13 ms·

GNU/Linux local username triggers Steam VAC ban

158 points by bdz 9y ago

baobrain 9y ago
> Good day, I've received word from the VAC team that this is intentional and not open for discussion on Github. > In general VAC issues are not handled on Github in any capacity and further issue reports on this may result in being banned from the Valve Software issue trackers. This is just incomprehensible from a PR standpoint, even for a company like Valve, especially since people on the thread have brought up legitimate concerns for users that might be caught in the flak.
- anonymousab 9y ago
  Enough people will say that it's fine because of cheaters. The gaming or software equivalent of justifying bad legislation because of criminals. Based off of the previous DNS false banning debacle, they'll ignore any negativity about this unless it reaches critical mass, at which point they'll say that combatting cheating is hard so give them carte blanche. The GitHub response is merely the "stop pointing out the Emperor's lack of clothes" aspect of the first part.
  - gsich 9y ago
    Was there false banning based on DNS?
    - anonymousab 9y ago
      False bans is hard to prove - you always have people claiming it, especially the cheaters themselves - but IIRC they came out and said they were scanning user DNS cache entries and using them as a basis for VAC actions. Gabe's response more or less boiled down to "cheating is a hard problem". I hope I'm not misremembering or being uncharitable. EDIT - I called it a false ban debacle because they was one half of the issue; the privacy implications were equally important.
      - arrivance 9y ago
        I believe you are misremembering: what Valve said within their statement on /r/games is that the DNS entries were being used after the detection of the cheats. Here's a quotation from Gabe's post: >VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result. [1] [1]: https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
        anonymousab 9y ago
        Ah, ok. Thanks for the correction.
  - FRex 9y ago
    Exfiltrating what websites you've accessed. That's basically what a spyware does. What in actual fuck.
    - stordoff 9y ago
      I'm not exactly fine with it, but my understanding[0] is that it did a local check and only send the "bad" domains remotely. Still a privacy leak, but in a different class as bulk-uploading your entire DNS record. [0] Per https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
      - FRex 9y ago
        And my understanding is that Gabe Newell who runs this circus just happens to have claimed so when the milk was already long split. If he is so concerned that Valve will be associated with spyware then he shouldn't have let VAC team create a literal piece of (definition fitting) spyware. Somehow the examples on VAC page say it looks for third party modifications to game files, not rummages through your entire machine. As if they knew it sounds sketchy to users. Even if they are working in good faith they might screw up during one of these raids against my machine (like they did with rm -rf on Linux in the uninstall script) and leak something or save it to some temporary file that something else might pick up. This is still very out of line. I buy games via a proprietary platform that doubles as a DRM while pirates have no DRM, open source torrent clients and verified cracker teams and I'm the one having privacy worries here?
- nickodell 9y ago
  Innocent users might be caught by this, but so far that's entirely hypothetical. The user that posted this has a pinned repo named "AimTux." The second guy is a contributor to "catbot." Ditto the third guy. One of the people in the thread suggests that he wants to have a TF2 aimbot installed, but it's not for cheating at TF2, honest.
  - ianai 9y ago
    Botters can ruin a very fun game completely. It may seem too far, but if a botter self identifies why not take them at their word?
  - deusum 9y ago
    Sad that you don't defend the innocent because you deemed them hypothetical.
    - throwaway2048 9y ago
      Hypothetical innocents that can be checked for before a banwave goes out vs hundreds/thousands of active accounts cheating and ruining games.
    - dkonofalski 9y ago
      He/she didn't deem them hypothetical. They are hypothetical until a legitimate user that doesn't use bots makes the claim that they were banned for this. According to updates made to this, the username wasn't even the source of the ban so these "innocents" are definitely hypothetical.
  - Kr4ken 9y ago
    Innocent users are the only ones that will get caught up by this anymore, the cheaters already worked around this(https://github.com/nullifiedcat/catbot-setup/commit/c2d22ee92d0af11376243ca20c7522e6e7205506 https://github.com/nullifiedcat/catbot-setup/commit/c2d22ee9...). Yes, cheaters were the first to report it because they were the first to experience it.
- na85 9y ago
  Valve is well known for being immune to the normal repercussions of having awful PR. For some reason, the market forgives them despite having downright hostile interaction with the community on a regular basis.
  - adnzzzzZ 9y ago
    >For some reason, Maybe because none of this is relevant and everyone in this thread is getting upset over nothing. No real users have been harmed as a result of this measure (most people in the github issues thread have repos where they own or contribute to cheating software) and it seems to have worked to ban a number of cheaters. Seems like good engineering to me on their part when such a simple solution turns out to be so effective.
