Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[LadyWYT]

5 hours ago, Compressed12Times said:

Safe to say they probably won't pick anyone from moddb to be on official dev team in the future after this.

ModDB has nothing to do with it; bad actors can come from anywhere. That doesn't mean that you need to run around paranoid about everything, it just means use some common sense and your best judgment to evaluate situations and determine what is an appropriate risk level for you and what isn't, and then act accordingly.

When it comes to game development, I think it's safe to say that after a situation like this, being part of the modding community doesn't exclude you from a chance to work for Anego if they're hiring. What it does mean, most likely, is that new hires are going to be screened more thoroughly, and more paperwork and supervision when it comes to keeping track of who did what and when.

Edited Saturday at 04:34 PM by LadyWYT
Forgot a word

[Psi-Hazel]

The responses from people here are disgusting, ignorant, or just simply childish. Why are you defending malware? What exactly do you get from telling someone who feels their trust was violated that they're wrong for feeling that way? The whole point of this seems to be that someone who now has some level of trust with the VS devs is not sorry that they released malignant code. If they simply apologised for the overreach this wouldn't be nearly as big, that and the level of bootlicking just escalates things further with those who feel wronged.

TLDR: Please stop being so petty and sarcastic, and accept that people can feel differently about breaches of trust.  

[Michaloid]

In my personal opinion I think that if you don't trust anego anymore due to this scandal, then refunding it is better than screaming to the void and fill space on forums that should be for the game only. I'm sure that if you mention this scandal as the reason for refund they're going to grant you that privilege even after 1000 hours i'm sure.
All that's been said has been said, and i don't think there's nothing new to add aside from repeating the same thing over and over and over. I don't think they are going to address this situation anymore but don't take my word for it. Imo, if anything they're probably waiting for Maltiez contract to end and then plan from there.

That being said, i'm sure that both sides are tired of this discussion and are ready to move on to the next thing in life, weather be not looking at this game any longer or continuing to play the game normally.

Edited Saturday at 01:54 PM by Michaloid

[LadyWYT]

11 minutes ago, Michaloid said:

I'm sure that if you mention this scandal as the reason for refund they're going to grant you that privilege even after 1000 hours i'm sure.

Even if there is no refund...why would one keep playing if they don't trust the developers or the game itself anymore? At that point it makes more sense to just walk away and don't use the services that the company offers.

[Sparticus247]

38 minutes ago, Psi-Hazel said:

The responses from people here are disgusting, ignorant, or just simply childish. Why are you defending malware? What exactly do you get from telling someone who feels their trust was violated that they're wrong for feeling that way? The whole point of this seems to be that someone who now has some level of trust with the VS devs is not sorry that they released malignant code. If they simply apologised for the overreach this wouldn't be nearly as big, that and the level of bootlicking just escalates things further with those who feel wronged.

TLDR: Please stop being so petty and sarcastic, and accept that people can feel differently about breaches of trust.  

Welcome to the forums.

To not retread water see my previous comment

https://www.vintagestory.at/forums/topic/22429-concerns-about-supporting-anego-studios-further-on/?page=2#comment-120577

Now onto the "bootlicking" part of the comment. I'd urge you to take your own words on the "petty" part and consider that there are number of us that feel the situation is addressed and are willing to move on.

"We feel differently about the breach of trust" like you said, and understand that it's ok for us to have that opinion. You are allowed to still be mad about it, but we are allowed to express our side as well.

There has been good discussions in the 2 main threads (outside of 1 obvious trollish outlier from earlier) so let's keep it that way.

[Endeavour]

1 hour ago, LadyWYT said:

To be frank, if Anego Studios had canned Maltiez(and potentially whomever else was remotely involved) before the facts were public knowledge, all to attempt to avoid public outcry and go along with what seemed to be popular public opinion...that would concern me a lot more. Because at that point, there's no actual leadership aside from mob rule, and public opinion is a fickle beast. That's a very easy situation for bad actors to take advantage of, and that's also how innocent parties get caught in the crossfire and have their lives and reputations ruined.

