Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Narcosis]

The thing here is how can you describe a victim? Were their machines destroyed? Their systems crashed? Their personal data stolen? Nothing of such had happened, aside from the minor inconvenience of not being able to play and having no idea what's going on; the only factor being anger and lost time. This is not a typical malware case, even though what Maltiez did with the mods can be pinned underneath the boundaries of the definition itself and is - of course - still inexcusable. In my opinion, people throwing the word 'malware' left and right already did far more damage to the game than Maltiez & Anego altogether.

The entire situation looks more akin to employee going rogue; even though his goals were most likely noble, he went too far thinking he can 'fix' the issue without asking anyone for input; there's obviously far more things to consider but we probably won't ever know the actual factors. I can only hope there's no malice on anyone's side, because it doesn't bode well for the future of the entire project. Throwing around the word 'personal vendetta' is at best unjustified and at worst, outright malicious. I highly doubt Maltiez wanted to hurt the game or community; he's just the kind of person that will. simply. not. admit. to. his. mistakes. lol. It is what it is.

What's done is done. I think Maltiez was still punished way too rashly and too harshly but in a way - he got what's coming. Let this serve as a reminder and warning to others. I'd advise everyone else to simply give the entire thing more time. If you're upset, take a break. If you don't care - mostly as I did, partially because I already knew this entire thing was absolutely blown out of proportions - carry on. I hope this entire hoopla resolves itself in best interest of everyone involved and maybe, perhaps we'll even learn something out of it, particularly Anego. This sort of experience is still very valuable and might help mitigate further, future issues down the line.

And yes, I use Maltiez' mods myself. No, I luckily never had a crash which wasn't me being a dumbass. Yes, my game is very heavily modded. Go guess.

[Meiiolri]

That's why as i mentioned before we need to wait for next response / clarification.
the first one is lacking in parts not addressing the issues that started the whole thing, the people that suffered collateral damage because of it, and the behavior Maltiez presented after it came to light.
"Oh, i don't need excuses, I know i did the right thing. and it worked."
"Why you is important here"
and his later doubling down.
The whole thing is a mess, and the Tyron response did quelch a bit of the anger, but did damage too for not adressing the other important parts too.

eh i just hope Tyron, and Anego Studio know what they are doing, and atleast I want to see clarification and adressing things not said in the first response.

[icesharkk]

18 minutes ago, Narcosis said:

The thing here is how can you describe a victim? Were their machines destroyed? Their systems crashed? Their personal data stolen? Nothing of such had happened, aside from the minor inconvenience of not being able to play and having no idea what's going on; the only factor being anger and lost time. This is not a typical malware case, even though what Maltiez did with the mods can be pinned underneath the boundaries of the definition itself and is - of course - still inexcusable. In my opinion, people throwing the word 'malware' left and right already did far more damage to the game than Maltiez & Anego altogether.

I can describe a victim as 1. anyone whose personal computer was subject to deliberate but undocumented code execution that disrupted the runtime enviroment of their purchased applications. 2. Any server team or owner that spent tens to hundreds of manhours trying to troubleshoot a client crash issue that was intentionally setup to evade attribution to the offending mod. 

18 minutes ago, Narcosis said:

The entire situation looks more akin to employee going rogue; even though his goals were most likely noble, he went too far thinking he can 'fix' the issue without asking anyone for input; there's obviously far more things to consider but we probably won't ever know the actual factors. I can only hope there's no malice on anyone's side, because it doesn't bode well for the future of the entire project. Throwing around the word 'personal vendetta' is at best unjustified and at worst, outright malicious. I highly doubt Maltiez wanted to hurt the game or community; he's just the kind of person that will. simply. not. admit. to. his. mistakes. lol. It is what it is.

18 minutes ago, Narcosis said:

What's done is done. I think Maltiez was still punished way too rashly and too harshly but in a way - he got what's coming. Let this serve as a reminder and warning to others. I'd advise everyone else to simply give the entire thing more time. If you're upset, take a break. If you don't care - mostly as I did, partially because I already knew this entire thing was absolutely blown out of proportions - carry on. I hope this entire hoopla resolves itself in best interest of everyone involved and maybe, perhaps we'll even learn something out of it, particularly Anego. This sort of experience is still very valuable and might help mitigate further, future issues down the line.

