Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[reg8]

4 minutes ago, l33tmaan said:

This is unfortunately what happens when a company stops being transparent and open with its customer base - it invites baseless speculation and fiery hearsay. Of course, Anego should try and cover their asses from any legal liability here, but I just don't understand why they would do so for a guy who constantly talked down to his userbase and was completely unrepentant about all this reputational damage he caused the studio. Maybe he apologized behind closed doors and maybe Tyron actually believed him? For their sake, I hope his code is REALLY good and they announce that they will not be renewing his contract once all this is said and done. 

In practical steps forward, not only should the modDB REQUIRE hash matching for open-source mods, not only should it have a warning posted on closed-source mod pages, not only should all of Maltiez's mods be forked and worked on by the community instead of this limp-wristed 'custodianship account', but there should be an independent third party group of experienced cybersecurity experts who go through and ruthlessly tear mods apart to provide them with a public-use safety rating.
Is this excessive? Yes, of course it is. But this was an excessive breach of trust that necessitates swift, decisive action and I'm simply not seeing that yet.

They are taking their sweet time with all this. And they don't even try to give us a decent timeframe for when another response could be posted. I guess they would rather have players make up their mind about the entire situation in the meantime instead of giving them any reassurance that things may change soon.

[Nossin]

Unfortunately I don't think we, as a community, are going to get any justice out of this. Anego is trying to cover their asses because this is a very legal issue and I'm likely to believe they condone Maltiez's actions in taking down the paid cheaters.

1. Downplay affected victims

2. Call it anticheat instead of malware

3. Put out a bunch of next steps / things there are already doing so they don't have to change

4. Scrub clean the affected mods

5. Sweep it all unde the rug until the outrage dies down

6. Maltiez keeps their job and gets free maintenance on their mods that they did not want to maintain. Also, guess who is going to maintain them on the dev side? Why not make the guy who made it, fix it.

The only thorn in their side is that Maltiez has shown no remorse or issued any apologies. Which makes it hard to move on when the perpetrator is still on team. As much as I want to have faith in Tyron and the team to review Maltiez's code, I will always be reminded every patch going forward that a malware distributor may have slipped something in again.

[l33tmaan]

It's extremely unlikely due to the nature of software development that he could distribute malicious code through vanilla VS itself. It's simply not a possibility unless Tyron misses it when he does two code reviews on Maltiez's code instead of one. But given their lies of omission so far, I totally understand why some people just wouldn't believe that even with evidence to the contrary. Trust is fickle like that, and it's a resource that Anego is spending to maintain Maltiez's position on the team.

[reg8]

13 minutes ago, Nossin said:

Unfortunately I don't think we, as a community, are going to get any justice out of this. Anego is trying to cover their asses because this is a very legal issue and I'm likely to believe they condone Maltiez's actions in taking down the paid cheaters.

1. Downplay affected victims

2. Call it anticheat instead of malware

3. Put out a bunch of next steps / things there are already doing so they don't have to change

4. Scrub clean the affected mods

5. Sweep it all unde the rug until the outrage dies down

6. Maltiez keeps their job and gets free maintenance on their mods that they did not want to maintain. Also, guess who is going to maintain them on the dev side? Why not make the guy who made it, fix it.

The only thorn in their side is that Maltiez has shown no remorse or issued any apologies. Which makes it hard to move on when the perpetrator is still on team. As much as I want to have faith in Tyron and the team to review Maltiez's code, I will always be reminded every patch going forward that a malware distributor may have slipped something in again.

I mean, idk how they plan to just wait this out and survive unscathed. Maltiez has said enough to the point it's indefensible. Only way to maintain any trust is to actually address it head on instead of making their own narratives.

[icesharkk]

7 minutes ago, l33tmaan said:

It's extremely unlikely due to the nature of software development that he could distribute malicious code through vanilla VS itself. It's simply not a possibility unless Tyron misses it when he does two code reviews on Maltiez's code instead of one. But given their lies of omission so far, I totally understand why some people just wouldn't believe that even with evidence to the contrary. Trust is fickle like that, and it's a resource that Anego is spending to maintain Maltiez's position on the team.

this isnt really the issue that has people upset with tyrons response. Its that this risk is unnecessary and choosing to continue risking it is at the expense of the community trust they claim to want to build. stacked on top of lying about hte nature of the code, lying about the impacted users, and applying consequences that are just how they were going to do business regardless. even the PR training isn't for our benefit. its to teach his people to keep their mouths shut so he doesnt have to clean up after skelsta or T.read again.

