Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[icesharkk]

Update: Tyron's official response on 3 Sept:

Quote

Here is a writeup for those interested:

Eight releases shipped hidden code that could crash or disconnect your game client. It was removed in 1.13.1. If you are on the current version, you are fine.

Affected: 8 releases
1.10.9
1.10.10
1.10.12
1.10.13
1.10.14
1.11.0
1.11.1
1.12.0

Not affected
1.13.1 and later
1.10.7 and earlier

What the code did:

It ran automatically when the mod loaded, then checked every other mod and library loaded into your game, looking for signs of cheat software: scrambled internal names, and specific names like Aimbot, KillAura, Esp and Nuker.

If it found a match, it waited a random 1.5 to 16 minutes, then broke your game client at random:

• Forced disconnect, or kicked you to the main menu

• Killed the client outright, or froze frame timing

• Wiped the interface, loaded creatures, or all server communication

• On the 1.10.x versions only: fired fake keyboard and mouse input every frame, and made your character attack itself

Note: Only multiplayer clients. Dedicated servers and single-player worlds were never affected.

Worth knowing:

• The code was not in the public source repository. It existed only in the released downloads.

• It was disguised as part of YamlDotNet, a normal library bundled inside the mod.

• It did not steal data, touch files, or contact network. (The effects were confined to crashing the running game.)

Maltiez is a long time mod author and recent hire to the dev team on Vintage Story
 

And here is the haste bin link deep dive on the discovery: https://hastebin.com/share/uqeyuhirof.markdown

Edited September 3 by icesharkk

[icesharkk]

11 minutes ago, Tyron said:

It's not our goal to silence people, we're desperately trying to moderate a massive flood of angry content. There is also plenty of discussion on reddit and discord that is public. The forum threads are public again now. 

I really feel for this. this cannot not be pleasant to deal with, but it also shouldn't be pleasant to deal with. its a big deal. and its my honest hope that Vintage story continues with its standards and ethics intact. it is critical to that end that that continued action by your studio does not further erode user trust. allowing the discussion to continue. and allowing us to wear our selves out is the probably the best move. We are (im)patiently waiting for the official response and next steps naturally take your time outlining that to the best of your ability. in the meantime the user base should discuss this (civilly!) because it is big deal and how its handle is a big deal. 

Edited September 2 by icesharkk

[Sparticus247]

Can we just get a single Master thread on this topic if it's going to be kept in this discussion board, and not moved to another? 

I'm not against having any discussions around it, I just don't want to see 15 topics on the same thing with "up to the minute news coverage" thread spidering out.

I'm not on the discord, but Reddit is absolutely overwhelmed.

[Stellarbone]

I mean discord moderators have demanded silence or bans, forced everyone into a seemingly unmoderated off topic channel to continue a nexus of vitriol over a breech of trust and poor PR. From the outside it just looks like all thats being done is as T.Read and Rorax have said, "Stop talking about it or we ban you". 

[Khondza]

From the looks of it they not only pulled the wool over those who downloaded the mod but the dev team themselves. Its a little funny to me because if they had just made a "target X hacked client anti cheat" mod they would have avoided all of this. If any of the Anego team is reading this i still trust you guys to make the right choices. The terms of use for the mod-db are the rules which govern to safety of those who use it, if it can be broken for the "right cause" or the "right people" it is worthless to us. Im not going to try and say what should be done, but if actions like this are allowed to continue on the mod-db ill probably just stay with vanilla. 

[icesharkk]

6 minutes ago, Sparticus247 said:

Can we just get a single Master thread on this topic if it's going to be kept in this discussion board, and not moved to another? 

I'm not against having any discussions around it, I just don't want to see 15 topics on the same thing with "up to the minute news coverage" thread spidering out.

I'm not on the discord, but Reddit is absolutely overwhelmed.

i asked for one. but there hasnt been any response or action taken.