None of this is punishment. punishment is a training tool. We are discussing consequences. Consequence is the result of your actions. Access to code on opensource projects is a privilege reserved for the trustworthy because the potential to do harm is great and the safeguards aren't perfectly effective. Per industry standard the consequence for betraying that trust is immediate and permanent removal from the project. There are enough supply chain risks and uncertainty out there that it is beyond imbecilic to allow an untrustworthy actor continued access to the supply chain.
 

that Anego is now choosing to protect him after the harm he's cause and the trust he has broken, while also erasing the impact to the victims is what shifts my opinion of Anego nearly as much as maltiez initial actions.

Edited Friday at 09:48 PM by icesharkk

[Teh Pizza Lady]

16 minutes ago, Meiiolri said:

That's why as i mentioned before we need to wait for next response / clarification.
the first one is lacking in parts not addressing the issues that started the whole thing, the people that suffered collateral damage because of it, and the behavior Maltiez presented after it came to light.
"Oh, i don't need excuses, I know i did the right thing. and it worked."
"Why you is important here"
and his later doubling down.
The whole thing is a mess, and the Tyron response did quelch a bit of the anger, but did damage too for not adressing the other important parts too.

eh i just hope Tyron, and Anego Studio know what they are doing, and atleast I want to see clarification and adressing things not said in the first response.

It's an initial response. We'll know more later. Or we won't. I'm sure Tyron knows more about the situation than the rest of us do. His response either told us what we need to hear or what he could say with confidence. Like him, I don't want to speculate, so I will leave it at that, as should everyone else. We do not know if Maltiez was truthful to us, so Tyron's contradictions could very well be the truth.

[pyr0kid]

i went on trip for a couple weeks and came back to look for mining tips and check patchnotes... just to find out that theres some modder shipping crashcode... who dislikes the community... and is part of the studio?

what the hell have i just walked in on?

looking into this further and the lead dev is suggesting that less than 100 bad actors were effected by this intentionally?

so lemme ask how many people were effected by this unintentionally then? if the falseflag rate is even 5% - which i think is believable for an unmaintained 'anticheat' made by a batman wannabe - that number is in the thousands.

i got this game to play modded with a bunch of my mates and a bunch of european dudes, and now i find it really interesting that the server was crashing at the start... and looking at the pastebin we were indeed running mods like config lib made by this 'malware maltiez' fellow so now im questioning if the mods we removed were even the problem to begin with.

 

im incredibly unhappy the studio is just glossing over the sheer amount of time wasted and server admin problems that were assuredly created across the playerbase by this.

[Teh Pizza Lady]

1 minute ago, pyr0kid said:

i went on trip for a couple weeks and came back to look for mining tips and check patchnotes... just to find out that theres some modder shipping crashcode... who dislikes the community... and is part of the studio?

what the hell have i just walked in on?

looking into this further and the lead dev is suggesting that less than 100 bad actors were effected by this intentionally?

so lemme ask how many people were effected by this unintentionally then? if the falseflag rate is even 5% - which i think is believable for an unmaintained 'anticheat' made by a batman wannabe - that number is in the thousands.

i got this game to play modded with a bunch of my mates and a bunch of european dudes, and now i find it really interesting that the server was crashing at the start... and looking at the pastebin we were indeed running mods like config lib made by this 'malware maltiez' fellow so now im questioning if the mods we removed were even the problem to begin with.

 

im incredibly unhappy the studio is just glossing over the sheer amount of time wasted and server admin problems that were assuredly created across the playerbase by this.

It seems you may have stumbled across some mis-information and possibly misunderstood what you read. Maltiez's code only crashed clients. If your server was crashing then the mods you removed were indeed the problem. I hope that clears things up for you!

[Dorf]

2 hours ago, williams_482 said:

This whole thing sucks, for very human, embarrassingly predictable reasons. 

