In all honesty, it’s a pretty unfortunate situation and I do hope it gets sorted out as quickly and in the best way possible for everyone been involved
But this has made my head hurt, and at the end of the day I can’t do really do anything about so I’m just gonna hope for the best and log off

Be kind to each other and to yourselves
Cheers!

By banning maltiez. Simple as.

T.read should be gone from moderating the discord server too, and any who supported injecting malware into mods.

Malwares has no place in any modding community, forgive this and it'll only get worse.

Banned 30 days for suggesting MALWARE should be a fireable offense. These mods are a disgrace.

Is to fire Maltiez, anything less and you can't be sure he won't try and inject more malware or worse again. The trust has been broken.

Sorry for the two uploads, Reddit just won’t let me upload the image.

the community is unset and your response is “shut up and move on or I’ll ban you” this dude needs to be taken off the mod team🤦🏽

Here you go, in his own words, its malware. And it was present in PML and Overhaul lib, not just config lib.

No warning, no mute, nothing, also had no other infractions and didn't get any kind of message from a mod for my ban reason, lol

I don't really think this is a good response to your community having an issue :/

Edit: Anego has known about the developer's behaviour since february and is fine with it. See replies to pinned mod comment for screenshot.

Absolutely insane behavior. But coming from a dev? Completely unacceptable.

e: background here

e2: here is u/Latmei giving an excellent breakdown of the exact nature of the malicious code. The effort the dev went through to hide these actions is unhinged, and none of their code should ever be trusted again.

e3: guess it's time to uninstall, sad.

https://i.imgur.com/4xd7jSd.png

Never seen a such a flippant response about such a breach of trust.

e4: banned from the discord for attempting to discuss this ☠️

This recent problem with Anego Studio's approach to mods and how they deal with internal problems, brings to light how much we can trust even indie software studios to self-police. Specially when it comes how they handle third party mods, and how much caution we have to exercise when using third party mods, run on indie games.

Personally, I was made aware of the malware code, when a music mod I was using in a private server with friends, caused everyone constant crashes.

As explained here by u/Latmei and with a very in-depth analysis of it here. Maltiez, an official developer of Anego Studio, introduced what by a large amount of cybersecurity companies(CrowdStrike, Kaspersky, etc) consider it is malware, in one of their mods.

We, as players and customers. Spent money, on not even a finished game software product. Expecting the developers and owners of said software product, to behave with transparency, honesty and integrity.
They had a Terms of Service for mods that forces the modders their own game to:

2- You warrant that the mod contains no harmful or malicious code, no material which is defamatory, bullying, offensive, obscene, or pornographic, and no breach of copyright of any other person.

5- A mod must have a clear explanation of its function in the English description.

The modder in question, and Anego Studio's Vintage Story affiliated and officially paid developer, broke these rules when they published the their mod. Without full disclosure of what actions said mod did.

And they did it with the full knowledge of the rest of the Anego Studio, and their tacit agreement on such practice, as per the screenshot in this post.

On top of being a breach of even their own ToS, not to even talk about the morality and ethics of such a thing. It is a huge breach of the player's trust.

Customers have and must never let, for companies to sell products or services that perform functions and actions that are undisclosed, hidden or worded in ambiguous and misleading terms. And even less to let them keep doing anti-consumer and anti-user practices. Specially in this landscape, in which players are treated like products to squeeze money off, instead of customers that support and allow them to work in this field.

Players come to indie games, fleeing from the enshitification and anti-consumer practices of such game corporations such as Electronics Arts, Sony, Ubisoft, Epic Games and other billion dollar corporations. Not to even mention of such other corporations like Microsoft, Google/Alphabet, Meta, Apple and so on, that have really set the gold standard, in how much they can get away with.

We hold contempt, frustration and anger against the aforementioned enshitification, anti-consumer practices and dark patterns that these companies and corporations employ. We do not want it to extend too, to even indie developers.

Finally, this is a warning for everyone. Any and all mods you download for any video game(Minecraft is a big example of this, as with Starsector or Rimworld), can and will have malware code that can not only affect your game, but your whole computer too. Be always vigilant of suspicious behavior after installing or updating any mod, in any game, and always.

