Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Teh Pizza Lady]

20 minutes ago, OBAMFSpike said:

I know we are not alone. It's just a stand up and stretch the legs check on the ol inter webs. 

The only thing I'm "salty" about at this point is just the lack of an official statement on the forums.

[LadyWYT]

12 minutes ago, Teh Pizza Lady said:

The only thing I'm "salty" about at this point is just the lack of an official statement on the forums.

I'm disappointed in that too, but I can also understand that it may have fallen to the wayside in the wake of the Reddit/Discord meltdowns. It's definitely not the end of the world, but it's something that I would like to see remedied in the future.

Edited Monday at 04:15 AM by LadyWYT
Grammar

[Cleitus]

49 minutes ago, Teh Pizza Lady said:

The only thing I'm "salty" about at this point is just the lack of an official statement on the forums.

That's how I feel. While I don't agree with all their actions, I would feel a lot better if they would at least make announcements on the forums. It feels like we get ignored, even though I would argue the game's biggest fans are here. 

Edited Monday at 04:51 AM by Cleitus

[greed23]

2 hours ago, LadyWYT said:

Regarding Anego Studios, unfortunately they get stuck in a no-win situation, given that they're going to get blamed for it by association, and there's no option they can pick that won't upset part of the community.

I beg to differ.

I don't think anyone (except the most serious Maltiez fan) is going to be upset if Maltiez is booted and Anego actually acknowledges that the software was malware, apologizes for praising the malware, and acknowledges that it negatively impacted innocent players and servers.  If anything it will please the entire playerbase, because it'll mean something was actually done and now everyone can move on.  As of now, they effectively took the stance of "The malware was very effective and protected servers.  Here's some things that we're saying we're doing to maltiez but doesn't actually impact him any major way."

Most of the anger right now is directed at the completely lackluster response from Anego, and rightly so; There's few faster ways to erode trust than to disregard the concerns of players and actively avoid saying or doing anything that would make them feel seen.  

Edited Monday at 05:29 AM by greed23

[Vratislav]

3 hours ago, OBAMFSpike said:

To hell with cheaters.

It is a valid point that if there were no cheaters, there would be none of this drama.

[Rainbow Fresh]

The saddest part about all of this is that all of this is and was very pointless in the grand scheme of things. Quoting OBAMFSpike "In 2026 IVE GROWN RATHER SICK OF CHEATS" - much like most anything else bad and questionable, it will not end. It never will because there is no way to stop it. Not cheating, not hacking, not piracy or anything similar. It comes and goes a small bit with the goodwill of the people behind it but some can simply never be changed. Maltiez said his little stunt "Fulfilled its purpose" because the cheat distributor in question "gave up on it" (even though the only proof of that I personally saw so far was a screenshot of a Discord message from - supposedly - the cheat creator stating they will "invest less" into the development of the VS cheat to focus on other game's cheats and "not guarantee function on heavily modded games"). But as Maltiez said aswell when lashing out at first about being found out - this "win" was solely built on the fact all this was hidden. It is no longer. And it would eventually have been discovered by someone regardless. If the old cheat developer will not return, a new one will appear. They always do. At best it's an infinite arms race between cheats bypassing anti-cheat and anti-cheats adapting to newer cheats - at worst we get TF2's public matchmaking because the anti-cheat developers gave up. The most thorough, waive all rights, Kernel-level memory scan anti-cheat was still bypassed in a matter of weeks (I remember this being Valorant when it became big.)

So even if we ignore the mishandling on all sides - Maltiez's chosen course of action, Anego's chose course of inaction - at the end this was just a blip in history and tomorrow we go back to normal operations with normal cheaters that get combated by normal means.

[tiggerbiggo]

15 hours ago, l33tmaan said:

It's extremely unlikely due to the nature of software development that he could distribute malicious code through vanilla VS itself. It's simply not a possibility unless Tyron misses it when he does two code reviews on Maltiez's code instead of one. But given their lies of omission so far, I totally understand why some people just wouldn't believe that even with evidence to the contrary. Trust is fickle like that, and it's a resource that Anego is spending to maintain Maltiez's position on the team.

This is a point I disasgree with, just knowing some of the ways that people have managed to sneak code into other open source projects I don't think human review of an untrustworthy actor's code is good enough. If they really wanted to sneak something in, they probably could. All it takes is one slip-up and they miss some updated dependency or hidden behaviour hidden in seemingly legit code.

