It was brought up in this thread:
https://www.gog.com/forum/general/telemetry
With links to other threads on the topic, that GOG galaxy files have been stealth added to offline installs and some of the games in question will fail to start with these files present.

The principal file identified is galaxy.dll, which if renamed, or removed will stop the game working. It is unknown what this file does/claims to do, however for those of us specifically using the offline installers and who do not want any part of the Galaxy arena, this is extremely worrying. From what I am reading in these threads it appears that the file can call home/send information out, however even if it does not, what place does this file have in offline installers.

I have had a ticket with GOG support who believe this is a non issue and explain that this is due to "achievements"- I attach the ticket. As someone who doesn't use Galaxy, Achievements , online saves etc. I still do not see why the offline installers should be the same as the galaxy ones, its not like there is parity between them in terms of patches half the time. This will certainly influence my decision on whether to spend money here or not.

So, I will keep a list here of games which will not run without galaxy.dll present - although any with achievements would appear to fall under this:

Game Version Tested
Bioshock 1.0.122872_(25715)
Bioshock 2 1.0.122864_(25813)
Bioshock Infinite 1.0.1643565_(29748)
Fallout New Vegas 1.4.0.525_(12010)

Ok, I agree, GOG games should be telemetry free. But AFAIK, no single player game on GOG needs Galaxy installed or an internet connection - so maybe your thread title is a bit... panicky?

Depends, galaxy.dll is a galaxy file, there to add galaxy functionality in. Several games are confirmed to not work without those files. We don’t know what those files are doing exactly, wether they will be compatible in the future or with modding, and are not needed to run the base game. So it’s not good from my side.

It’s not the end of the world of course, I can pull out the net cable or box the game, but it’s something we shouldn’t be having to do with paid games. It took complaining before to even get installers without full galaxy in them, they keep trying.

Well at least the issue with Fallout NV is nothig new.
https://www.gog.com/forum/fallout_series/fallout_nv_calls_home_delaying_launch_when_internet_down

Yes and for certain games it is required. But if you don't run the game through Galaxy (can be done by deleting a certain file in the games directory so Galaxy doesn't pick it up.) Or don't have Galaxy installed its just a dummy file and does nothing.

As said by Hunch your title is very misleading as Galaxy is not required the games run fine without Galaxy.

Many GOG games that come with galaxy.dll / galaxy64.dll (as well as related filenames GogGalaxyHooks.dll, GalaxyCSharp.dll, GalaxyCSharpGlue.dll, GalaxyPeer64.dll, Galaxy64.lib, Galaxy64.pdb, etc) will crash / refuse to start with a "can't start because Galaxy is missing from your computer" message if those files are deleted / renamed. This includes : A Hat in Time, Blood Fresh Supply, Crookz The Big Heist, Divinity Original Sin: EE, Kathy Rain, QUBE2, Shadwen, Stardew Valley, etc, and a ton of others.

Some games also come with steam_api.dll / steam_api64.dll included. For some it's completely inactive, harmless and those files can be deleted without issue (eg, Amnesia Dark Descent, Divinity Original Sin EE, etc). For others (eg, QUBE, The Witness, etc), if you delete them the games refuse to start no differently than if you bought them on Steam and tried to run them without the Steam client, suggesting that for some games, the DRM check call to steam_api.dll is hard-coded into the game and the "DRM-Free" version supplied by the devs to GOG basically involves some cheap "auto-Steam-authenticate" loopback code in a replacement dll (little different to how cracks work) instead of actually being removed / supplied from a fresh pre DRM'd build. It doesn't stop you from playing if you don't delete the files, but it does look quite amateurish. In fact if you delete steam_api.dll and Steamworks.NET.dll from the GOG version of Hammerwatch, it crashes and the log file actually states "Failed to initialize Steam"...

Personally I don't mind local dll's that exist to avoid the need to install the client IF it doesn't go online, IF it doesn't interfere with offline gameplay, IF it doesn't affect long-term compatibility (eg, the DLL itself having issues with future Windows), and IF it doesn't cause performance issues. As mentioned in the other thread though, GOG's versions of Bioshocks start up 5x slower than Steam's DRM'd ones and Humble DRM-Free versions and the only difference is Galaxy integration, so I'd definitely like to see whatever is causing that (some network check/ timeout?) removed from those games precisely because it obviously does negatively affect some games.

True, but forum software doesn’t allow thread title changes. If only they put half the effort into these things rather than a steam like client...