Edit: For clarification. Said malicious code was found as it created a lot of "false positives" on mods that it was not the individual paid cheat mod described in the forensic analysis posted above. Otherwise no one would have found out that they let a fellow developer break their own ToS, and inject malicious crash code.

Concealing homemade "anti-cheat" in a config library is pretty crazy, but I can see how Maltiez could think it's a good idea. What I can't understand is how Anego was told about this and thought it was fine, and is not setting a clear policy against this sort of thing.

This sets a horrible precedent. It shows they don't care if mod creators subject you to absolute slop in their mods. Maybe we'll all add some targeted sabotage to our mods, since it's no big deal.

I love Anego and Vintage Story, but there needs to be some closure here before we can wrap this up... It's not frivolous Reddit drama it's a seriously concerning violation of trust.

In regards to the recent Maltiez situation, I think it's now prudent to discuss this. All code mods uploaded to the mod DB should have their source code be readable in some way, and at the VERY LEAST not obfuscated in any way. Both of which are extremely easy to do, and thus this is not a difficult request. Mod pages already have an option for linking to github for example, and obfuscation is something that the programmer actively chooses to do.

I'm surprised this hasn't been a rule on the mod DB in the first place. Especially as you are given a disclaimer from Angeo Studios that says they are not responsible for damage done to your computer as a result of mods. How can we know if a mod is or is not malicious if we cannot read its source**?**

Now, I am not going to write any malware here, but to give you an idea of what mods you can create, since mods have the same privileges as the Vintage story binary (Vintagestory.exe) and are not sandboxed, with C# code it can do things like have

1. full access to most files on the user file system (meaning reading and deletion of any file it is allowed to access),
2. network access (ex. a mod could phone home about whatever it can see on your PC).

These are all of the things I know about as an amateur modder, and this list is certainly not exhaustive. Imagine what a more motivated malicious actor could do. Note that having access to these things is not necessarily BAD. Some mods may want to know what other mods you have for compatibility reasons (though iirc Vintage Story has built-in support for this), or the creator of the mod may want to collect usage data (though this should be heavily disclaimed by them).

What I ask for is the ability to read the source code of a mod, so that I can protect myself.

EDIT:

1. minor grammar mistake

2. Linking context to Maltiez situation (my bad folks)

this seems rather concerning to me, why would they ban any mention of the topic, civil or not, from being discussed? this seems very strange on anego studios’ part ): i’m very worried! i love this game so much

I am making this post for people who have not yet heard of the drama yet so there is a clear and concise explanation for what is going on.

It was recently discovered that Maltiez, the creator of Config lib (A popular modding library) among other notable mods, had quietly added an anti-cheat function to Config lib that would crash your game if it detected you using a cheat client.

The anti-cheat (that only activated when you went into multiplayer), would, as far as i have understood it, search for obfuscated code in your modlist, if it detected any mods with obfuscated code, it would begin an internal countdown to crash your game. The function was quietly added and ironically was hidden with obfuscated code, making it hard to detect, as well, it would eat the log file, making it impossible to trace what had crashed your game. To make matters worse, the anti-cheat was itself, faulty, and would regularly detect false positives(a notable example being Caves N Caverns). Edit cause I forgot to include it: here is u/Latmei 's far mor in depth explanation of what the anticheat does and how it functions.

I must preface that the problem with this is not that Maltiez made an anti-cheat. The problem is that he hid a faulty anti-cheat it in a popular library mod. Server owners would be confused as to why players were crashing (Or as i have seen one server owner state, be confused as to why someone was kicked). People who were in private servers could get affected because they had a incompatible mod. And there was no way to turn it off without physicaly removing it from the mods code.

This is malware, while a "tame" example, it was still a malicious piece of unwanted code added to something that should never have had it in the first place. If Maltiez wanted to make an anti-cheat, he should have made a different mod with it clearly listed as an anti-cheat, not sneaking it into Config lib.

Please do not attack the discord moderators or devs. Also do not say here which moderator this is - I do not want to be responsible for anyone getting nasty messages.

These screenshots are from earlier today in the Vintage Story discord's #vintagestory channel. The blue is a discord moderator and the white is a random discord user and player.

