icesharkk

for anyone who doesn't get this i have a world leader to sell you on. maltiez is unrepentant and caustic. His forced remorse is just words. his actions have caused harm but the consequences heal nothing. The studio response served only to paint Anego as cut from the same cloth as maltiez by association, similar lies, ethics, and disdain for the paying user.

By retaining malties Anego is putting their own feelings ahead of the best practice. By ignoring and erasing the impact to the victims of collateral damage Anego is proving that they prioritize PR over their paying customers. By praising the effectiveness of maltiez' operation and targeted action they are siding with the distribution of malware and lying about its collateral damage. As a result Anego has proven themselves birds of a feather with maltiez. the fire is certainly out.

bottom line people arguing over the definition of obfuscation and the definition of malware are just people grasping at straws to minimize the situation. they have no better argument because there is no better argument. malware was introduced to the game. the individual responsible is being retain to continue working on the game. end.

this is why actual anticheat is made a required install by the core game. You know, in normal legal business practices. I really dont see much value in trying to point out that they way he went about it "makes sense" "from a certain perspective" because its ignoring that premise is flawed. This was NOT the only way to combat cheaters. Allegedly Anego already declined to include the anti cheat in their game. it was the only way left for maltiez to combat cheaters on his own personal crusade. Per his own words this was not about protecting servers it was about attacking the cheat developer.

and this technique can never work again. since all the modder has to do is play spot the difference between the github and moddb release. or do the literal basic server modd list troubleshooting to find the incompatibility. This was an incredibly fragile approach to anti cheat and entirely circumventable once discovered. Furthermore the idea that this anti cheat is why the cheat author ceased operations is and unfounded assumption to being with. VS isnt a large enough userbase to make a ton of profit on cheats with so its equally possible the cheat author left in favor of a community with more members to sell to. perhaps influenced by the crashing or perhaps irrespective of the crashing. its not like he cares if who he sells too crashes after they purchase. I doubt the customer support on paid cheats in tiny communities is stellar.

you would think so. I would have agreed with you but I'd say half of my messages on here and reddit are arguing with people who wont read the Wikipedia or webster's definition of malware because it doesn't support their narrative. Webster's is the best btw "software designed to interfere with a computer's normal functioning"

ah shit. I am sorry. in that case i have no opinion on DT ignite at this time and i am sorry for jumping in to disagree with you about the wrong thing entirely.

I'm not even going to argue that PUP is a subset of malware anymore because more importantly: involuntary and deliberate denial of service or disruption of the runtime environment of the users applications is NOT pup. It meets the criteria for intent to harm. the fact that he missed and shot bystanders does not in ANY WAY remove the intent to harm. intent to decieve is met by the techniques used to prevent attribution of the crash to configlib when troubleshooting and delaying the crashcodes to further conceal cause and confuse troubleshooting. I stand by what i said as it relates to maltiez but @Teh Pizza Lady was talking about DT ignite and i am over here arguing with a chair. beddddd~~~

ah i think the lies they're referring to are not the coverup you were asking for proof of. I can definitely say the lies i'm talking about are things like Vallen stating "its not malware" in the refund request, Tyron stating only <100 cheat users were affected, and the operation was targeted. Lies by omission and bald faced lies about the targeting mechanism of the code itself. but im tired and i need to get away from this place for a while so i'll check back in the morning if i can sleep.

im too tired to keep track of your shifting goal posts. what argument are you trying to make right now? that Anego didn't hide functions of the malware? Technically maltiez is and continues to be a member of Anego but lets leave that aside. what are you proving by stating that Anego did not hide portions of the malware or take actions to cover up?

Do you not consider hiding it from the public github and sideloading it before hosting it on moddb to be hiding aspects of its function from the public?

I have lost trust with Anego studios as a whole because of their choice to protect and laude the malware developer. They are not acknowledging or devoting they efforts towards preventing this from happening. They benefited (until he was caught) from the actions he told them he was going to do. The way this stands, with Tyrons response, I do not trust this to be the last shady thing they do. you're right it probably wont be malware. but that kinda misses the point. You observation makes this worse. You are pointing out the obvious fact that the "consequence" of maltiez "having oversight" is just status quo and that Anego isn't taking this serious accountability or changing anything to actually protect the consumer..

this is a smaller snip of an image in my toplevel post for this thread. it also affected 8 releases of configlib itself :1.10.9, 1.10.10, 1.10.12, 1.10.13, 1.10.14, 1.11.0, 1.11.1, 1.12.0 ranging from November of last year to 5 days ago. (edit to first sentence. more polite) Not really, since there is no granular permissions control for VS mods like you see with iphone apps it didnt have to be configlib. configlib was ideal because of its incredibly widespread install rate within the player base. maltiez added a poisoned file to the released hosted on moddb (so the github repository was always sparkling clean) that ran when your client connected to the game. configlib's scope or interaction with the game client was mostly irrelevant to the malicious logic. the criminality of an act and the prosecute-ability of the act are separate things. distributing malware is illegal, but the likelihood any actual legal proceedings occur seems low because evaluating the scope of harm is difficult and making it stick through the user's tacit acceptance of third party software when modding. I'm not a lawyer just been yelled at by enough of them over the years.

