I have been a fan of Maltiez's Vintage Story mods for many years: he is an excellent modder with a high standard for quality content along with him being a Vintage Story team-member makes this betrayal shocking. This is case is far more severe than that of a similar case of malicious code inserted into mods for the game "Star Sector", the "Lost Forest" mod feuding with the "RJW" in Rimworld, or others.
It is completely inexcusable to include malware (deliberate crash code) in software you are transmitting to other users who are not both aware of and consenting. The fact that Maltiez freely admits to this in Discord and commit notes is shocking.
This is not 'white hat' code, e.g. crashing the Vintage Story program if it detects an infinite loop, memory leak, or similar serious problem with functionality. Protecting the user from harm.
This is not 'grey hat' code, e.g. 'defensively' crashing a program to stop hackers from accessing a server. Causing harm for justifiable reasons, e.g. 'ends justify the means', or in legally/morally vague ways.
This is clearly 'black hat' code, since it is undocumented, obfuscated, and can operate on legitimate paying Vintage Story customer's devices simply because of their modding choices, let alone any bugs which may have caused the malware to fire inappropriately. Causing harm deliberately and consciously, for harm's sake. Yes, this malware merely causes 'a hard crash', so it is not particularly severe outside of disrupting the Vintage Story application, but either is it excusable..
To deliberately add this code to multiple versions of a mod shows a clear pattern of intent that this was intended behavior.
To hide the existence of this crashcode (not documenting it) shows clear understanding that this behavior is unethical and 'needs' to be hidden.
Obfuscating the code shows further proof this author knew their behavior was unethical. Edit: Does not appear any of the mod's code was obfuscated.
The fact Maltiez defended his actions shows a clear lack of repentance and level his commitment to this behavior.
That Maltiez described his intent to add further code which would have harvested and/or transmitted client-side data, despite his inability to implement such a feature, shows a clear violation of user's privacy and trust, as well as potentially violating laws. Edit: This was merely discussed, with no proof it was ever developed or implemented. Though given the lack of transparency about this crash code, perhaps that should be taken with healthy skepticism.
Furthermore
It is particularly frustrating to see so much sustained and juvenile behavior from the official Vintage Story server's Discord Moderators. Harassing and insulting users who are acting reasonably and are understandably upset about this situation is inexcusable; including telling users to stop discussing this malware situation in a thread dedicated 'to' that mod, accusing them of being "off-topic", etc. Frankly, these moderators should resign, be fired, or be re-trained to a much higher standard. Very unprofessional and completely tone-deaf to the situation and seriousness, for the sake of 'internet moderator' "I'm an important person on the internet" bawking.
It is also painful seeing users in the Vintage Story official Discord server defending Maltiez's actions, especially antagonizing, trolling, and harassing other users. I understand some of these users may not have the technical understanding or context of what happened here, or are acting merely out of emotion for a beloved mod author, but this behavior is completely out of touch and shows serious ignorance to what has transpired and should be condemned. It upsets me that most of these conversations are still present in the Discord server, and there seems to be no moderation action taken against them.
In Conclusion
The Vintage Story community deserves a clear and direct response from Tyron once the team has decided upon a course of action.
I feel strongly that:
All of Maltiez's mods should be removed from the official Vintage Story website, if only temporarily pending manual code review. But until then the risk and severity of this case is too high for an author who so deliberately hide crash code from his own userbase over such a long period of time.
All of Maltiez's contributions to vanilla Vintage Story should require a manual code review. Anything less would seriously undermine the community's trust in that product.
Shockingly awful opinion. It is pretty disrespectful to call others "angry kids" and "absoutely nuts" when you clearly are either trolling or have no clue what has transpired. Crash Code is not inherently malware, but the implementation of it in this Maltiez situation is flagrantly malicious even by his own admission. Do some basic research in the future before spouting wild accusations about others. Rude.