[l33tmaan]

A cynical perspective. I agree!

[Thorfinn]

"Looks like I picked the wrong week to stop sniffing glue."

Probably to no one's surprise, I'm approximately in Camp @Vratislav. I say "approximately" because I think not only is it inconsequential (in the grand scheme of things), it is actually healthy for the community. The Venn diagram of the people who were "harmed" and those who fall for a blatant phishing email has a lot of overlap. One should always exercise caution adding DLLs to one's system.

"Always... No. Never.... forget to check your references."

I think an anti-cheat is good, but it's a little early to put the effort into adding it to vanilla. Like @Diff (and likely others) pointed out, doing this sub-rosa on a major mod was likely the only way it could be done at all. If the guy who wrote the cheat mod had read the wiki, or were remotely good at debugging, he'd have been able to narrow down the problem in, what, log2(number of mods) tries. Suggests a script kiddie to me. Likely just got the addresses out of something like GameCheatEngine or similar and grafted in some library's GUI.

Based on absolutely nothing at all, I'd guess the reason it went forward and is evidently not cause for pearl-clutching at Anego was just that it seemed like a good way to test out one potential manner of addressing cheating in future vanilla.

[EDIT]

Incidentally, I think the best thing going forward is not to dump everything in Anego's lap, but rather for members of the community who have the skills review the source and compile it to see if the DLL matches. Anego need do nothing more than add a field in ModDB for reviewers. @Diff would be a pretty good indicator it's safe. @M4dH4xx0r, not so much.

Edited Sunday at 06:50 PM by Thorfinn

[Teh Pizza Lady]

7 minutes ago, Thorfinn said:

"Looks like I picked the wrong week to stop sniffing glue."

Probably to no one's surprise, I'm approximately in Camp @Vratislav. I say "approximately" because I think not only is it inconsequential (in the grand scheme of things), it is actually healthy for the community. The Venn diagram of the people who were "harmed" and those who fall for a blatant phishing email has a lot of overlap. One should always exercise caution adding DLLs to one's system.

"Always... No. Never.... forget to check your references."

I think an anti-cheat is good, but it's a little early to put the effort into adding it to vanilla. Like @Diff (and likely others) pointed out, doing this sub-rosa on a major mod was likely the only way it could be done at all. If the guy who wrote the cheat mod had read the wiki, or were remotely good at debugging, he'd have been able to narrow down the problem in, what, log2(number of mods) tries. Suggests a script kiddie to me. Likely just got the addresses out of something like GameCheatEngine or similar and grafted in some library's GUI.

Based on absolutely nothing at all, I'd guess the reason it went forward and is evidently not cause for pearl-clutching at Anego was just that it seemed like a good way to test out one potential manner of addressing cheating in future vanilla.

get out of my head get out of my head get out of my head get out of my head

You're saying what's niggling at the back of my mind... get out of my head.

[LadyWYT]

16 minutes ago, Thorfinn said:

Incidentally, I think the best thing going forward is not to dump everything in Anego's lap, but rather for members of the community who have the skills review the source and compile it to see if the DLL matches.

That's pretty much what I was wondering out loud about earlier. It's really easy to point fingers at Anego and say it's all their fault and they should have handled X in Z fashion instead of Y. But just thinking back on my own experience with troubleshooting...there's been many times where I've crashed the game and had to go figure out what was causing said crash, because the crash log isn't always the most useful thing. I remove the offending mod and then happily go back to whatever I was doing, never giving it a second thought or bothering to go dig through the mod's code to see what the problem could be, question why it would be a problem, or otherwise report the problem to the mod author so it can be fixed. Because I mean...why would I? It takes time to do that, and technically it's not my problem to fix(aside from removing the defective mod from my mod list). On the other hand, if problems were reported more diligently, they could be fixed faster. Taking a few minutes of time to look at the mod's code itself could add more information to those bug reports, or allow discovery of potentially questionable code much sooner than just brushing it off. And of course, if the mod author is ignoring the bug reports and genuine concerns, that would be a pretty good reason to consider using the report feature on the modDB or otherwise sending a moderator a polite DM with your concerns.