    - anonymousab 9y ago
      > No real users have been harmed If they had, they wouldn't know why. That's one of the major parts of the problem - the entire ban system (and appeals process, or rather, the letter memory hole valve deigns to call a process) is opaque, a black box. You don't know why you're banned beyond "cheating/hacking" or "cheating in game X" in the best case. There's then the self-fulfilling silliness with the proclamations of perfection of VAC; you need such a high standard to prove the negative, that you did not cheat, and a ton of luck for them to even consider the possibility.
  - pdkl95 9y ago
    > the market forgives them It's not forgiveness; Valve et al know that if they simply ignore the bad PR, people will forget and protesting becomes repetitive and tiresome. This is the insidious power of silence, and why actual change only happens when people refuse to go away until the problem is actually fixed. Without this continuous push back, silence transforms bad behavior into the new normal. Jim Sterling has a great video[1] that explains this problem in greater detail. [1] https://www.youtube.com/watch?v=a6lvDL4cNdM https://www.youtube.com/watch?v=a6lvDL4cNdM (warning: contains some strong language)
- jaccarmac 9y ago
  > even for a company like Valve There is no such thing as too far for Valve, as the community for their games knows well. It's become something of a meme at this point. You are familiar with Gabe calling the host of a tournament out publicly on Reddit, yes?
emsy 9y ago
As someone who plays a lot of games, I can't wait for the day when Steam gets replaced by something better. And given Steam's current state, "something better" is a really low bar to go by. At this point I would prefer individual installers for each game, without any "platform" whatsoever.
- jhasse 9y ago
  That's what you have on gog.com :)
  - morganvachon 9y ago
    I agree, unfortunately the number of titles is an order of magnitude less on GOG. Still, I have over 50 games from GOG and just over 100 from Steam. Anecdotal I know, but I find the GOG lineup more curated and less filler than Steam.
    - jhasse 9y ago
      > Anecdotal I know, but I find the GOG lineup more curated and less filler than Steam. There's a reason for that: It's harder to get your game on GOG, they are still deciding on a case-by-case basis. While on Steam every game which pays a fee (~$100) gets accepted IIRC.
  - deleted 9y ago
    [deleted]
  - jakebasile 9y ago
    I'd love for GOG to be better competition for Steam, and they've made wonderful strides - I actually prefer their Galaxy client over Steam, though I also think UPlay is nicer than Steam since Steam has so much going on that I don't need. But like sibling commenter points out it's a numbers game and GOG's stock just doesn't compare yet. You can't get many AAA releases on GOG even after some time has passed since release - publishers are simply allergic to their strong no-DRM policy and see no reason to be there when people will happily buy it on Steam. Where GOG is deftly competing is the AA market - games from smaller developers/publishers such as CD Projekt Red (CDPR is owned by the same company as GOG but they are a titan in the AA/AAA field), THQ Nordic, Paradox Interactive, and so on. Many of the games from these companies are released day and date on GOG.
morpheuskafka 9y ago
Just wait till someone writes a bot that runs under a 'tux' user by default...
- gsich 9y ago
  or "root"
  - jandrese 9y ago
    I have to wonder how many people would go "Yeah, sketchy cheatbot app, go ahead and run as root. That seems like a good idea."
    - dpwm 9y ago
      There's nothing special about the name root, it's just a convention that it maps to uid 0. You can change it to something else and then rename an account with a uid != 0 to root. Whether this breaks anything is largely distribution dependant. Whether or not that would result in the check being changed to see if "root" is uid 0 is another step in an arms race. Because with containerization or virtualization you can run as root with much more acceptable levels of risk than usual.
    - ryanlol 9y ago
      You're already running the code locally, unless you're in an incredibly hardened environment it is going to make precisely zero difference whether you run it as root or not.
bdz 9y ago
In Team Fortress 2, there is a group of people who host multiple cheat-controlled aimbotting bots, which run around on servers, destroying everyone playing in the other team. These are called cat-bots. To host these bots, you need to set up a Linux environment. Then you can use a script, which automatically prepares your system for hosting the bots. One of the things it does is it creates multiple users in Linux (to run multiple Steam instances), all of them starting with "catbot". https://github.com/nullifiedcat/catbot-setup https://github.com/nullifiedcat/catbot-setup And the script creators already changed every mention of "catbot" to "kisak" (name of the Github moderator for Valve) https://github.com/nullifiedcat/catbot-setup/commit/58582f8103064d63db063eef4b2d31792ebb2cd0 https://github.com/nullifiedcat/catbot-setup/commit/58582f81...
- ajross 9y ago
