Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[BlackCDown]

22 hours ago, Teh Pizza Lady said:

Seems like some sort of screamo heavy metal lyrics for sure.

 

22 hours ago, Cetasaya said:

its fantastic

would totally mosh pit with the bros to shit this fire 

.The original post that the thread title and the post were adapted from is a very vitriolic one targeting minorities FYI

[williams_482]

2 minutes ago, BlackCDown said:

It need not be trivial to bypass, ACs work without needing to be stealthily installed after all. ACs and cheats are two sides of the same coin in function, and just like cheats ACs can use obfuscation to make it harder for cheat devs to figure out how they work, and evidently Maltiez has been taking some lessons from PatchGuard whether he intended to or not. 

Yes, but engaging in a back and forth "I block you, you circumvent me, repeat" battle with a modder who is making money off their cheat mod doesn't really accomplish anything. It's just a commitment to spend unending unpaid hours to make sure that the cheat mod *sometimes* doesn't work. Simply obfuscating code is a pretty minor roadblock for a human committed to figuring out how it works (AI tools make this even easier), but it does make it almost impossible for a conventional program to differentiate between legitimate and illegitimate mod code. 

Maltiez's crash code did, for a time, completely shut that mod down. The mod author didn't know what the problem was, where it came from, or how to solve it because they didn't know where to look (If this had been a dedicated anti-cheat mod, it would be the obvious place to start) and the crash code very deliberately pointed them in misleading directions. Evidently they spent enough time trying and failing to diagnose the problem that they gave up, which is exactly what Maltiez was going for. 

[BlackCDown]

Just now, williams_482 said:

Yes, but engaging in a back and forth "I block you, you circumvent me, repeat" battle with a modder who is making money off their cheat mod doesn't really accomplish anything. It's just a commitment to spend unending unpaid hours to make sure that the cheat mod *sometimes* doesn't work. Simply obfuscating code is a pretty minor roadblock for a human committed to figuring out how it works (AI tools make this even easier), but it does make it almost impossible for a conventional program to differentiate between legitimate and illegitimate mod code. 

Maltiez's crash code did, for a time, completely shut that mod down. The mod author didn't know what the problem was, where it came from, or how to solve it because they didn't know where to look (If this had been a dedicated anti-cheat mod, it would be the obvious place to start) and the crash code very deliberately pointed them in misleading directions. Evidently they spent enough time trying and failing to diagnose the problem that they gave up, which is exactly what Maltiez was going for. 

Aye, true and fair enough. Plus we were all on the same page about where we stand on this morally either way.

[Diff]

13 minutes ago, BlackCDown said:

.The original post that the thread title and the post were adapted from is a very vitriolic one targeting minorities FYI

Wow that's substantially worse than I was expecting when I went looking.

[Teh Pizza Lady]

19 minutes ago, freelikegnu said:

Maybe so many folks here are upset is because "someone who has your payment information which includes mailing address." demands reciprocal trust.  If someone on the Anego team is violating that trust, I think it would be rather hard to find much support going forward.  

That's a fair point, and I don't disagree that there's some trust relationship at play here. But it's worth being precise about the mechanics, because I don't think it's as direct as "Anego holds your payment info."

Anego doesn't actually hold your card/payment data themselves, that sits with their payment processor or bank, same as basically every online storefront. And it's worth being precise about that since my earlier comment is now coming under fire. Anego wouldn't have your card number just sitting in a database somewhere. What they'd have is transaction records tied to your account (name, order history, maybe a billing address if one was entered at checkout, I don't remember because I didn't actually buy the game; it was gifted to me). If someone wanted to actually pursue legal action and needed to identify a person behind a username, that's a subpoena to the payment processor, not something Anego could hand over directly even if they wanted to.

And separately, that trust relationship, whatever its shape, is with Anego as a company, not with any individual dev. Maltiez doesn't have any special access to billing/payment records any more than any other non-billing team member would. So "he violated trust, and Anego holds my payment info" doesn't really chain together unless the claim is that Anego's handling of him is itself evidence they're bad custodians of financial data generally, which is a much bigger claim than "I don't like that they kept this guy on." My initial point wasn't even in regards to whether they could be trusted with that information, and instead it was more to the point that if this type of discourse continues to say untrue things about the company and it hurts their financial bottom line, then they have every right to pursue legal action and we, the players, aren't as anonymous as we think we are.