That doesn't mean that what Maltiez did was right and that there shouldn't be consequences, or that Tyron and co. have handled everything with the upmost grace and wisdom(as I said in a previous post, time will tell how his decisions pan out, and I can't honestly say that I wouldn't have made the same/better decisions in his shoes). And it's okay to be upset about the situation and politely express as much. But I do think there are several that are insistent on blowing things way out of proportion because they want heads to roll and will settle for nothing less.

I consider its a tiny indie studio of people who made a minecraft mod into a full game and the entire purpose of the code was to hit an actually malicious mod but the creator went about it completely the wrong way. At the end of the day it's honestly not that huge of a deal. It is a very interesting drama to discuss tho.

[ifoz]

I haven't really weighed in much at all with this whole drama, since I didn't feel like I had anything unique to say about it that hadn't already been said a thousand times before.

However, I do think it'd be good if the VS team actually disclosed the basics of what Maltiez' job currently is. We know he's an "advisor", but beyond that as far as I'm aware there is no concrete explanation of what that position actually entails. A lot of the fearmongering around this issue seems to stem from the idea that Maltiez could sneak further malicious code into the game in some way, and I think a decent potential way to help quell some of that would be letting it known just what parts of the code he's actually got access to and the basic gist of what he is doing with it, if anything.

If it turns out he's really just there to say "yeah, this looks good" or "here's how I would have done that" to changes in the combat update, I think that could help to clear some of the air.
And if he is touching further code beyond that, at least then we would know roughly what areas he's working in.

Edited Saturday at 02:47 PM by ifoz

[MKMoose]

38 minutes ago, ifoz said:

However, I do think it'd be good if the VS team actually disclosed the basics of what Maltiez' job currently is. We know he's an "advisor", but beyond that as far as I'm aware there is no concrete explanation of what that position actually entails. A lot of the fearmongering around this issue seems to stem from the idea that Maltiez could sneak further malicious code into the game in some way, and I think a decent potential way to help quell some of that would be letting it known just what parts of the code he's actually got access to and the basic gist of what he is doing with it, if anything.

His role is listed as "Mod API Programmer" on the Discord and on the website, and as "Bug fixing, Mod API" in game credits, and beyond that we don't really know any details - the best you can currently do is check his activity on GitHub to see which bugs he's likely contributed to fixing. This has been spoken about by at least myself, tsu and Diff in a couple places in this whole mess (e.g. here, here or here), though I certainly don't fault you for not finding it.

Most if not all of the code that he has contributed to public game releases is publicly visible in Anego's GitHub repositories, and he doesn't have the ability to directly modify the game's code without it going through other team members as part of the standard review process.

Edited Saturday at 03:23 PM by MKMoose

[woobomp]

Anego needs to fire Maltiez plain and simple, I do not trust any of the development staff if they keep him onboard and if this situation gets any worse, I plan on refunding my copy and never touching this game again.

[Gandorf]

The poll results are pretty close to 50/50 among core contributors, and if we count non-contributors, it's 3300 to 2783 per op post from 5 hours ago, which means the community is really divided, and this won't be good. The hard part is measuring the impact on the VS brand's reputation. Indie studios are thought to be more trustworthy than big corporations, but that makes them more vulnerable to losing that trust, in a way

[BlackCDown]

  

18 hours ago, Narcosis said:

Were their machines destroyed? Their systems crashed? Their personal data stolen? Nothing of such had happened, aside from the minor inconvenience of not being able to play and having no idea what's going on; the only factor being anger and lost time. 

Malware is a specialized form of software engineering designed to subvert or disrupt the regular functioning of your system without your consent. Of course, info stealers and ransomware are very flashy and all the craze but they are only a subset of what malware is designed for. By subverting the regular functioning of the game for unknowing players it already opened itself to that interpretation.

