Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Diff]

In fairness, it's good juice.

19 minutes ago, Byran33 said:

That's why you didn't address that aspect of my last post

Only bothered replying to things that are outright wrong, mostly about concrete technical details. If something's simply your view or your opinion I'm not going to tell you you're wrong or that you can't feel that way.

If you think I'm wrong about the things I replied, I'd appreciate if you could show where a concrete thing I said is incorrect, same as I'm doing with you.

19 minutes ago, Byran33 said:

They wouldn't just need to look over his code- they would actively need to insure that didn't have access to the Vanilla VS codebase in any meaningful way

He doesn't. They said this in the announcement, all code is reviewed before it's committed, nobody can just like. Add code to the codebase. That's simply not how it works. It's not like editing a text file on your computer. Code changes are gathered, submitted for review, signed off by Tyron and potentially others, and then if it passes style, quality, and correctness checks, is approved to be merged into the codebase. There's a whole process.

19 minutes ago, Byran33 said:

Do they need to make sure that he isn't trying to impede development of future features he might disagree with implementing, too?

No, again that's not how software development works. Like, there is no action that Maltiez or anyone could take to accomplish this, short of posting "Hey I don't want this" in their internal discord or slack or email or whatever.

19 minutes ago, Byran33 said:

Are you on the dev team or in any position to inform consumers about how this monitoring process would actually work?

No, I just know how software development works on a basic level. I don't mean this as an insult, after all, why would a random person know this for no reason? But that's why I'm posting it here, so others can know and be a little more informed about the topic we're discussing.

Edited Saturday at 05:13 AM by Diff

[LadyWYT]

3 minutes ago, Diff said:

all code is reviewed before it's committed, nobody can just like. Add code to the codebase.

I'm pretty sure this is how 99% of software development works, unless it's like...one guy working on the entire project. 

[Mushroomancer]

52 minutes ago, Cetasaya said:

i agree, vintage story was literally my favorite game behind rimworld.  and i game a lot.  but now eveytime i feel like playing it again, i'm;

1.  having my mind nagged by the malware peddler and the devs and owner's VEHEMENT defense and deciet around this issue AND thier attacks and censorship OF THEIR OWN PLAYERS

2.  wondering what other pieces of malware have been loaded on my laptop from vintage story and its mods.  luckily for anego studios i use a seperate laptop for my work and i handle peoples medical records.  if thier mods infected THAT laptop they would be facing many many many years in prison, because they KNEW the malware peddler infected people's devices with malware.  for a year.  at least i would be cleared cause the peddler hid their malware from the players.  though obviously playing games and downloading sh!t to a laptop wioth sensitive professional data would be a thing only total morons would do lol.  but of course, im not the only vintage story player that has used mods from their official mod database page.  but even if i had downloaded those mods on a brand new computer, i would have at least contacted my attorney on what expert i could contact in order to bring legal action for compensation for my data and potentially laptop.  cause you know... any malware is just open season on god knows what else was compromised.  people keep saying over and over again that "we know what the mod did" but they all said that before the multiple more functions of this malware that the devs have hid have come to light from players, some of those people are just idiots of course, but the rest including the devs and owner have now been proven to have long known, kept the mod up, hired the malware peddler, lied about everything, banned people for asking questions and calling for the malware peddler to be fired, ect., ect.

3.  troubled that tyron himself has quadrupled down, lied, banned people's voices, and refuses to punish, ban, and fire the malware peddler.  all for what?  a modder that has long has severe mental social issues, has treated players with vitriolic hatred and vile language?  a malware peddler that has now been proven to have KNOWINGLY INFECTED PEOPLES DEVICES WITH HIDDEN MALWARE BY THEIR OWN PUBLIC ADMISSION (which again is an extremely serious crime)

these arent mistakes.  these devs have been and are likely still lying to us.

and we cannot trust anything they will ever tell us.  theyre proven liars.  and they STILL have a proven malware peddler on their official staff.

Then you should refund the product. I am not saying this to be dismissive, it sounds like you cannot be comfortable or feel safe using this game or product, and if you are not exaggerating at all, there is nothing that Anego or their community can do to assuage that. If you are this worried and this uncomfortable with the idea of using Anego's software, if your trust is THIS broken, there is nothing they can do.