  So in one sentence, a user name containing "catbot" is a legitimate signature of an actual work of malware Valve is trying to mitigate. HN, you got trolled. There's nothing wrong here at all.
  - rnhmjoj 9y ago
    A legitimate signature would be a sequence of actions the client sends the server that are clearly not possible to have been performed by an actual user playing the game. Like an incredibly improbable statistic or too fast actions or something else. This is a poor solution: it's the equivalent of blocking spammers by IP address. It works but will also lock out legitimate users.
    - ajross 9y ago
      That's not the way this kind of thing works, not even in commercial AV. What you are asking for is for Valve to solve the halting problem before addressing ongoing actual cheating in it's games. That's ridiculous. You take what clues you can get and you push the fix. This is what all their users not named catbot want.
      - 9y ago
subway 9y ago
Remember when Valve made cool games, instead of bilking kids for hat money and removing product functionality because of your username?
- xroche 9y ago
  > Remember when Valve made cool games Remember when Valve made games...
  - novium 9y ago
    So that card game they're talking about isn't a game? [0] https://www.theverge.com/2017/8/9/16117586/artifact-dota2-game-valve-official-teaser https://www.theverge.com/2017/8/9/16117586/artifact-dota2-ga...
    - fwer 9y ago
      If it's a game, then why not post a link to steam store? your shitty article has zero information about the game, no gameplay, no nothing. kys
    - Mithaldu 9y ago
      Let's be fair here: It's an easy pivot where they keep paying the DOTA artists already on the payroll with a minimum staff of software and game design devs in order to milk the plump microtransaction teat. Yes, it's a game. But barring the DOTA IP and existing graphics assets it will not be particularly different from any given other offering in this specific market space. And that's the unspoken thing in the post you're replying to: "new". Valve hasn't made any truly new game since Left 4 Dead, and i'm sure it could easily be argued that even that wasn't particularly ground-breaking.
andrewmcwatters 9y ago
My answer to Valve's behavior in recent years was to just stop buying games from them, or on Steam in general, so they don't receive revenue from me.
Karunamon 9y ago
Remember when Valve's official stance about VAC was that it will only ever detect cheats, that it doesn't make mistakes, and that if you got a VAC ban, you had it coming? And then they had a number of false positives over the years where they had to rescind the bans? And now they're detecting things that aren't cheats. A username on the local machine is not a cheat, end of fucking discussion.
- ReverseCold 9y ago
  Why would you set your username to the name of a known cheat though? And if you are VAC banned because of it, you can still play your games on non official servers. "Less evil DRM" if you will.
  - stordoff 9y ago
    Why would expect users to know the names of all known cheats though? If someone created a bot called, say, "VerseC", I doubt you'd be thrilled if that resulted in you being banned. I also suspect the crossover between cheat names and gamer user names is high - "catbot" would not look at all out of place in a list of user name.
    - paulmd 9y ago
      Anyone who's still playing TF2 at this point has a pretty good idea of the names of the various bots at this point, because they spam them in chat while they're running. GET GOOD GET LMAOBOX has ruined many a session for me, and I would never think of using 'lmaobox' as a username. Even if you aren't actually hacking, that's a quick route to the other denizens of the server votebanning you. Nor would I ever dream of using it as a system user. I think the context you and most other people are missing here is that these bots are a fucking plague on what remains of the TF2 community and we're more than willing to have zero tolerance for anything connected to them.
      - stordoff 9y ago
        A) The cheat may post-date your choice of username. Even if you're aware of the name (and thus avoid using it in-game), you probably wouldn't change (or even think to change) a long standing system username. B) Non-TF2 players probably _aren't_ going to be aware of TF2 cheat names. A CS:Source player may not know of them, as it's not their game, but the same VAC ban covers both CS:S and TF2 (FWIW I play CS:S occasionally and have never seen such ads. there). I understand that it is a major issue (it's one of the reasons I haven't returned to TF2 in a while), but that's not a great reason to accept a poor solution that could effect innocent users.
PlutoIsAPlanet 9y ago
Given that all the accounts claiming to have been banned are somehow linked back to CSGO cheating on their GitHub profiles, gonna say this is just cheaters trying to get unbanned.
- Kr4ken 9y ago
  Including the Valve Employee that confirmed their issue?
  - user5994461 9y ago
    Including you who commented on the issue and is affiliated to the bot. You're a living case of a criminal trying to pretend he's not a criminal after he's caught.
    - Kr4ken 9y ago
      Yes, I commented on the issue. No, I am not affiliated with the bot. I'm not pretending to be anything, I never claimed anything. If I wanted to hide anything I wouldn't use my main github account. I just thought that Valve banning based on usernames was an interesting subject, so I commented on it. You're commenting on a thread about cheaters, why would you do so? You're a living case of a criminal trying to pretend he's not a criminal after he's caught hands in!