Worth being precise on the technical side too, since I've got firsthand experience here: I've submitted pull requests to the actual game codebase and had a chunk of it rejected for not meeting their standards, had to rewrite it, eventually got a fix in for a bug that had gone unresolved through 5+ reports. Their review process for anything touching vanilla is genuinely rigorous, multiple sets of eyes, scrutiny on even how something's written, not just whether it works.

That's the important distinction with ConfigLib though: AdditionalStuff.cs was never subject to any of that. It was Maltiez's own independently-published mod on ModDB, completely outside Anego's review pipeline. The process didn't fail to catch it, it was never in scope to catch it, since that pipeline never touches third-party ModDB uploads. So the real risk question isn't "will review miss it next time," it's "does Maltiez have another unreviewed channel to end users right now," and from what's been laid out (no commit access, no ModDB presence anymore, everything funnels through the same review as anyone else), that specific channel looks closed. End of story.

None of this settles whether he should have been kept on, that's a separate question people are still arguing ad nauseam. I just don't think the payment-info angle adds much weight to it, since that particular trust relationship doesn't actually run through him and never will.

5 minutes ago, Jack_Black said:

Hey, I'm on a phone, but could you remind me of whether or not it took over half a year of searching to find that it was obfuscating its own crash log?

Again, the term "obfuscating." People really like to use words they don't actually know the definition of, and "obfuscating a crash log" doesn't even make sense in technical terms. What Maltiez did was force the crash logs to not name ConfigLib as the source of the problem, so the cheat mod dev would have a harder time figuring out why his mod suddenly stopped working. As already pointed out, the fact that he didn't disclose what he was doing is exactly why it worked, and that cheat mod in particular seems to be one Anego and a lot of affected server owners had a real grudge against, given how hard it apparently was to deal with until Maltiez decided to take matters into his own hands.

But that's beside the point I'm actually making. Hiding something and misdirecting attention away from it isn't the same thing as obfuscating it, obfuscation is a specific technical term with a specific technical meaning, and it doesn't describe what happened here. There's already way too much telephone happening with the known facts of this incident. If people are going to keep discussing it, it's worth actually being precise about what did and didn't happen.

[Dark Thoughts]

On 9/3/2026 at 11:41 PM, Cicadas said:

I am disappointed but not surprised.

After some very nasty interactions with some of the mods here on the forums & moddb, that make me even scared to freely & bluntly express myself here out of fear of repercussions, I unfortunately share exactly this sentiment. It's one (albeit not the only one) of the reasons why I also haven't played VS much since those incidents, and also left the forums behind for the most part as well. It just leaves a bitter taste whenever I even think of the game, even though I enjoy the game itself so much. And frankly speaking, this incident, or much rather the official response to it, adds massively to that. I've even seen other reports from incidents (including on TOPS) that even go all the way up to Tyron, who also gave a very lackluster and downright understated account of what happened, as it certainly did not only affect cheaters but also some who used legitimate moddb mods.

That's likely all I'll have to say about this, because, again, I am even scared that this comment alone is enough to hand me a ban. But as someone who paid for VS and felt passionately about it, I still felt the need to at least get 'something' out to be said about it.

[Dark Thoughts]

How does one block user's with private profiles? The mouseover just shows:

Quote

There was a problem loading this content.

 

[MKMoose]

41 minutes ago, Teh Pizza Lady said:

Again, the term "obfuscating." People really like to use words they don't actually know the definition of, and "obfuscating a crash log" doesn't even make sense in technical terms.

To be fair, once we're talking about logs and not code, then a broader definition of obfuscating might be considered reasonable - something like "to deliberately make more confusing in order to conceal the truth." Granted, using it in this specific context could still equally be considered misleading or otherwise inappropriate, so a lot of it is just a matter of agreeing upon definitions (and good luck agreeing on definitions with all current and future participants in the conversation).

