Originally posted by Jixijenga:

Wait wait wait. So you're saying that you guessed with all of this?

No. I'm telling you where you can find the traces you need to convince yourself. I'm not giving readily digested and interpreted information, but pointing you to it, so you can capture and interpret it for yourself.

Originally posted by Jixijenga:

Okay. So you said it was a keylogger. I would like to specifically know how you came to this conclusion. You've made this out to be a very serious thing, nefarious even, but how can you know that if you haven't done something as basic as analyzing a pcap? Everyone knows what BuffPanel is and what it does, this has been known for years. I don't have the game installed right now, but if it's anything like the other games then pops_api.dll can be stopped simply by setting a firewall rule for api.buffpanel.com and calling it a day.

A keylogger is a very specific claim and carries with it a very, very dark implication that Paradox/CO have been doing a lot more than market analytics. I am interested in this claim because it concerns me and I would like to know more about any keylogging CS might be doing.

Install the game, decompile it, install a debugger and trace it in action, and capture the data as it's being collected. If you are interested, as you say, do your homework. I've pointed you where it is collected, and won't do more of your homework for you. Or just ask anyone, if as you say, everyone knows what BuffPanel is and what it does.

It should be very simple to write a mod using harmony 2, patch the popsapi wrapper and dump the data supplied to it to a local file.

A packet capture would only contain data that the server specifically requested for a given user identifier/IP address/time of day, etc. Without knowing the protocol specification, you would be guessing if a particular packet capture is representative of all data exchanges with buffpanel.com (the domain where the data goes to)

Originally posted by ColossalOrder:

No keyloggers, viruses, bitcoin mining software, or similar has been found in mods on the Steam Workshop

ROFL at the wording... the KEYLOGGER is in the vanilla game uploaded by Colossal Order themselves. See full description above:

KEYLOGGER is documented here:

https://steamhost.cn/steamcommunity_com/groups/HarmonyForGames/discussions/4/4362302357662347864/#c4362302357663690136

Originally posted by Reggie:

What telemetry data does Cities: Skylines collect from my PC and are the collected data anonymized?

I think this question should not be addressed to the PR team, whose role is to do damage control, but can instead be answered by reading the Cities Skylines EULA.

The EULA is the legal document through which the lawyers seek liability waivers from you, the end user. You have to assume that anything that the EULA covers is being collected, now or in the future, as long as the waiver is in place.

Originally posted by EULA:

5. Collection of Information

Paradox may collect information from you when you use the Game. Such information includes your SteamID, computer configuration, gameplay behavior and progress, browser type, platform type and software usage. This information is gathered periodically to facilitate the provision of software updates, product support and other services related to the Game.
Paradox may use any collected information to improve its products, administer the Game, analyze trends, or to provide services to you. In addition, Paradox may use this information for the purpose of research, development, administration, support and marketing of Paradox products and services. For more information, please see Paradox’s Privacy Policy available at
https://www.paradoxplaza.com/privacy.

If I may interpret, this clause allows any information you have to be collected at any time while you are using the Game

The paragraph lists some inclusions, but no limitations, nor does it use the typical "but not limited to" language which would be too inflammatory.

Legal documents are carefully worded technical documents crafted expertly so they can stand in Court, should the need arise. The choice of wording is expressly made as to support a defense in Court.

In short, Paradox can collect anything they can get their hands on, legally, with your permission, which you've given when you accepted this EULA.

The data sent to Paradox is personalized with your paradox account login info. If you do not have a paradox account, it is personalized with your Steam account info.

The entire purpose of the "Login with Paradox" window on the main menu screen is to secure the linking of the "telemetry" data with your identity.

Originally posted by YuLun:

While for Paradox and CO, vast majority is the supporter.

I doubt it, here is why:

1 week after Airports was released and I published Next3, there were already 16k subscribers. At this time, after 1 week of focused attacks by CO's army of trolls, I was attacked by about 600 unique steam accounts, most of them new or throw-away accounts.

Combine with this that people who just want the mod, but don't talk about it, make no comments of all. On the other hand, the trolls are very vocal.

The figures and the difference in behaviour between trolls and people interested in the game tell me that there is a small minority of extremely active trolls, compared with a vast majority who just want to play the game they bought without participating in the community.

Even after a week of trolling and Colossal removing Next 3 from the workshop, and the rumors of malware (for which there never was any evidence), the majority of Next3 users remain subscribed, and I'm guess they are happy to continue using it.

This anecdotal data tells me that the majority is not supporting CO, but because CO does have complete control of the workshop, and is able to rally trolls and throw away accounts, means that eventually CO will win control of their workshop, and re-establish censorship. Also the Next2 will eventually, and soon, be killed, regardless of sniggledigit's efforts. The issue was never about him being away, but that Next2's existence affects DLC sales.

All gamesaves that use Next2 are soon going to become unloadable, obsoleted by CO.

Thank you gentlemen for the feedback. We should start a separate thread for the social aspects at play here.

Meanwhile, for anyone who is looking for Network Extensions 3, the project will be maintained as long as it's needed, and is available for local install from GitHub (see top post for instructions).

In short, NE3 was removed by Colossal Order (I have confirmed this with Steam Support), for supposedly "violating Steam Community & Content Guidelines"; This is the sort of non-explanation that Colossal has been harassing me with for a long time.

Remember, Steam does not have a monopoly on game mods, and they exist in various places. Steam's main benefit is that it's very convenient.

Picture of workshop item as visible to me: https://imgur.com/a/CtZEqoq

This mod allows creators to publish mods, assets and other workshop content directly from GitHub releases.

