tiggerbiggo

Once again you're shifting the point away from the principle of trust and onto procedure, which is important but in the case of Malt it doesn't make the situation somehow OK just because he's been caught and will be kept an eye on. First, you're trying to assert that there could be no way by pointing to some examples that don't apply in this case, but what i'm saying doesn't rely on any specific example of a way Malt could do it. The point is their behaviour and speech reveals a mindset that is specifically dangerous in software, and it's one that human oversight cannot guarantee protection from because the influence of people with malicious intent isn't limited to what you think they can do, that's what manipulators do, they observe people's expectations of them and create trust to exploit it for their own gain, ideological or economical. Malt is not just someone who made malware, they are a *bad actor*. This means their potentially harmful actions are not limited to simply following the procedures as you imagine. If you're asking me to prove where the hole is Malt could exploit, that to me is irrelevant because a bad actor with sufficient motivation and arrogance can find holes in people, not just systems. The whole point is that you don't work with people like that once you know who they are. It would be different if Malt wasn't outright defending their actions and mocking those who have a problem with what he did. There is no such thing as a "good bad actor", and that's what it feels like you're describing here. If we put Malt in a secure enough box, they can't hurt us. I want them out of the box entirely, in no small part because I hold myself to that same standard. If I ever write malware and hide it in public code, even "harmless" malware like this one, **I am a bad actor**, and I would FULLY expect to be blacklisted from the software development industry permanently. In open source, we have no choice but to treat everyone as untrustworthy, because it's all public. I don't think that my employer would see it the same way if I published malware to the public internet, not even to company code. I'd lose their trust, and no amount of code review would be good enough from their perspective to keep me employed. Hence why my issue around keeping Malt is one of trust. A developer with the ideological capability to do something like this does not deserve a place at the table.

This is a point I disasgree with, just knowing some of the ways that people have managed to sneak code into other open source projects I don't think human review of an untrustworthy actor's code is good enough. If they really wanted to sneak something in, they probably could. All it takes is one slip-up and they miss some updated dependency or hidden behaviour hidden in seemingly legit code.

From my perspective there's (at least) one big problem with the way things are done right now that mean a guide (while useful) wouldn't really have stopped this from taking longer than normal to uncover; Releases (Compiled binaries) are uploaded by the mod author separately from the code, so there's nothing stopping a mod author from misdirecting people by making the release act differently to the source code. Usually if you're working with open source mods, if there's a problem you can go to the source, but in this case the easiest solution would have surfaced nothing since the source wasn't malicious. One possible way to solve this would be to require mods to be compiled be a trusted entity. So, modders develop and publish the source code, and then instead of publishing a release themselves, the mod portal itself would automatically compile it and serve it. If the mod author cannot push their own binary, there's no possibility for the source code to differ from the binary. This does introduce the problem of forcing all mods to be open source, which wouldn't be a problem for most people but I guess some people are protective of mod code. I don't understand it personally since it kinda goes against the spirit to me. That feels like writing code on top of someone else's creation and not wanting anyone to modify yours in kind, but that's beside the point.

Also, if I get my refund i'll shut up and leave forever, but i'd much rather be able to trust the devs which is why i'm even here at all. If I wanted to just be done with the game I could wait for my refund and go, but I don't need the money and I want to be able to trust that the game isn't doing stuff it shouldn't. What I want is for the devs to do the right thing.

I don't think I need to rebuke your semantic argument because it's not even incorrect to call what it does obfuscation, and the way you're getting caught up on that definition rather than talking about the actual behaviour of the mod makes me think you're not a programmer, because even if you're right all you're saying there is that I used the wrong word (I didn't, obfuscation is correct), and you're not talking about the real problem. "It was very easy to find it and figure out what it did once people knew it was there" - So is a landmine, if you have the tools to detect and disarm it. The fact the this code didn't kill anyone is irrelevant, and it still takes multiple steps to avoid being discovered in the first place. "Are you going to say those devs are obfuscating their code and thus incorporating malware into them?" - That is not the definition of malware I gave, and you clearly don't understand the problem. Someone else said it pretty well above; "Malt is able to be ideologically motivated by his own internal debates on whats right or wrong and then apply it with deliberate intent to hide it" Malt decided he knew better than I do about how my client should act, and took deliberate steps to obscure what mod was causing said irregular behaviour. I don't care if he had my "best interests" in mind. He decided that my client should crash if I install an unrelated mod, without knowing my intentions or asking me for permission. THAT is the malicious act here, and if I did anything REMOTELY like this in my job I WOULD BE FIRED. Seriously, this would be an instant dismissal and blacklist from any other industry. PERIOD. If you're blaming me for getting mad at a literal malware developer being kept on the dev team because it's impacting your "real" game discussion (which is precisely as real as not being able to trust running the game AT ALL) then you should be pointing the finger instead at the dev team who have chosen to keep such a bad actor. If you're defending his actions because "It was very easy to find it and figure out what it did once people knew it was there", i'm just really glad people smarter <- (Probably inappropriate to say this, edited. Calling you stupid is not correct.) more knowledgable in this field than you are at the head of most of the computer security organisations where this would have a more real-world impact. If you think about that for a second you'll see how wrong it is. The problem here is the deliberate attempts to hide it, the disrespect they showed community members who were concerned about LITERAL MALWARE, and the fact that they have not fired the perpetrator outright.

Yeah I get that, hopefully I managed to communicate what I was trying to say regardless, it doesnt conflict with what you're saying even though I thought it did

I'm not really trying to and i see what you meant there sorry, but regardless of that misinterpretation on my side the news story is still only half of the equation and the lack of trust only exacerbates the first part since even though it's easy enough for a programmer to read and understand that post you linked, if the mod didn't take those steps to hide itself there would be less questions for a non-technical user to even ask, and less things they could misinterpret or misinform others on. The very fact that it was trying to hide itself will lead non technical users to speculate, creating that vacuum even when accurate technical info is given. There's a pretty clear and established line in the sand with this kind of malicious behaviour in game code, and for good reason.

The beginning of the story is when the malware was uploaded, not when it was found. Malware doesn't become a problem only when it is found and dissected.

That writeup is useful, but it doesn't change my opinion. The malicious code was not in the public repo, and was baked into the release itself. It was placed inside another library inside ConfigLib to make it look like something else It had random behaviours triggered at a random time so you couldn't easily track it down. So sure, once the code itself was found and identified, it got pulled apart fast. But until that point, its behaviour was specifically designed to be hard to find, and make it look like it's the fault of some other mod. So I think both things contributed to it and the actions of both parties are pretty inexcusable imo...

Said malicious code was designed to obfuscate itself. The 2 are one and the same. The code itself creates its own information vacuum by default, forcing speech to provide accurate information. If the code was self-documenting, open source or simply wasn't trying to hide itself, less people would be speculating on its true behaviour. As a side note, this is a big reason why undocumented, obfuscated, misaligned and intrusive behaviour is ALWAYS classified as malware, even if it doesn't actually cause harm.

Huh, almost like smuggling malicious code into a mod destroys trust and creates an information vacuum or something... Who would have thought that doing sneaky stuff with code makes people not trust you any more...