[VANTABlack2000]

55 minutes ago, icesharkk said:

Here are the most relevant statements (in my opinion) from within discord, for any users who do not or choose not to use discord, presented in a clear thread with no inflammatory title. there is a lot of struggle going on with PR so please be civil in this so that it doesn't also get lock or deleted.

if you are just hearing about this issue here is  a summary per user LitchManWithAIO on reddit whose summary is probably simplest explanation I've seen:

Maltiez is a long time mod author and recent hire to the dev team on Vintage Story
 

And here is the haste bin link deep dive on the discovery: https://hastebin.com/share/uqeyuhirof.markdown

I think this is a good summary of everything. It does a good job of getting everyone on the same page, so we aren't arguing about misinformation. I would like to see a response from the devs, but things are crazy right now, so I am not sure what is going to happen. I am still going to give the devs benefit of the doubt though considering this thread isn't locked.

[greed23]

1 hour ago, Tyron said:

It's not our goal to silence people, we're desperately trying to moderate a massive flood of angry content. There is also plenty of discussion on reddit and discord that is public. The forum threads are public again now. 

Its really not helping that your discord moderators are banning people without issuing warnings for the rule breaks first and forcing the discussion to be pushed to a side thread labelled "off topic" about 20 channels down.  It doesn't feel like conversations are being allowed to happen in any place of moderate visibility.

[Diff]

Just now, Khondza said:

if they had just made a "target X hacked client anti cheat" mod they would have avoided all of this

Wouldn't have avoided this unfortunately. Making it a dedicated, separate mod would have made it laughably easy to bypass. Patching out the checks of an anticheat mod like that is something you could accomplish following the generic "Quickstart" Harmony tutorial with 0 modding experience. It only works if you don't know it's there. Shouldn't have been done at all, but doing it any other way would have been pointless.

[LadyWYT]

4 minutes ago, icesharkk said:

i asked for one. but there hasnt been any response or action taken.

In fairness, it's only been what...24-48 hours since the controversy blew up? It's a little difficult to make an official announcement/mega-thread when you're still scrambling to uncover the facts yourself, find and neutralize the problem mod code, and deal with the community running wild with speculation(especially when the community keeps creating multiple threads about the same thing) at the same time. And of course, with everyone piling on at once, in multiple places, it gets very hard to sort out the actual questions people have from the general mess of comments.

I expect as soon as Anego Studios figures out what the heck happened, there will be an official statement providing the facts about what happened, how the problem was handled, how the offending parties were handled, and what measures will be taken to help ensure such things can't happen as easily in the future. Until we have an official statement, I would say it's a good idea to be very careful about speculating. It's perfectly fine to be concerned, and politely air those concerns in the appropriate designated space, but it's also very easy to get carried away and wind up muddying the waters.

[icesharkk]

7 minutes ago, LadyWYT said:

In fairness, it's only been what...24-48 hours since the controversy blew up? It's a little difficult to make an official announcement/mega-thread when you're still scrambling to uncover the facts yourself, find and neutralize the problem mod code, and deal with the community running wild with speculation(especially when the community keeps creating multiple threads about the same thing) at the same time. And of course, with everyone piling on at once, in multiple places, it gets very hard to sort out the actual questions people have from the general mess of comments.

I expect as soon as Anego Studios figures out what the heck happened, there will be an official statement providing the facts about what happened, how the problem was handled, how the offending parties were handled, and what measures will be taken to help ensure such things can't happen as easily in the future. Until we have an official statement, I would say it's a good idea to be very careful about speculating. It's perfectly fine to be concerned, and politely air those concerns in the appropriate designated space, but it's also very easy to get carried away and wind up muddying the waters.

you misinterpret my statement. i asked for a megathread where we could all safely discuss this without spilling into a half dozen threads. I have no expectation to rush the official statement regarding the incident or the consequences.

