Paruza
Vintarian-
Posts
7 -
Joined
-
Last visited
Content Type
Profiles
Forums
Blogs
News
Store
Everything posted by Paruza
-
It will unfortunately. But that can be mitigated by ultimately taking a hard line on this kind of abuse. This is 100% of the issue. You can make an anti-cheat mod if you would like, VS can add anti more official cheat measures if they want, All of this is fine as long as you are disclosing this activity and your customers are agreeing to it via a EULA. But stuffing malware "anti-cheat" into a mod that has nothing to do with that? That is straight up illegal and is a serious offence against supply chain trust. However much people like his mods, the right answer here is additional transparency and banning him from moddb. Followed up with a review of moddb policy as well if needed. I wouldn't go quite so far as that yet. It's hard to know really how many people knew, and if at the time they really understood the gravity of these actions. I totally understand and forgive the disjointed response so far, it's easy to see how that can happen. Some team members knowing about a thing, but not really connecting with the problem, isn't the same as an official response by the company. Let them sort through it, and we will judge their actions after.
-
It's not useful because it's not the important part of this. I don't care what his motives were, literally at all. What he claims his motives to be, cannot be taken at face value at this point. His actions are costing a lot of people a lot of time auditing his code, forking it, etc. To say nothing about the admins having to do extra work removing his mods and dependencies, cleaning up their worlds, debating this on forums. And the damage and efforts the dev team themselves will have to go through to resolve this situation as well.
-
I agree completely with this. I'm not angry with the VS studio *yet* . It's easy to see how this can happen, it's easy to understand how the communication thus far could be misguided and fragmented. It's not optimal, but I'm fine with that. What matters is what they ultimately decide to do. Fortunately there's plenty of past examples of how you deal with this kind of thing, and the consequences for the studio if they don't handle it well.
-
"Many game companies have hidden malware in their code that breaks the game if you pirate it." Depends what you mean specifically by "hidden". Games that have invasive anticheat definitely are very clear about what general capabilities it has, and you are agreeing to that when you install the game, accept the ToS, etc. The intent is not at all hidden. One could debate about the details, and there's plenty to be said about how problematic kernel level anti-cheat is, but those are different topics. "Yes it wasn't something that should've been done, but it's not like it was harming people's computers." He did significant actual harm here. The core issue is one of trust. He abused his standing in the community to install malicious software without disclosing that functionality. It's harmed VS's reputation, this is going to turn people away from the game, it's going to create a press shitstorm. He demonstrated his willingness to behave in this way, so you can't trust anything he claims about the rest of his code. So now people are going to have to comb through all of this and verify if he is in fact telling the truth now. The amount of time he's ultimately costing people picking up the pieces from this is going to be huge. Aside from that, the people affected would definitely disproportionately not even be the intended targets. A tiny percentage of people play VS play on public servers. The VAST majority play either solo, or on private servers with some few friends. That's not an environment where hacking is a relevant point of discussion. I don't know the details on what circumstances would cause crashes and D/C's however I can say I've run a private server myself for my own use and used xray mods to learn how prospecting works and various other things. Nothing wrong with that, do you think I would want to be dealing with that bs? Do you think the developer that ultimately had to dig into his code to fix the problem it was causing wanted to be spending his time on that? I could go on. They really need to make an example of him, I don't care what mods he made, we can move on without him.