 

16 minutes ago, Dark Thoughts said:

That's likely all I'll have to say about this, because, again, I am even scared that this comment alone is enough to hand me a ban.

As much as I can understand some concerns, we've seen so much worse on the Forums, not to mention Discord and Reddit. Do you really think that a reasonably level-headed, careful expression of what is clearly your own opinion, with not a trace of insults towards other members and no bad-mouthing Anego, posted under the apporpriate topic, would be reason enough for a ban? I think it's very fair to say that, after the mess that was the recent couple days for which a couple moderators have received a lot of flack, they are bound to be extra careful with the ban hammer.

Edited Saturday at 06:06 PM by MKMoose

[Teh Pizza Lady]

14 minutes ago, Dark Thoughts said:

I am even scared that this comment alone is enough to hand me a ban.

this comment should be fine. It's when the comments delve into personal attacks, hate speech, and other things that actually break the rules of the forums that the moderators are forced to take action. Some users seem more inclined to do that than others, but this comment is fine.

[Teh Pizza Lady]

5 minutes ago, MKMoose said:

a lot of it is just a matter of agreeing upon definitions (and good luck agreeing on definitions with all current and future participants in the conversation).

isn't that what dictionaries are for? I agree in a non-technical sense, your linked definition holds up but once technical things start getting thrown into the mix, definitions change drastically. Remember a theory is just a theory until it becomes scientific.

[icesharkk]

8 minutes ago, Teh Pizza Lady said:

isn't that what dictionaries are for? I agree in a non-technical sense, your linked definition holds up but once technical things start getting thrown into the mix, definitions change drastically. Remember a theory is just a theory until it becomes scientific.

you would think so. I would have agreed with you but I'd say half of my messages on here and reddit are arguing with people who wont read the Wikipedia or webster's definition of malware because it doesn't support their narrative. Webster's is the best btw "software designed to interfere with a computer's normal functioning" 

Edited Saturday at 06:21 PM by icesharkk

[icesharkk]

1 hour ago, williams_482 said:

Yes, but engaging in a back and forth "I block you, you circumvent me, repeat" battle with a modder who is making money off their cheat mod doesn't really accomplish anything. It's just a commitment to spend unending unpaid hours to make sure that the cheat mod *sometimes* doesn't work. Simply obfuscating code is a pretty minor roadblock for a human committed to figuring out how it works (AI tools make this even easier), but it does make it almost impossible for a conventional program to differentiate between legitimate and illegitimate mod code. 

Maltiez's crash code did, for a time, completely shut that mod down. The mod author didn't know what the problem was, where it came from, or how to solve it because they didn't know where to look (If this had been a dedicated anti-cheat mod, it would be the obvious place to start) and the crash code very deliberately pointed them in misleading directions. Evidently they spent enough time trying and failing to diagnose the problem that they gave up, which is exactly what Maltiez was going for. 

and this technique can never work again. since all the modder has to do is play spot the difference between the github and moddb release. or do the literal basic server modd list troubleshooting to find the incompatibility. This was an incredibly fragile approach to anti cheat and entirely circumventable once discovered.

Furthermore the idea that this anti cheat is why the cheat author ceased operations is and unfounded assumption to being with. VS isnt a large enough userbase to make a ton of profit on cheats with so its equally possible the cheat author left in favor of a community with more members to sell to. perhaps influenced by the crashing or perhaps irrespective of the crashing. its not like he cares if who he sells too crashes after they purchase. I doubt the customer support on paid cheats in tiny communities is stellar.

Edited Saturday at 06:28 PM by icesharkk

[williams_482]

1 minute ago, icesharkk said:

and this technique can never work again. since all the modder has to do is play spot the difference between the github and moddb release. This was an incredibly fragile approach to anti cheat and entirely circumventable once discovered.

Furthermore the idea that this anti cheat is why the cheat author ceased operations is and unfounded assumption to being with. VS isnt a large enough userbase to make a ton of profit on cheats with so its equally possible the cheat author left in favor of a community with more members to sell to. perhaps influenced by the crashing or perhaps irrespective of the crashing. its not like he cares if who he sells too crashes after they purchase. I doubt the customer support on paid cheats in tiny communities is stellar.

All of this is true.