The devs made the classic PR blunder of choosing empathy for a person they personally know and judge to be a useful contributor, along with practical steps to prevent them from doing anything like this again, over sating the bloodlust of an angry mob. You can just see the naive programmer logic here: we made sure this person won't do this again (in ways we tried to explain but can't directly demonstrate at this time), we're still doing our best to improve this game you all love, why are you all still mad at us?

A huge corporation would not typically make this mistake, because 1) they have expensive PR people on staff to handle this kind of thing, 2) huge corporations are big enough that the decision makers are generally not personally aquatinted with the accused (when they are, these mistakes are far more likely), and 3) they are usually far more concerned with perception and short term sales than with the long term quality of their product. 

It seems pretty clear that the folks here who understand software development do not see Maltiez's reduced role as a plausible vector for new malware in either the base game or any of his existing mods. Those who still want him gone are speaking on moral or general policy grounds, which is fair enough and an unsurprising theater for reasonable people to disagree. We don't know exactly why Anego doesn't want to cut Maltiez out completely, but it's probably some combination of familiarity with the project and valuing his perspective on design questions totally unrelated to vigilante malware injection. 

There's also a huge group of people in here who don't understand the technical aspect of this (because it's bloody difficult to differentiate expertise in an unfamiliar field from confident idiocy, especially with emotions running high as they are now) and want this guy gone because they think there is still a credible danger of Maltiez secretly infecting their computer. There is not, but the misconception is understandable.

Finally, we have people who are just angry. There are a lot more of them on Reddit than on these boards. Some of them are fans who feel betrayed and aren't worried about the details, some of them are just along for the ride because joining in with the mob and yelling about the failings of others is a pleasant distraction from the complicated problems of daily life. Nothing short of immediate, unambiguous, and complete separation from Maltiez was going to satisfy, and if that happened then that vitriol wouldn't even be gone, just focussed on Maltiez the individual villain. Which is worse, because it increases the small but believable danger of real wackos taking extreme steps against him. 

I'm not exactly overflowing with sympathy toward Maltiez myself right now, as he did make some dumb choices and has come across as a real asshole. Although, I can't help but wonder how the rest of us would come across if unexpectedly berated by hundreds for a questionable choice in our own pasts. 

I am feeling very sympathetic towards Tyrone and the rest of Anego, who were suddenly thrown into this whole thing and forced to make a very public decision which had no definitive right answer, and carries with it a terrifying range of unlikely but very serious dangers. 

The whole thing sucks.

The fact that he put them in this situation at all just infuriates me. They took a chance on him, put him on the payroll, then when he gets outed for this he shows no remorse, doubling down and trying to justify negatively affecting people's experiences with malicious, obfuscating code (malware by definition), putting them in a terrible, unwinnable position.

Maybe he shouldn't be fired because of the malware, but to then come out and publicly defend your actions when they are so clearly wrong? As a business owner myself, for me, that person has to go. That's someone representing your company. In no way does it make logical sense to keep that person onboard as a business. They could be the best developer/advisor on planet Earth, but if their damage to reputation causes your customer-base to lose faith in the product and your own management, damaging the trust of people who put food on your employees' plate...they NEED to go. It would not be up for debate for me.

A few days ago the reputation of Anego Studios was great, now it is being brought into question by the actions of a single person. This has gone very public now. I found out about this from videos on YouTube with 20k+ views. That might not sound like a lot, but consider that, say, 10% of those viewers (this is generous, likely more) are just now getting their first impressions of your studio, not the game, your company, and decide they don't want your product, at the current price of $24.00, can you afford to lose $48,000 of potential revenue as a small development team from a single video? These are smaller channels that are getting huge views considering their subscriber count. One particular example I can see has 979 Subscribers but their video on this situation has, at this moment of writing, 48,569 views. The comments are full of people in disbelief that something like this is even happening with a game like Vintage Story. There are larger channels that are likely waiting for the dust to settle before chiming in that easily pull in over 100k views on their Vintage Story content. The potential losses, not to mention the damage of reputation among your existing customers is just downright bad business and damaging to your project at its core. 