You are just smearing the walls on your way out at this point or venting extreme, borderline manic emotional distress which isn't healthy to do in a public space. At the very least, I recommend taking a step away for a day or two to collect your thoughts and consider what, if anything, you're asking for or want from this exercise of castigation. 

I also don't think you have a very good grasp of the different forms malware takes or comes in, it very much sounds like you are currently directly accusing Anego of actively and maliciously compromising your data which is a serious accusation and was not the purpose of either the code in the community APIs or in Vintage Story itself. You're also accusing them of partaking in the active development of this malicious software, which is not the case from anything I've read on this situation.

This is the reason for things like the 'censorship'. It was overzealous, but these kind s of accusations are serious and were, especially in the early morning of this whole controversy, extremely inflammatory and speculative. If you're so worried you are considering legal action against Anego, I don't know what to tell you except that without some shift in perspective or some very significant change in the information we have available., there's nothing here for you now. 

[Teh Pizza Lady]

5 minutes ago, Mushroomancer said:

Then you should refund the product. I am not saying this to be dismissive, it sounds like you cannot be comfortable or feel safe using this game or product, and if you are not exaggerating at all, there is nothing that Anego or their community can do to assuage that. If you are this worried and this uncomfortable with the idea of using Anego's software, if your trust is THIS broken, there is nothing they can do.

You are just smearing the walls on your way out at this point or venting extreme, borderline manic emotional distress which isn't healthy to do in a public space. At the very least, I recommend taking a step away for a day or two to collect your thoughts and consider what, if anything, you're asking for or want from this exercise of castigation. 

I also don't think you have a very good grasp of the different forms malware takes or comes in, it very much sounds like you are currently directly accusing Anego of actively and maliciously compromising your data which is a serious accusation and was not the purpose of either the code in the community APIs or in Vintage Story itself. You're also accusing them of partaking in the active development of this malicious software, which is not the case from anything I've read on this situation.

This is the reason for things like the 'censorship'. It was overzealous, but these kind s of accusations are serious and were, especially in the early morning of this whole controversy, extremely inflammatory and speculative. If you're so worried you are considering legal action against Anego, I don't know what to tell you except that without some shift in perspective or some very significant change in the information we have available., there's nothing here for you now. 

not to mention the potential for backlash if, say, someone really spreads the word that Anego just makes malware. Pretty sure that slander or at least libel both of which are actionable in courts of law. The censorship protects both parties.

[Mushroomancer]

Just now, Teh Pizza Lady said:

not to mention the potential for backlash if, say, someone really spreads the word that Anego just makes malware. Pretty sure that slander or at least libel both of which are actionable in courts of law. The censorship protects both parties.

This is already becoming a line used throughout social media in some places by people who either don't understand the complexities of what is going on or are intentionally spreading that message out of spite and/or genuine belief.

[Teh Pizza Lady]

5 minutes ago, Mushroomancer said:

This is already becoming a line used throughout social media in some places by people who either don't understand the complexities of what is going on or are intentionally spreading that message out of spite and/or genuine belief.

yeah, not really a good idea to slander or libel someone who has your payment information which includes mailing address.

EDIT:

NOT that Anego would use this information to pick on individuals indiscriminately or nefariously, but if push came to shove and it hurt the company financially, then they would have grounds to pursue legal action.

Edited Saturday at 05:40 AM by Teh Pizza Lady

[Mushroomancer]

7 minutes ago, Teh Pizza Lady said:

yeah, not really a good idea to slander or libel someone who has your payment information which includes mailing address.

It very likely won't lead anywhere unless there's a very large concerted effort from an actual journal or influencer doing it. Legally speaking, things like libel and slander are difficult to pursue already, and outside of some specific places where it can be used as a cudgel by those with enough money to wield it that way, things like 'potential damages' are often deciding factors on if such cases even see the light of day. A few random users of Bluesky and Twitter are not likely to be at risk of that.