-
It's a really rough situation for VS honestly. It's absolutely not acceptable to be posting binaries on the moddb that do not reflect the published source. It's not acceptable to post things on moddb that take actions that are hard for users to understand or have nothing to do with the mods stated purpose. And, of course, it's not acceptable to knowingly post malicious content on moddb. All of this put together is absolutely grounds for an immediate lifetime ban. I am no expert but some of this may cross into overtly illegal territory in some areas: The United Kingdom: Computer Misuse Act 1990 (CMA) https://www.cps.gov.uk/prosecution-guidance/computer-misuse-act#:~:text=Section 3%3A Unauthorised Acts with intent to,will do one of the things set The United States: Computer Fraud and Abuse Act (CFAA) https://uscode.house.gov/view.xhtml?req=(title:18 section:1030 edition:prelim)#:~:text=(5)(A) knowingly causes the transmission of a,damage without authorization%2C to a protected computer%3B The secret part of this is important. People thought they were downloading a ConfigLib, not an "anti-cheat". Practically speaking, is someone going to come after him for damages for any of this? No, this is small potatoes, but it is almost certainly illegal in many places. This sort of thing has happened before in a lot of various ways, for various reasons. There was a case recently where intentionally buggy (effectively malicious in this context) code was submitted to the Linux kernel by some security researchers at the University of MN ostensibly to test the submission process, the whole school was banned from further contributions and an independent audit of everything they ever submitted to the kernel had to be conducted. Because when trust is broken... it's broken right? You don't know this is the only malicious thing he's ever done, he's demonstrated he's willing to behave in this way and now some people have to go over all his stuff with a very skeptical eye. There have been several cases of package maintainers taking similar actions in Linux repos, all banned. There have been various gaming modding authors doing various similar things, almost universally banned. There was a JS library author that published malicious code that destroyed data on computers that had geoip data pointing at Russia shortly after the war in Ukraine started. Totally understand that one honestly, but geoip isn't perfect and you bet people around the world forked that immediately. The question of if you agree with any of these or not is far less relevant than the question of ongoing supply chain trust. Is Maltiez just an important special little snowflake that gets to violate the TOS while others don't? Will this behavior if left unpunished cause other potential "do-gooders" to do some good on your computer as well? It's not *what* he did, it's that he did it in secret. What makes this especially difficult is that it seems that some members of the VS team knew about it and did nothing. I don't care if he didn't violate *your* trust, it's *my* computer.
- 946 replies
-
- 18
-
-
-
-
I think 1Zuras1 nailed it here as a proof of concept. Original logo is awful, it's very amateurish. I like the new logo, but people are right, it doesn't really match the rest of the art and theme of the game, it doesn't work in the current game menus, and the text is still little more than an unstyled font with a drop-shadow. I think this concept art demonstrates the wider issue that the gui elements themselves are also bad, the new logo could work *IF* the gui were redone to match that style. So overall, I think you need to think about the overall style you want, instead of the logo individually.
-
I thought it was great actually. You can hover over items and hit H, the guides are pretty complete, the survival handbook section covers all the basics including survival armor. Wolves are literally the only threat on the surface, and only exist in forests. They run after getting hit by two spears, killed in 3, copper spears kill in 2. They are only a significant threat if you have no armor, and initial armor literally takes just firewood. *However* I don't think the worldgen should allow a forest or water start by default. It should force a plains at the origin for the wolves reason, and other issues like spawning on top of mountains or in a lake. I agree, I think this is on his list already. I would love to agree with you Hal13, but you're unfortunately wrong. Translocators only go around 5k, in a random direction, you need about 30k on default settings to get to the tropics. Connecting the dots for that distance would be a large server community level project. On the other hand you can travel about 5k per in game day, so on single player translocators are definitely quite pointless. I made the trip and back to get building materials and seeds, wasn't too bad. I agree. Personally I think the map, and navigation should have expanded in game mechanics. Keep in mind that temporal stability scales spawn rates. So go caving when it's calm. I actually disagree. Firstly, it doesn't by default. The default server settings are that if there is nobody on the server, then time is frozen. If you are on a busy server, or people have disconnected schedules, then sure it will. However there's in-game mechanics to fix this. Many foods can last years, if you will be traveling and logging off periodically while others are playing then you can bring sealed foods. If you are at home then it's no issue since grain and other things can last a very long time. Regardless this is a double edged sword because if it were "fixed" in the way you suggest, then it also creates effectively an exploit to create a logged off stockpile of food frozen in time. I thought they were effectively identical to minecraft? Regardless, yes I agree, the minecraft system sucks, I think it's on his list already. I think this is the biggest thing the game lacks. There is effectively no adventure content beyond caving. Eventually there needs to be some bosses and mob variety. The enemies in this game are sort of depressing, visually glitchy things that have differing quantities of metal sticking in them. I like gears and mechanics, but I think it's safe to say that inevitably the vast majority of players will have no idea what lovecraft is or how the poor enemy design relates to it. I've played the game for a couple hundred hours or so, and yet I couldn't right now name the various mobs off the top of my head. They are nondescript, providing no real lasting memory of which is which. That's a real problem from a gameplay perspective regardless of if you are a fan of lovecraft or not. I adore the attention to detail in the game otherwise however.