3 ms·

I agree. I wish Steam would implement a sandbox and require all games to run in it. Every native game I download could be uploading any portion of of my hard dr

I agree. I wish Steam would implement a sandbox and require all games to run in it. Every native game I download could be uploading any portion of of my hard drive to wherever they choose.

dublinben 11y ago
You could say the same for any proprietary program you're running. A sandbox just provides a false sense of security.
- kbenson 11y ago
  I wouldn't say it's entirely false. A sandbox allows you to provide different levels of trust and responsibility to different parties, which allow you to align those responsibilities with the incentives of the parties involved. If Valve is providing a sandbox, then it's in Valve's best interest to make sure it works fairly well, as if it doesn't then that reflects poorly on them. Game developers will want to fit within the sandbox, and not break the rules, because the benefits of Valve's Steam are obvious, and losing access to it (or getting a worse deal on sales percentages) is a big deal. Is it possible to break out of sandboxes? Sure. Do I think that having a sandbox in place prevents some of the more rampant abuse and some bad actors? Also yes. So I think sandboxes make us more secure (if you trust the sandbox provider), but that doesn't mean we are secure (which is for the most part unobtainable, so we should be focusing on degrees of security anyways).
- mwfunk 11y ago
  No, a sandbox provides an actual layer of security. You could argue about whether or not this or that sandbox implementation succeeds, but there is no getting around the fact that it is by definition an additional system-level layer of security. Given the verbiage that you used, what you're clearly trying to express is, "anything that's not open source is inherently insecure." If that's the point you're trying to make, you should just make that point, don't dance around it by making it sound like you're talking about the usefulness of sandboxing. Hell, chroot could be considered a form of sandboxing and it's used in open source all the time, as are VMs, as are jails, as are having dedicated system accounts for different daemons, as are a gazillion other technologies and practices that provide additional separation between software and the system it's running on. Surely you don't think that stuff is all smoke and mirrors to make people feel safe.
- Paul-ish 11y ago
  Sure, but I can trust Valve not to mess with my machine more than I can trust a random indie game not to mess something up. There is still trust, but I think one can make a case that the trust is not misplaced in Valve.
  - dublinben 11y ago
    Even Valve can make mistakes.[0] [0]http://techreport.com/news/27687/steam-for-linux-bug-deletes-your-data http://techreport.com/news/27687/steam-for-linux-bug-deletes...
  - fucking_tragedy 11y ago
    It's not so much that I trust Valve or any other company, their interests are often orthogonal to mine. They are an entity that can be held accountable, however.
khedoros 11y ago
I certainly hope that they are uploading a portion of my hard drive, although I also hope that it's limited to providing the cloud save functionality.

I agree. I wish Steam would implement a sandbox and require all games to run in it. Every native game I download could be uploading any portion of of my hard drive to wherever they choose.

dublinben 11y ago

You could say the same for any proprietary program you're running. A sandbox just provides a false sense of security.

kbenson 11y ago
I wouldn't say it's entirely false. A sandbox allows you to provide different levels of trust and responsibility to different parties, which allow you to align those responsibilities with the incentives of the parties involved. If Valve is providing a sandbox, then it's in Valve's best interest to make sure it works fairly well, as if it doesn't then that reflects poorly on them. Game developers will want to fit within the sandbox, and not break the rules, because the benefits of Valve's Steam are obvious, and losing access to it (or getting a worse deal on sales percentages) is a big deal. Is it possible to break out of sandboxes? Sure. Do I think that having a sandbox in place prevents some of the more rampant abuse and some bad actors? Also yes. So I think sandboxes make us more secure (if you trust the sandbox provider), but that doesn't mean we are secure (which is for the most part unobtainable, so we should be focusing on degrees of security anyways).
mwfunk 11y ago
No, a sandbox provides an actual layer of security. You could argue about whether or not this or that sandbox implementation succeeds, but there is no getting around the fact that it is by definition an additional system-level layer of security. Given the verbiage that you used, what you're clearly trying to express is, "anything that's not open source is inherently insecure." If that's the point you're trying to make, you should just make that point, don't dance around it by making it sound like you're talking about the usefulness of sandboxing. Hell, chroot could be considered a form of sandboxing and it's used in open source all the time, as are VMs, as are jails, as are having dedicated system accounts for different daemons, as are a gazillion other technologies and practices that provide additional separation between software and the system it's running on. Surely you don't think that stuff is all smoke and mirrors to make people feel safe.
Paul-ish 11y ago
Sure, but I can trust Valve not to mess with my machine more than I can trust a random indie game not to mess something up. There is still trust, but I think one can make a case that the trust is not misplaced in Valve.
- dublinben 11y ago
  Even Valve can make mistakes.[0] [0]http://techreport.com/news/27687/steam-for-linux-bug-deletes-your-data http://techreport.com/news/27687/steam-for-linux-bug-deletes...
- fucking_tragedy 11y ago
  It's not so much that I trust Valve or any other company, their interests are often orthogonal to mine. They are an entity that can be held accountable, however.

khedoros 11y ago

I certainly hope that they are uploading a portion of my hard drive, although I also hope that it's limited to providing the cloud save functionality.