    - pdkl95 9y ago
      Do you have evidence to support your accusation of affiliation with the people involved with "catbot"[1]? Or is this libel? > criminal Writing unauthorized software modifications for commercial software is not illegal, making your accusation of criminal activity doesn't make sense. Unless the bot also made copies of the software, this is a civil matter and probably at worst a breech of contract. However, even if someone authored the bot, unsubstantiated accusations have no place in civilized society. If accusations are being made, you need to provide evidence 0of the actual bot, not hearsay based on merely an account name. That evidence needs to be presented with at lest some amount of due process where the accused has the opportunity to face their accuser and rebut the claim. [1] Or any other unauthorized 3rd-party utility software for games published on Steam.
varjag 9y ago
http://www.catb.org/jargon/html/D/Don-t-do-that-then-.html http://www.catb.org/jargon/html/D/Don-t-do-that-then-.html
- jimnotgym 9y ago
  catb as a name is dangerously close to getting you banned by Steam
deleted 9y ago
[deleted]
hitekker 9y ago
As Nickodell and PlutoIsAPlanet pointed out, this "issue" was raised by a group of banned Team Fortress 2 cheaters, who are developing obfuscated aimbots. In all likelihood, VAC's detection is premised on other factors in combination with the username. Like, for example, botting in online multiplayer games. This may come as a surprise to half the users in these comments, but, for the 99% of gamers who are not malware enthusiasts, banning bad actors is a feature, not a bug.
- anonymousab 9y ago
  Seemingly heavy handed features wouldn't be so readily despised if: * Valve didn't shut the discussion down altogether. If the GitHub page wasn't the right place, then suggesting a forum where feedback would be appropriate and actually prompt a response would be the way to go. * Valve (or rather, their support staff) didn't have a history of extolling the perfection of VAC while dealing with some false bans in private. * Bans didn't have such large implications, or: * The support and appeal process wasn't so obtuse, seemingly useless and blackboxed. I think they'd be encouraged to take more chances with their Anti-cheat ideas if the process for fixing false positives wasn't so genetically corporate and so user-hostile.
  - throwaway2048 9y ago
    The problem is all of those mechanisms give hackers a lot of leverage to evade banning, and they will be abused.
- FRex 9y ago
  No, it's clearly not. There are people in the linked issue saying they had no cheats and just the username and got banned and the last comment is a Valve employee stating this is all intentional and forbidding any further discussion of it. This is an incredibly dumb way to catch "cheaters" and now that they know they will easily defeat it. This is absolute bullshit and like saying "issue of rape in prison was raised by criminals who are evil so it's a feature for society they get raped". And here's a money quote (guess whose): > When the truth of one issue goes against a person's political leanings, that person will generally say whatever they can to avoid feeling guilt or shame.
jwilk 9y ago
VAC = Valve Anti-Cheat https://en.wikipedia.org/wiki/Valve_Anti-Cheat https://en.wikipedia.org/wiki/Valve_Anti-Cheat
jimnotgym 9y ago
I'm not sure I want Steam on my PC anymore. My local accounts are non of their business. What other nonsense are they up to?
zkomp 9y ago
Ouch I did not know Valve had sunk so low... String matching parts of a local username alone can not ever be enough for a ban... Completely ridiculous
chickenfries 9y ago
This is by far one of the strangest things I have seen HN get mad about. The commenters on the linked issue seem to be mostly aimbot users. Wouldn't be surprised if they're here too.
arkona 9y ago
> Good day, I've received word from the VAC team that this is intentional and not open for discussion on Github. > In general VAC issues are not handled on Github in any capacity and further issue reports on this may result in being banned from the Valve Software issue trackers. This is not the way to address a paying customer. These people truly are a bunch of clowns.
jimjimjim 9y ago
It's their software, they can do whatever they like. Manufactured drama.
drngdds 9y ago
So if I'm understanding this right, you can get permanently banned from all of these games (http://store.steampowered.com/search/?category2=8 http://store.steampowered.com/search/?category2=8) just for having a certain username? That's crazy, no matter what the username is.
- dkonofalski 9y ago
  You're understanding the way they described it right. The reality, however, is not correct. You cannot get banned from those games just for having a certain username. You would have to have that username and also trigger other detection parameters.
csense 9y ago
New Year's resolution: Don't buy anything else on Steam.
uname-a 9y ago
inb4 bots runs at root
NelsonMinar 9y ago
A Valve employee showed up on Reddit to say this bug report is not correct. https://np.reddit.com/r/linux_gaming/comments/7ndjdt/valve_will_vac_ban_you_automatically_for_having/ds2dulw/ https://np.reddit.com/r/linux_gaming/comments/7ndjdt/valve_w...