It was a bad plan! Because I can understand the motives and it *almost* worked out I may come across as defending it, but I am not. I wouldn't have recommended it, and I certainly wouldn't encourage anyone to try it again. 

[KekkusMaximus]

1 hour ago, williams_482 said:

Yes, but engaging in a back and forth "I block you, you circumvent me, repeat" battle with a modder who is making money off their cheat mod doesn't really accomplish anything. It's just a commitment to spend unending unpaid hours to make sure that the cheat mod *sometimes* doesn't work. Simply obfuscating code is a pretty minor roadblock for a human committed to figuring out how it works (AI tools make this even easier), but it does make it almost impossible for a conventional program to differentiate between legitimate and illegitimate mod code. 

Maltiez's crash code did, for a time, completely shut that mod down. The mod author didn't know what the problem was, where it came from, or how to solve it because they didn't know where to look (If this had been a dedicated anti-cheat mod, it would be the obvious place to start) and the crash code very deliberately pointed them in misleading directions. Evidently they spent enough time trying and failing to diagnose the problem that they gave up, which is exactly what Maltiez was going for. 

Another thing that is necessary to understand

The code that Maltiez used to supposedly mess with cheaters is written to work client side, not server side.
If you make a standalone client-side anticheat mod that says "crashes your game if you cheat", guess who is not going to install it? That's right, cheaters.

It's still fucked up and it should have never been done in the first place, but the method is coherent with what an anticheat does to make itself hard to detect and avoid by cheaters.

Edited Saturday at 06:39 PM by KekkusMaximus

[icesharkk]

26 minutes ago, KekkusMaximus said:

Another thing that is necessary to understand

The code that Maltiez used to supposedly mess with cheaters is written to work client side, not server side.
If you make a standalone client-side anticheat mod that says "crashes your game if you cheat", guess who is not going to install it? That's right, cheaters.

It's still fucked up and it should have never been done in the first place, but the method is coherent with what an anticheat does to make itself hard to detect and avoid by cheaters.

this is why actual anticheat is made a required install by the core game. You know, in normal legal business practices.

I really dont see much value in trying to point out that they way he went about it "makes sense" "from a certain perspective" because its ignoring that premise is flawed. This was NOT the only way to combat cheaters. Allegedly Anego already declined to include the anti cheat in their game. it was the only way left for maltiez to combat cheaters on his own personal crusade. Per his own words this was not about protecting servers it was about attacking the cheat developer.

[Diff]

1 hour ago, Dark Thoughts said:

How does one block user's with private profiles? The mouseover just shows:

It is here:

[Karidwen]

18 hours ago, Mushroomancer said:

The main issue, from what I can tell, is that it is currently somewhat hard to know the exact scope of collateral damage because elements of the community escalated from zero-to-eleven immediately. There's a lot of misinformation and vague information floating around, and while I can sympathize with discord managers wanting to contain things so that the discussion didn't spiral into panic and misinformation, that was already too late by the time they started cracking down on people not obeying the posting rules overzealously.

What we do know is what the code did and didn't do. It targeted a particular paid mod that was used for griefing and disruption of servers (not necessarily of the server's activity, but economic and balance disruption?). The way it detected the activation of this mod, unfortunately, was by detecting obfuscated code above a certain percentage and so when a server itself had other mods with obfuscated code activated, it caught these 'bystanders' as collateral. It did not target the servers themselves, but functionally simulated a modding incompatibility and triggered irregularly timed client-side crashes. It would then redirect any crash logging to other mods and mask config.lib's involvement by pretending the 'incompatibility' was somewhere else.

I'm not exactly clear on if mods by Maltiez OTHER than config.lib were smuggling the killcode? I've heard that said multiple times but it's also kind of vaporous? I figured config.lib's means of interacting with other mods already is why it was ideal for smuggling the killcode.Similarly it seems like a lot of people have taken to throwing massive numbers out of 'victims', despite the code having no means of actually tracking those affected. It's pretty likely even Anego's numbers are tied to projections based on manually reported crash logs that fit the suspect criteria? Though I'm not a hundred percent sure that's the case. I'm not sure THEY have accurate numbers and I do think it was somewhat irresponsible for them to say 'Only a hundred cheaters' were affected. There have been claims that the mod destroyed saves, but saves are server side and the mod only activates on multiplayer instances, it could not cause a crash and poorly timed corruption of save data for a client because it did not trigger in singleplayer. There are repeated statements that Anego 'knew all along, or at least since february and tacitly supported Maltiez', but this seems to be from a miscommunication in the early panic of the outrage when a dev claimed that Maltiez had told them SOMETHING, but it became apparent they didn't have the full scope of the situation at the time.

