lizardsprint

You Also you Please re-read my message: It is impossible to know, because all of his code/contributions to the core game HAVE NOT BEEN RE-REVIEWED YET. Please learn what "could" means. "could" != "is". When you get back from reading the dictionary, and quit strawmanning, then we can continue this discussion. Until then, I have no interest in discussing with dishonest individuals.

I know what code review is. I deal with it all the time; no need to explain it to me especially after I've already given my background. I also didn't mention changes to the game solely related to "anti-cheat" code. I also mentioned that his contributions to the game could be doing other, or even worse, things, which YOU have no way of knowing yet until all of his code has been re-reviewed. So you are just speaking out of your ass here. So you lied then, and my original claim was 100% accurate wrt him hiding it from the git repo. The source code never had AdditionalStuff.cs, because he hid it from the git repo, and it was only in compiled builds. Not responding any further; I don't deal with liars and people who make strawman arguments (like claiming I said the code was obfuscated, when I never did).

Never say never. Every vetting process has holes, and people make mistakes all the time. This is like saying _____ is unhackable, or unsinkable.

At least someone here understands. He is objectively being deceptive, so who knows what all changes he made to game for his own benefit after being hired, regardless of whether the mod's code is older than when he was hired.

Hi. Perhaps I misunderstood the Vintage Story team's public messages regarding the situation there re: core API changes, especially after they said they were confident in the code he submits "does he says it does", but then later backpedal and admit they were deceived and his code was doing more than he let on. However, this is an ongoing situation that has contradicting information from various VS staff/devs, and his contributions to the actual game's code, no matter the intended purpose/what he was hired for, should be re-reviewed with more scrutiny, so it's impossible to say for certain he didn't do this, or even possibly something else/worse, until all of his code has been re-reviewed. I understand the actual malicious code was in the mod(s). However, I never claimed it was obfuscated, in this thread or in the other thread. I said it was hidden. If you could link AdditionalStuff.cs that'd be helpful, as checking Config Lib's code there's a very deliberate entry in the .gitignore to ignore anything with "AdditionalStuff". I also couldn't find AdditionalStuff.cs in other repositories/dependencies, but maybe I missed one.

I said "maybe they shouldn't have broken that trust" because (at the very minimum) Maltiez objectively did, who is also a Vintage Story developer, and some team members did, in fact, downplay the situation. Nowhere in this thread or the mega-thread did I throw insults around. I've explained my concerns as reasonably as I can, especially from my perspective of a software developer myself. Your response to that was to deny everything that happened, and immediately call me a "whiny child" and a "false snake", and say I'M the one in bad faith. Then, when others also called out your behavior, you claim to want to avoid this toxic community, when YOU are part of the problem. You are a hypocrite. Not responding to you any further; you are clearly too emotional right now to have a serious conversation, and I don't deal with hypocrites.

If anything, you immediately resorting to insults instead of trying to listen to other's concerns, is EXACTLY the toxicity you claim to want to avoid. You are objectively a hypocrite.

No offense, but I simply do not care about your opinion on this. And the community has literally nothing to do with the situation when the situation centers around the developers of the game (one malicious one, and the others for not reviewing his code as thoroughly, at the bare minimum). Your (obviously emotionally-charged) opinion on the situation and "the community" is completely irrelevant and doesn't change the facts.

My username is literally just the words from the auto-generated alias email I made that I originally used to register (lizard.sprint<numbers>@<email.tld>).

I've bought 16 copies of the game, one for myself and 15 for my friends. I ran a server for those friends. I'd say my concerns are valid. That is literally what happened. They've even admitted it themselves once caught. And this is only what we know of. Look, I'll even cut the rest of the team some slack and play ball with the idea that Maltiez is solely responsible, and that he did in fact lie to the rest of the team (what they're now claiming) in order to get these API changes into the game so that Config Lib could use those changes (hiding the Config Lib code that does this from the public git repo is another issue). What other changes of his got past code review into the game itself, that doesn't do exactly what he said it did? As a software developer myself, this raises HUGE concerns for me considering the game, and server software, has been running on my machines.

Pot. Kettle. Black. It's whatever, it's the Internet. People love to insult and project. Reasonable people simply just don't like developers of games deciding what mods they're allowed to use and hiding the code to do so, and lying about it being there, and other devs of the games downplaying that.

Maybe they shouldn't have broken that trust ¯\_(ツ)_/¯ They're an employee of the company; their actions, words, doing work on the game or projects related to the game, as a publicly-facing employee of the company can harm the company's reputation if what they're doing is malicious, especially when other employees and even the CEO downplay the situation. Welcome to the real world.

It feels so malicious because this is what a lot of software developers that end up torching their reputation and putting actual malware (ones that will encrypt all your shit in exchange for Monero, and/or steal your wallet keys, ID documents, bank login credentials, etc.) into their software do. He's literally following in their footsteps, and it's likely he would've escalated had he not been caught.

It's really not a tricky situation at all, and their actions so far have been showing the exact opposite of this, that they don't really think this is a serious situation. I don't deal with games, or developers of games, that intentionally harm/degrade the experience of players because of their own grudges or insecurities, whether it's with DRM like Denuvo, always-online connections/spyware, rudimentary "malware" like this one, or of course actual malware in games. The "motive" does not really matter. The "motive" behind Flock/Axon cameras is to "stop criminals" but they are routinely abused for cop's or random 3rd party individuals with access own personal interests/motives. I have plenty of other games in my library whose developers let me play how I want that don't have a track record of endorsing, or downplaying, harmful software in their game/mods, especially by one of their own developers. No need to bother with wannabe-arbiters of gameplay.

Same. I've bought so many copies of the game for people, too, which is sad. I ran a server for all those friends, but have decided to shut it down tonight after learning of this, will warn all of them and others, and uninstall the game myself. Sure, in terms of malware, what's currently known is rather tame in the grand scheme of things, compared to actual malware that scans for personal documents, cryptocurrency wallet keys, etc., but what else is there that we can't see, especially in builds of VS itself given he works at the company? Their downplaying, odd choice of wording ("we trust all his other code does exactly what he says it does" especially after already knowing about the malicious code), and backpedaling/contradictions is all very shady, and I just don't want to deal with that broken trust or have their code running on my systems. I have plenty of other games from much more professional developers in my library.

In addition to the dotnet package, the Vintage Story server also requires screen, so you should have the screen command available on your system. You should be able to run screen -r on the machine VintagestoryServer is running on; this will bring up the server log, and you can enter commands here as the server. When you are finished, press Ctrl+A, then Ctrl+D on your keyboard to detach from the server process without killing it.