The more time that goes buy the more likely the community will say you only did the right thing because the outcry forced your hand. I for one will have a significant portion of my faith restored immediately if he is removed from the project and his full impact of actions are honestly accounted for (unlike Tyron's response). ill pack up my things and return to my cottage core survival craft, and I'll fight with anyone that continues to spread misinformation about he situation. Ill got back and edit any of the messages where i mentioned tyron/Anego's response being inadequate. I am not afraid to be wrong. I know many who will do the same. will there be drama still? yeah but it wont have any more fuel to burn.

your frustration with the gloss over is reasonable. just know that that, thankfully, the crashcodes were only triggered on client instances in multiplayer and limited to vintage story itself. so it unless several other things went massively wrong it is unlikely that maltiez is responsible for the situation you experienced. at least as described. but yeah the rest of it is crazy.

I can describe a victim as 1. anyone whose personal computer was subject to deliberate but undocumented code execution that disrupted the runtime enviroment of their purchased applications. 2. Any server team or owner that spent tens to hundreds of manhours trying to troubleshoot a client crash issue that was intentionally setup to evade attribution to the offending mod. None of this is punishment. punishment is a training tool. We are discussing consequences. Consequence is the result of your actions. Access to code on opensource projects is a privilege reserved for the trustworthy because the potential to do harm is great and the safeguards aren't perfectly effective. Per industry standard the consequence for betraying that trust is immediate and permanent removal from the project. There are enough supply chain risks and uncertainty out there that it is beyond imbecilic to allow an untrustworthy actor continued access to the supply chain. that Anego is now choosing to protect him after the harm he's cause and the trust he has broken, while also erasing the impact to the victims is what shifts my opinion of Anego nearly as much as maltiez initial actions.

your good man. I'm not attacking you, merely expanding to include more complete list of the issues with Tyron's response. Tryon's response erased my remaining benefit of the doubt. they are choosing to stand by the problem, omit and erase the victims, and borderline praise the actions of the perpetrator. My lack of benefit of the doubt is beginning to make me suspicious about the sequence of events.

if you ignore the part where Tyron and co were aware of parts of maltiez efforts for months, and you ignore that Tyrons response omits the hundred to thousands of innocent users impacted by maltiez code triggering with no cheats present, lacks meaningful consequence beyond status quo oversight, and goes on to paint maltiez' actions as targeted and successful. Then sure you can say this happened on the mod side of things. The issue i have now is that with Tyrons tepid response is that he has shifted this beyond maltiez to erode my trust in Anego.

At what point is it too much for his continued employment? when he reinstated the malware out of spite after caught? when he told the justifiably upset users to take their drama elsewhere? when he misrepresented the code to his current employer either out of ignorance or maliciousness? when he caused, through deliberated manipulation of the mod distribution trust relationship the installation of his malicious code on thousands of machines? when he admitted that this "was never about protecting servers" "the sole purpose was to make a specific cheat author waste enough time"? this isn't about punishment or reform. its about baseline consequences for already taken actions.

wut. if the code is validated against the public repository then the logic needed to "pop a hidden DLL out of that PNG" would be present in the repo to be discovered by independent review. thats the entire point of independant review. you're right that this sort of transparency doesnt stop immediate malicious code distribution but it goes a long way to improving the security of the moddb and specifically prevents the exact mechanism that maltiez used to to secure 300,000 plus downloads of his poisoned library over a multi month period.

that is the Russian word for gun. arresthor appears to be recommending self harm. Naturally please do not listen to them. your emotional well being is much more important than any game and that individual has essential resorted to name calling in all threads. You have a right to be upset at this situation.

there is nuanced difference between the malicious logic maltiez distributed and other more egregious acts of malicious logic. true I agree that Maltiez should not be retained. this is not because the intent or outcome of what he did wasn't severe. it is because the action take to achieve it is incompatible with trusted opensource software development.

exactly the rightfully outraged customer is not the responsible party here. These are the consequences of Maltiez' and Tyron's actions and statements.

I concur. this degree of harm and the impacted individuals probably does not raise this to the level that it would actually see investigation or prosecution. the grounds would be tenuous because of the relationship between user and accepted liability for installing third party mods. No the bigger issue is how Anego is handling this and protecting maltiez ruins my ability to continue supporting or trusting the studio. Anego is allowing the fact that our servers were impacted, our purchased application was hijacked, and manipulated to go without mention or meaningful consequence and they are retaining the malicious actor responsible for it on their staff.

I appreciated vintage story until 11AM UTC yesterday. Now i appreciate vintage story but can no longer support or recommend the software distributed by Anego.