Additionally there is constant chatter of legal liability and criminality but it's hard to say how seriously something like this would be taken in a court in the EU. There's a good chance it was criminal, but so is double-parking. It's very likely due to the limited scope and immaterial damage beyond frustration and time wasted that it would ever see the light of day, but people's lives have been ruined over pettier things, especially in courts that don't understand technology.

Anego has steered a clean ship for a decade now, and even if this is rough seas and they choose to power through, I don't see a material reality where this sinks it. I think they'll do fine and keep things going the right way, even if not always perfectly. If it's too much for you, however, take a lifeboat. Get your refund, there's a thousand games out there.

Anegos reaction has nothing to do with the scope. 

The actions of their employee/contractor were illegal. Said person has shown he can and will do illegal things driven by own ego. Said person does not deny or regret doing it, in fact, has shown that they will do it again if they feel like it. Such a person should not be in a position where they have access to code of the product. Such a person should not have any trust of the company after this. End of story.

[Diff]

48 minutes ago, icesharkk said:

since all the modder has to do is play spot the difference between the github and moddb release.

Without some sort of complex provenance system this is far easier said than done. There's actually a lot of code that can wind up in a DLL that won't be in a source release, for legitimate reasons. Maltiez's ConfigLib DLL contains a Yaml parser (AdditionalStuff.cs hid itself inside its namespace), but it's not in the source release. Just a dependency. You can also obfuscate or not publish your source.

50 minutes ago, icesharkk said:

Furthermore the idea that this anti cheat is why the cheat author ceased operations is and unfounded assumption to being with. VS isnt a large enough userbase to make a ton of profit on cheats with so its equally possible the cheat author left in favor of a community with more members to sell to. perhaps influenced by the crashing or perhaps irrespective of the crashing. its not like he cares if who he sells too crashes after they purchase. I doubt the customer support on paid cheats in tiny communities is stellar.

We don't know, but someone does. Since we know that this all took place in a Discord server, if it still exists it'd be *really* interesting to see any logs of what went down. I doubt the customer support is stellar, but if you have a Discord server full of people all saying that "It has to be your fault, I disable your mod and all the crashes stop", that'll hamper new sales.

18 minutes ago, icesharkk said:

I really dont see much value in trying to point out that they way he went about it "makes sense" "from a certain perspective" because its ignoring that premise is flawed. This was NOT the only way to combat cheaters. Allegedly Anego already declined to include the anti cheat in their game. it was the only way left for maltiez to combat cheaters on his own personal crusade. Per his own words this was not about protecting servers it was about attacking the cheat developer.

Do want to say that you're 100% correct, the premise is flawed. I'm of the mind that all client-side anticheat is ultimately pointless. You're running in someone else's home, and eventually the house will win.

I have written in the past that Maltiez's approach is the only one that could have worked for any amount of time. But every time I write that, I also (try to) include that it was still a bad idea from the very start. When I talk about how it is the only way that it could have worked, it's specifically to debunk the idea that it could have just been split out into its own mod. The idea's broken, but the suggestion's even more broken. 

[KekkusMaximus]

24 minutes ago, icesharkk said:

I really dont see much value in trying to point out that they way he went about it "makes sense" "from a certain perspective" because its ignoring that premise is flawed

I agree, which is why I said that it is still fucked up and it shouldn't have been done regardless.

Also I agree that it's not the only way to fight cheaters, as I have stated previously I believe the best (and honestly only) way to actually combat cheaters is to build stable communities with good admins that stay on top of things and do multiple backups a day.

