Diff

I'm not at my computer, but the one thing I notice looking at the recipe is that the fat must be rendered. Is yours?

Do you know who's on third? People have mentioned it indirectly but I only know Caves N Caverns and URL Radio by name.

These demo files could be (and maybe should be) captured on the server side. A cheat mod knows if it's about to do something illegal and can just not include that in the demo that's sent to the server. I don't see anything here that doesn't have visibility on the server side, and anything that is going to impact other players (excluding leaking info like Xray cheats) is going to have to loop the server in on what's going on. Capturing it on the client side seems to only leave it open to be tampered with. Cheat mod doesn't have to re-implement diffie-hellman if it just selectively blinds the anticheat when it needs it to look the other way.

Nailed it. Right, if we take Maltiez at his outdated word, it was never about protection. It was about frustrating the person developing cheats until they stopped developing cheats. In the game, there is a function "TryAttackEntity" that is used to attack things. AdditionalStuff tells it the thing we're trying to attack is ourselves. Which is probably legitimately used sometimes, I'm thinking using a temporal gear to restore stability likely does the same thing. But it is absolutely more of an annoyance. Player likely winds up thinking it's just delayed fall damage or a hidden bowtorn or something.

Huh, you're right. I have two copies of AdditionalStuff.cs, one from Maltiez's discord message and the one I yanked myself out of 1.10.9. I was referencing the decompiled version from 1.10.9, I'll attach it here as well. AdditionalStuff.cs.txt

Which ones are you thinking of? People have managed to slip evil code into the Linux kernel before. And of course there's the XZ incident. But these really are different beasts. In the XZ incident, Jia Tan stashed code hidden inside the repository, inside a random file supposedly used for testing. Then inside the tar release on the website (but left out of the repository) was a build script that would extract the code from that file and inject it into a different, highly sensitive program and leave a backdoor. Something that actually has very small echoes of what played out with ConfigLib, with code being left out of the repository but being sorta-present in the website release. Maltiez can't begin to do something like this with VS. Jia Tan had direct commit access and the ability to upload releases directly to the website, Maltiez doesn't. How about the University of Minnesota incident with the Linux kernel? Specifically their "Hypocrite Commits" paper, where they fixed some minor bug, but also smuggled in the beginnings of a vulnerability by breaking an assumption in a different part of the same code that was being fixed. This earned the whole university a lifetime ban from ever contributing to the Linux kernel again. This is much closer to what you're fearing, except that every one of em depended on C's memory unsafety, and they were incomplete holes. C# doesn't have those problems. Updated dependencies won't cause problems. Hidden behavior can only hide so much before it's obvious that you're up to no good, and really only languages like C can pack a small tweak that breaks big things in an unsafe way. And look at the portion of code that Maltiez is contributing to. It's primarily documentation, behaviorless declaration, and some thin layers of glue. I wrote it elsewhere, but if you're supposed to be doing 1 simple thing and instead you're scanning loaded assemblies and hashing them, that's gonna stand out. That's not going to slip past a review. Best he could slip past review is a completely untargeted crash that would be easily spotted and fixed. Human review of an untrustworthy actor's code is how we run the digital world right now.

There's really not a ton you can do to reduce the technical risk for the average person. In the end there's no substitute for code review, and the ModDB is explicitly unreviewed, as is every game's modding ecosystem. It's inherently reactive rather than proactive.

