official post here

this... all of this. I still don't know why they haven't... but oh well. I guess people are finding out through the grapevine, but the information is so fragmented it's hard to get the whole story. I guess maybe the reasons they addressed Reddit and Discord is that's where the community was going the wildest, perhaps? Too much to guess and too many unknowns there, but hey at least people are hearing the truth, eventually.

[DarkGold]

46 minutes ago, Teh Pizza Lady said:

I guess maybe the reasons they addressed Reddit and Discord is that's where the community was going the wildest, perhaps?

I'm not a member of the Discord, or on the Reddit, but I was curious about this on the 3rd, so I looked up some numbers.

• The views on the forum (that aren't on hot topics like this one, that will definitely have more views than unique users) tend to peak around new releases, at under 30k. This might not account for unique users, so something like the vote that was done on the Vintage Story Cover Art Rebrand is something else to consider; that had 2,301 votes before the poll was closed.
• For Reddit, r/VintageStory had 125k visitors and 8k contributions per week.
• The Discord had over 37k online members and over 152k members (at the time of day that I checked).

(These numbers were from the 3rd of September)

This led me to believe that things were probably a lot busier over there at the time (and probably are on a day to day basis). Discord tends to have an incredible pace of information in general.

Edit: Another piece of data; at time of edit...

• This topic has 912 replies, started on the 2nd.
• The official post on Reddit has 2.1k+ comments, 7 days old (so posted later).

Edited 4 hours ago by DarkGold
Added quote, correcting typos, added data

[Teh Pizza Lady]

2 hours ago, DarkGold said:

I'm not a member of the Discord, or on the Reddit, but I was curious about this on the 3rd, so I looked up some numbers.

• The views on the forum (that aren't on hot topics like this one, that will definitely have more views than unique users) tend to peak around new releases, at under 30k. This might not account for unique users, so something like the vote that was done on the Vintage Story Cover Art Rebrand is something else to consider; that had 2,301 votes before the poll was closed.
• For Reddit, r/VintageStory had 125k visitors and 8k contributions per week.
• The Discord had over 37k online members and over 152k members (at the time of day that I checked).

(These numbers were from the 3rd of September)

This led me to believe that things were probably a lot busier over there at the time (and probably are on a day to day basis). Discord tends to have an incredible pace of information in general.

Edit: Another piece of data; at time of edit...

• This topic has 912 replies, started on the 2nd.
• The official post on Reddit has 2.1k+ comments, 7 days old (so posted later).

Yeah that firms up my hypothesis that those two places had more traffic and thus were the places that needed an immediate response. I'm sure once it all blows over we'll get some sort of post here, maybe.

[Thorfinn]

9 hours ago, greed23 said:

There's a severe difference between an early access game crashing because the code is shoddy, and an early access game crashing because one of its devs abused the implicit trust they had as a prominent modder to inject malware.

...

It's like if your car's tires went flat because you drove over a nail accidentally left on the road vs. your best friend sneaking into your garage every night because you gave them a key, and they let the air out of your tires

 

Sure. The difference is... emotion. Either way, you still have a flat tire to deal with. I'd actually feel better about the friend doing it, because all I have to do is run the air compressor and change the locks. I don't have to put on the spare and go to the tire place to get it fixed.

I think that's been the pretty consistent take. I prefer to leave the emotion out of it, you don't.

If it helps, think of it as not just a flat tire, but someone put you in a wheelchair for life. Does it really make any difference if he intended to do it? Does the paralysis end earlier one way or the other?