To be clear I love this game and do not want to see it lose all community trust due to this situation. I think it is a petty tyrant issue more than a security concern. Truthfully the harm done in this situation is probably not enormous. However, that does not make it acceptable behavior to introduce malware to your mod under any circumstances, but moreover when you have been hired by the studio. That they may have known about this is concerning and leads one to wonder how much they knew and what exactly they were told and what exactly they told Maltiez.

This is a clear violation of TOS and should be treated as such. The devs need to release an actual statement because this is very concerning and I think many of us would like to hear an explanation of why and how this occurred. I am open to the possibility of new information that recontextualizes what we already know or have been told about the situation.

I think we should all withhold judgement until an explanation is given but an explanation must be given at this point.

Edit: Allegedly this moderator made this up whole-cloth. Apparently this was a complete fabrication. Having worked in customer service with coworkers of various competence levels I do believe this. Would not be the first customer facing worker I have seen start randomly making things up to try and get out of a situation. (Which then inevitably makes the situation much worse.) Since the team is on the case now, nothing to do now but wait to see what they uncover in their investigation and how they choose to address and share what they discover.

wasn't sure what to do with the middle section of this build for the longest time, finally my fiance suggested shutters... I'd never thought about that, and here they are! I'm to MC brained to realize how great they look when done right

I've just read the current drama regarding ConfigLib and its ability to edit the game client, cause crashes and disconnects at its own discretion.

I've been troubleshooting random disconnects for months. Months of testing different mod configs with my friend who's the server admin, testing performance mods, clients, network stuff and basically any other fix we could think of.

For months I've been the only one plagued by disconnects, and sometimes crashes, on a server of around 13 players. Everyone else can stay connected for 4+ hours at a time with basically no issue.

The only way we found to make the game stop randomly disconnecting me was for the server admin to add Stratum, which in turn seemed to make the server worse and broke compatibility with some other mods too.

I've now informed the admin, who's going to disable Stratum and update ConfigLib so we can properly test it. I can't say for certain yet that ConfigLib is the cause, but I highly suspect it for a few reasons:

• The game would disconnect me completely randomly after joining. Sometimes it would be 2 minutes, sometimes 5, sometimes an hour, sometimes multiple hours, there was never any consistent pattern to it.
• I cleaned absolutely all traces of VS from my system, thinking it was mod data, config, cache or some old file causing it. I completely reinstalled the game and let the server redownload everything fresh. None of it worked.
• I tweaked performance settings and tested performance mods, even though I don't struggle to run this game at all, and none of that helped either.
• We tested it on my Steam Deck as well to try and narrow down whether it was my PC, my network or my player data on the server.
• I used Wireshark to capture packets between me and the host to try and identify a pattern, alongside continuously pinging my gateway, 1.1.1.1 and the server itself. The pings stayed completely fine during disconnects, but the game connection would seemingly just break at random.
• From the server side there was basically nothing useful either. As far as the server was concerned, I would just disconnect. My client would sometimes report a connection timeout, but there wasn't some obvious crash or error on the server explaining it.

I'm still not entirely sure why Stratum fixed the issue enough to stop the disconnects, assuming ConfigLib does turn out to be the cause. Crashes do still sometimes happen.

I'll update the post when, or if, removing Stratum and updating ConfigLib fixes the issue. I obviously don't want to claim this is definitely the cause before we've actually tested it, but considering the behaviour that's now been found in ConfigLib, especially the randomised delays and its ability to deliberately cause disconnects and crashes, I'm very suspicious that this is what we've been chasing for months.

Whether it ends up being the fix or not, I'm so incredibly disappointed by the hidden code and even more so by the response from the dev and team.

I'm a junior game dev myself. If I did something like this in my job, hiding code in a dependency that deliberately interfered with users' clients because of something else they had installed, I'd be fired instantly.

EDIT: After further reading (section starting at line 285), apparently VS Radio can trigger it quite consistently. many players use them on the server including myself. Absolutely dumbfounded.

If anyone is like me and isn't a coder and so wants the current situation with Configlib broken down in an understandable way, now I finally get it