Technically not every game file, "Assemblies" in this context means "The DLLs (code) currently loaded by VintageStory". And yes, it never interacts with your PC's files. MKMoose got this one. I also have no idea what the source for that list of names is, but regardless it seems to be accurate and in the same order as they are in the code if anyone wants to spot check it. I only checked the first two, Aimbot (3606486923) and InstantShot (3515110866). Yes. It can do one of a number of many things. Rarely (0.565%), it'll spam random key presses, buttons, and mouse clicks every game tick. Very rarely (0.196%), your player will attack itself. The rest are various flavors and varieties of freezes, crashes, disconnects, and normal exits. There's two. The first one, MKMoose mentioned. That's the one that triggers in response to obfuscation or string matches. The other one is (5±4) * 107471, between 1 minute 47 seconds and 16 minutes. This one triggers if any of the types contain nonprintable characters in their name, I suppose another obfuscation check, but neither of the two false positive mods I inspected would have triggered this one... maybe the original cheat mod was using a particularly wacky kind of obfuscation that inspired this? No, the networking, UI, and other tomfoolery should only produce direct crashes and freezes. For the UI for example, your UI won't glitch out, instead it's is set up to be the trigger for the crash. It sets the list of GUI Composers to null, so the next time something goes to grab a Composer, it'll crash. There's some behavior I can't personally predict without testing it, one of the random options is telling the game client to Start() when it's already started. I'm not sure what exact effects that has, but I do imagine it's quite consistent, and most likely just crashes. Might also freeze. Based on what I read before giving up, I can't imagine it's subtle. Like I mentioned in the last one, it doesn't really hide or alter error logs. It leaves banana peels strewn in the main walkway and waits for someone to take themselves out. In all the logs I've seen so far, it's the game itself that trips over it rather than a mod. This also aligns with my expectations based on the code. However, it is still "blaming other mods" in that if you remove the mod that upset it (false positive or true positive), it will stop crashing. That does implicate the other mod, if not for being bad code, then for being incompatible in some way with another mod.

IMO, likely more than ~100. Really doubt we hit 1000 false positives just based on vibes. Downloads are cumulative across versions, they're not unique users. If we pretend the highest number of downloads on any single version is a proxy for unique downloads, it's 1200 for the both of them combined. Caves N Caverns likely has a substantial population of single player users. URL Radio sounds like it'd be almost completely multiplayer users. Just based on vibes still, let's say 650 (all of em) from URL and 250 (half) from CNC are downloads for servers. So that's 850 opportunities pulled straight out of my assumptions, however common ConfigLib is on your average server is what's going to matter for the final made up body count. I don't know enough about that to even try to guess though.

Welcome to the forums! Pr0fesseur's assessment is accurate. Right now we're aware of 2 mods that were caught in the crossfire, the caves n caverns you mentioned already and the url radio mod.

Ah no need to apologize, we're saying the same thing. I didn't spot your answer to that part of genderBiohazard's question when I read it through the first time.

They didn't specify which part of the community is the part engaging in bad faith, but I'm going to risk putting words in their mouth and say I don't believe Mushroomancer thinks this is it.

Two mods that I'm aware of. Caves N Caverns, as already mentioned. URL Radio is the other one that's confirmed. I'd be very interested to investigate any other mods. You can get hard proof for yourself with a decompiler. If you decompile a mod's DLL files and find any with a bunch of classes, functions, and variables with 1- and 2-letter names, it's obfuscated, and it would have angered ConfigLib. There are effectively no other ways to accidentally activate it. They don't all need to be short variable names, but about 22% of them need to be. Maltiez was targeting a specific modder, the creator of the paid cheat mod.

Undeniably caustic. Being caustic is externally viewable. Repentance comes from within. What (if anything) would you (@anyone) accept as a genuinely repentant Maltiez? Would it even make a difference if he was somehow verifiably repentant? It's fine if there's nothing and if it makes no difference, just trying to understand better. No worries, horse isn't going anywhere. Welcome to the forums!