Edited Saturday at 05:45 AM by Mushroomancer

[Emeal]

People certainly seem to be disappointed from a level of trust which they should not have had at all in my opinion.
Mods always have the potential of containing malicious code and Anego does not check every mod's code, like you should know this.

I certainly don't agree with firing a good programmer over an unhealthy amount of trust, if Tyron trusts Maltiez to not be shifty and double checks his code that is good enough.

[Endeavour]

1 hour ago, Emeal said:

People certainly seem to be disappointed from a level of trust which they should not have had at all in my opinion.
Mods always have the potential of containing malicious code and Anego does not check every mod's code, like you should know this.

I certainly don't agree with firing a good programmer over an unhealthy amount of trust, if Tyron trusts Maltiez to not be shifty and double checks his code that is good enough.

Idunno, he does seem to have done damage to the brand, to Moddb, and while the idea of an multiplayer anticheat to combat a shady, seedy cheat mod that is damaging the community is not bad, the issue is doing it secretly and doing a hilariously terrible job at creating that mod(any mod above 22% obfuscated code gets shotgunnd).  Had it been disclosed to the community not only the dev team in the moddb description, it would be a non issue right now especially with how few were affected and the affects were just random crashes. 

Personally I would consider firing such person solely based on the damages to the brand alone paired with the terrible anti cheat solution. Facts are facts but nobody cares about the facts when you get to get to enroll in some internet drama.

I mean we should do better but geniuinely most people believe kernel level anticheats and anticheats that deliberately ban users solely based on their OS are a good thing, so this Matinez behavior is industry wide. 

Edited Saturday at 09:20 AM by Endeavour

[kanedias]

what a shame, just as i wanted to jump back in again. seems like any vintagestory related code stays off my system until I can be sure this maltiez person won't touch anything vs-related ever again and anegos stance reflects that transparently.

[Compressed12Times]

Safe to say they probably won't pick anyone from moddb to be on official dev team in the future after this.

[tiggerbiggo]

On 9/4/2026 at 1:22 AM, Diff said:

I also wish the false positives had been mentioned. In truth, we don't know how widespread these false positives were. Mods are third-party code of unknown quality, and mods do just crash. Null Reference Exceptions in particular are the classic mystery meat crash, and they're the kind of crash that ConfigLib provoked. We do have at least one confirmed case of a mod caught in the crossfire, Caves N Caverns, due to it obfuscating its code. Speculating a touch, if CNC's 1000 downloads were enough to blow the lid off this, it does suggest that false positives were not common... But I feel that's the limit on how far you can reasonably minimize this issue.

Ultimately, we don't know how widespread the false positives really were, and that itself is part of the problem. In a vacuum of information, a lot of crashes are now getting pinned on ConfigLib. Is it true? Were these crashes also mixed with random game inputs and disconnects, all consistently between 2-9 minutes after assets loaded? We don't know. Nobody that's claiming ConfigLib kicked their cat is going that far into depth with it. And the announcement only continues that vacuum of information. I'm personally fine overall with the VS team's current path forward, but that's the complaint I have with the announcement.

Huh, almost like smuggling malicious code into a mod destroys trust and creates an information vacuum or something... Who would have thought that doing sneaky stuff with code makes people not trust you any more...

[Diff]

6 hours ago, icesharkk said:

ah i think the lies they're referring to are not the coverup you were asking for proof of. I can definitely say the lies i'm talking about are things like Vallen stating "its not malware" in the refund request, Tyron stating only <100 cheat users were affected, and the operation was targeted. Lies by omission and bald faced lies about the targeting mechanism of the code itself.

Coming back around to this now that it's morning, what Cetasaya wrote was specifically

6 hours ago, Cetasaya said:

people keep saying over and over again that "we know what the mod did" but they all said that before the multiple more functions of this malware that the devs have hid have come to light from players

It's pretty clear to me that they meant that the devs covered up behaviors of Maltiez's code that the players had to uncover themselves. Cetsaya really didn't mention any of the other potential issues with the announcement or with non-official Anego statements like from Vallen, they invented something new beyond any of that when they  talked about the "functions of this malware that the devs have hid."