158 points by bdz 9y ago

> Good day, I've received word from the VAC team that this is intentional and not open for discussion on Github. > In general VAC issues are not handled on Github in any capacity and further issue reports on this may result in being banned from the Valve Software issue trackers. This is just incomprehensible from a PR standpoint, even for a company like Valve, especially since people on the thread have brought up legitimate concerns for users that might be caught in the flak.

anonymousab 9y ago
Enough people will say that it's fine because of cheaters. The gaming or software equivalent of justifying bad legislation because of criminals. Based off of the previous DNS false banning debacle, they'll ignore any negativity about this unless it reaches critical mass, at which point they'll say that combatting cheating is hard so give them carte blanche. The GitHub response is merely the "stop pointing out the Emperor's lack of clothes" aspect of the first part.
- gsich 9y ago
  Was there false banning based on DNS?
  - anonymousab 9y ago
    False bans is hard to prove - you always have people claiming it, especially the cheaters themselves - but IIRC they came out and said they were scanning user DNS cache entries and using them as a basis for VAC actions. Gabe's response more or less boiled down to "cheating is a hard problem". I hope I'm not misremembering or being uncharitable. EDIT - I called it a false ban debacle because they was one half of the issue; the privacy implications were equally important.
    - arrivance 9y ago
      I believe you are misremembering: what Valve said within their statement on /r/games is that the DNS entries were being used after the detection of the cheats. Here's a quotation from Gabe's post: >VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result. [1] [1]: https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
      - anonymousab 9y ago
        Ah, ok. Thanks for the correction.
- FRex 9y ago
  Exfiltrating what websites you've accessed. That's basically what a spyware does. What in actual fuck.
  - stordoff 9y ago
    I'm not exactly fine with it, but my understanding[0] is that it did a local check and only send the "bad" domains remotely. Still a privacy leak, but in a different class as bulk-uploading your entire DNS record. [0] Per https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
    - FRex 9y ago
      And my understanding is that Gabe Newell who runs this circus just happens to have claimed so when the milk was already long split. If he is so concerned that Valve will be associated with spyware then he shouldn't have let VAC team create a literal piece of (definition fitting) spyware. Somehow the examples on VAC page say it looks for third party modifications to game files, not rummages through your entire machine. As if they knew it sounds sketchy to users. Even if they are working in good faith they might screw up during one of these raids against my machine (like they did with rm -rf on Linux in the uninstall script) and leak something or save it to some temporary file that something else might pick up. This is still very out of line. I buy games via a proprietary platform that doubles as a DRM while pirates have no DRM, open source torrent clients and verified cracker teams and I'm the one having privacy worries here?
nickodell 9y ago
Innocent users might be caught by this, but so far that's entirely hypothetical. The user that posted this has a pinned repo named "AimTux." The second guy is a contributor to "catbot." Ditto the third guy. One of the people in the thread suggests that he wants to have a TF2 aimbot installed, but it's not for cheating at TF2, honest.
- ianai 9y ago
  Botters can ruin a very fun game completely. It may seem too far, but if a botter self identifies why not take them at their word?
- deusum 9y ago
  Sad that you don't defend the innocent because you deemed them hypothetical.
  - throwaway2048 9y ago
    Hypothetical innocents that can be checked for before a banwave goes out vs hundreds/thousands of active accounts cheating and ruining games.
  - dkonofalski 9y ago
    He/she didn't deem them hypothetical. They are hypothetical until a legitimate user that doesn't use bots makes the claim that they were banned for this. According to updates made to this, the username wasn't even the source of the ban so these "innocents" are definitely hypothetical.
- Kr4ken 9y ago
  Innocent users are the only ones that will get caught up by this anymore, the cheaters already worked around this(https://github.com/nullifiedcat/catbot-setup/commit/c2d22ee92d0af11376243ca20c7522e6e7205506 https://github.com/nullifiedcat/catbot-setup/commit/c2d22ee9...). Yes, cheaters were the first to report it because they were the first to experience it.
na85 9y ago
Valve is well known for being immune to the normal repercussions of having awful PR. For some reason, the market forgives them despite having downright hostile interaction with the community on a regular basis.
- adnzzzzZ 9y ago
  >For some reason, Maybe because none of this is relevant and everyone in this thread is getting upset over nothing. No real users have been harmed as a result of this measure (most people in the github issues thread have repos where they own or contribute to cheating software) and it seems to have worked to ban a number of cheaters. Seems like good engineering to me on their part when such a simple solution turns out to be so effective.
  - anonymousab 9y ago
    > No real users have been harmed If they had, they wouldn't know why. That's one of the major parts of the problem - the entire ban system (and appeals process, or rather, the letter memory hole valve deigns to call a process) is opaque, a black box. You don't know why you're banned beyond "cheating/hacking" or "cheating in game X" in the best case. There's then the self-fulfilling silliness with the proclamations of perfection of VAC; you need such a high standard to prove the negative, that you did not cheat, and a ton of luck for them to even consider the possibility.
- pdkl95 9y ago
  > the market forgives them It's not forgiveness; Valve et al know that if they simply ignore the bad PR, people will forget and protesting becomes repetitive and tiresome. This is the insidious power of silence, and why actual change only happens when people refuse to go away until the problem is actually fixed. Without this continuous push back, silence transforms bad behavior into the new normal. Jim Sterling has a great video[1] that explains this problem in greater detail. [1] https://www.youtube.com/watch?v=a6lvDL4cNdM https://www.youtube.com/watch?v=a6lvDL4cNdM (warning: contains some strong language)
jaccarmac 9y ago
> even for a company like Valve There is no such thing as too far for Valve, as the community for their games knows well. It's become something of a meme at this point. You are familiar with Gabe calling the host of a tournament out publicly on Reddit, yes?