[Thorfinn]

Yeah, I don't bother much with it. As with open source, I generally scan it quickly to make sure there's nothing crude like a buffer overflow, and, occasionally, check to make sure some overly complex pointer is going to something reasonable, then compile. If it doesn't match, I assume it means I don't have some include or other, and go on my merry way.

I don't use ConfigLib, so would not have encountered this particular thing, but I'm pretty confident that, like @Diff, my compile would not have matched. If there were a field for it, I'd have noted it, with the proviso that it might be a nothing burger like missing a library.

[icesharkk]

40 minutes ago, Thorfinn said:

Probably to no one's surprise, I'm approximately in Camp @Vratislav. I say "approximately" because I think not only is it inconsequential (in the grand scheme of things), it is actually healthy for the community. The Venn diagram of the people who were "harmed" and those who fall for a blatant phishing email has a lot of overlap. One should always exercise caution adding DLLs to one's system.

this is simply not true and dismissive of the situation. one of the most trusted mod authors on the site using one of the most popular mods on the site did harm for personal purpose and gain. that isnt the first person you would distrust and want to verify the code of. and even if you did verify all of the mods before adding them to your game Maltiez omitted the code from his github to conceal his actions. it is one thing to say that you should not trust mods from disreputable sources. Its another thing entirely to say that you should decompile and reverse engineer every piece of code that you install, and its completely unacceptable to expect the userbase to simply accept the tepid response from Anego that doesnt even address or improve the supply chain problem that maltiez exploited to put the malicious code in after the public repo was clean that detonated the trust teh community had in the process..

Your argument dismisses the problem and shuffles all of the blame onto the consumer instead of the bad actor and apathetic and now disingenuous studio. for the record i dont actually think Anego should have had to review all mod code to prevent this. But i do think the pipeline for mods could have some easy atestation and hash checking built in to protect the consumer. and its obvious now that is a vulnerability of this moddb implementation.
 

2 minutes ago, Thorfinn said:

Yeah, I don't bother much with it. As with open source, I generally scan it quickly to make sure there's nothing crude like a buffer overflow, and, occasionally, check to make sure some overly complex pointer is going to something reasonable, then compile. If it doesn't match, I assume it means I don't have some include or other, and go on my merry way.

I don't use ConfigLib, so would not have encountered this particular thing, but I'm pretty confident that, like @Diff, my compile would not have matched. If there were a field for it, I'd have noted it, with the proviso that it might be a nothing burger like missing a library.

and of course since this wouldn't have affected you all of the transgressions committed should be dismissed.

[Temeriki]

6 hours ago, MKMoose said:

I have no idea where this comes from, as I haven't personally seen any evidence of it hiding or altering any logs in spite of seemingly quite a lot of people claiming that it did. It randomly modifies some part of the game to cause it to work incorrectly or crash instead of directly causing a crash by itself, which means that it avoids taking the blame in the stack trace, but it doesn't obscure the cause for the crash further beyond this.

So your saying it doesnt alter logs, it only alters the game as its crashing to make something else take the blame.  Id call that altering the logs since its actively doing things to make them spout nonsense.  

[Jhoryn]

1 hour ago, Thorfinn said:

Incidentally, I think the best thing going forward is not to dump everything in Anego's lap, but rather for members of the community who have the skills review the source and compile it to see if the DLL matches. Anego need do nothing more than add a field in ModDB for reviewers. @Diff would be a pretty good indicator it's safe. @M4dH4xx0r, not so much.

I like this idea - like a committee of knowledgeable community members who can add their checkmark or something to the mod, like a verification kind of system, to say 'hey this has been checked and seems legit to us to do what it says it does' . But, this would could be a great deal of work, so not sure how feasible this would be?

Wish I could help, but I only know enough to edit existing mods to get them to do little additional things, (Or break them...lol).