[Sadi89]

22 hours ago, MKMoose said:

It targets not mods, but type names, to be specific. Apparently the CRC32s that it checks against correspond to "Aimbot", "InstantShot", "KillAura", "MapCursorTeleport", "Nuker", "VintageClient", "BlockFinder" and "Esp", though I'm not certain about the credibility of the source for this information (it was written by an LLM and posted by someone on Discord, and I don't even know what the original source is at this point). The type names need to start with this string, plus there are also additional checks against the length of the type name for "BlockFinder" and "Esp" which need to have at least one additional character after that. If at least three of these are found, the detector trips.

 

It's (5 ± 4) * 92439 ms, so anywhere between ~92 s and nearly 14 minutes.

 

I have no idea where this comes from, as I haven't personally seen any evidence of it hiding or altering any logs in spite of seemingly quite a lot of people claiming that it did. It randomly modifies some part of the game to cause it to work incorrectly or crash instead of directly causing a crash by itself, which means that it avoids taking the blame in the stack trace, but it doesn't obscure the cause for the crash further beyond this.

Thank you for clearing this up.
The way I understand it now is that it looks for specific wording of "type names" which I think is part of the code instead the names of the mods. so for example if I would make a magic mod and name one of my spell funtions "KillAura" it would probably trigger a response because it thinks its a cheat?

-------

Nearly 14 minutes to stop someone from destroying a MP world is quite long and feels like the person doesnt care if the cheats are actually used in favor to hide the tool.

-------

Ok, will look into the claims of altering the logs more. It seems though this was a communication error and one can argument that the tool hiding its own presence by crashing the main game as "blaming other mods/the game" in a broad sense. As removing one mod would magically make it work again.

 

9 hours ago, Diff said:

 

Technically not every game file, "Assemblies" in this context means "The DLLs (code) currently loaded by VintageStory". And yes, it never interacts with your PC's files.

MKMoose got this one. I also have no idea what the source for that list of names is, but regardless it seems to be accurate and in the same order as they are in the code if anyone wants to spot check it. I only checked the first two, Aimbot (3606486923) and InstantShot (3515110866).

Yes. It can do one of a number of many things.

Rarely (0.565%), it'll spam random key presses, buttons, and mouse clicks every game tick. Very rarely (0.196%), your player will attack itself. The rest are various flavors and varieties of freezes, crashes, disconnects, and normal exits.

There's two. The first one, MKMoose mentioned. That's the one that triggers in response to obfuscation or string matches. The other one is (5±4) * 107471, between 1 minute 47 seconds and 16 minutes. This one triggers if any of the types contain nonprintable characters in their name, I suppose another obfuscation check, but neither of the two false positive mods I inspected would have triggered this one... maybe the original cheat mod was using a particularly wacky kind of obfuscation that inspired this?

No, the networking, UI, and other tomfoolery should only produce direct crashes and freezes. For the UI for example, your UI won't glitch out, instead it's is set up to be the trigger for the crash. It sets the list of GUI Composers to null, so the next time something goes to grab a Composer, it'll crash. There's some behavior I can't personally predict without testing it, one of the random options is telling the game client to Start() when it's already started. I'm not sure what exact effects that has, but I do imagine it's quite consistent, and most likely just crashes. Might also freeze. Based on what I read before giving up, I can't imagine it's subtle.

Like I mentioned in the last one, it doesn't really hide or alter error logs. It leaves banana peels strewn in the main walkway and waits for someone to take themselves out. In all the logs I've seen so far, it's the game itself that trips over it rather than a mod. This also aligns with my expectations based on the code.

However, it is still "blaming other mods" in that if you remove the mod that upset it (false positive or true positive), it will stop crashing. That does implicate the other mod, if not for being bad code, then for being incompatible in some way with another mod.

First off, thank you for the detailed answer I prob post some follow up questions once I read through again.

1. You mentioned a second timer that reacts to "nonprintable characters in their name" does this refer to other alphabets like russian or chinese or what does a nonprintable character entail?
2. How does the character attack itself? Didnt know that function existed in the game. also seems more like an annoyance than a crash.
3.ok another post confirming no alteratiosn to the logs, it was probably a broad generalisation that led to this misunderstanding then.

[Diff]

1 hour ago, tiggerbiggo said:

This is a point I disasgree with, just knowing some of the ways that people have managed to sneak code into other open source projects I don't think human review of an untrustworthy actor's code is good enough. If they really wanted to sneak something in, they probably could. All it takes is one slip-up and they miss some updated dependency or hidden behaviour hidden in seemingly legit code.

Which ones are you thinking of? People have managed to slip evil code into the Linux kernel before. And of course there's the XZ incident. But these really are different beasts.

