KitchenLib – Security & Privacy Concerns – 23/06/2023

[StarFluxGames]

I StarFluxGames,
Allow me to begin with this. I wish to apologize for my actions in the development, implementation, and usage of the “Prank Menu”. This was not designed or intended to cause harm or controversy. I, unfortunately, didn’t think about my actions when taking them and didn’t think about the repercussions that would ensue. I understand not everyone is going to accept what I say or have further trust in me. Unfortunately, that is an outcome I will have to deal with.

I would like to openly acknowledge my actions not only as a mod developer, but as the lead developer of KitchenLib. I understand I have overstepped with my power in the modding community, and implemented features into KitchenLib which were not public knowledge.
I would like to state my “Prank Menu” is/was never intended in a harmful manner to target users directly, the intent was for a harmless joke (Which has unfortunately gone wrong) with streamers. This menu could alter things related to the host’s current game session such as (But not limited to): Setting Fires, Changing Outfits, etc. KitchenLib in no way modified any personal data stored on the user’s computer, or accessed any files other than what’s directly required to run. The files in question are file from the game PlateUp! And mod preference files. No other files/data/information is accessed.

I would like to further explain the mechanics behind the menu, and how it worked so it’s clearer. When using KitchenLib users were prompted with a data collection request menu, proceeding after this menu if the user had consented to data collection, and other relevant questions KitchenLib will proceed to “Phone Home” to its server with the information it’s collecting. Information collected by KitchenLib had included an identifier known as the Steam Lobby ID, which is what allows games to use Steam as a multiplayer platform and the joining of lobbies. Once in the lobby, KitchenLib proceeded to use a feature called a “Responsive View Object” which allows small pieces of information to be sent between the client and the host, this is what allowed KitchenLib’s “Prank Menu” to make various changes to an active game/run.

I understand I have lost the trust of a significant number of community members and the player base, and will be unable to regain that trust, I take full responsibility for my actions. I understand in losing this trust, users wish to not use my mods/tools. Unfortunately, this also causes a large number of other PlateUp! Mods to no longer function. I endeavor to change how I interact with both the modded and un-modded communities of PlateUp!

I would like to state this tool was used and intended for a harmless joke on streaming individuals, whilst this has not been a problem, I had made a poor judgment on who I was interfering with and how I reacted regarding the situation, and the capacity of KitchenLib’s popularity has been misused. I understand PlateUp! Is intended to be a fun co-op experience for a casual player base, unfortunately with KitchenLib I have overstepped and ruined this

As of KitchenLib v0.7.6 the entire functionality of the “Prank Menu” has been removed and made inaccessible. KitchenLib is open-source software and the code can be viewed directly on the GitHub page https://www.github.com/KitchenMods/KitchenLib . On the imminent release of KitchenLib v0.7.7, I will further remove any remaining code which does not directly belong in a library, and I will entirely remove the data collection functionality. I will have an authorized user from the PlateUp! Community as a witness to confirm the removal of all information regarding data-collection and any existing information.

I would like to acknowledge a couple of other things that have been mentioned within the last 24 hours, such as the “21 Balloons” and the April Fools situation. I understand upon the launch of the April Fools update, KitchenLib modified the rendering of two key objects in the game such as “Kitchen Floor Protectors” being Nicholas Cage, and “Counters” being Danny Devito. I understand this caused problems for the vision-impaired community, and I took action to make changes to this as soon as I possibly could. I understand members also didn’t enjoy the “21 Balloons” which were placed in the lobby whilst these were placed in the lobby and in a way not to interfere these were also not accepted by the community. On the release of KitchenLib v0.7.7, I will be removing both of these from the game.

I would like to state that PlateUp! As a game has no part in my actions, whilst some team members were aware of the tool’s existence, they were not aware of its active use. I have been contacted by the PlateUp! Team directly regarding the situation to come to a solution. As previously stated, the features of the “Prank Menu” and its related part have been removed, and are no longer functional. This situation should not reflect PlateUp! As a game, or PlateUp! as a team as it put them in an extremely difficult position without many options.

I understand some members of the community wish KitchenLib to be completely removed from the Steam Workshop, and/or myself to be removed from the KitchenLib team entirely. Please understand some users still wish to play PlateUp! in a modded way, and removing KitchenLib will cause further problems as it will prevent these users from playing in the way they wish. After the release of KitchenLib v0.7.7, I will have a more security-first method for development, as KitchenLib will now require one or more verified contributors to approve changes before its final implementation. I will proceed to review every change in KitchenLib, ensure everything is public and transparent, and request regular feedback regarding its development, features, and stability.

I would also like to state that the implementation of the “Prank Menu” was solely my own doing, other KitchenLib contributors had no control over it. Whilst they weren’t on board with the feature, they also understood they had no control. I will be providing more control to contributors, and requiring more input from them in the future.

Furthermore, I would like to apologize to all affected and endeavor to right my wrongs in the community. I understand I have lost the trust of several users and will be unable to regain the trust, I will have everything regarding KitchenLib and its contents significantly more transparent.

Any questions, or concerns. Please respectfully ask.

[nite97m]

Thank you for this followup and taking the concern seriously. This helps to regain some of that trust. Sticking to the plans mentioned going forward will help a lot.

I do appreciate the work that goes into this and other mods.

I can verify that the code used to launch the "fun" menu and (as far as I have seen) the functions called by the "fun" menu has been removed from the mod on github.

I will note that a lot of streamers are likely to be ok with the types of things that the fun menu was capable of doing, just not being done without their knowledge. Having those types of actions coming through stream chat or other stream events via a mod described as doing those things wouldn't be an issue.

[PHELMS]

Please post the source code to your Harmony mod implementation publicly.

[StarFluxGames]

Originally posted by PHELMS:

Please post the source code to your Harmony mod implementation publicly.

Hi PHELMS. I do not develop, maintain, or work with HarmonyX it is not my project. I only added it to the workshop.

It's source code can be found here https://github.com/BepInEx/HarmonyX

[PHELMS]

The team behind KitchenLib should revise their pull request/deployment into a two party consent to prevent this from occurring again. This is a common strategy from bad actors and shouldn't be viable for a single developer to pull an unauthorized branch. Happened just last week with a bunch of minecraft mods.

For what it is worth, I did review the distributed version of both Harmony & KitchenLib and the code matches the repos

Is the source code for either http call public?

https://raw.githubusercontent.com/StarFluxMods/starfluxmods.github.io/master/AccessRemoteServer
http://api.plateupmodding.com 

[imziiiTTV]

I know I can say this for myself and others StarFlux, I have never doubted you and never felt there was any invasion of privacy.

That being said, I know nothing about coding BUT would it be possible to make a type of Mod that you can OPT IN to the prank menu. I know many of us absolutely enjoyed it when you came in to play around and i know some others that wanted a chance to be pranked but haven't been able to stream. It's wonderful when the creators and devs interact with the community.

[Lycaous]

Hey Starflux, sorry you had to remove the "Fun menu." As I streamer, I really enjoyed the content and am sad to see it go, but understand why it's happened. Games like Clustertruck have always amused me when the developers would tease the players, so I was really excited to see stuff like the "fun menu" in a game I love. You are always welcome in my kitchen.

As a future suggestion, some streamers and I were discussing maybe an "opt in" toggle that is auto toggled off at the start of game to allow kitchen lib devs to come mess with the game if they so choose. It would be a pain to toggle it every game, but then for sure we are choosing to play with the developers if they want. I know nothing about mod development, so I am not sure if this is an option, but it sounded fun.