This is just me backseating though I guess? For me, he would have to be an absolute miracle to the project and potential revenue to weather the storm with him like this. But considering I've seen posts of him essentially bragging about needing AI to make basic GUI elements? I dunno where that miracle is coming from. Isn't his main expertise in combat mechanics? Is combat mechanics the main draw of this game? I wouldn't say so. Nothing adds up to being sensible to me about this.

Edited Friday at 10:01 PM by Dorf

[icesharkk]

9 minutes ago, pyr0kid said:

i went on trip for a couple weeks and came back to look for mining tips and check patchnotes... just to find out that theres some modder shipping crashcode... who dislikes the community... and is part of the studio?

what the hell have i just walked in on?

looking into this further and the lead dev is suggesting that less than 100 bad actors were effected by this intentionally?

so lemme ask how many people were effected by this unintentionally then? if the falseflag rate is even 5% - which i think is believable for an unmaintained 'anticheat' made by a batman wannabe - that number is in the thousands.

i got this game to play modded with a bunch of my mates and a bunch of european dudes, and now i find it really interesting that the server was crashing at the start... and looking at the pastebin we were indeed running mods like config lib made by this 'malware maltiez' fellow so now im questioning if the mods we removed were even the problem to begin with.

 

im incredibly unhappy the studio is just glossing over the sheer amount of time wasted and server admin problems that were assuredly created across the playerbase by this.

your frustration with the gloss over is reasonable. just know that that, thankfully, the crashcodes were only triggered on client instances in multiplayer and limited to vintage story itself. so it unless several other things went massively wrong it is unlikely that maltiez is responsible for the situation you experienced. at least as described. but yeah the rest of it is crazy.

[quicksilvr]

Seems like the studio hired a real lolcow with Maltiez. I'm hesitant to keep the game installed anymore, as a known malware producer is on the dev team which just seems odd to me to keep around. I guess in the EU it's fine to distribute malware, but here in California it is not legal at all to knowingly introduce a contaminant into a computer system. 

[williams_482]

21 minutes ago, Dorf said:

A few days ago the reputation of Anego Studios was great, now it is being brought into question by the actions of a single person. This has gone very public now. I found out about this from videos on YouTube with 20k+ views. That might not sound like a lot, but consider that, say, 10% of those viewers (this is generous, likely more) are just now getting their first impressions of your studio, not the game, your company, and decide they don't want your product, at the current price of $24.00, can you afford to lose $48,000 of potential revenue as a small development team from a single video? These are smaller channels that are getting huge views considering their subscriber count. One particular example I can see has 979 Subscribers but their video on this situation has, at this moment of writing, 48,569 views. The comments are full of people in disbelief that something like this is even happening with a game like Vintage Story. There are larger channels that are likely waiting for the dust to settle before chiming in that easily pull in over 100k views on their Vintage Story content. The potential losses, not to mention the damage of reputation among your existing customers is just downright bad business and damaging to your project at its core. 

The big question for them at this stage, and every proceeding stage after they had established the facts and taken a moment to think about it, is this: Does firing this guy actually change the story in a meaningful way? Or is it really just an extra detail thrown in under the "Vintage Story Developer did MALWARE!!!!" headline which won't change the tone or takeaway of videos crafted primarily to be sensationalist clickbait?

Call my cynical, but in this media environment I don't think the reality or the follow through matters much at all relative to first impressions, and no <1K subscriber channel is suddenly getting 50K views by being nuanced and reasonable. 

[Dorf]

10 minutes ago, quicksilvr said:

Seems like the studio hired a real lolcow with Maltiez. I'm hesitant to keep the game installed anymore, as a known malware producer is on the dev team which just seems odd to me to keep around. I guess in the EU it's fine to distribute malware, but here in California it is not legal at all to knowingly introduce a contaminant into a computer system. 

The EU law most relevant to this actually just had its 13th year anniversary as of yesterday! Directive 2013/40/EU!

Long story short, the articles it could arguably trigger:

Article 4 – Illegal System Interference
Seriously hindering or interrupting the functioning of an information system by inputting computer data... intentionally and without right.

