No warning, no mute, nothing, also had no other infractions and didn't get any kind of message from a mod for my ban reason, lol

I don't really think this is a good response to your community having an issue :/

Edit: Anego has known about the developer's behaviour since february and is fine with it. See replies to pinned mod comment for screenshot.

Sorry for the two uploads, Reddit just won’t let me upload the image.

Absolutely insane behavior. But coming from a dev? Completely unacceptable.

e: background here

e2: here is u/Latmei giving an excellent breakdown of the exact nature of the malicious code. The effort the dev went through to hide these actions is unhinged, and none of their code should ever be trusted again.

e3: guess it's time to uninstall, sad.

https://i.imgur.com/4xd7jSd.png

Never seen a such a flippant response about such a breach of trust.

e4: banned from the discord for attempting to discuss this ☠️

the community is unset and your response is “shut up and move on or I’ll ban you” this dude needs to be taken off the mod team🤦🏽

Here you go, in his own words, its malware. And it was present in PML and Overhaul lib, not just config lib.

In regards to the recent Maltiez situation, I think it's now prudent to discuss this. All code mods uploaded to the mod DB should have their source code be readable in some way, and at the VERY LEAST not obfuscated in any way. Both of which are extremely easy to do, and thus this is not a difficult request. Mod pages already have an option for linking to github for example, and obfuscation is something that the programmer actively chooses to do.

I'm surprised this hasn't been a rule on the mod DB in the first place. Especially as you are given a disclaimer from Angeo Studios that says they are not responsible for damage done to your computer as a result of mods. How can we know if a mod is or is not malicious if we cannot read its source**?**

Now, I am not going to write any malware here, but to give you an idea of what mods you can create, since mods have the same privileges as the Vintage story binary (Vintagestory.exe) and are not sandboxed, with C# code it can do things like have

1. full access to most files on the user file system (meaning reading and deletion of any file it is allowed to access),
2. network access (ex. a mod could phone home about whatever it can see on your PC).

These are all of the things I know about as an amateur modder, and this list is certainly not exhaustive. Imagine what a more motivated malicious actor could do. Note that having access to these things is not necessarily BAD. Some mods may want to know what other mods you have for compatibility reasons (though iirc Vintage Story has built-in support for this), or the creator of the mod may want to collect usage data (though this should be heavily disclaimed by them).

What I ask for is the ability to read the source code of a mod, so that I can protect myself.

EDIT:

1. minor grammar mistake

2. Linking context to Maltiez situation (my bad folks)

Please do not attack the discord moderators or devs. Also do not say here which moderator this is - I do not want to be responsible for anyone getting nasty messages.

These screenshots are from earlier today in the Vintage Story discord's #vintagestory channel. The blue is a discord moderator and the white is a random discord user and player.

To be clear I love this game and do not want to see it lose all community trust due to this situation. I think it is a petty tyrant issue more than a security concern. Truthfully the harm done in this situation is probably not enormous. However, that does not make it acceptable behavior to introduce malware to your mod under any circumstances, but moreover when you have been hired by the studio. That they may have known about this is concerning and leads one to wonder how much they knew and what exactly they were told and what exactly they told Maltiez.

This is a clear violation of TOS and should be treated as such. The devs need to release an actual statement because this is very concerning and I think many of us would like to hear an explanation of why and how this occurred. I am open to the possibility of new information that recontextualizes what we already know or have been told about the situation.

I think we should all withhold judgement until an explanation is given but an explanation must be given at this point.

Edit: Allegedly this moderator made this up whole-cloth. Apparently this was a complete fabrication. Having worked in customer service with coworkers of various competence levels I do believe this. Would not be the first customer facing worker I have seen start randomly making things up to try and get out of a situation. (Which then inevitably makes the situation much worse.) Since the team is on the case now, nothing to do now but wait to see what they uncover in their investigation and how they choose to address and share what they discover.

wasn't sure what to do with the middle section of this build for the longest time, finally my fiance suggested shutters... I'd never thought about that, and here they are! I'm to MC brained to realize how great they look when done right

I've just read the current drama regarding ConfigLib and its ability to edit the game client, cause crashes and disconnects at its own discretion.

I've been troubleshooting random disconnects for months. Months of testing different mod configs with my friend who's the server admin, testing performance mods, clients, network stuff and basically any other fix we could think of.

For months I've been the only one plagued by disconnects, and sometimes crashes, on a server of around 13 players. Everyone else can stay connected for 4+ hours at a time with basically no issue.

The only way we found to make the game stop randomly disconnecting me was for the server admin to add Stratum, which in turn seemed to make the server worse and broke compatibility with some other mods too.

I've now informed the admin, who's going to disable Stratum and update ConfigLib so we can properly test it. I can't say for certain yet that ConfigLib is the cause, but I highly suspect it for a few reasons:

• The game would disconnect me completely randomly after joining. Sometimes it would be 2 minutes, sometimes 5, sometimes an hour, sometimes multiple hours, there was never any consistent pattern to it.
• I cleaned absolutely all traces of VS from my system, thinking it was mod data, config, cache or some old file causing it. I completely reinstalled the game and let the server redownload everything fresh. None of it worked.
• I tweaked performance settings and tested performance mods, even though I don't struggle to run this game at all, and none of that helped either.
• We tested it on my Steam Deck as well to try and narrow down whether it was my PC, my network or my player data on the server.
• I used Wireshark to capture packets between me and the host to try and identify a pattern, alongside continuously pinging my gateway, 1.1.1.1 and the server itself. The pings stayed completely fine during disconnects, but the game connection would seemingly just break at random.
• From the server side there was basically nothing useful either. As far as the server was concerned, I would just disconnect. My client would sometimes report a connection timeout, but there wasn't some obvious crash or error on the server explaining it.