The impact argument is like saying it's okay to leave a mosquito flying around your home because it's at least not giving you Lyme disease like some other bloodsucker. No, you kill it because it still gives you and your family an itch. Likewise, this should not be tolerated on principle alone, not just because "eh, it's just lost hours in a game".

It's even more incriminating that he could not have just made a robust AC mod for server admins to install, he chose the method that would allow him to deal punishment however he wanted with no need for accountability, almost like he was just chasing personal satisfaction from vigilantism instead of an altruistic desire to improve the community. And more than that it reflects poorly on Anego to try and whitewash this issue the way they did and apologise only for being made to.

Edited Saturday at 03:48 PM by BlackCDown

[BlackCDown]

23 minutes ago, Gandorf said:

Indie studios are thought to be more trustworthy than big corporations, but that makes them more vulnerable to losing that trust, in a way

More trustworthy is not the same as trustworthy, it's just that the bar is that low now. Even No Man's Sky gets applauded for fixing the game post-launch when the game should not have been delivered in a state requiring that to begin with.

[Eruannon]

17 hours ago, Dorf said:

The EU law most relevant to this actually just had its 13th year anniversary as of yesterday! Directive 2013/40/EU!

Long story short, the articles it could arguably trigger:

Article 4 – Illegal System Interference
Seriously hindering or interrupting the functioning of an information system by inputting computer data... intentionally and without right.

Article 5 – Illegal Data Interference
The code damages or renders inaccessible data on the system (corrupted saves, broken configurations, etc.), this applies as a separate or concurrent offence. (not impossible for a save to be corrupted by a crash)

Article 7 – Tools for Committing Offences

Intentional production, sale, procurement for use, import, distribution or -> otherwise making available <-, a computer program designed or adapted primarily for the purpose of committing the offences in Articles above (and others but they don't fit as much)

 

Not many precedents to fit this particular case but charges can be around 2-3 years imprisonment from a quick. Like with a lot of EU laws, there are other laws that this will break simultaneously. I think it skirts the worst of them by not really involving any actual monetary gain (that we know of). As always with law, precedent is key but there isn't much out there for such a relatively specific case. 

You forgot article 3 - where access was given without right - i.e. by adding it as additional payload not disclosed in source files - i.e. by deception, in a scope beyond permission given by users (users accept scope as written in description, and to that they can be inferred to have given their permission, but this code was undisclosed and unknown until someone decided to dig deeper into what crashes clients - i.e. due to false positive).

and article 8, this time unfortunately on Anego part, where the official statement officially condones and excuses the actions in question. 

 

16 hours ago, Diff said:

Not possible based on my research.

You say 'saves' I say 'logs', specifically the part where the code intentionally delayed the crash to manipulate logs into listing a false culprit
https://hastebin.com/share/uqeyuhirof.markdown
So unless You have legal assessment by actual lawyer, I'd personally change 'not possible' to 'unlikely' personally, as this situation is fishy AF.

[Jack_Black]

I never participate in this kind of thread and this kind of thread looks astroturfed or filled to the brim with people who do not recognize had he done this as a coder in 99% of positions he would be blacklisted from the industry for proving predisposed to hiding functionality because they think it's 'right'.

 

You can put a burglar in the bank as a teller and insist because you're watching them we should by extent have inherent trust in a pattern of behavior that shows no remorse, utmost confidence in themselves and a very unfriendly face before they got gag ordered. I don't trust your burglar, and when your official PR answer dodges all the thousands of hours lost by hundreds of people to crash logs that deliberately point a finger at a non-problem in the midst of announcing he's on the team, I don't trust you either and no, I don't need to be told don't play it then. I hosted Pterodactyl VMs running the game and I'm not anymore.

 

For such a good game, this conversation, this thread, the kind of nonargument detractions being made in the face of someone whose name would never work in coding again were this any other situation is the most massive and profound disappointment I've ever seen in a community.