Article 5 – Illegal Data Interference
The code damages or renders inaccessible data on the system (corrupted saves, broken configurations, etc.), this applies as a separate or concurrent offence. (not impossible for a save to be corrupted by a crash)

Article 7 – Tools for Committing Offences

Intentional production, sale, procurement for use, import, distribution or -> otherwise making available <-, a computer program designed or adapted primarily for the purpose of committing the offences in Articles above (and others but they don't fit as much)

 

Not many precedents to fit this particular case but charges can be around 2-3 years imprisonment from a quick. Like with a lot of EU laws, there are other laws that this will break simultaneously. I think it skirts the worst of them by not really involving any actual monetary gain (that we know of). As always with law, precedent is key but there isn't much out there for such a relatively specific case. 

[Dorf]

3 minutes ago, williams_482 said:

The big question for them at this stage, and every proceeding stage after they had established the facts and taken a moment to think about it, is this: Does firing this guy actually change the story in a meaningful way? Or is it really just an extra detail thrown in under the "Vintage Story Developer did MALWARE!!!!" headline which won't change the tone or takeaway of videos crafted primarily to be sensationalist clickbait?

Call my cynical, but in this media environment I don't think the reality or the follow through matters much at all relative to first impressions, and no <1K subscriber channel is suddenly getting 50K views by being nuanced and reasonable. 

See the videos for yourself. The one I saw presented the facts as they are. My example in particular is 1 minute and 42 seconds long, and just states the situation about as plainly as can be without really adding any opinions. They even stickied a comment in their comment section that has this very important message (this was before Tyron's response):

"I think it would be prudent to wait for the team to have an official response to the entire situation. There's tons of misinformation flying around reddit and discord, simply trying to stir the pot and cause confusion, and poorly cropped screenshots trying to separate messages from context. I would hope that everyone keeps a level head about this and stays rational rather than flying off the handle."

Hardly the kind of clickbait content you are trying to dismiss it as. 

[River Oak]

nice effort post

[williams_482]

12 minutes ago, Dorf said:

See the videos for yourself. The one I saw presented the facts as they are. My example in particular is 1 minute and 42 seconds long, and just states the situation about as plainly as can be without really adding any opinions. They even stickied a comment in their comment section that has this very important message (this was before Tyron's response):

"I think it would be prudent to wait for the team to have an official response to the entire situation. There's tons of misinformation flying around reddit and discord, simply trying to stir the pot and cause confusion, and poorly cropped screenshots trying to separate messages from context. I would hope that everyone keeps a level head about this and stays rational rather than flying off the handle."

Hardly the kind of clickbait content you are trying to dismiss it as. 

I'm guessing this is the video being referenced? 

To be honest, I'm reasonably impressed that this is the video that seems to have gained traction. It's still a reaction video and misses some details (such as the very vague reference to "mods that it didn't like", or anything about the timeline of the malware happened and when Maltiez began working for Anego), but you are right that it isn't overtly sensationalized in any way. Well done.

I do note, though, that this post went up on September 2. The situation had been public for at most a day and a half when it was posted, probably less (although Youtube is not so kind as to provide a posting time). Firing someone less than a day and a half after people on the internet got angry about something relatively complex might have been the optimal move purely from a business perspective, but wow, it's a big decision to make that fast, and if you don't have all the answers already, taking premature action has serious risks too. 

Now we're two days later, and this is still the most readily available video on the topic. How much difference would firing this guy today, or yesterday, have actually made to videos that were already out and gaining traction? That's a serious question, because I'm sure there are PR people out there with real training who could give a reasonable answer. 

[Diff]

38 minutes ago, Dorf said:

Article 5 – Illegal Data Interference
The code damages or renders inaccessible data on the system (corrupted saves, broken configurations, etc.), this applies as a separate or concurrent offence. (not impossible for a save to be corrupted by a crash)

Not possible based on my research.

[icesharkk]

30 minutes ago, williams_482 said:

Now we're two days later, and this is still the most readily available video on the topic. How much difference would firing this guy today, or yesterday, have actually made to videos that were already out and gaining traction? That's a serious question, because I'm sure there are PR people out there with real training who could give a reasonable answer. 