emsy 9y ago

As someone who plays a lot of games, I can't wait for the day when Steam gets replaced by something better. And given Steam's current state, "something better" is a really low bar to go by. At this point I would prefer individual installers for each game, without any "platform" whatsoever.

jhasse 9y ago
That's what you have on gog.com :)
- morganvachon 9y ago
  I agree, unfortunately the number of titles is an order of magnitude less on GOG. Still, I have over 50 games from GOG and just over 100 from Steam. Anecdotal I know, but I find the GOG lineup more curated and less filler than Steam.
  - jhasse 9y ago
    > Anecdotal I know, but I find the GOG lineup more curated and less filler than Steam. There's a reason for that: It's harder to get your game on GOG, they are still deciding on a case-by-case basis. While on Steam every game which pays a fee (~$100) gets accepted IIRC.
- deleted 9y ago
  [deleted]
- jakebasile 9y ago
  I'd love for GOG to be better competition for Steam, and they've made wonderful strides - I actually prefer their Galaxy client over Steam, though I also think UPlay is nicer than Steam since Steam has so much going on that I don't need. But like sibling commenter points out it's a numbers game and GOG's stock just doesn't compare yet. You can't get many AAA releases on GOG even after some time has passed since release - publishers are simply allergic to their strong no-DRM policy and see no reason to be there when people will happily buy it on Steam. Where GOG is deftly competing is the AA market - games from smaller developers/publishers such as CD Projekt Red (CDPR is owned by the same company as GOG but they are a titan in the AA/AAA field), THQ Nordic, Paradox Interactive, and so on. Many of the games from these companies are released day and date on GOG.

morpheuskafka 9y ago

Just wait till someone writes a bot that runs under a 'tux' user by default...

gsich 9y ago
or "root"
- jandrese 9y ago
  I have to wonder how many people would go "Yeah, sketchy cheatbot app, go ahead and run as root. That seems like a good idea."
  - dpwm 9y ago
    There's nothing special about the name root, it's just a convention that it maps to uid 0. You can change it to something else and then rename an account with a uid != 0 to root. Whether this breaks anything is largely distribution dependant. Whether or not that would result in the check being changed to see if "root" is uid 0 is another step in an arms race. Because with containerization or virtualization you can run as root with much more acceptable levels of risk than usual.
  - ryanlol 9y ago
    You're already running the code locally, unless you're in an incredibly hardened environment it is going to make precisely zero difference whether you run it as root or not.

bdz 9y ago

In Team Fortress 2, there is a group of people who host multiple cheat-controlled aimbotting bots, which run around on servers, destroying everyone playing in the other team. These are called cat-bots. To host these bots, you need to set up a Linux environment. Then you can use a script, which automatically prepares your system for hosting the bots. One of the things it does is it creates multiple users in Linux (to run multiple Steam instances), all of them starting with "catbot". https://github.com/nullifiedcat/catbot-setup https://github.com/nullifiedcat/catbot-setup And the script creators already changed every mention of "catbot" to "kisak" (name of the Github moderator for Valve) https://github.com/nullifiedcat/catbot-setup/commit/58582f8103064d63db063eef4b2d31792ebb2cd0 https://github.com/nullifiedcat/catbot-setup/commit/58582f81...