[Diff]

4 minutes ago, tiggerbiggo said:

Huh, almost like smuggling malicious code into a mod destroys trust and creates an information vacuum or something... Who would have thought that doing sneaky stuff with code makes people not trust you any more...

No, smuggling malicious code only destroys trust. Not speaking on it creates an information vacuum. You know what they say. It take years.

Edited Saturday at 11:21 AM by Diff

[tiggerbiggo]

29 minutes ago, Diff said:

No, smuggling malicious code only destroys trust. Not speaking on it creates an information vacuum. You know what they say. It take years.

Said malicious code was designed to obfuscate itself. The 2 are one and the same. The code itself creates its own information vacuum by default, forcing speech to provide accurate information. If the code was self-documenting, open source or simply wasn't trying to hide itself, less people would be speculating on its true behaviour.

 

As a side note, this is a big reason why undocumented, obfuscated, misaligned and intrusive behaviour is ALWAYS classified as malware, even if it doesn't actually cause harm.

Edited Saturday at 11:52 AM by tiggerbiggo

[A_British_Lass]

honestly just wish they'd revise the apology, i can *accept* maltware retaining employment even if i quite frankly think this is a blunder of a life time
it's the fact the whole situations has been misinterpreted to make maltware look better, the guy has been an ass for ages now just can't fathom why tyron wants to put stock behind a guy who admits to his own wrong doing like he's an anime villain

[Diff]

6 minutes ago, tiggerbiggo said:

Said malicious code was designed to obfuscate itself. The 2 are one and the same. The code itself creates its own information vacuum by default, forcing speech to provide accurate information. If the code was self-documenting, open source or simply wasn't trying to hide itself, less people would be speculating on its true behaviour.

 

The existence of the code is the thing that broke the story. We've known about the code since it became a story, because it wasn't a story before then. It's a short file, it can be read in a single sitting, its full behavior breakdown was available same-day. There was never a info vacuum on that.

What I was originally talking about when I mentioned an information vacuum was Anego needing to mention the false positives in their announcement. Not giving clear information on the scope of the false positives is the present vacuum left by their statement. Because the behavior of the code is well-understood for anyone who cares to.

If you yourself are unsure how the code behaves, I recommend the breakdown in the first post of this topic. It's short and covers everything. AdditionalStuff.cs doesn't really do much.

[tiggerbiggo]

3 minutes ago, Diff said:

 

The existence of the code is the thing that broke the story. We've known about the code since it became a story, because it wasn't a story before then. It's a short file, it can be read in a single sitting, its full behavior breakdown was available same-day. There was never a info vacuum on that.

What I was originally talking about when I mentioned an information vacuum was Anego needing to mention the false positives in their announcement. Not giving clear information on the scope of the false positives is the present vacuum left by their statement. Because the behavior of the code is well-understood for anyone who cares to.

If you yourself are unsure how the code behaves, I recommend the breakdown in the first post of this topic. It's short and covers everything. AdditionalStuff.cs doesn't really do much.

That writeup is useful, but it doesn't change my opinion.

The malicious code was not in the public repo, and was baked into the release itself.

It was placed inside another library inside ConfigLib to make it look like something else

It had random behaviours triggered at a random time so you couldn't easily track it down.

 

So sure, once the code itself was found and identified, it got pulled apart fast. But until that point, its behaviour was specifically designed to be hard to find, and make it look like it's the fault of some other mod. So I think both things contributed to it and the actions of both parties are pretty inexcusable imo...

[Diff]

15 minutes ago, tiggerbiggo said:

The malicious code was not in the public repo, and was baked into the release itself.

It was placed inside another library inside ConfigLib to make it look like something else

It had random behaviours triggered at a random time so you couldn't easily track it down.

Those aren't opinions, they're facts. Well, with one tiny correction. Placed inside another library's namespace*

16 minutes ago, tiggerbiggo said:

So sure, once the code itself was found and identified, it got pulled apart fast. But until that point, its behaviour was specifically designed to be hard to find, and make it look like it's the fault of some other mod. So I think both things contributed to it and the actions of both parties are pretty inexcusable imo...