[Handbananasplit]

1 hour ago, Teh Pizza Lady said:

isn't that what dictionaries are for? I agree in a non-technical sense, your linked definition holds up but once technical things start getting thrown into the mix, definitions change drastically. Remember a theory is just a theory until it becomes scientific.

Obfuscating is an English word that means "to make hidden". It's not some word that programmers made up. It's used by programmers to describe a specific thing, "Obfuscating Code". Them using it in that specific way does not change the definition of the word.

This mod hid that it was causing crashes and intentionally blamed other mods. That's the argument. Not the definition of obfuscating. But instead of engaging with that fact you are bogging the conversation down with this dictionary junk.

Do you think it was right to blame other mods, potentially causing other mod devs to waste their own time troubleshooting crashes that had nothing to do with them? Do you think it was right for Anego to ignore that in their official response? How do you feel about them completely omitting the fact that the only reason any of us even know this happened was because an ordinary mod dev was wasting their own time troubleshooting crashes caused by ConfigLib's janky unsolicited and undocumented "anti-cheat"?

[scorives]

I think this is a bigger issue than just Maltiez's. The whole ModDB needs some better rules and regulations and more oversight as well. I have uploaded a post last month to the Mod DBforum for the devs in regards to changes I Think should be implemented along with others that are not listed. Here is a link if interested: 

 

 

[Handbananasplit]

On 9/4/2026 at 10:39 AM, TeaJay said:

If anyone destroyed the community it's Maltiez and the VS devs. They have spent years building up goodwill and wrecked it all because of what? In defense of some modder who put malware in the game, lied about it and then was a smug asshole about it. This is a person they chose over the community. I think in some time they will look back on this and realize it was not worth alienating a huge part of the community. 

It's incredibly hard to build trust but very easy to lose it. And even harder to regain it. They had the chance to do a proper response, but they didn't. I'm personally incredibly disappointed since I've played this game for a while, recommended it to a lot of people and now? A lot of people I know are saying they don't feel like playing anymore and I can't disagree with them. 

Maltiez lit VS on fire and for some reason the Dev team is mad at the people shouting please put out this fire instead of the guy that lit the fire.  This is what I don't get about this whole thing. Maltiez is the person who put their project at risk. He unilaterally decided to do this thing, and as a result half the community is questioning their support of the game. Why are they defending him instead of the game? Unless there is something we don't know going on behind the scenes the official reaction makes no sense to me. Is he really such an important part of the team that they have to just take this backlash because they couldn't continue without him?

[Handbananasplit]

54 minutes ago, Diff said:

It is here: *posts informative image*

Nice. Thanks.

[icesharkk]

23 minutes ago, Handbananasplit said:

Obfuscating is an English word that means "to make hidden". It's not some word that programmers made up. It's used by programmers to describe a specific thing, "Obfuscating Code". Them using it in that specific way does not change the definition of the word.

This mod hid that it was causing crashes and intentionally blamed other mods. That's the argument. Not the definition of obfuscating. But instead of engaging with that fact you are bogging the conversation down with this dictionary junk.

Do you think it was right to blame other mods, potentially causing other mod devs to waste their own time troubleshooting crashes that had nothing to do with them? Do you think it was right for Anego to ignore that in their official response? How do you feel about them completely omitting the fact that the only reason any of us even know this happened was because an ordinary mod dev was wasting their own time troubleshooting crashes caused by ConfigLib's janky unsolicited and undocumented "anti-cheat"?

bottom line people arguing over the definition of obfuscation and the definition of malware are just people grasping at straws to minimize the situation. they have no better argument because there is no better argument. malware was introduced to the game. the individual responsible is being retain to continue working on the game. end.

[Handbananasplit]

37 minutes ago, KekkusMaximus said:

Also I agree that it's not the only way to fight cheaters, as I have stated previously I believe the best (and honestly only) way to actually combat cheaters is to build stable communities with good admins that stay on top of things and do multiple backups a day.

This is correct. Unfortunately for all of us this is NOT the best way to personally attack a cheat dev you don't like. Which it seems was maltiez's goal. It seems he did not care about possible collateral damage or the possibility of community backlash. Looks like he wanted to attack this person so he did the best thing he could come up with regardless of the negative results.