 

They defiled cybersecurity to the point they'd not be hired for being a legal liability. These kinds of things usually effect the finance sector pretty aggressively or some sort of bookkeeping- not my videogame, and its very unappreciated the importance of trust did not apply evenly here despite the liability factor being the very same for the very same reasoning- Malt is able to be ideologically motivated by his own internal debates on whats right or wrong and then apply it with deliberate intent to hide it. Stop making excuses for someone who took their prestigious career as a lying jerk and managed to get promoted to game dev because they made their dependency a pillar. If you genuinely side with him, in cybersecurity you are what's called a big fish with a picket fence- you think yourself unable to bleed or be bothered by a hole in your PC security and thats exactly why you are the big catch because when you finally learn the hard way you're likely to shift your beliefs after learning the hard way. You stand against hiring and firing of liabilities to principles every formally educated coder knows and abides by.

 

But Maltware is an exception that deserves to he an exception to the standard response to an employee deploying unsanctioned code on thousands of PCs? Get real.

Edited Saturday at 04:27 PM by Jack_Black
Mispelling/correcting ESL errors.

[JustDavid]

@Tyron 

First, I love this game. I love that it's built for mods. I'm not a Youtuber or any kind of influencer. I'm retired guy living my best life in my very own world in VS but more importantly I'm a customer. There's an idiom here in the states about customer service "If a customer has a good experience they will tell 1,2, maybe 3 people but if a customer has a bad experience they will tell everyone they know." That goes for external and internal customer service as well. By keeping and protecting this employee that did things maliciously in his off time to harm your customer trust and loyalty is most definitely damaging the reputation of you and this game. The community that took you 10 years to build is now lacking trust in your handling this situation. I have read your statement and I've come here to add my voice to many others in calling for termination of Maltiez.  Please reconsider your stance on this situation. 

[williams_482]

25 minutes ago, BlackCDown said:

It's even more incriminating that he could not have just made a robust AC mod for server admins to install, he chose the method that would allow him to deal punishment however he wanted with no need for accountability, almost like he was just chasing personal satisfaction from vigilantism instead of an altruistic desire to improve the community. And more than that it reflects poorly on Anego to try and whitewash this issue the way they did and apologise only for being made to.

This keeps being said. It sounds nice, but it's not really accurate.

First off, to be completely clear, the correct thing for Maltiez to do was nothing. Do not to attempt to engage in vigilante justice. He did it anyway, and it worked, before spiraling into this clusterfuck several months later. A useful lesson in why this was a bad idea, because even the "success" turned disastrous because of an entirely unsurprising human error.

However, given that Maltiez was foolishly committed to taking down this cheat mod, trying to create a separate mod specifically for that purpose would not have worked. Maltiez's solution was effective only because it was secret and well hidden in very popular mods. A server mod which openly claims to target this cheat mod would have been quickly identified and trivially circumvented by the cheat mod author. 

Likewise, a detection method more precise than checking how much code was obfuscated wasn't technically possible either: It's really difficult to programmatically determine what this cheat mod was doing in blocks of obfuscated code, doubly so because the cheat mod author was perfectly willing and able to make adjustments whenever someone did figure out how to target it. 

This is the environment we live in. As nice as it would be to claim there was a better way to achieve the same ends, there really wasn't. The same openness and modability that contributes to Vintage Story's success also makes it incredibly difficult to combat undesirable mods through purely technical means. There's a reason Anego didn't do anything more involved than ban the mod maker and ask them to stop. The next plausible step for them to consider was probably legal action, which is risky enough that it may not have been worth it. 

So was Maltiez wrong to do this? Absolutely. Could they have accomplished the same thing through less underhanded means? No, probably not. 

[Teh Pizza Lady]

4 hours ago, tiggerbiggo said:

Said malicious code was designed to obfuscate itself. The 2 are one and the same. The code itself creates its own information vacuum by default, forcing speech to provide accurate information.