I'm still not entirely sure why Stratum fixed the issue enough to stop the disconnects, assuming ConfigLib does turn out to be the cause. Crashes do still sometimes happen.

I'll update the post when, or if, removing Stratum and updating ConfigLib fixes the issue. I obviously don't want to claim this is definitely the cause before we've actually tested it, but considering the behaviour that's now been found in ConfigLib, especially the randomised delays and its ability to deliberately cause disconnects and crashes, I'm very suspicious that this is what we've been chasing for months.

Whether it ends up being the fix or not, I'm so incredibly disappointed by the hidden code and even more so by the response from the dev and team.

I'm a junior game dev myself. If I did something like this in my job, hiding code in a dependency that deliberately interfered with users' clients because of something else they had installed, I'd be fired instantly.

EDIT: After further reading (section starting at line 285), apparently VS Radio can trigger it quite consistently. many players use them on the server including myself. Absolutely dumbfounded.

I am making this post for people who have not yet heard of the drama yet so there is a clear and concise explanation for what is going on.

It was recently discovered that Maltiez, the creator of Config lib (A popular modding library) among other notable mods, had quietly added an anti-cheat function to Config lib that would crash your game if it detected you using a cheat client.

The anti-cheat (that only activated when you went into multiplayer), would, as far as i have understood it, search for obfuscated code in your modlist, if it detected any mods with obfuscated code, it would begin an internal countdown to crash your game. The function was quietly added and ironically was hidden with obfuscated code, making it hard to detect, as well, it would eat the log file, making it impossible to trace what had crashed your game. To make matters worse, the anti-cheat was itself, faulty, and would regularly detect false positives(a notable example being Caves N Caverns). Edit cause I forgot to include it: here is u/Latmei 's far mor in depth explanation of what the anticheat does and how it functions.

I must preface that the problem with this is not that Maltiez made an anti-cheat. The problem is that he hid a faulty anti-cheat it in a popular library mod. Server owners would be confused as to why players were crashing (Or as i have seen one server owner state, be confused as to why someone was kicked). People who were in private servers could get affected because they had a incompatible mod. And there was no way to turn it off without physicaly removing it from the mods code.

This is malware, while a "tame" example, it was still a malicious piece of unwanted code added to something that should never have had it in the first place. If Maltiez wanted to make an anti-cheat, he should have made a different mod with it clearly listed as an anti-cheat, not sneaking it into Config lib.

He is present in a LOT of important Libs. Off the top of my head (and the ones i use);

JSON Patches Lib
Overhaul Lib
Player Model Lib
Configlib (obviously)!

I wonder if the malicious code is Present in those as well. It might be good to give it a shot though.

I can't decompile myself at the moment since my laptop is fried and in repairs. I would have done so, though. So i ask the help of the active community here. cheers!

Since recently looking at the Maltiez Situation;

https://www.reddit.com/r/VintageStory/s/Jcacplor5X

I've been wondering what's the steps forward using ConfigLib?

I'm still genuinely shocked someone can be this mental though, policing someone's single player experience is way too far, multiplayer sure if the admin wants that or not, should be a choice not some egotistical modder who's also part of the VS dev team adding their own anti-cheat to their widely used mod because they was turned down for it to be added to the base game (at least from what I understand)

I hope this doesn't get sweeped under the rug, this needs to be talked about more, and Maltiez needs to take accountability for his actions.

Personally I wouldent want this type of person on the VS dev team.

Edit: Typo

I'm using Room HUD mod to display if a space is a room or not, in the top-left corner.

This is a conversation dug up from what was happening in the discord today, one I've not seen anyone talk about yet, but one I think really needs more visibility.

Today there's been reports that some mods were mysteriously crashing, one of which being the Caves n Caverns mod. But the leading cause didn't come from it or a compatibility issue, but instead came from a completely different mod; ConfigLib. Turns out, ConfigLib had a feature implemented that was meant as an anti-cheat feature that deals with encryption.

The idea is precarious at best, but clearly it's harming usage of other mods by just interrupting your game client. But when it was released, it was deemed "pointless" now it was exposed, and was just removed. End of story.

I'm not going to dive into the reasons why this was added, but there is a stern thought that doesn't sit well with me; This is code that directly affects your game or other mods. And it is code that is NOT disclosed to be added (logically, but still). Personally this feels like a strong breach of trust because appearantly they found it no problem at all to sneak in code against its users knowing, and now this has been exposed, what more secret code are we supposed to expect to find in this- or other mods, that we don't know about yet?

I think sneaking in code is dangerous. An Easter egg, reference or homage/credit is one thing, but this is a whole another level.

And the peace we are expected to accept is; "you found it, it's updated and removed, carry on."?

From what I read earlier a discord moderator made a terrible statement but none of the devs have commented yet. Given that it was an actual dev who did this, it makes me uncertain as to what they might have slipped into the client without people realising.