Angius

4. Look how needed this anticheat was! Cheaters are even griefing our servers! Look how right Malwaretiez was in his crusade!

To be honest, that statement was piss-poor weaksauce anyway. I especially love Tyron saying that the post will be updated should any discrepancies arise, then proceeding to not update it once discrepancies arose lmao

Anego releases a central reusable workflow in some `Anego/provenance` repo Mod authors use that reusable workflow instead of an action they write themselves The action uses OIDC to authenticate with the upload API The upload API checks the `job_workflow_ref` claim in the JWT they get, and see if it matches the reusable workflow If so, the built binaries are guaranteed to have come from the build action that only Anego has control of One possible issue is the `.csproj` file of the mod containing some MSBuild tasks that do shady stuff, but: The `.csproj` file has to be in the repo for the code to even build, so anybody will be able to see any shady tasks Stripping them from the `.csproj` inside of the action is not all that hard to do For additional safety, the build can be called via `unshare -n` so it doesn't have network access besides localhost, and so it can't download any code from external sources during build Provenance is a very solvable (and very solved: jsr.io and nuget.org for example) problem.

Sure it's not easy, but it's very doable. Offer a basic Github action that builds the code and submits it to moddb. Any mod submitted that way gets a nice little checkmark badge. That way, the binaries the players install are guaranteed to be exact to the code contained in the repo (which should be required to be public and at least source-available, if not open-source outright). One of the issues with ConfigLib and other mods that had the malware in them was that the "anticheat" code was not present in the repo.

Which is, apparently, writing better guidelines. Which already existed in the form of TOS, which was wholly ignored by Malwaretiez. There are no technical solutions (provenance, scanning, whatever) proposed. Which he said himself he was already tired of maintaining. Also, the control of them was relegated to the VS team... which Malwaretiez is a part of.

Malwaretiez is still hired by them to work on the game in full official capacity. The whole official statement is weak and barely qualifies as a response. Not only was it not posted to the official forums, it also didn't mention the false positives, didn't acknowledge moderators tripping balls, claimed that Malwaretiez forgot to remove malware from ConfigLib where they removed and then re-added it... Tyron claims the Reddit post will be updated if he forgot anything. Well, it's been 12 hours now and no updates, so I think it's safe to assume they won't change anything. To sum up: Tyron spent more time gushing over how righteous Malwaretiez was in their quest to thwart the bad chest developer, than he spent acknowledging issues, and Malwaretiez will be "punished" by being removed from the Discord (which they claimed was toxic anyway) and their mods (which they were tired with maintaining anyway) being transferred to Anego.

Since this seems to be the closest thing to a megathread, lemme crosspost my mod provenance suggestion. tl;dr: there are ways to guarantee that the mod files uploaded to the moddb have been built from the exact specific code in a public repository. One of the reasons the whole ConfigLib conundrum feels so malicious, is that the "anticheat" code did not exist in the public repository. This time it was something somewhat benign, yes, but what's stopping someone from uploading a zipbomb? Some sort of provenance system is, IMHO, necessary.

You at least got a warning before. I was suddenly banned without as much as a warning, and I still have no clue what for

Mod DB should support mod provenance, that is a way to attest that the mod we download is build from the exact code on Github/Gitab/Codeberg/whatever. A build function should exist that builds the code and uploads the built binaries to the database, with some integrity checks along the way. That way, it can be guaranteed that the code the mod author has on their Git repo is what the player actually runs, removing the risk of the author uploading binaries built from code different to what they claim it is. cough cough ConfigLib At the same time, I'm not arguing for it to be required, just give the mods that have a proven provenance some badge or something, and let us filter for it. Prior art: JSR.io, NuGet.org

Tyron is the server owner, so...

Now mods on the Discord are deleting messages lmao Good going guys, protect the malicious modder and stay silent, ignoring and silencing the discussion about issues like that has historically never gone badly, right?