It was found and identified at the beginning of the story. Again, the topic of discussion was a vacuum of information. Nobody's disagreeing on what the code did or how it hid itself. Those have all been identified from the beginning.

[tiggerbiggo]

Just now, Diff said:

Those aren't opinions, they're facts. Well, with one tiny correction. Placed inside another library's namespace*

It was found and identified at the beginning of the story. Again, the topic of discussion was a vacuum of information. Nobody's disagreeing on what the code did or how it hid itself. Those have all been identified from the beginning.

The beginning of the story is when the malware was uploaded, not when it was found. Malware doesn't become a problem only when it is found and dissected.

[Diff]

1 minute ago, tiggerbiggo said:

The beginning of the story is when the malware was uploaded, not when it was found. Malware doesn't become a problem only when it is found and dissected.

News story broke on discovery, its history of course goes back further, that's part of what we're all discussing. I'm not enjoying bickering over semantics. Let me know if you want to chat about something else though.

Edited Saturday at 12:31 PM by Diff

[tiggerbiggo]

1 minute ago, Diff said:

News story broke on discovery. I'm not enjoying bickering over semantics. Let me know if you want to chat about something else though.

I'm not really trying to and i see what you meant there sorry, but regardless of that misinterpretation on my side the news story is still only half of the equation and the lack of trust only exacerbates the first part since even though it's easy enough for a programmer to read and understand that post you linked, if the mod didn't take those steps to hide itself there would be less questions for a non-technical user to even ask, and less things they could misinterpret or misinform others on. The very fact that it was trying to hide itself will lead non technical users to speculate, creating that vacuum even when accurate technical info is given.

There's a pretty clear and established line in the sand with this kind of malicious behaviour in game code, and for good reason.

[Diff]

Don't disagree at all that this is Not Good.

Unfortunately this is inherently a technical topic, and that makes it easy for misinformation to spread. The targeting mechanism is very technical and easy to telephone into a variety of incorrect things. Solutions are also very technical and people are throwing around words they don't understand and that they don't understand the complexities of. From the start to the path forward, everything's very, very technical. And a lot of people, now that they've lost trust, aren't willing to just accept "trust me, technically it all makes sense."

Again "makes sense" doesn't mean "is fine" or "was a good idea." It just means that a lot of the suggestions or demands or worries are based on misunderstandings.

[tiggerbiggo]

5 minutes ago, Diff said:

Don't disagree at all that this is Not Good.

Unfortunately this is inherently a technical topic, and that makes it easy for misinformation to spread. The targeting mechanism is very technical and easy to telephone into a variety of incorrect things. Solutions are also very technical and people are throwing around words they don't understand and that they don't understand the complexities of. From the start to the path forward, everything's very, very technical. And a lot of people, now that they've lost trust, aren't willing to just accept "trust me, technically it all makes sense."

Again "makes sense" doesn't mean "is fine" or "was a good idea." It just means that a lot of the suggestions or demands or worries are based on misunderstandings.

Yeah I get that, hopefully I managed to communicate what I was trying to say regardless, it doesnt conflict with what you're saying even though I thought it did

[LadyWYT]

3 hours ago, Endeavour said:

Personally I would consider firing such person solely based on the damages to the brand alone paired with the terrible anti cheat solution. Facts are facts but nobody cares about the facts when you get to get to enroll in some internet drama.

To be frank, if Anego Studios had canned Maltiez(and potentially whomever else was remotely involved) before the facts were public knowledge, all to attempt to avoid public outcry and go along with what seemed to be popular public opinion...that would concern me a lot more. Because at that point, there's no actual leadership aside from mob rule, and public opinion is a fickle beast. That's a very easy situation for bad actors to take advantage of, and that's also how innocent parties get caught in the crossfire and have their lives and reputations ruined.

That doesn't mean that what Maltiez did was right and that there shouldn't be consequences, or that Tyron and co. have handled everything with the upmost grace and wisdom(as I said in a previous post, time will tell how his decisions pan out, and I can't honestly say that I wouldn't have made the same/better decisions in his shoes). And it's okay to be upset about the situation and politely express as much. But I do think there are several that are insistent on blowing things way out of proportion because they want heads to roll and will settle for nothing less.