False. It was very easy to find it and figure out what it did once people knew it was there. Maltiez did not try to obfuscate his code. That is a programming term that means to scramble variable names and properties within the code so that anyone who decompiles it will have a very difficult time understanding what the code does. That is what obfuscating code means. The code was not that. It just wasn't in the public repo. It is no more obfuscated than the code that runs Seasoned Firewood Redux, Injury Expanded, Inventory Transfer or Antique Tuning Cylinders, just to name a few mods that don't even HAVE public repos. Are you going to say those devs are obfuscating their code and thus incorporating malware into them? Because that's what you're implying here and it's provably wrong by the four examples I just gave you.

2 hours ago, Michaloid said:

In my personal opinion I think that if you don't trust anego anymore due to this scandal, then refunding it is better than screaming to the void and fill space on forums that should be for the game only. I'm sure that if you mention this scandal as the reason for refund they're going to grant you that privilege even after 1000 hours i'm sure.
All that's been said has been said, and i don't think there's nothing new to add aside from repeating the same thing over and over and over. I don't think they are going to address this situation anymore but don't take my word for it. Imo, if anything they're probably waiting for Maltiez contract to end and then plan from there.

That being said, i'm sure that both sides are tired of this discussion and are ready to move on to the next thing in life, weather be not looking at this game any longer or continuing to play the game normally.

Finally a voice of reason... It's a wonder the moderators haven't come down even harder on these forums because we're not in the off-topic section. People talk of censorship, but I think the powers that be have been extremely lenient and only stepping in when things are going too far to an extreme. That said, I wouldn't mind seeing all the dissenters just getting their refunds and having the door smack them on their way out. All the negativity does is breed more negativity and in my opinion, these forums are no place for it. If people want to have a healthy discussion about the topic @icesharkk created a thread for that. All these other noisy threads filled with negativity that keep popping up just need to go. Closed, locked, hidden from sight, whatever, just gone.

But maybe I'm just salty because all this talk about he said-she said blah blah blah has drowned out my thread about the uses of flora in the game. You know... ACTUAL game discussion that ACTUALLY belongs in the game discussion forum? Pepperidge Farms remembers.

1 hour ago, MKMoose said:

His role is listed as "Mod API Programmer" on the Discord and on the website, and as "Bug fixing, Mod API" in game credits, and beyond that we don't really know any details

Technically, he's not listed on the Discord any longer since he voluntarily left for "reasons". Clicking his profile shows that he's no longer in the VS Discord. Just wanted to make that small correction.

[MKMoose]

3 minutes ago, Teh Pizza Lady said:

Technically, he's not listed on the Discord any longer since he voluntarily left for "reasons". Clicking his profile shows that he's no longer in the VS Discord. Just wanted to make that small correction.

He's listed as part of the team in #rules-and-info.

Edited Saturday at 04:32 PM by MKMoose

[Diff]

33 minutes ago, Eruannon said:

You say 'saves' I say 'logs', specifically the part where the code intentionally delayed the crash to manipulate logs into listing a false culprit
https://hastebin.com/share/uqeyuhirof.markdown
So unless You have legal assessment by actual lawyer, I'd personally change 'not possible' to 'unlikely' personally, as this situation is fishy AF.

You didn't say saves, I didn't say saves either. Dorf said saves, Dorf was the person I was responding to. No legal assessment needed for the technical question of "Did this thing cause save corruption."

Edited Saturday at 04:36 PM by Diff

[Teh Pizza Lady]

3 minutes ago, MKMoose said:

He's listed as part of the team in #rules-and-info.

What an odd place to tuck that information. I never would have thought to look there. Okay well thanks for clarifying!

[Eruannon]

1 minute ago, Diff said:

You didn't say saves, I didn't say saves either. Dorf said saves, Dorf was the person I was responding to. No legal assessment needed for the technical question of "Did this thing cause save corruption."

Frankly I have to apologise - It seems I have overgeneralized or messed up what 'Not possible' here was aimed at. I understood You as it's not possible to argue for article 5, rather than responding to crash save corruption claim, and answered with that assumption. I guess 'I dun goofed'.

My bad. Once again - sorry for the misunderstanding.

[freelikegnu]

10 hours ago, Teh Pizza Lady said:

yeah, not really a good idea to slander or libel someone who has your payment information which includes mailing address.

