icesharkk

oh i see what you mean. not that wasnt what i had in mind. just a collapse of the threads on the topic and basically say "be civil and keep it in here until we have our own statement on the topic." this came up because earlier this morning all of the threads on the topic were getting locked and removed and there was no where to reference the info or continue discussion. it was not a good look for the company and it was relatively quickly undone but the threads remained locked.

you misinterpret my statement. i asked for a megathread where we could all safely discuss this without spilling into a half dozen threads. I have no expectation to rush the official statement regarding the incident or the consequences.

i asked for one. but there hasnt been any response or action taken.

I really feel for this. this cannot not be pleasant to deal with, but it also shouldn't be pleasant to deal with. its a big deal. and its my honest hope that Vintage story continues with its standards and ethics intact. it is critical to that end that that continued action by your studio does not further erode user trust. allowing the discussion to continue. and allowing us to wear our selves out is the probably the best move. We are (im)patiently waiting for the official response and next steps naturally take your time outlining that to the best of your ability. in the meantime the user base should discuss this (civilly!) because it is big deal and how its handle is a big deal.

Update: Tyron's official response on 3 Sept: Maltiez is a long time mod author and recent hire to the dev team on Vintage Story And here is the haste bin link deep dive on the discovery: https://hastebin.com/share/uqeyuhirof.markdown

can we get a sticky on the forum for this topic with an appropriate title. while zaldaryon unlocked the original thread it did have an aggressive name and tyron has come back in and locked it again. at least it remains visible for now. a thread with a clear title indicating the discussion is about the maltiez situation, malicious code in the moddb, and broken trust within the playerbase?

I just want a place where we can record the public statements and information so far so that it can be perused by other member of the community. there is a lot of misinformation as well as blatant minimization and spin going on. and not just the cherry picked stickied PR safe stuff in the discord.

edit it did not like my photos the way i added them initially. reformatting.

FYSA Multiple threads from this forum related to the ongoing incident are now being removed without feedback by the staff. Zaldaryon restored the removed threads.

a distinction without meaningful difference. the code was written in a manner to obfuscated its presence during troubleshooting and investigation. i keep seeing people saying the code was plain so it wasnt obfuscated. no it was just missing from the public repository and sideloaded by the dev for release on moddb. thats concealment if i've ever seen it.

thats my screenshot and there is something i want to clarify about it: the bigger issue is not that they knew about it since it is not clear what was known by whom. maltiez was unsurprisingly not truthful with them either. the bigger issue is that seleksta seems to think that its okay since he didnt break the devs trust only the users trust and the devs can trust him to commit safe code in the future. which is a shit take for two obvious reasons. ignoring the broken trust of the users is egregiously tonedeaf and trusting a known malicious actor with access to the supply chain is an insane litigation risk. its entirely possible maltiez told them "hey I put anti cheat in one of my mods" and they were like yeah sure seems fair. which is different than him saying i put deliberately malicious crash codes into my mod library, hid my tracks, committed it from the public github and covers all logging tracks on it. I'm not ready to assume that the devs were fully informed when they took no action yet. but it is still a possibility.

we cant even scope the damage down to innocent users because *checks notes* maltiez code erased its logging footprint and covered its execution environments tracks to prevent attribution of the crash to configlib.

theres also a lot of rug sweeping and minimization going on. bottom line maltiez pushed known malicious code to thousands of computers. Thankfully there was not credit card theft/ransomwhere/etc highly illegal consumer exploitation but that doesnt change the definition of "malware". the fact that his intent was noble is completely irrelevant to the impacted users. We cant even properly assess how many were impacted because his code deliberately obfuscated its contribution to the crash reports and runtime errors in order to remain hidden in the first place. Furthermore this shows maltiez is willing to violate of ethics, moddb terms of use, and several laws in pursuit of his own version of the greater good. someone who chooses not follow rules they dont believe in is one comfy justification away from repeat offense.

i want to be playing vintage story next year. that isnt going to happen if they retain a significant supply chain risk on their dev team. neither from a risk to my own users standpoint nor from a simple ethical principles standpoint. the facts that outline maltiez action and culpability are already nailed down and not up for debate. how cognizant the VS team was is another matter that remains to be seen as well as what they are going to do about this. but maltiez has already crossed the Rubicon.

oh that's just adorable.

you might just be out of the loop. which part of this do you believe isnt a fact? we can provide the links as needed

well, I for one am glad we cleared that up. integrity is not harboring a known malicious actor and continuing allowing them access to the supply chain for a product your users expect to trust. no amount of oversight and code review is going to make the PR problem or supply chain risk defensible in a litigation circumstance.

the code was obfuscated. it scrubbed its log footprint and obfuscated the crashcode execution timing through delays specifically to prevent attribution of the crashes to configlib. And yes it was not in the github repository maltiez injected it only into the packed moddb release. which further indicates that he knew what he was doing needed to be hidden. the intent is not up for debate since the intent is completely irrelevant. the outcome he is responsible for is the installation of malicious code onto thousands of computers for his own purpose and to further his own interests without the consent of the user and owner of the computer that was compromised. further statements by seleksta indicate that they at least think hes not a risk on the team since the dev team already knew about this and therefore he didnt break the dev teams trust just the users trust and thats what matters. the truth is probably very complicated miscommunication between what was disclosed verses understood byt the dev team. but the interesting part to me is seleksta being fine with the users being compromised as long as the dev team knew about it. that adds another fool to the pile of anti consumer nonsense in this story.

reasonable. i must note that while i am quite the vocal member right now pointing out the inconsistencies and doublespeak going on, we have not gotten a proper official response from the studio itself nor and list of consequences/next steps. please wait to see what happens next before you decide on your future involvement with the game. this may simply be resolved decisively and cleanly. Vintage story is one of my most beloved games and if i have to drop it because the studio cant be trusted that will be a very sad day. we are not at that point yet. its a lot of confused and angry people trying to damage control and inadvertently covering up the issue instead of resolving it.

why take the chance when maltiez himself originally said he did nothing wrong and doesnt have to explain himself? A mindset that does not respect the rules he doesn't agree with will violate them again.

thats possible. the only person on the VS side of the house that has acquitted themselves well during this is shadowfox. everyone else is just a screaming user (me) or a panicking dev or T.read *rolls eyes*

imo the discord mods moved the discussion to off topic" so that they could justify issuing 30 day bans with no warnings. especially since this is the fastest way to cull the discussion and silence the dissent. even if that wasnt why it is what's happening. people are encountering the news for the first time going to the discord to ask whats up and getting slapped with a 30 day ban preventing them from contributing or engaging with a very current issue with the game, moddb, and game studio. even if the mods are sick of hearing about it doesnt really matter eh? the community is not done talking about it. the community is not even done hearing about it and getting caught up on the news. except for shadowfox. that person has the patience of a 100 year old saint.

wonderfully articulated. and thank you, i thought i was losing my darn mind.

so its fine that he breached our trust and run code on our machines without our consent because you knew about it in advance? im sorry no. without significant retraction and consequences i will not be endorsing vintage story moving forwards. this is is a completely f'd take by sekelsta. edit: "furthermore this is a breach of the ModDB Terms of use page, Section 2 of Mod Uploads states: "You warrant that the mod contains no harmful or malicious code"" so sekelsta openly admits that Anego studios had prior knowledge of malicious code contained in one of the mod libraries in violation of their own moddb terms of use. Took no action. and is now claiming that it was okay because he didnt break the studio's trust? did i get that all right? or does another dev want to shove the foot further into their mouth?

hey!... share~