It would be much appreciated to have clarity from staff as to what exactly is going on here...notably, are these just inert files or are they connecting/transmitting information, etc?

EDIT: This has been fixed now so not relevant anymore.

Here is a case of something else in a game besides achievements missing without Galaxy:
In X4 Foundations you need Galaxy (or Steam if bought there) to unlock new game starts. To make it even more fun, there is no Galaxy for Linux... thankfully this can be circumvented with a hack. Unlocks are tied to achievements :-( In a way it is better than the old way where you lost all your unlocks when you reinstalled a game. If anyone can figure out a better method, please tell me or the developers Egosoft.

EDIT: Not true anymore.

These libraries are needed due to how dynamic libraries work. Software that uses a library needs to have access to the library's development files during compile time, and the runtime DLL must be present at run time because once the executable is demand loaded into memory at application startup time one of the first things that happens is the operating system's dynamic linker has to load and resolve the symbols of all of the libraries the application is dynamically linked to. This is how dynamic linking works in a nutshell on Windows, Linux, Mac and pretty much all operating systems since the beginning of time.

If you remove a DLL file in Windows, or a .so file in Linux that an application is linked to, then the dynamic linker will not be able to locate the library and resolve the symbols causing the program to be unable to execute. Therefore, if any program uses any library to implement functionality the library must be installed on the system and available to the dynamic linker to load the software - even if the specific functionality provided by the library is not actually being used. This is a technical requirement for the software to function using shared libraries.

The other option is to link the libraries statically instead of dynamically in which case the entire library would be built right into the application's executable and the shared library (DLL/.so) would not need to be distributed as a separate file installed on the system because it is entirely built directly into the program. Static linking is generally something to avoid in modern apps except in specific circumstances, and would not in any way change anything with regard to the context of the current discussion though, it would merely change the code from existing inside a separate DLL demand page loaded only when the software actually needs it, but which needs to be present at startup time for the dynamic linker to find it - and change it into a program that has the entire library built right into it which is less optimal for the most part.

This is the same reason that programs that use Steam for anything at all, will provide a copy of the Steam runtime library, or if they use nVidia's PhysX, you need to have PhysX installed even if you are using AMD hardware, or countless hundreds of examples.

This isn't something forced onto everyone by GOG as a grand conspiracy theory to get everyone to use GOG Galaxy whether they like to or not, it is a technical requirement of all operating systems for dynamic linking of runtime libraries.

https://en.wikipedia.org/wiki/Dynamic_linker
https://en.wikipedia.org/wiki/Dynamic-link_library
https://www.symantec.com/connect/articles/dynamic-linking-linux-and-windows-part-one
https://www.symantec.com/connect/articles/dynamic-linking-linux-and-windows-part-two

We all know what dlls are thank you. We also know these games came out without this specific dll so this has been added later as an additional requirement t for GOG specific versions. It is not like physx or other software as it is not required by the game to run, only required as and additional layer put there by gog.

Also note that for some games you can remove this dll and the game will function fine without it, the ones mentioned above are the ones specifically where the game will not run without it, even though versions from elsewhere do not contain this file.

A further point of note is that there are two clear download options, galaxy enabled downloads, which contain all those achievements, online saves etc. And the offline installers. The question is why offline installers have to have galaxy components embedded in them when if you want the galaxy components simply download the galaxy installer. It’s simply creating parity between the two downloads where there is no need.

Single player games shouldn't need an Internet connection, but if there is one there are games that will attempt to use it for various reasons. Rise of the Triad for example will attempt to connect to the developer's servers at startup to download game news to present in the user interface. Other games are likely to do similar things. Single player games with optional online features may also try to connect online.

As some have pointed out in the thread, many games may attempt to connect to telemetry gathering servers either as a part of the developer's own telemetry gathering, or due to a bug present in Microsoft Visual Studio from a few years ago which enabled telemetry by default in the CRT IIRC, but I believe was fixed in a future update (whether or not that made it to existing software builds out there I'm not aware). I personally do not want anyone gathering any telemetry for anything for any reason by default either as it's always "anonymous data that is harmless" but which someone out there will figure out a way to harvest data from or do bad things with anyway IMHO and I prefer silent by default and opt-in to things than sharing data by default. I'm not sure what the current status of telemetry gathering is with Galaxy or other GOG built software, but I firewall off outbound requests to GOG, Steam, Microsoft, and other company's telemetry gathering, log file gathering, etc. servers by default under the premise of less unknown data leaving my machine is better (for me). Having said that, I'd rather block it myself and have control over that than leave it up to other companies to decide the best for me, but I'd like it if all telemetry was disabled by default and people were asked if they want to enable it and told why, with no penalty or downside to saying "no thanks".