In the XZ incident, Jia Tan stashed code hidden inside the repository, inside a random file supposedly used for testing. Then inside the tar release on the website (but left out of the repository) was a build script that would extract the code from that file and inject it into a different, highly sensitive program and leave a backdoor. Something that actually has very small echoes of what played out with ConfigLib, with code being left out of the repository but being sorta-present in the website release. Maltiez can't begin to do something like this with VS. Jia Tan had direct commit access and the ability to upload releases directly to the website, Maltiez doesn't.

How about the University of Minnesota incident with the Linux kernel? Specifically their "Hypocrite Commits" paper, where they fixed some minor bug, but also smuggled in the beginnings of a vulnerability by breaking an assumption in a different part of the same code that was being fixed. This earned the whole university a lifetime ban from ever contributing to the Linux kernel again. This is much closer to what you're fearing, except that every one of em depended on C's memory unsafety, and they were incomplete holes. C# doesn't have those problems.

Updated dependencies won't cause problems. Hidden behavior can only hide so much before it's obvious that you're up to no good, and really only languages like C can pack a small tweak that breaks big things in an unsafe way. And look at the portion of code that Maltiez is contributing to. It's primarily documentation, behaviorless declaration, and some thin layers of glue. I wrote it elsewhere, but if you're supposed to be doing 1 simple thing and instead you're scanning loaded assemblies and hashing them, that's gonna stand out. That's not going to slip past a review. Best he could slip past review is a completely untargeted crash that would be easily spotted and fixed.

Human review of an untrustworthy actor's code is how we run the digital world right now.

[MKMoose]

27 minutes ago, Sadi89 said:

1. You mentioned a second timer that reacts to "nonprintable characters in their name" does this refer to other alphabets like russian or chinese or what does a nonprintable character entail?

Those are control codes, ASCII characters 0 through 31. These are literally nonprintable - unless your editor specifically highlights them, they are invisible and they have no place in a type name which is supposed to be human-readable.

 

10 hours ago, Diff said:

Rarely (0.565%), it'll spam random key presses, buttons, and mouse clicks every game tick. Very rarely (0.196%), your player will attack itself.

Where does this come from? The code Maltiez shared in this Discord message doesn't seem to include it, and neither does the decompiled code posted by someone in this thread. I've heard mentions of other code put in other places at some point, but I can't quite find any information on it at the moment.

[tiggerbiggo]

1 hour ago, Diff said:

Which ones are you thinking of? People have managed to slip evil code into the Linux kernel before. And of course there's the XZ incident. But these really are different beasts.

In the XZ incident, Jia Tan stashed code hidden inside the repository, inside a random file supposedly used for testing. Then inside the tar release on the website (but left out of the repository) was a build script that would extract the code from that file and inject it into a different, highly sensitive program and leave a backdoor. Something that actually has very small echoes of what played out with ConfigLib, with code being left out of the repository but being sorta-present in the website release. Maltiez can't begin to do something like this with VS. Jia Tan had direct commit access and the ability to upload releases directly to the website, Maltiez doesn't.

How about the University of Minnesota incident with the Linux kernel? Specifically their "Hypocrite Commits" paper, where they fixed some minor bug, but also smuggled in the beginnings of a vulnerability by breaking an assumption in a different part of the same code that was being fixed. This earned the whole university a lifetime ban from ever contributing to the Linux kernel again. This is much closer to what you're fearing, except that every one of em depended on C's memory unsafety, and they were incomplete holes. C# doesn't have those problems.

Updated dependencies won't cause problems. Hidden behavior can only hide so much before it's obvious that you're up to no good, and really only languages like C can pack a small tweak that breaks big things in an unsafe way. And look at the portion of code that Maltiez is contributing to. It's primarily documentation, behaviorless declaration, and some thin layers of glue. I wrote it elsewhere, but if you're supposed to be doing 1 simple thing and instead you're scanning loaded assemblies and hashing them, that's gonna stand out. That's not going to slip past a review. Best he could slip past review is a completely untargeted crash that would be easily spotted and fixed.

Human review of an untrustworthy actor's code is how we run the digital world right now.

Once again you're shifting the point away from the principle of trust and onto procedure, which is important but in the case of Malt it doesn't make the situation somehow OK just because he's been caught and will be kept an eye on. First, you're trying to assert that there could be no way by pointing to some examples that don't apply in this case, but what i'm saying doesn't rely on any specific example of a way Malt could do it.

The point is their behaviour and speech reveals a mindset that is specifically dangerous in software, and it's one that human oversight cannot guarantee protection from because the influence of people with malicious intent isn't limited to what you think they can do, that's what manipulators do, they observe people's expectations of them and create trust to exploit it for their own gain, ideological or economical.