The more time that goes buy the more likely the community will say you only did the right thing because the outcry forced your hand. I for one will have a significant portion of my faith restored immediately if he is removed from the project and his full impact of actions are honestly accounted for (unlike Tyron's response).

ill pack up my things and return to my cottage core survival craft, and I'll fight with anyone that continues to spread misinformation about he situation. Ill got back and edit any of the messages where i mentioned tyron/Anego's response being inadequate. I am not afraid to be wrong. I know many who will do the same. will there be drama still? yeah but it wont have any more fuel to burn.

[Echo_Rivera]

This has been my favorite game ever since I discovered it. I've always loved everything about it. But the official response, and the defensive position he took is completely out of line.

You're telling me I can trust this company and trust downloading anything coming from it now that they REFUSED to fire him? As someone who was a victim of malware, it boils my blood to see people acting like keeping the calm "no drama" feeling of the community is more important than punishing this creator for their malicious code. 

I don't care how many people defend this dude like he paid them to do so. It doesn't matter if it was targeting a hacked client (which is another MOD made by another creator, not a real hacked client). This breaks every bit of trust anyone can have with Anego as a company. Maltiez literally added MALWARE code to his mod just because he didn't want players to play the way they wanted, but rather the way that it pleases HIM. 

I'm never touching this game again or downloading anything from it until I'm 100% he's out of the project completely. And multiple people are feeling the same way. MALWARE IS ILLEGAL. I was planning on buying more licenses for my friends and getting other people to play it, it's depressing that I can no longer think about doing that without feeling like I'm putting all of them at risk. 

Every single player is at risk while this dude is in the team. You will not convince us otherwise. 

If you wanna defend his malware and illegal actions, don't waste your time.

FIRE MALTIEZ

[Mushroomancer]

1 hour ago, Dorf said:

See the videos for yourself. The one I saw presented the facts as they are. My example in particular is 1 minute and 42 seconds long, and just states the situation about as plainly as can be without really adding any opinions. They even stickied a comment in their comment section that has this very important message (this was before Tyron's response):

"I think it would be prudent to wait for the team to have an official response to the entire situation. There's tons of misinformation flying around reddit and discord, simply trying to stir the pot and cause confusion, and poorly cropped screenshots trying to separate messages from context. I would hope that everyone keeps a level head about this and stays rational rather than flying off the handle."

Hardly the kind of clickbait content you are trying to dismiss it as. 

The main issue, from what I can tell, is that it is currently somewhat hard to know the exact scope of collateral damage because elements of the community escalated from zero-to-eleven immediately. There's a lot of misinformation and vague information floating around, and while I can sympathize with discord managers wanting to contain things so that the discussion didn't spiral into panic and misinformation, that was already too late by the time they started cracking down on people not obeying the posting rules overzealously.

What we do know is what the code did and didn't do. It targeted a particular paid mod that was used for griefing and disruption of servers (not necessarily of the server's activity, but economic and balance disruption?). The way it detected the activation of this mod, unfortunately, was by detecting obfuscated code above a certain percentage and so when a server itself had other mods with obfuscated code activated, it caught these 'bystanders' as collateral. It did not target the servers themselves, but functionally simulated a modding incompatibility and triggered irregularly timed client-side crashes. It would then redirect any crash logging to other mods and mask config.lib's involvement by pretending the 'incompatibility' was somewhere else.

I'm not exactly clear on if mods by Maltiez OTHER than config.lib were smuggling the killcode? I've heard that said multiple times but it's also kind of vaporous? I figured config.lib's means of interacting with other mods already is why it was ideal for smuggling the killcode.Similarly it seems like a lot of people have taken to throwing massive numbers out of 'victims', despite the code having no means of actually tracking those affected. It's pretty likely even Anego's numbers are tied to projections based on manually reported crash logs that fit the suspect criteria? Though I'm not a hundred percent sure that's the case. I'm not sure THEY have accurate numbers and I do think it was somewhat irresponsible for them to say 'Only a hundred cheaters' were affected. There have been claims that the mod destroyed saves, but saves are server side and the mod only activates on multiplayer instances, it could not cause a crash and poorly timed corruption of save data for a client because it did not trigger in singleplayer. There are repeated statements that Anego 'knew all along, or at least since february and tacitly supported Maltiez', but this seems to be from a miscommunication in the early panic of the outrage when a dev claimed that Maltiez had told them SOMETHING, but it became apparent they didn't have the full scope of the situation at the time.

