Teh Pizza Lady

And the only way that's going to happen is if he's fired and in regards to that EU law must be followed. It's a real hassle to terminate anyone in the EU.

They won't be satisfied even if he rots in jail and is buried in an unmarked grave. Look at what mob justice did to Jacopo de' Pazzi.

I think you underestimate how many blocks you touch/handle on a daily basis. Those blocks are still only getting updated once, especially the trees and mined areas. Even increasing the world size from 100MB to 1GB to account for anomalies and outliers is still nothing on today's hardware. A minimal 40GB droplet from Digital Ocean would be enough to run it, I think. That is why the server-side ledger is necessary. If block changes happen without being tied to a user because of the hack, then they are rejected. But everything has a digital paper trail. The client sends the information to the server. Even if the client doesn't identify the user, the client can still be identified because it is sending the information to the server. The server can be modified not to accept information without a user id attached to it. And if that information comes without a user id, the offending client is disconnected.

the qualification of "harm" here is subjective. so we would quit drowning out actual threads about the game with another new thread. This is a concept known as a megathread, which some of us have been asking for since this whole thing exploded. Because the rest of your post is just you reading between the lines stuff I didn't say and never meant, so the rest of your comment isn't even worth responding to. You know the saying, "Never play chess with a pigeon..." Came here to say this. People still play Minecraft even though Micro$oft is a corrupt company. This is the correct way. Take whatever personal action you feel is necessary. Hush and leave the rest of us alone on your way out. (Not YOU, personally, but the ones saying "I'm taking my refund and recommending others do the same.")

the solution is much more elegant than that. Just tag each block in the 3d space with who modified it and when. If the block was removed, then it gets no more updates until it gets replaced with something else. At most it adds 50-ish bytes to the map per block when it's added or deleted. You can stage rollbacks from that by looking at the timestamps and replicating the most recent valid state of the block at the desire date and time. on a server with 200 players you're looking at an increase in map size of about 100MB at most after several hours of playtime if each player places or deletes 10,000 blocks each.

nevermind that what he did was BEFORE he was on the payroll. If I sneeze on an old lady's shoe and then get a job at a hospital are you going to want the hospital to punish me for what I did before I got there? Doesn't make sense. This whole thread is a certified "We did it, Reddit" moment. The cheat mod went away. I call that a win. No one got physically or monetarily hurt in the process. They just couldn't use certain mods for a bit until Maltiez remember the code was there and pulled it. And then put it back to spite certain people and then pulled it again after the backlash got out of hand.

What I would do is stop relying on the client to determine if certain actions are valid based on whether the player is an admin or not. Everything authenticated on the server. Then I would remove the ability for client side commands to change anything that affects the sever as a whole, for example changing your character's look and feel is currently a client side action that is enabled via server command for an individual player, but that command requires elevation. IIRC the cheat client in question was telling the server that the player using the commands was an admin and the server was just accepting it blindly instead of verifying against a list of known admins and shutting it down immediately. Also the server should disconnect users that fail validation like this. Second what I would do is track what each player does and store it in the world save itself. A block removed? How? Who? Was it done within the confines of normal gameplay (did the player use a tool or break the block instantly)? Removing an offending player should remove anything and everything that player did through a recursive undo as long as it doesn't intersect with something another player has done. This and it's in line with making sure everything is authenticated and validated correctly on the server, not the client. The first rule of multiplayer programming is that you never rely on the client to tell you it's allowed to perform a task. Always verify, authenticate, and double check that the client is not lying to you. Does it increase network overhead? yes, but not by a lot.

