Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Thorfinn]

13 hours ago, Zvengks said:

why are there replies with 'content unavailable'?

My guess is that those links no longer point to those other threads because those threads no longer exist. They are here.

I thought the same thing, BTW. WHAT? When I went to bed, there were only 10 pages, now there's 30!?!?!

[Sparticus247]

1 minute ago, Abdoola said:

As a cybersec engineer I can say that, if something looks like malware, smells like malware, acts like malware and quacks like malware, it is malware.

As someone in the development and security space as well, you would also know that factual details do matter when filing reports. Again, what reports and evidence do you have about malware being put into the main vintage story code base that made it all the way past peer review?

In this case "absence of proof is not a proof of absence" as you so put it actually does matter for an actual investigation.

[Diff]

34 minutes ago, Abdoola said:

there were accounts of malware being snuck through a code review

Those accounts are different beasts entirely. You can't sneak malware through code review. You can maybe sneak a vulnerability through code review, but that's primarily in memory-unsafe languages like C and C++. C# can't have memory unsafety holes accidentally poked in it just because you weren't paying close enough attention. XZ didn't sneak past code review. It was done by a maintainer where there was no code review at all.

34 minutes ago, Stellarbone said:

I also feel a developer modding their own game is a conflict of some interest.

I'm deeply confused by this statement, a conflict in what way? Developer modding their own game with their own personal ideas without integrating them into main sounds like a great way to toy and experiment in a low-stakes way that can be trashed at a moment's notice.

Edited Tuesday at 05:01 PM by Diff

[Cleitus]

7 hours ago, Demoncyborg said:

adding this here since it seems to be the most recently active topic. posted on the discord earlier

Again, no official post on the forums. Unless I am missing it.

[Thorfinn]

As someone who got kicked out of college for what was then the undefined charge of "hacking", and immediately getting hired on at one of the biggest mainframe companies to tighten up their security, I'm a little disappointed Malt isn't officially recognized on the team. [EDIT] I'm absolutely certain they recognize what they are letting slip past. [/EDIT]

I'm more than a little disgusted at the bloodthirstiness of the mob. Though I suppose outrage porn over the latest thing is just a fact of life anymore.

Edited Tuesday at 05:00 PM by Thorfinn

[Thorfinn]

3 minutes ago, Diff said:

Those accounts are different beasts entirely. You can't sneak malware through code review. You can maybe sneak a vulnerability through code review, but that's primarily in memory-unsafe languages like C and C++. C# can't have memory unsafety holes accidentally poked in it just because you weren't paying close enough attention.

Hey, @Diff, I have not looked at the three incompatible mods at all. Do you know the deets of why they were flagged? What was being misperceived by Malt's algorithm?

[Diff]

5 minutes ago, Thorfinn said:

Hey, @Diff, I have not looked at the three incompatible mods at all. Do you know the deets of why they were flagged? What was being misperceived by Malt's algorithm?

I haven't looked at playerlist yet, planning to this afternoon. The first two angered ConfigLib by being obfuscated. More than 22% of their types were 2 chars or less. That's likely the case for the third, but there's a small chance of other shenanigans biting here.

Edited Tuesday at 05:08 PM by Diff

[LadyWYT]

9 minutes ago, Abdoola said:

Just a recent(ish) one - XZ, but there were more. Like, say, Webmin.

Again, do you have proof that what you claim actually happened? This tells me nothing.

 

12 minutes ago, Abdoola said:

There's none. But, absence of proof is not a proof of absence.

If we don't need to prove a claim is real before we act on it, then what we have is mob rule and people making all kinds of claims just to get benefits for themselves and punish those they don't like.

13 minutes ago, Abdoola said:

As a cybersec engineer

It's the internet. Which is notorious for people claiming to be things they are very much not. 

[Teh Pizza Lady]

2 minutes ago, LadyWYT said:

If we don't need to prove a claim is real before we act on it, then what we have is mob rule and people making all kinds of claims just to get benefits for themselves and punish those they don't like.

I would have less trust in Anego if they fired Maltiez now because it shows they are capable of being swayed by their fanbase's opinions. And if I can't trust them to avoid mob votes, then I can't trust them to make good decisions when it comes to the trajectory of the game.

[LadyWYT]

11 minutes ago, Cleitus said:

Again, no official post on the forums. Unless I am missing it.

You're not missing it. At this point, I'm not expecting one either. Well, outside of a recap when everything settles down, anyway. It's definitely something that needs improvement in the future. Not that I want to see all the drama on the forums either, but the forums do operate at a slower pace than say, Discord, so it's a little harder for people to react emotionally in the heat of the moment.