Additionally there is constant chatter of legal liability and criminality but it's hard to say how seriously something like this would be taken in a court in the EU. There's a good chance it was criminal, but so is double-parking. It's very likely due to the limited scope and immaterial damage beyond frustration and time wasted that it would ever see the light of day, but people's lives have been ruined over pettier things, especially in courts that don't understand technology.

Anego has steered a clean ship for a decade now, and even if this is rough seas and they choose to power through, I don't see a material reality where this sinks it. I think they'll do fine and keep things going the right way, even if not always perfectly. If it's too much for you, however, take a lifeboat. Get your refund, there's a thousand games out there.

[icesharkk]

27 minutes ago, Mushroomancer said:

...I'm not exactly clear on if mods by Maltiez OTHER than config.lib were smuggling the killcode? 

this is a smaller snip of an image in my toplevel post for this thread.
it also affected 8 releases of configlib itself :1.10.9, 1.10.10, 1.10.12, 1.10.13, 1.10.14, 1.11.0, 1.11.1, 1.12.0 ranging from November of last year to 5 days ago.

27 minutes ago, Mushroomancer said:

... I figured config.lib's means of interacting with other mods already is why it was ideal for smuggling the killcode...

(edit to first sentence. more polite) Not really, since there is no granular permissions control for VS mods like you see with iphone apps it didnt have to be configlib. configlib was ideal because of its incredibly widespread install rate within the player base. maltiez added a poisoned file to the released hosted on moddb (so the github repository was always sparkling clean) that ran when your client connected to the game. configlib's scope or interaction with the game client was mostly irrelevant to the malicious logic.

 

27 minutes ago, Mushroomancer said:

Additionally there is constant chatter of legal liability and criminality but it's hard to say how seriously something like this would be taken in a court in the EU. There's a good chance it was criminal, but so is double-parking. It's very likely due to the limited scope and immaterial damage beyond frustration and time wasted that it would ever see the light of day, but people's lives have been ruined over pettier things, especially in courts that don't understand technology.

the criminality of an act and the prosecute-ability of the act are separate things. distributing malware is illegal, but the likelihood any actual legal proceedings occur seems low because evaluating the scope of harm is difficult and making it stick through the user's tacit acceptance of third party software when modding. I'm not a lawyer just been yelled at by enough of them over the years.

Edited Saturday at 12:56 AM by icesharkk

[Teh Pizza Lady]

15 minutes ago, Mushroomancer said:

The main issue, from what I can tell, is that it is currently somewhat hard to know the exact scope of collateral damage because elements of the community escalated from zero-to-eleven immediately. There's a lot of misinformation and vague information floating around, and while I can sympathize with discord managers wanting to contain things so that the discussion didn't spiral into panic and misinformation, that was already too late by the time they started cracking down on people not obeying the posting rules overzealously.

What we do know is what the code did and didn't do. It targeted a particular paid mod that was used for griefing and disruption of servers (not necessarily of the server's activity, but economic and balance disruption?). The way it detected the activation of this mod, unfortunately, was by detecting obfuscated code above a certain percentage and so when a server itself had other mods with obfuscated code activated, it caught these 'bystanders' as collateral. It did not target the servers themselves, but functionally simulated a modding incompatibility and triggered irregularly timed client-side crashes. It would then redirect any crash logging to other mods and mask config.lib's involvement by pretending the 'incompatibility' was somewhere else.