Malt is not just someone who made malware, they are a *bad actor*. This means their potentially harmful actions are not limited to simply following the procedures as you imagine. If you're asking me to prove where the hole is Malt could exploit, that to me is irrelevant because a bad actor with sufficient motivation and arrogance can find holes in people, not just systems. The whole point is that you don't work with people like that once you know who they are. It would be different if Malt wasn't outright defending their actions and mocking those who have a problem with what he did. There is no such thing as a "good bad actor", and that's what it feels like you're describing here. If we put Malt in a secure enough box, they can't hurt us. I want them out of the box entirely, in no small part because I hold myself to that same standard. If I ever write malware and hide it in public code, even "harmless" malware like this one, **I am a bad actor**, and I would FULLY expect to be blacklisted from the software development industry permanently.

In open source, we have no choice but to treat everyone as untrustworthy, because it's all public. I don't think that my employer would see it the same way if I published malware to the public internet, not even to company code. I'd lose their trust, and no amount of code review would be good enough from their perspective to keep me employed. Hence why my issue around keeping Malt is one of trust. A developer with the ideological capability to do something like this does not deserve a place at the table.

Edited Monday at 12:48 PM by tiggerbiggo

[Diff]

13 minutes ago, MKMoose said:

Where does this come from? The code Maltiez shared in this Discord message doesn't seem to include it, and neither does the decompiled code posted by someone in this thread. I've heard mentions of other code put in other places at some point, but I can't quite find any information on it at the moment.

Huh, you're right. I have two copies of AdditionalStuff.cs, one from Maltiez's discord message and the one I yanked myself out of 1.10.9. I was referencing the decompiled version from 1.10.9, I'll attach it here as well.

AdditionalStuff.cs.txt

[Diff]

1 hour ago, Sadi89 said:

The way I understand it now is that it looks for specific wording of "type names" which I think is part of the code instead the names of the mods. so for example if I would make a magic mod and name one of my spell funtions "KillAura" it would probably trigger a response because it thinks its a cheat?

Nailed it.

1 hour ago, Sadi89 said:

Nearly 14 minutes to stop someone from destroying a MP world is quite long and feels like the person doesnt care if the cheats are actually used in favor to hide the tool.

Right, if we take Maltiez at his outdated word, it was never about protection. It was about frustrating the person developing cheats until they stopped developing cheats.

1 hour ago, Sadi89 said:

2. How does the character attack itself? Didnt know that function existed in the game. also seems more like an annoyance than a crash.

In the game, there is a function "TryAttackEntity" that is used to attack things. AdditionalStuff tells it the thing we're trying to attack is ourselves. Which is probably legitimately used sometimes, I'm thinking using a temporal gear to restore stability likely does the same thing. But it is absolutely more of an annoyance. Player likely winds up thinking it's just delayed fall damage or a hidden bowtorn or something.

[Jem8883]

i put my original two cents in back on the "Fire Maltiez" thread. ill put my last comment from the peanut gallery here since things have developed a good bit, including the 'official response'. 

Speaking for myself, i want some level of accountability to be taken. rather than blame shifting and trivializing the breach of trust in what feels like an attempt to 'CYA'(cover your 'their' ass). i may not like the lack of punishment toward the perpetrator but i can accept it, if i can trust the team lead. Something like "we are sorry for our part to play in this terrible situation, nothing about this is okay, beyond the fact that it could have gone far worse. Going forward we will be using this moment to learn from and ensure, nothing like this can ever happen again. to those who may have lost time due to this, you have our sincerest apology. the direct actions we are going to take next are still being discussed internally but we will make sure to keep the community informed with what comes next. We hope our game continues to bring countless hours of entertainment to you all in the years to come."

but instead we got something that felt like "But he had good intentions! And did anyone really get hurt? i mean C'mon guys!.." which isn't the point in the slightest. 

Said it before and ill say it again "the path to hell is paved with good intentions". and intentions aren't good enough. I'm coming away from this just feeling incredibly disappointed.. I Still think that this game would be amazing to introduce into classrooms at some point, but I'm far more skeptical now.. fingers crossed for a better tomorrow.. 

[Angius]

10 hours ago, Teh Pizza Lady said:

The only thing I'm "salty" about at this point is just the lack of an official statement on the forums.