As for why there's been no official forum post, I'm not sure. I have some guesses on that, but given how bloodthirsty and prone to wild speculation certain parts of the community seem inclined to be, the last thing I want is to go voicing those thoughts and inadvertently have someone take it out of context and use it as an excuse to play telephone and fan the flames further.

[Thorfinn]

9 minutes ago, Diff said:

I haven't looked at playerlist yet, planning to this afternoon. The first two angered ConfigLib by being obfuscated. More than 22% of their types were 2 chars or less. That's likely the case for the third, but there's a small chance of other shenanigans biting here.

Huh. So if the cheat had just used longer names, Malt would have had to come up with something else? Was the cheat getting past domains somehow? How was it affecting things out of its own scope? [EDIT] If that's a C# vulnerability, I don't need to know. [/EDIT]

Edited Tuesday at 05:17 PM by Thorfinn

[Stellarbone]

17 minutes ago, Diff said:

 

I'm deeply confused by this statement, a conflict in what way? Developer modding their own game with their own personal ideas without integrating them into main sounds like a great way to toy and experiment in a low-stakes way that can be trashed at a moment's notice.

It's just a personal opinion. Modding the game the way you said, sure. Toying around and making a funny skeleton, go nuts. Major mod dependencies though? Feels wrong to me. Like on paper. In my head it sounds right, like the devs would be the best to make mod tools. 

Edited Tuesday at 05:15 PM by Stellarbone

[Teh Pizza Lady]

2 minutes ago, Thorfinn said:

Huh. So if the cheat had just used longer names, Malt would have had to come up with something else? Was the cheat getting past domains somehow? How was it affecting things out of its own scope?

from my understand, the cheat mod was exploiting the server's trust that the client couldn't change it's own authorization level or ask the server to do things that a normal player normally couldn't do. This really just needs some heavier server-side authentication of client actions and forcing a disconnect if the client tries to do something outside of normal gameplay.

[Diff]

4 minutes ago, Thorfinn said:

Huh. So if the cheat had just used longer names, Malt would have had to come up with something else? Was the cheat getting past domains somehow? How was it affecting things out of its own scope?

Believe only internal references get scrambled. So like instead of CheatModSystem and CheatModDialog and CheatModConfig, you get a, A, and b. URL Radio for instances has a lot of normal names and only an interior core gets scrambled.

Obfuscation like that makes it really difficult to fingerprint a chunk of code, especially when obfuscated names can change version to version. Today's q might be tomorrow's zN. If they had used longer names, or names that had a less consistent scheme, it could have been even more difficult to latch onto.

Edited Tuesday at 05:21 PM by Diff

[IAmMoss]

1 hour ago, LadyWYT said:

Stripping away his mods, banning him from creating more mods, and keeping him on a much tighter leash is still holding him accountable. For many in the community, that's enough. For those who demand harsher punishment though, or who hold personal vendettas against the guy for whatever reason, that's obviously not going to be an answer they're satisfied with. They're free to disagree, and politely express as much, but at this point a good chunk of the disagreement isn't really polite, as much as it is a bunch of people upset that they didn't get what they want and trying to form a mob to force Anego's hand or otherwise start fights with those who have different opinions about the verdict. That's where it stops being simple disagreement and starts becoming a problem.

That's the thing right? Those people act as if banning him from the community is a reward. It certainly isn't. Was he tired of the community and modding for it? Sure, so he says. Yet he still also interacted, stayed, and developed his mods when he could have just walked away. Regardless of what he said, maltiez still got something out of modding and interacting with people.

Never having to deal with him again is enough for me. I dont need to see him fired by the mob because I dont like him, which I dont.

Edited Tuesday at 05:35 PM by IAmMoss

[Thorfinn]

1 minute ago, Diff said:

Only internal references get scrambled. So like instead of CheatModSystem and CheatModDialog and CheatModConfig, you get a, A, and b.

Obfuscation like that makes it really difficult to fingerprint a chunk of code, especially when obfuscated names can change version to version. Today's q might be tomorrow's zN. If they had used longer names, or names that had a less consistent scheme, it could have been even more difficult to latch onto.

Huh. Good thing I don't use ConfigLib, I guess. I rarely use more than 2 or 3 characters in my own mods, and sometimes I even flog case if I'm running out of names.

Merging what @Teh Pizza Lady said, this allows one add new permissions or something? Just make it harder for the server to distinguish between a valid and invalid request? Abusing the updating routines? Adding a block that rots into redstone or something after one day? Not sure I see why short names would do that, but it would make it harder for a human to track.