[Tyron]

14 minutes ago, greed23 said:

Its really not helping that your discord moderators are banning people without issuing warnings for the rule breaks first and forcing the discussion to be pushed to a side thread labelled "off topic" about 20 channels down.  It doesn't feel like conversations are being allowed to happen in any place of moderate visibility.

It's also discussed in some 3 other forum threads, on #mods-general on discord as well as on reddit. 
If someone was unfairly banned, please write us a ban appeal

[LadyWYT]

4 minutes ago, icesharkk said:

you misinterpret my statement. i asked for a megathread where we could all safely discuss this without spilling into a half dozen threads. I have no expectation to rush the official statement regarding the incident or the consequences.

Yeah but that's kind of my point--a proper mega-thread, at least in my opinion, would be some kind of official statement, along with the known facts, would it not? Likewise, it's one thing to start a mega-thread, but another thing entirely to both keep it civil and get users to post in that thread instead of making duplicates and running wild everywhere else. It's a common problem when it comes to forums and drama in general, not just this specific forum and circumstance. That's all.

[icesharkk]

3 minutes ago, LadyWYT said:

Yeah but that's kind of my point--a proper mega-thread, at least in my opinion, would be some kind of official statement, along with the known facts, would it not? Likewise, it's one thing to start a mega-thread, but another thing entirely to both keep it civil and get users to post in that thread instead of making duplicates and running wild everywhere else. It's a common problem when it comes to forums and drama in general, not just this specific forum and circumstance. That's all.

oh i see what you mean. not that wasnt what i had in mind. just a collapse of the threads on the topic and basically say "be civil and keep it in here until we have our own statement on the topic." this came up because earlier this morning all of the threads on the topic were getting locked and removed and there was no where to reference the info or continue discussion. it was not a good look for the company and it was relatively quickly undone but the threads remained locked.

[AtomicWinter]

10 minutes ago, Tyron said:

It's also discussed in some 3 other forum threads, on #mods-general on discord as well as on reddit. 
If someone was unfairly banned, please write us a ban appeal

The first and only warning I’ve received was a permanent point on my account and a threat of being permanently banned. I thought my original post disappeared due to a site error, a simple message asking me not to make such posts again was all that needed to be done instead I was given a heavy handed ultimatum.

[WrenFox]

1 hour ago, icesharkk said:

Here are the most relevant statements (in my opinion) from within discord, for any users who do not or choose not to use discord, presented in a clear thread with no inflammatory title. there is a lot of struggle going on with PR so please be civil in this so that it doesn't also get lock or deleted.

if you are just hearing about this issue here is  a summary per user LitchManWithAIO on reddit whose summary is probably simplest explanation I've seen:

Maltiez is a long time mod author and recent hire to the dev team on Vintage Story
 

And here is the haste bin link deep dive on the discovery: https://hastebin.com/share/uqeyuhirof.markdown

I've just now heard about this whole drama (whatever you want to call it) I've also heard of this from a YT video, I don't really know how else to respond but "yikes".

The fact that Maltiez could've hid something else in that obfuscated code is really concerning to say the least, I'll leave it at that.

[Diff]

19 minutes ago, WrenFox said:

The fact that Maltiez could've hid something else in that obfuscated code is really concerning to say the least, I'll leave it at that.

Maltiez's code wasn't obfuscated, just hidden under the bones of a bundled dependency. Hidden well. Even knowing it existed, it took me a while to find it.

But once found, it's easily read. We can speak confidently about what the code did and didn't do. From my own research into it, the summary in the OP is pretty comprehensive. It mentions things I have found in the code myself and that I've seen missing from other summaries of the mod's behavior.

Edited September 2 by Diff

[Teh Pizza Lady]

16 minutes ago, WrenFox said:

could've hid something else in that obfuscated code

could have, but didn't, so speculating on it is useless and in line with the actions that got other forum members silenced/sent to vacation island.

[WrenFox]

1 minute ago, Diff said:

Maltiez's code wasn't obfuscated, just hidden under the bones of a bundled dependency.