Well the ambiguity bothers me. That's about the only way I can phrase it without triggering certain individuals to come after me and my report button is already worn out as it is.

you mean 50% of the people that voted. I didn't vote. A lot of people don't use Reddit. I agree with @LadyWYT here, that the Reddit poll means absolute bunk in this situation. Anego made their decision. They made it within the EU laws governing termination of employees with cause. They made it with consideration of the importance of what Maltiez is doing for the 1.23 update. They made it knowing that it would be extra work to closely examine all his submitted work, so they, in good faith, can say that he did not submit anything containing any malware to the base game. Anego made a decision that wasn't yours, mine, or anyone else's to make. They just so happened to choose something other than what you would have chosen. It's not about you. Get over it.

this is what I mean. Hit box issues, the inability to hit the target while using a shield. Attacks that hit the shield splashing through, etc, etc. I'd implement real, locational damage for each limb, the head, and the torso. And I'd make projectiles model real world physics in the case of arrows and spears in terms of trajectory and damage upon impact. Also a female player model.

I'd work on making combat good and intuitive so that players don't have to create massive mods for it themselves.

The only thing I'm "salty" about at this point is just the lack of an official statement on the forums.

The resolution is sufficient. Anego weighed the severity of Maltiez's actions, his importance to the 1.23 updates, and the legals risks that come with firing him without notice in the EU and decided that keeping him on under observation was the better course of action. Seems resolved to me, sufficiently I might add. I'm terribly sorry that you're not getting your way, but you've grown from keeping a level head and only stating the facts to jumping on the "can him anyway" bandwagon. disappointing...

I looked at that mod and didn't like some of the potions it added. Seemed too overpowered.. lol

Bumping to say I did some research on the existing flora and I have found enough evidence that a reality-based potions and poisons mod can be created so that is what I've been doing with my time as of late. My design document is 125KB of pure markdown, collecting my thoughts and research into the game's code.

But there is a huge difference between altering logs that are already written and crashing the game in a way that doesn't point the finger at ConfigLib. That's a distinction worth noting because ConfigLib did NOT write to your filesystem. It made zero changes to the system beyond forcibly crashing the client if it detected code what was within parameters for being deemed "suspicious".

get out of my head get out of my head get out of my head get out of my head You're saying what's niggling at the back of my mind... get out of my head.

isn't that what dictionaries are for? I agree in a non-technical sense, your linked definition holds up but once technical things start getting thrown into the mix, definitions change drastically. Remember a theory is just a theory until it becomes scientific.

this comment should be fine. It's when the comments delve into personal attacks, hate speech, and other things that actually break the rules of the forums that the moderators are forced to take action. Some users seem more inclined to do that than others, but this comment is fine.