ajross 9y ago
So in one sentence, a user name containing "catbot" is a legitimate signature of an actual work of malware Valve is trying to mitigate. HN, you got trolled. There's nothing wrong here at all.
- rnhmjoj 9y ago
  A legitimate signature would be a sequence of actions the client sends the server that are clearly not possible to have been performed by an actual user playing the game. Like an incredibly improbable statistic or too fast actions or something else. This is a poor solution: it's the equivalent of blocking spammers by IP address. It works but will also lock out legitimate users.
  - ajross 9y ago
    That's not the way this kind of thing works, not even in commercial AV. What you are asking for is for Valve to solve the halting problem before addressing ongoing actual cheating in it's games. That's ridiculous. You take what clues you can get and you push the fix. This is what all their users not named catbot want.
    - 9y ago

subway 9y ago

Remember when Valve made cool games, instead of bilking kids for hat money and removing product functionality because of your username?

xroche 9y ago
> Remember when Valve made cool games Remember when Valve made games...
- novium 9y ago
  So that card game they're talking about isn't a game? [0] https://www.theverge.com/2017/8/9/16117586/artifact-dota2-game-valve-official-teaser https://www.theverge.com/2017/8/9/16117586/artifact-dota2-ga...
  - fwer 9y ago
    If it's a game, then why not post a link to steam store? your shitty article has zero information about the game, no gameplay, no nothing. kys
  - Mithaldu 9y ago
    Let's be fair here: It's an easy pivot where they keep paying the DOTA artists already on the payroll with a minimum staff of software and game design devs in order to milk the plump microtransaction teat. Yes, it's a game. But barring the DOTA IP and existing graphics assets it will not be particularly different from any given other offering in this specific market space. And that's the unspoken thing in the post you're replying to: "new". Valve hasn't made any truly new game since Left 4 Dead, and i'm sure it could easily be argued that even that wasn't particularly ground-breaking.

andrewmcwatters 9y ago

My answer to Valve's behavior in recent years was to just stop buying games from them, or on Steam in general, so they don't receive revenue from me.

Karunamon 9y ago

Remember when Valve's official stance about VAC was that it will only ever detect cheats, that it doesn't make mistakes, and that if you got a VAC ban, you had it coming? And then they had a number of false positives over the years where they had to rescind the bans? And now they're detecting things that aren't cheats. A username on the local machine is not a cheat, end of fucking discussion.

ReverseCold 9y ago
Why would you set your username to the name of a known cheat though? And if you are VAC banned because of it, you can still play your games on non official servers. "Less evil DRM" if you will.
- stordoff 9y ago
  Why would expect users to know the names of all known cheats though? If someone created a bot called, say, "VerseC", I doubt you'd be thrilled if that resulted in you being banned. I also suspect the crossover between cheat names and gamer user names is high - "catbot" would not look at all out of place in a list of user name.
  - paulmd 9y ago
    Anyone who's still playing TF2 at this point has a pretty good idea of the names of the various bots at this point, because they spam them in chat while they're running. GET GOOD GET LMAOBOX has ruined many a session for me, and I would never think of using 'lmaobox' as a username. Even if you aren't actually hacking, that's a quick route to the other denizens of the server votebanning you. Nor would I ever dream of using it as a system user. I think the context you and most other people are missing here is that these bots are a fucking plague on what remains of the TF2 community and we're more than willing to have zero tolerance for anything connected to them.
    - stordoff 9y ago
      A) The cheat may post-date your choice of username. Even if you're aware of the name (and thus avoid using it in-game), you probably wouldn't change (or even think to change) a long standing system username. B) Non-TF2 players probably _aren't_ going to be aware of TF2 cheat names. A CS:Source player may not know of them, as it's not their game, but the same VAC ban covers both CS:S and TF2 (FWIW I play CS:S occasionally and have never seen such ads. there). I understand that it is a major issue (it's one of the reasons I haven't returned to TF2 in a while), but that's not a great reason to accept a poor solution that could effect innocent users.

PlutoIsAPlanet 9y ago

Given that all the accounts claiming to have been banned are somehow linked back to CSGO cheating on their GitHub profiles, gonna say this is just cheaters trying to get unbanned.