Oh, my apologies.
Maybe I've just read from the wrong sources and stumbled upon some false information as the drama is still very much ongoing (looking at the VS subreddit) and I was recently notified about this, still I hope this drama doesn't get too out of hand.

[greed23]

7 minutes ago, Diff said:

Maltiez's code wasn't obfuscated, just hidden under the bones of a bundled dependency. Hidden well. Even knowing it existed, it took me a while to find it.

But once found, it's easily read. We can speak confidently about what the code did and didn't do. From my own research into it, the summary in the OP is pretty comprehensive. It mentions things I have found in the code myself and that I've seen missing from other summaries of the mod's behavior.

I think a lot of people are using obfuscated incorrectly, but mean "obscured" or "hidden".  I understand that's not what it actually means, but the sentiment when people say he "obfuscated his code" is that he did something to make it really hard to find, far harder than it should be, and omitted it from public git

[VANTABlack2000]

3 minutes ago, WrenFox said:

Oh, my apologies.
Maybe I've just read from the wrong sources and stumbled upon some false information as the drama is still very much ongoing (looking at the VS subreddit) and I was recently notified about this, still I hope this drama doesn't get too out of hand.

It seemed out of hand for a while, but I think things have calmed down now. Lot's of things were thrown around and it got confusing, but I think this thread is better now. I will admit I was part of the problem in all of the chaos trying to figure out what was going on and commenting in threads.

[Banch]

As someone who doesn't play on servers, this incident is the first I'm ever hearing of the cheat client this code was apparently in there to stop. It feels weird and unnecessary that I've had this "feature" in my singleplayer worlds the whole time...

[A_British_Lass]

insane that he's not been banned from the mod db yet 

 

[-Glue-]

Thank you for the clear and concise rundown. Its hard to piece everything together through all the disjointed forums, as someone who is not on the Discord.

I think while the actions Maltiez took were morally understandable, in that they were attacking cheaters, the way they went about it was absolutely reprehensible, and a major breach in trust. It would be one thing if they were just a modder. People could simply make the choice to stop using their mods or not. However, the fact they are now an official developer at Anego, and this information was kept hidden, does damage the trust in the studio as a whole.

I know Tyron and the rest of the team would never do, or allow anything to negatively affect their game, or the user experience. However, the way this whole situation was handled was just awful, and does significantly damage trust. Instead of simply making an official announcement, laying out the facts, and informing us of what is happening/being done, they chose start hiding forums. Apparently even banning people from the Discord as well. Which only serves to further damage trust, and let the issue fester.

This is where my issue lies. Moderators chose to try and cover up the issue, instead of simply clear the air with facts. The only post I have seen from a moderator, or dev themselves, was Tyron saying he wasn't going to allow inflammatory titles, before locking and hiding posts. Which simply does not look good under any circumstances. It comes across as sweeping the issue under the rug, denying the problem.
If this was handled better by the mods and devs here, I don't think it would have been blown out of proportion quite as much.

As for Maltiez. I'm not sure. I don't think they would be so bold as to do something like this in an official update, but I don't feel as comfortable having them on the team now... I really just want to hear from the team to know what is being done, what they are thinking.

[-Glue-]

5 hours ago, Tyron said:

It's not our goal to silence people, we're desperately trying to moderate a massive flood of angry content. There is also plenty of discussion on reddit and discord that is public. The forum threads are public again now. 

I trust that you have our best interest at heart, but you really should make an official pinned post here about what is happening and what is being done about it.
As someone who is not on the Discord, it looks really, really bad not getting any official information from you guys. Hiding and locking posts was probably the worst thing you guys could of done, and has really fanned the flames.

I understand you are likely overwhelmed with a whole flood of community anger that most of us can't even see, but I think an official statement should be the priority. It will help quell some confusion, and give a more centralized location for discussion on the topic here. Transparency is the best rout for getting things back on track.

Edited September 2 by -Glue-