[icesharkk]

7 minutes ago, Temeriki said:

So your saying it doesnt alter logs, it only alters the game as its crashing to make something else take the blame.  Id call that altering the logs since its actively doing things to make them spout nonsense.  

about half of the arguments the last 36 hours are sacrificing overall clarity to instead pursue detail specificity.

To me the hair splitting has begun to feel pedantic but i understand that for the people who think this is no big deal they want to minimize the severity of the language used. And some people are genuinely trying to hell make sure clear correct terms are being used. However, in the case you're replying to, that is just rejection of the reality to split hairs on a lower level technicality that doesnt change the overall truth.

[williams_482]

3 hours ago, icesharkk said:

collateral damage is unknown but presumed significantly higher than cheater impact. 

Presumed by who, on what evidence?

[Bruno Willis]

1 hour ago, Thorfinn said:

Incidentally, I think the best thing going forward is not to dump everything in Anego's lap, but rather for members of the community who have the skills review the source and compile it to see if the DLL matches. Anego need do nothing more than add a field in ModDB for reviewers. @Diff would be a pretty good indicator it's safe. @M4dH4xx0r, not so much.

I think this is a really good take. I feel like VS has a player base with higher than average initiative and practical skill (as a VS player myself) so we could look at this drama as an opportunity to figure out what we can each do with our particular skills to improve things, and then do that. 

 

[williams_482]

Here's what's happening, over and over again in cycles:

- Person #1 comes in here with an angry take about Maltiez that is based on misunderstanding a technical term, or simply factually incorrect information.

- Some people in what we'll call group #2 respond to them, clarifying the misunderstanding or correcting the incorrect information.

- Some other people in group #3 accuse the people in group #2 of making pointless pedantic arguments in Maltiez's favor. 

Most members of group #3 are well aware of the facts of the case, and have come to an informed judgement that they feel Maltiez should be fired. That's totally legitimate! This is a highly subjective thing and we can all agree on the facts and come to different conclusions, and there's plenty of argumentitive ground to be worked over that doesn't contest established facts. 

Person #1 does does not have all the facts! If they're going to come to an informed judgement themselves, they need to have those facts! It seems to me (from my inevitably biased perspective) that group #3 disagrees with this position, purely on the ground that person #1 already agrees with group #3, and they feel the important thing is not person #1 making an informed judgement, but person #1 continuing to agree with group #3. 

This is a complicated, technical issue and the facts are relevant. There is also a large subjective component and plenty of people are going to disagree on those grounds. Can we stick to informing people of those facts and arguing about the subjective aspects here?

[Teh Pizza Lady]

39 minutes ago, icesharkk said:

about half of the arguments the last 36 hours are sacrificing overall clarity to instead pursue detail specificity.

To me the hair splitting has begun to feel pedantic but i understand that for the people who think this is no big deal they want to minimize the severity of the language used. And some people are genuinely trying to hell make sure clear correct terms are being used. However, in the case you're replying to, that is just rejection of the reality to split hairs on a lower level technicality that doesnt change the overall truth.

But there is a huge difference between altering logs that are already written and crashing the game in a way that doesn't point the finger at ConfigLib. That's a distinction worth noting because ConfigLib did NOT write to your filesystem. It made zero changes to the system beyond forcibly crashing the client if it detected code what was within parameters for being deemed "suspicious".

[greed23]

4 hours ago, Spear and Fang said:

Having been in and around conversations with Maltiez frequently, I would describe him as relatively emotionless, admittedly having zero sense of humor, and always straight to the point (which was often borderline offensive, especially to those who were unfamiliar with his personality).  Add to this his acknowledgement of using ai at times to work though some difficult hurdles. So yeah, he rubbed a lot of people the wrong way.  

I'd be curious to see a venn diagram of the Maltiez is a jerk crowd, the anti-AI crowd, and the fire Maltiez crowd.

Doesn't help that he called everyone who was against AI being on the db "idiots" and that they make him "want to learn it to use it more"

I'm sure there's a lot of overlap, but its kind of self inflicted since he just doesn't know how not to be an ass to people lol.