That's a fair point, and I don't disagree that there's some trust relationship at play here. But it's worth being precise about the mechanics, because I don't think it's as direct as "Anego holds your payment info." Anego doesn't actually hold your card/payment data themselves, that sits with their payment processor or bank, same as basically every online storefront. And it's worth being precise about that since my earlier comment is now coming under fire. Anego wouldn't have your card number just sitting in a database somewhere. What they'd have is transaction records tied to your account (name, order history, maybe a billing address if one was entered at checkout, I don't remember because I didn't actually buy the game; it was gifted to me). If someone wanted to actually pursue legal action and needed to identify a person behind a username, that's a subpoena to the payment processor, not something Anego could hand over directly even if they wanted to. And separately, that trust relationship, whatever its shape, is with Anego as a company, not with any individual dev. Maltiez doesn't have any special access to billing/payment records any more than any other non-billing team member would. So "he violated trust, and Anego holds my payment info" doesn't really chain together unless the claim is that Anego's handling of him is itself evidence they're bad custodians of financial data generally, which is a much bigger claim than "I don't like that they kept this guy on." My initial point wasn't even in regards to whether they could be trusted with that information, and instead it was more to the point that if this type of discourse continues to say untrue things about the company and it hurts their financial bottom line, then they have every right to pursue legal action and we, the players, aren't as anonymous as we think we are. Worth being precise on the technical side too, since I've got firsthand experience here: I've submitted pull requests to the actual game codebase and had a chunk of it rejected for not meeting their standards, had to rewrite it, eventually got a fix in for a bug that had gone unresolved through 5+ reports. Their review process for anything touching vanilla is genuinely rigorous, multiple sets of eyes, scrutiny on even how something's written, not just whether it works. That's the important distinction with ConfigLib though: AdditionalStuff.cs was never subject to any of that. It was Maltiez's own independently-published mod on ModDB, completely outside Anego's review pipeline. The process didn't fail to catch it, it was never in scope to catch it, since that pipeline never touches third-party ModDB uploads. So the real risk question isn't "will review miss it next time," it's "does Maltiez have another unreviewed channel to end users right now," and from what's been laid out (no commit access, no ModDB presence anymore, everything funnels through the same review as anyone else), that specific channel looks closed. End of story. None of this settles whether he should have been kept on, that's a separate question people are still arguing ad nauseam. I just don't think the payment-info angle adds much weight to it, since that particular trust relationship doesn't actually run through him and never will. Again, the term "obfuscating." People really like to use words they don't actually know the definition of, and "obfuscating a crash log" doesn't even make sense in technical terms. What Maltiez did was force the crash logs to not name ConfigLib as the source of the problem, so the cheat mod dev would have a harder time figuring out why his mod suddenly stopped working. As already pointed out, the fact that he didn't disclose what he was doing is exactly why it worked, and that cheat mod in particular seems to be one Anego and a lot of affected server owners had a real grudge against, given how hard it apparently was to deal with until Maltiez decided to take matters into his own hands. But that's beside the point I'm actually making. Hiding something and misdirecting attention away from it isn't the same thing as obfuscating it, obfuscation is a specific technical term with a specific technical meaning, and it doesn't describe what happened here. There's already way too much telephone happening with the known facts of this incident. If people are going to keep discussing it, it's worth actually being precise about what did and didn't happen.

What an odd place to tuck that information. I never would have thought to look there. Okay well thanks for clarifying!

False. It was very easy to find it and figure out what it did once people knew it was there. Maltiez did not try to obfuscate his code. That is a programming term that means to scramble variable names and properties within the code so that anyone who decompiles it will have a very difficult time understanding what the code does. That is what obfuscating code means. The code was not that. It just wasn't in the public repo. It is no more obfuscated than the code that runs Seasoned Firewood Redux, Injury Expanded, Inventory Transfer or Antique Tuning Cylinders, just to name a few mods that don't even HAVE public repos. Are you going to say those devs are obfuscating their code and thus incorporating malware into them? Because that's what you're implying here and it's provably wrong by the four examples I just gave you. Finally a voice of reason... It's a wonder the moderators haven't come down even harder on these forums because we're not in the off-topic section. People talk of censorship, but I think the powers that be have been extremely lenient and only stepping in when things are going too far to an extreme. That said, I wouldn't mind seeing all the dissenters just getting their refunds and having the door smack them on their way out. All the negativity does is breed more negativity and in my opinion, these forums are no place for it. If people want to have a healthy discussion about the topic @icesharkk created a thread for that. All these other noisy threads filled with negativity that keep popping up just need to go. Closed, locked, hidden from sight, whatever, just gone. But maybe I'm just salty because all this talk about he said-she said blah blah blah has drowned out my thread about the uses of flora in the game. You know... ACTUAL game discussion that ACTUALLY belongs in the game discussion forum? Pepperidge Farms remembers. Technically, he's not listed on the Discord any longer since he voluntarily left for "reasons". Clicking his profile shows that he's no longer in the VS Discord. Just wanted to make that small correction.

yeah, not really a good idea to slander or libel someone who has your payment information which includes mailing address. EDIT: NOT that Anego would use this information to pick on individuals indiscriminately or nefariously, but if push came to shove and it hurt the company financially, then they would have grounds to pursue legal action.

not to mention the potential for backlash if, say, someone really spreads the word that Anego just makes malware. Pretty sure that slander or at least libel both of which are actionable in courts of law. The censorship protects both parties.

*gently pats on head* It's okay. Everyone is drinking stupid juice around this topic, myself included.