EDIT:

NOT that Anego would use this information to pick on individuals indiscriminately or nefariously, but if push came to shove and it hurt the company financially, then they would have grounds to pursue legal action.

Maybe so many folks here are upset is because "someone who has your payment information which includes mailing address." demands reciprocal trust.  If someone on the Anego team is violating that trust, I think it would be rather hard to find much support going forward.  

[Eruannon]

6 minutes ago, Teh Pizza Lady said:

What an odd place to tuck that information. I never would have thought to look there. Okay well thanks for clarifying!

To be fair it seems to be copy of official 'about us' section on the website, https://www.vintagestory.at/aboutus.html/ which is much more reasonable place to show it.

[BlackCDown]

   

19 minutes ago, williams_482 said:

However, given that Maltiez was foolishly committed to taking down this cheat mod, trying to create a separate mod specifically for that purpose would not have worked. Maltiez's solution was effective only because it was secret and well hidden in very popular mods. A server mod which openly claims to target this cheat mod would have been quickly identified and trivially circumvented by the cheat mod author. 

It need not be trivial to bypass, ACs work without needing to be stealthily installed after all. ACs and cheats are two sides of the same coin in function, and just like cheats ACs can use obfuscation to make it harder for cheat devs to figure out how they work, and evidently Maltiez has been taking some lessons from PatchGuard whether he intended to or not. 

Not all ACs are made equal, but anyone who has lurked cheat forums will often see people having difficulty with coming up with bypasses no matter the game. What matters is accountability - you can keep the keys to your safe but you should at least make sure the owner of the house knows you are putting one there. You do not get to enjoy the benefits associated with stealth, but you can still add to the cost of development.

Edited Saturday at 04:49 PM by BlackCDown

[Jack_Black]

31 minutes ago, Teh Pizza Lady said:

False. It was very easy to find it and figure out what it did once people knew it was there. Maltiez did not try to obfuscate his code. That is a programming term that means to scramble variable names and properties within the code so that anyone who decompiles it will have a very difficult time understanding what the code does. That is what obfuscating code means. The code was not that. It just wasn't in the public repo. It is no more obfuscated than the code that runs Seasoned Firewood Redux, Injury Expanded, Inventory Transfer or Antique Tuning Cylinders, just to name a few mods that don't even HAVE public repos. Are you going to say those devs are obfuscating their code and thus incorporating malware into them? Because that's what you're implying here and it's provably wrong by the four examples I just gave you.

Finally a voice of reason... It's a wonder the moderators haven't come down even harder on these forums because we're not in the off-topic section. People talk of censorship, but I think the powers that be have been extremely lenient and only stepping in when things are going too far to an extreme. That said, I wouldn't mind seeing all the dissenters just getting their refunds and having the door smack them on their way out. All the negativity does is breed more negativity and in my opinion, these forums are no place for it. If people want to have a healthy discussion about the topic @icesharkk created a thread for that. All these other noisy threads filled with negativity that keep popping up just need to go. Closed, locked, hidden from sight, whatever, just gone.

But maybe I'm just salty because all this talk about he said-she said blah blah blah has drowned out my thread about the uses of flora in the game. You know... ACTUAL game discussion that ACTUALLY belongs in the game discussion forum? Pepperidge Farms remembers.

Technically, he's not listed on the Discord any longer since he voluntarily left for "reasons". Clicking his profile shows that he's no longer in the VS Discord. Just wanted to make that small correction.

Hey, I'm on a phone, but could you remind me of whether or not it took over half a year of searching to find that it was obfuscating its own crash log?

 

Of course we know it's there now. It took a long time for us to get to that point and what we got in response was a few days of getting called out on it and acting very hostile and unapologetic until it came time to give an apology less than 24 hours later to put out the fire.

 

He hid his code to such an extent it functionally put on a blindfold and a shotgun and had a bad habit of saying "Wildcraft did it lol" in crash logs.