[IAmMoss]

5 hours ago, icesharkk said:

they will pick your weakest argument, defeat it with rhetoric or hair splitting and then declare that you reasoning is flawed.

i've seen you do the same thing to those that are defending specifically anego in ANY capacity in this situation... every time someone counters your reasoning, you either do the same thing, or just drop the argument. Which by the way people read things, shows you cant defend your position past your initial reasonings. Disregarding the few that specifically defend maltiez, most just have a differing opinion than you on how things actually are.

You see tyron's response as a defense of maltiez' actions. I see it as a statement to explain to the community exactly what happened, why it happened, and that things are as of now, safe. This is typical formatting for an initial statement on a situation like this.

if you take the time and read the statement without bias, it reads fairly neutral. which is normal.

[IAmMoss]

5 hours ago, icesharkk said:

hundreds to thousands of man hours have been spent chasing these ghost crashes prior to that

i don't think this is even quantifiable given when these problems started, and when it was discovered. Not knocking cave n caverns devs work in discovering this, i think you are over inflating the time spent.

[craigmg]

7 hours ago, icesharkk said:

the cheat could be countered with server rollback and standard moderation procedure but the collateral damage could not be. the crashcodes could not troubleshot successfully until caves and caverns discovered the malicious code and many hundreds to thousands of man hours have been spent chasing these ghost crashes prior to that. I am hesitant to say the collateral damage is presumed minor. collateral damage is unknown but presumed significantly higher than cheater impact. 

people keep willfully ignoring the wasted time spent troubleshooting and chasing the crashcodes.

rollbacks? You aren't rolling back an entire server if 2 to 3 people lose their stuff due to a cheater.

[icesharkk]

3 hours ago, Teh Pizza Lady said:

But there is a huge difference between altering logs that are already written and crashing the game in a way that doesn't point the finger at ConfigLib. That's a distinction worth noting because ConfigLib did NOT write to your filesystem. It made zero changes to the system beyond forcibly crashing the client if it detected code what was within parameters for being deemed "suspicious".

it is true that the malicious code did not write to the filesystem. whether it wrote to the filesystem or no it engineered an outcome that ensured attribution of the crash to its code would be difficult to achieve as a result of the evasive action it took. whether it wrote to the filesystem or not it still disrupted the availability of the application it had no authorization or responsibility impacting. The harm it caused is not mitigated by whether it touched the filesystem or not. if it had written to the filesystem it might have been "worse" but so too it might have also stolen credit cards, which it didnt so that line of reasoning isnt really fruitful. 

call it concealment, call it evasiveness, call it obfuscation, call it a logic bomb. I see how each of can apply to what maltiez did.

[icesharkk]

2 hours ago, IAmMoss said:

i've seen you do the same thing to those that are defending specifically anego in ANY capacity in this situation... every time someone counters your reasoning, you either do the same thing, or just drop the argument. Which by the way people read things, shows you cant defend your position past your initial reasonings. Disregarding the few that specifically defend maltiez, most just have a differing opinion than you on how things actually are.

You see tyron's response as a defense of maltiez' actions. I see it as a statement to explain to the community exactly what happened, why it happened, and that things are as of now, safe. This is typical formatting for an initial statement on a situation like this.

if you take the time and read the statement without bias, it reads fairly neutral. which is normal.

Perhaps. I am hardly perfect and it has been a long few days.

I cannot simply read something without bias and to insinuate that i haven't taken the time to read it as neutrally as possible is a bit obnoxious. just because i do not agree with you does not me that my conclusion is as a result of bias. We do not agree on Tyron's response. 

[icesharkk]

4 hours ago, williams_482 said:

Presumed by who, on what evidence?

2 hours ago, IAmMoss said:

i don't think this is even quantifiable given when these problems started, and when it was discovered. Not knocking cave n caverns devs work in discovering this, i think you are over inflating the time spent.

Presumed by myself and several others discussing it. Conspicuously and conveniently absent from accountability by Tyron. on a rough order of magnitude comparison between the official statement number of cheaters and the total number of potential impacts between the two mods we know of at this time. and frankly I place significantly more weight behind the harm/impact done to the innocent users than the cheaters.