This updater mod was banned by Colossal Order from their workshop, as it bypasses their censorship, and is available only for local install. Find the mod, source code and installation instructions at its GitHub Release Page[github.com]

When a new release of a particular item is published at GitHub, this mod can download and update your local workshop files with that content.

Why would you want to?

• you can control when to receive updates and when to freeze updating
  
• Where a team works on a item, it allows more than one person to update the content, eg, in case the original author is unavailable, retired, banned, sick, dead, etc. It allows work to continue on the item, subject to permissions set up by the team at the github site (eg, the team may restrict publishing releases to just a few team members)
  
• To allow you to select one of several available versions of an item, not necessarily the latest.
  
• To prevent mods being updated mid game, causing game crashes. Update from GitHub only downloads and installs at the beginning of the game (although Steam items will still be updated mid-game if that's when they get pushed by their authors. Only GitHub-published items are restricted to downloading at the start)

If you are a creator, you might be interested in direct github updates in order to:

• Use github's automation features for building, testing and releasing items
  
• Provide the end-users with more options (ability to freeze updates, select specific versions)
  
• Easier management of multiple release channels per project (eg, a "stable" channel, beta, alpha, etc)
  
• Easier for teams larger than 1 to publish
  
• Continuity of the project in case the main Steam Item owner is unavailable to upload releases.
  
• Publish once, reach multiple users (Steam, Epic Games, GoG, etc)

This initial release is a prototype, and can update one single item at this time, Harmony (redesigned), and is otherwise featureless. I had to rush to publish it before Harmony 2.2's upcoming API release.

I expect to add the following features in the future:

• Ability to generalize publishing to make it applicable to any item on the workshop.
  
• Selection of versions where multiple releases are available @ GitHub
  
• Ability to freeze some items, and update others. Currently, disabling the mod stops all updates.
  
• Better reporting of available releases and their notes, combined with manual updates.
  
• Support for hosts other than GitHub, such as GitLab, etc.

I'm leaving the item unlisted (it is linked from Harmony (redesigned), and visible to my friends) until I can release the more generalized version which will be able to update mods other than just my Harmony. In its current state, it's usefulness is limited, hence unlisted.

Typically "telemetry" is anonymized, aggregated data. A developer can learn how they're software is working, but not who is using it.

In Colossal Order's case, the "Paradox Login" exists to accomplish the opposite, to connect the keylogged data to a personally identifying account, ie, your Paradox Account, so every key press can be properly accounted for.

Now, don't expect that if you signed up at Paradox with anonymous looking user information, this keeps you secure. Not only can your personal identity be easily unmasked by even a low-skilled internet user, but marketers like Paradox are experts at it. This manner of "understanding their customers" is their bread and butter, and they are extremely good at it.

Of course, if you do this is called "doxing", but when Paradox does it, it's "marketing".

I encourage you to not naively accept the various explanations that will be coming out of Colossal Order, Paradox, and their army of "trusted modders", and instead inform yourself independently of your rights. These people are not your friends, and they don't have your best interests in their hearts.

"Independently" means, I'm not your lawyer, Colossal and the community they've created is not your friend, you need to find your own source of information. I can only suggest that when you pay a lawyer to work for you, he is ethically bound to act in your best interest. No-one else has that obligation, and you should not assume that random people on Steam or Reddit is acting in your best interest.

... applies to your key presses collected by Colossal Order, regardless of EULA

Harmony Redesigned disabled this telemetry a few days ago when I published it, and had to avoid referring to the disabled malware in the release notes, for fear of censorship by Avanya of Collosssal Order. I had to withhold the source code for the same reason. The source is coming out momentarily, with the "Update from GitHub" mod release.

6 years of "telemetry" safely in Paradox's vault, while the "respected modders" found no malware in the vanilla code. They want the million or so users to continue to trust them.

Mr. Honest Modder Klyte5, since your mod is clearly disabling the keylogging activity reported here, why not be fully honest and use the same word, keylogging, since that is what is happening? How honest is for you to dumb it down to something so innocuous sounding as "simple telemetry"?

The Colossal EULA makes specific emphasis on "Section 5 on collection of information", meaning they want to be double sure that when this comes up in Court, they can use as defense that the end users accepted it, for sure:


This is not accidental. That data is very very precious, and the Colossal and Paradox trolls wants their precious data. You have to wonder why they want it so bad if it's not that useful.

I have so much exposure on this gang of "game developers" and "respected modders" coming out, it's not even funny.

Originally posted by slavonator:

@BadPeanut welcome back man. what happened to next3???. mod was deleted and the author disappeared without a word? do you know anything about that because he promised that the mod will support and update regularly. and suddenly he doesn't.

I am "temporarily" banned by Colossal Order until Feb 13, while they've launched this coordinated campaign against me, with aubergine18, kjmci (a promoter for cities skylines), and Andy Brown, the author of the "news[www.nme.com]".

Colossal is in damage control mode, due to the discovery I've made regarding the keylogger malware they've had built into the game for the past 6 years (see post above). They've decompiled my Harmony 1.0 release in which my code disables their keylogger, and have realized that the shit is about to hit the fan.


The notification email directs me to the "cities skylines support team" https://paradox.zendesk.com/home rather than to Steam support, because it's Paradox that is responsible for the removal, not Steam.

It is merely hidden, not deleted, and the project will continue, but it appears that the author of Next2 (sniggledigit) has made an appearance. I'm curious if he will update Next2. The logical step would be for him to merge into his code base the bugfixes I've made since I took over maintenance, but we'll see how that plays out.

It's not a coincidence that this trinity of Colossal, Harmony and Network Extensions keeps popping up.