I'm not certain, but I think No Man's Sky also connects online for some things but that may or may not be able to be disabled (I don't own it so can't check easily).

I wouldn't be surprised if there are some games in GOG's catalogue which have unexpected network traffic that may or may not be necessary or useful, but which are legacy code that GOG likely inherited, and the publisher either can't or doesn't want to bother rebuilding the game with changes to disable it perhaps at risk of destabilizing a game that is no longer actively developed. I haven't encountered any, but I'd be surprised if there aren't some things of this nature left in some games. Probably more annoying than anything to be concerned about mind you.

Knowing what a DLL is, and knowing how it actually works and how they're loaded and function are two different things, and the majority of computer users very much do not have any clue about how such low level things actually work. There might be the odd person here who does, but I highly doubt most people do, and if they did there would be more evidence of that in everyone's comments rather than what I actually see which is the opposite of that.

If a game can have the DLL file removed then it might have separate executables present for single player mode of the game and for multiplayer with the mutliplayer executable linked to the DLL. Removing the DLL would then not affect the single player one if it does not link to it, and if the person doesn't use the multiplayer one then it's not a problem if it is broken by removal of the DLL. But nothing of substance is really gained by deleting it either. Demand loading it is another possiblity but there's little benefit to be gained from that for the effort to do it so developers are less likely to bother doing it without a good benefit even if some do decide to do it. It's really a matter of how the publisher of a game decides to implement the functionality in their game and not something GOG themselves decide really.

There is a big difference between having downloadable installers that do and don't have the Galaxy client included for convenience, and completely ripping all Galaxy support out of a game's executables completely. The later would involve the publisher having to make custom builds of two completely different versions of a game to provide to GOG, one with Galaxy support and the associated DLL(s), and one with it completely disabled without the DLLs. There is really no real world benefit to doing the latter other than saving the miniscule disk space the DLL file consumes, but there is a real world developer/quality assurance overhead to building and testing multiple virtually identical builds of a program for what the publisher, developer, GOG and the majority of customers see as no real world practical benefit, so it is very unlikely that any company will ever do this for the sole purpose of appeasing a very small niche number of customers embroiled by what is essentially an irrational fear of the unknown. The irrational unknown being what is in the DLL and it's function and fear that it is doing something harmful to them and must be eradicated at all costs. I honestly don't think any company out there is going to take such a fear seriously and spend a lot of extra time and effort to provide multiple custom builds of a game and support it merely out of paranoia. It's just not a realistic thing to do.

If there are enough people paranoid about Galaxy's DLLs and all of the horrible things they must be doing, at least one person must be a developer out there. All they need to do is to create custom DLL files of the same names and put stub functions in them that do nothing, essentially satisfying the executable's need for a proper DLL to be installed and available for symbol resolution, but providing no actual functionality. I'm not sure how DLL overriding works on Windows, but in Linux you can install a custom shared library in the system to override any others present, and force the dynamic linker to always use the overridden library instead. I imagine Windows probably has a similar feature which one could use to override any GOG/Steam/whatever supplied libraries with fake stubs to satisfy runtime linker requirements if so desired. I'm not sure the effort is really worthwhile but it should be technically possible for the so inclined.

Looking back at some changelogs, I also note that GOG are going back into each offline installer systematically adding Galaxy feature parts into them. I noted a lot of older games have changelog - added cloud saves - which thankfully, I have not been downloading. So I take a look at Dungeon Keeper Gold:
My version: 2.0.0.4, no galaxy components. Installer size 246mb
Current version: 10.1_(28184). galaxy cloud save functionality. Installer size 281mb. Principal file change is game.gog whic increased by 20+mb.

This is aditional work being made specifically to make parity between offline installers and galaxy installers to have the same functionality. I haven't found an example of achievements being added yet, but I would suspect that has been happening also.
So we don't just have the galaxy tie in, we are back to the question which was debated back when galaxy came out that size of installers is increasing due to galaxy etc.

To my mind, galaxy installers are provided, there is a big blue button for it and its pointed to everywhere on the site. Offline installers are for those of us who do not want galaxy, why make them the same, there is no point.

And just to note the text on the offline installers:
Download game files only. Useful if you anticipate limited internet access, or want to have a backup. These installers don't support auto-updating, nor on-line features.