I think these are reasonable takes. He indeed never denied it... not that we'd want him to. He definitely didn't regret it in the beginning and was his usual caustic self about it when confronted. He has apologized since and I don't think we can confidently say he doesn't regret doing it. Lot's happened since, and his lack of regret isn't carved in stone. If "access to code" is important to you, you may be interested to know he kinda doesn't right now. I understand if you just want him gone regardless. But if it's "access" that concerns you, he has as much access to the code as you or I do right now. He maybe has a tiny bit of additional read access to the small, obfuscated portions of the VS client, but no additional write access. He can't sneak anything in, even if he felt like it. Software development practices don't require trust, because trusting the wrong person can mean horribly bad things no matter where you go. It can also just mean your project slowly devolves into buggy spaghetti in the long run. From what people with firsthand experience have reported, VS has high standards before code gets approved and checked in.

Without some sort of complex provenance system this is far easier said than done. There's actually a lot of code that can wind up in a DLL that won't be in a source release, for legitimate reasons. Maltiez's ConfigLib DLL contains a Yaml parser (AdditionalStuff.cs hid itself inside its namespace), but it's not in the source release. Just a dependency. You can also obfuscate or not publish your source. We don't know, but someone does. Since we know that this all took place in a Discord server, if it still exists it'd be *really* interesting to see any logs of what went down. I doubt the customer support is stellar, but if you have a Discord server full of people all saying that "It has to be your fault, I disable your mod and all the crashes stop", that'll hamper new sales. Do want to say that you're 100% correct, the premise is flawed. I'm of the mind that all client-side anticheat is ultimately pointless. You're running in someone else's home, and eventually the house will win. I have written in the past that Maltiez's approach is the only one that could have worked for any amount of time. But every time I write that, I also (try to) include that it was still a bad idea from the very start. When I talk about how it is the only way that it could have worked, it's specifically to debunk the idea that it could have just been split out into its own mod. The idea's broken, but the suggestion's even more broken.

It is here:

Wow that's substantially worse than I was expecting when I went looking.

You didn't say saves, I didn't say saves either. Dorf said saves, Dorf was the person I was responding to. No legal assessment needed for the technical question of "Did this thing cause save corruption."

Don't disagree at all that this is Not Good. Unfortunately this is inherently a technical topic, and that makes it easy for misinformation to spread. The targeting mechanism is very technical and easy to telephone into a variety of incorrect things. Solutions are also very technical and people are throwing around words they don't understand and that they don't understand the complexities of. From the start to the path forward, everything's very, very technical. And a lot of people, now that they've lost trust, aren't willing to just accept "trust me, technically it all makes sense." Again "makes sense" doesn't mean "is fine" or "was a good idea." It just means that a lot of the suggestions or demands or worries are based on misunderstandings.

News story broke on discovery, its history of course goes back further, that's part of what we're all discussing. I'm not enjoying bickering over semantics. Let me know if you want to chat about something else though.

Those aren't opinions, they're facts. Well, with one tiny correction. Placed inside another library's namespace* It was found and identified at the beginning of the story. Again, the topic of discussion was a vacuum of information. Nobody's disagreeing on what the code did or how it hid itself. Those have all been identified from the beginning.

The existence of the code is the thing that broke the story. We've known about the code since it became a story, because it wasn't a story before then. It's a short file, it can be read in a single sitting, its full behavior breakdown was available same-day. There was never a info vacuum on that. What I was originally talking about when I mentioned an information vacuum was Anego needing to mention the false positives in their announcement. Not giving clear information on the scope of the false positives is the present vacuum left by their statement. Because the behavior of the code is well-understood for anyone who cares to. If you yourself are unsure how the code behaves, I recommend the breakdown in the first post of this topic. It's short and covers everything. AdditionalStuff.cs doesn't really do much.

No, smuggling malicious code only destroys trust. Not speaking on it creates an information vacuum. You know what they say. It take years.

Coming back around to this now that it's morning, what Cetasaya wrote was specifically It's pretty clear to me that they meant that the devs covered up behaviors of Maltiez's code that the players had to uncover themselves. Cetsaya really didn't mention any of the other potential issues with the announcement or with non-official Anego statements like from Vallen, they invented something new beyond any of that when they talked about the "functions of this malware that the devs have hid."