I'm not exactly clear on if mods by Maltiez OTHER than config.lib were smuggling the killcode? I've heard that said multiple times but it's also kind of vaporous? I figured config.lib's means of interacting with other mods already is why it was ideal for smuggling the killcode.Similarly it seems like a lot of people have taken to throwing massive numbers out of 'victims', despite the code having no means of actually tracking those affected. It's pretty likely even Anego's numbers are tied to projections based on manually reported crash logs that fit the suspect criteria? Though I'm not a hundred percent sure that's the case. I'm not sure THEY have accurate numbers and I do think it was somewhat irresponsible for them to say 'Only a hundred cheaters' were affected. There have been claims that the mod destroyed saves, but saves are server side and the mod only activates on multiplayer instances, it could not cause a crash and poorly timed corruption of save data for a client because it did not trigger in singleplayer. There are repeated statements that Anego 'knew all along, or at least since february and tacitly supported Maltiez', but this seems to be from a miscommunication in the early panic of the outrage when a dev claimed that Maltiez had told them SOMETHING, but it became apparent they didn't have the full scope of the situation at the time.

Additionally there is constant chatter of legal liability and criminality but it's hard to say how seriously something like this would be taken in a court in the EU. There's a good chance it was criminal, but so is double-parking. It's very likely due to the limited scope and immaterial damage beyond frustration and time wasted that it would ever see the light of day, but people's lives have been ruined over pettier things, especially in courts that don't understand technology.

Anego has steered a clean ship for a decade now, and even if this is rough seas and they choose to power through, I don't see a material reality where this sinks it. I think they'll do fine and keep things going the right way, even if not always perfectly. If it's too much for you, however, take a lifeboat. Get your refund, there's a thousand games out there.

"But my game crashed! So it's clearly Maltiez's fault!", right? It couldn't be the other 67 mods I had installed, right? Clearly I'm a victim here.

 

[Mushroomancer]

3 minutes ago, icesharkk said:

the criminality of an act and the prosecute-ability of the act are separate things. distributing malware is illegal, but the likelihood any actual legal proceedings occur seems low because evaluating the scope of harm is difficult and making it stick through the user's tacit acceptance of third party software when modding. I'm not a lawyer just been yelled at by enough of them over the years.

Thank you, I do recall seeing that post by Maltiez now. 

My last point wasn't to downplay the legality or illegality of the actions but to point out that it's very unlikely Anego is going to be 'prosecuted into oblivion' or held legally liable for the situation at this point in time as some people were deeply worried about. I also don't put a lot of stock into the conflation of legality and morality, but that's more philosophical at this point. Especially because I don't think the actions taken were either legal nor ethical. It's clear that Anego, at least as of the last official statement, see Maltiez's intentions and targets as mitigating even considering the lazy shortcut of just blacklisting any mod with a certain threshold of obfuscation resulted in collateral.

They've probably also got their hackles up a bit with the fervor and vitriol they've been feeling since this all blew up overnight.

[Ichika]

On 9/3/2026 at 5:59 PM, HalfAxd said:

Sorry, but no...  you are not the community and you don't speak for me.

If you don't like something, then you have the right to leave.

At this point the rabble rousing is beyond absurd.

Please say your peace and go.

Neither do you speak for the rest of us. As you said, "say your peace and go". Don't like it, don't interact with the post.

[kuzimo]

57 minutes ago, Teh Pizza Lady said:

"But my game crashed! So it's clearly Maltiez's fault!", right? It couldn't be the other 67 mods I had installed, right? Clearly I'm a victim here.

 

You would figure if a mod was causing the issue through investigating the client-crash.log but you couldn't because it was tampered with.

So I guess it is Maltiez's fault!

[Ichika]

On 9/3/2026 at 10:42 AM, Lukas Marty said:

Your framing is incredibly bad faith, this is why I am calling you a false snake. This is only about Maltiez and even that is totally overblown. And you people now destroyed this community. I would never want interact with this absolutely toxic community ever again and I am sure many normal people feel the same

 

Good. We don't want to interact with you either. Good bye

[Teh Pizza Lady]

11 minutes ago, kuzimo said:

You would figure if a mod was causing the issue through investigating the client-crash.log but you couldn't because it was tampered with.

So I guess it is Maltiez's fault!

oops nevermind it was the mod I was developing. False alarm everyone!