[Sparticus247]

1 hour ago, Stellarbone said:

I dont have a lot to really weigh in on that part. Suppose it can be debated forever really. I don't think he should have lost his mods like that, but I also feel a developer modding their own game is a conflict of some interest. Again, it all seems performative. 

I'm actually with you on the underlined part a bit.

I imagine of another long term dev now became a modder that made all sorts of popular addons that the community loved, but Anego decided that they didn't want part of the main game, and the community was well aware of that aspect, there could be some dicey political shenanigans at play eventually.

Edited Tuesday at 05:44 PM by Sparticus247
typos

[Teh Pizza Lady]

3 minutes ago, Sparticus247 said:

I'm actually with you on the underlined part a bit.

I imagine of another long term dev now became a modder that made all sorts of popular addons that the community loved, but Anego decided that they didn't want part of the main game, and the community was well aware of that aspect, there could be some dicey political shenanigans at play eventually.

or the developer left the studio to pursue other employment for their own reasons, however the developer still loved making things for the game so took up modding. Nothing weird about that. You're inventing scenarios that don't exist surrounding the facts of configLib and Anego's decisions surrounding it all.

[VANTABlack2000]

3 hours ago, Teh Pizza Lady said:

the qualification of "harm" here is subjective.

so we would quit drowning out actual threads about the game with another new thread. This is a concept known as a megathread, which some of us have been asking for since this whole thing exploded.

Because the rest of your post is just you reading between the lines stuff I didn't say and never meant, so the rest of your comment isn't even worth responding to. You know the saying, "Never play chess with a pigeon..."

Came here to say this. 

People still play Minecraft even though Micro$oft is a corrupt company.

This is the correct way. Take whatever personal action you feel is necessary. Hush and leave the rest of us alone on your way out. (Not YOU, personally, but the ones saying "I'm taking my refund and recommending others do the same.")

I am well aware people play Minecraft even though Microsoft is a corrupt company. I am trying to recommend games to people that actually care about the players and not just trying to make money. Vintage Story is for sure better than Minecraft, but given everything right now I really just do not know how much they care about the players. I would probably still play VS over Minecraft if someone wanted to play a multiplayer game or would mention it if a conversation about Minecraft came up, but the way things are right now as I said I just do not know how much the players feelings are being considered or how much it's just about Anego right now.

For example if we want to talk about corrupt corporations it seems Discord is heading in that direction if not already there, so I really do not like having to get information from Discord on top of everything going on when the forum is right here.

[A_British_Lass]

i'm not the only one who feels this has just made the situation... worse right? 

[Sparticus247]

13 minutes ago, Teh Pizza Lady said:

or the developer left the studio to pursue other employment for their own reasons, however the developer still loved making things for the game so took up modding. Nothing weird about that. You're inventing scenarios that don't exist surrounding the facts of configLib and Anego's decisions surrounding it all.

The underlined bit from your post above I'm 100% onboard with. My meaning was more of a scenario like:

1. Community members loves current dev who now also starts making popular mods.
2. Said members keeps begging for the mods to be part of the game to Anego.
3. Anego keeps saying no.
4. Said members just won't give up.
5. Other devs internally are like "dude, get your posse to leave us alone lol" 

Nothing really about the configLib thing, more about inter-team dynamics. All what ifs really, but those always go in 100 directions, but that's a conversation for another thread, I don't want to hijack this one for that topic.

Sorry I should have maybe been a bit more clear on that part. I was meaning to circle back to this reference in the official response as well. I'm curious as to the "new internal policies" that will arise from all this will be. I imagine it's mostly about a "do no harm and be transparent" oath.

[Stralgaez]

1 hour ago, Cleitus said:

Again, no official post on the forums. Unless I am missing it.

Which is interesting - I thought we have the forums specifically to not directly need other social platforms for communication if you don't feel for dealing with their issues.

Yet everywhere else but the forums get official statements posted.

This all feels backwards.

[Stellarbone]

21 minutes ago, A_British_Lass said:

i'm not the only one who feels this has just made the situation... worse right? 

 

I mean telling your customers you don't care about their opinions and then telling them to leave isn't the brightest business strategy. 

[A_British_Lass]

1 minute ago, Stellarbone said:

I mean telling your customers you don't care about their opinions and then telling them to leave isn't the brightest business strategy. 

right? i will not be surprised if we see some core devs jump ship for hytale or some fuckin shit, r.i.p project glint lmao 

Edited Tuesday at 06:21 PM by A_British_Lass

[Cicadas]

33 minutes ago, A_British_Lass said:

i'm not the only one who feels this has just made the situation... worse right? 

Agreed.

It's in my opinion still out of touch.