To be honest, that statement was piss-poor weaksauce anyway. I especially love Tyron saying that the post will be updated should any discrepancies arise, then proceeding to not update it once discrepancies arose lmao

[reg8]

36 minutes ago, Angius said:

To be honest, that statement was piss-poor weaksauce anyway. I especially love Tyron saying that the post will be updated should any discrepancies arise, then proceeding to not update it once discrepancies arose lmao

I am PRAYING it's not coming quickly just because it was the weekend.

[ImHereToProcrastinate]

44 minutes ago, Angius said:

discrepancies arose

Eh. They didn't though, no? The facts didn't really change since then. The stance the company took is just very different from what a lot of people envisioned. And there have been a lot of reactions to that, sure. But nothing substantial in terms of facts really came up - still only 3 mods are known that triggered the code in configlib, still the same screenshots of the same  discord convos are being reposted, and the timeline of events stayed the same.

At this point it's just people grappling with the fact, that the official statement is so radically different from what they hoped for. And that's fine I suppose - the official statement invites criticism (both literally and nonliterally). However I think that those who are still hoping that Tyron is somehow secretly still investigating the "true" impact and will somehow reverse or change course are in for a disappointment. This is very likely all the facts and official statements that you (we) are going to get.

Edited Monday at 03:13 PM by ImHereToProcrastinate

[Diff]

3 minutes ago, ImHereToProcrastinate said:

still only 3 mods are known that triggered the code in configlib

Do you know who's on third? People have mentioned it indirectly but I only know Caves N Caverns and URL Radio by name.

[Gandorf]

 

Poll closed and shows angeo will hurt itself with their choices so far

[ImHereToProcrastinate]

1 minute ago, Diff said:

Do you know who's on third?

Unfortunately no, I'll admit that I also only read about it indirectly, so I'm in the same boat. 

[Spear and Fang]

5 minutes ago, Diff said:

Do you know who's on third? People have mentioned it indirectly but I only know Caves N Caverns and URL Radio by name.

I haven't seen the third one named but somewhat assumed it was one of Zaldaryon's, since they were the only other modder that I'm aware of that was obfuscating code. Not sure if the timelines line up though.

[Gandorf]

4 minutes ago, ImHereToProcrastinate said:

Unfortunately no, I'll admit that I also only read about it indirectly, so I'm in the same boat. 

Don't quote me on this, but I think I remember reading somewhere in replies on Reddit that at some point in the past, OptiTime? triggered a false positive too, or was it another kind of incompatibility? I might be misremembering things, though 

[LadyWYT]

2 minutes ago, Gandorf said:

Poll closed and shows angeo will hurt itself with their choices so far

Eh...polls can be useful, but they're also very easy to skew. A Reddit poll is going to rely on people going to Reddit to vote, and will possibly require them to have a Reddit account to vote. It's very easy for one person to create multiple Reddit accounts, if they wish. And I think it's also fair to say that users with strong opinions tend to be the ones more inclined to vote, while users who don't really feel strongly one way or the other(or just don't wish to voice an opinion) are likely to sit it out.

At best, all the poll really shows is that the community is split about 50/50 on whether or not users believe Maltiez should be fired, with those who aren't firmly in the "fire" camp seemingly having a wider variety of opinion.

What the future holds for Anego is unknown. It's very easy to speculate, but only time will tell what the actual outcome will be.

[Gandorf]

1 minute ago, LadyWYT said:

Eh...polls can be useful, but they're also very easy to skew. A Reddit poll is going to rely on people going to Reddit to vote, and will possibly require them to have a Reddit account to vote. It's very easy for one person to create multiple Reddit accounts, if they wish. And I think it's also fair to say that users with strong opinions tend to be the ones more inclined to vote, while users who don't really feel strongly one way or the other(or just don't wish to voice an opinion) are likely to sit it out.

At best, all the poll really shows is that the community is split about 50/50 on whether or not users believe Maltiez should be fired, with those who aren't firmly in the "fire" camp seemingly having a wider variety of opinion.

What the future holds for Anego is unknown. It's very easy to speculate, but only time will tell what the actual outcome will be.

Disappointing 50% of your fanbase is no small thing 

[LadyWYT]

Just now, Gandorf said:

Disappointing 50% of your fanbase is no small thing 

The poll doesn't prove it's 50% of the fanbase. All the poll shows is that 50% of the people who voted think the guy should be fired. What the poll doesn't show is whether or not those people actually own a copy of Vintage Story, and whether or not multiple accounts that belong to the same user are voting.

Otherwise, I agree that disappointing 50% or more of a fanbase is no small action. But just because a large group of people demands something doesn't automatically put them in the right. It doesn't mean that they're wrong either, but setting a precedent for mob rule is a very dangerous thing to do.