Kr4ken 9y ago
Including the Valve Employee that confirmed their issue?
- user5994461 9y ago
  Including you who commented on the issue and is affiliated to the bot. You're a living case of a criminal trying to pretend he's not a criminal after he's caught.
  - Kr4ken 9y ago
    Yes, I commented on the issue. No, I am not affiliated with the bot. I'm not pretending to be anything, I never claimed anything. If I wanted to hide anything I wouldn't use my main github account. I just thought that Valve banning based on usernames was an interesting subject, so I commented on it. You're commenting on a thread about cheaters, why would you do so? You're a living case of a criminal trying to pretend he's not a criminal after he's caught hands in!
  - pdkl95 9y ago
    Do you have evidence to support your accusation of affiliation with the people involved with "catbot"[1]? Or is this libel? > criminal Writing unauthorized software modifications for commercial software is not illegal, making your accusation of criminal activity doesn't make sense. Unless the bot also made copies of the software, this is a civil matter and probably at worst a breech of contract. However, even if someone authored the bot, unsubstantiated accusations have no place in civilized society. If accusations are being made, you need to provide evidence 0of the actual bot, not hearsay based on merely an account name. That evidence needs to be presented with at lest some amount of due process where the accused has the opportunity to face their accuser and rebut the claim. [1] Or any other unauthorized 3rd-party utility software for games published on Steam.

varjag 9y ago

http://www.catb.org/jargon/html/D/Don-t-do-that-then-.html http://www.catb.org/jargon/html/D/Don-t-do-that-then-.html

jimnotgym 9y ago
catb as a name is dangerously close to getting you banned by Steam

deleted 9y ago

[deleted]

hitekker 9y ago

As Nickodell and PlutoIsAPlanet pointed out, this "issue" was raised by a group of banned Team Fortress 2 cheaters, who are developing obfuscated aimbots. In all likelihood, VAC's detection is premised on other factors in combination with the username. Like, for example, botting in online multiplayer games. This may come as a surprise to half the users in these comments, but, for the 99% of gamers who are not malware enthusiasts, banning bad actors is a feature, not a bug.

anonymousab 9y ago
Seemingly heavy handed features wouldn't be so readily despised if: * Valve didn't shut the discussion down altogether. If the GitHub page wasn't the right place, then suggesting a forum where feedback would be appropriate and actually prompt a response would be the way to go. * Valve (or rather, their support staff) didn't have a history of extolling the perfection of VAC while dealing with some false bans in private. * Bans didn't have such large implications, or: * The support and appeal process wasn't so obtuse, seemingly useless and blackboxed. I think they'd be encouraged to take more chances with their Anti-cheat ideas if the process for fixing false positives wasn't so genetically corporate and so user-hostile.
- throwaway2048 9y ago
  The problem is all of those mechanisms give hackers a lot of leverage to evade banning, and they will be abused.
FRex 9y ago
No, it's clearly not. There are people in the linked issue saying they had no cheats and just the username and got banned and the last comment is a Valve employee stating this is all intentional and forbidding any further discussion of it. This is an incredibly dumb way to catch "cheaters" and now that they know they will easily defeat it. This is absolute bullshit and like saying "issue of rape in prison was raised by criminals who are evil so it's a feature for society they get raped". And here's a money quote (guess whose): > When the truth of one issue goes against a person's political leanings, that person will generally say whatever they can to avoid feeling guilt or shame.

jwilk 9y ago

VAC = Valve Anti-Cheat https://en.wikipedia.org/wiki/Valve_Anti-Cheat https://en.wikipedia.org/wiki/Valve_Anti-Cheat

jimnotgym 9y ago

I'm not sure I want Steam on my PC anymore. My local accounts are non of their business. What other nonsense are they up to?

zkomp 9y ago

Ouch I did not know Valve had sunk so low... String matching parts of a local username alone can not ever be enough for a ban... Completely ridiculous

chickenfries 9y ago

This is by far one of the strangest things I have seen HN get mad about. The commenters on the linked issue seem to be mostly aimbot users. Wouldn't be surprised if they're here too.

arkona 9y ago

> Good day, I've received word from the VAC team that this is intentional and not open for discussion on Github. > In general VAC issues are not handled on Github in any capacity and further issue reports on this may result in being banned from the Valve Software issue trackers. This is not the way to address a paying customer. These people truly are a bunch of clowns.

jimjimjim 9y ago

It's their software, they can do whatever they like. Manufactured drama.

drngdds 9y ago

So if I'm understanding this right, you can get permanently banned from all of these games (http://store.steampowered.com/search/?category2=8 http://store.steampowered.com/search/?category2=8) just for having a certain username? That's crazy, no matter what the username is.

dkonofalski 9y ago
You're understanding the way they described it right. The reality, however, is not correct. You cannot get banned from those games just for having a certain username. You would have to have that username and also trigger other detection parameters.

csense 9y ago

New Year's resolution: Don't buy anything else on Steam.

uname-a 9y ago

inb4 bots runs at root

NelsonMinar 9y ago

A Valve employee showed up on Reddit to say this bug report is not correct. https://np.reddit.com/r/linux_gaming/comments/7ndjdt/valve_will_vac_ban_you_automatically_for_having/ds2dulw/ https://np.reddit.com/r/linux_gaming/comments/7ndjdt/valve_w...