4 ms·

Enough people will say that it's fine because of cheaters. The gaming or software equivalent of justifying bad legislation because of criminals. Based off of

Enough people will say that it's fine because of cheaters. The gaming or software equivalent of justifying bad legislation because of criminals. Based off of the previous DNS false banning debacle, they'll ignore any negativity about this unless it reaches critical mass, at which point they'll say that combatting cheating is hard so give them carte blanche. The GitHub response is merely the "stop pointing out the Emperor's lack of clothes" aspect of the first part.

gsich 9y ago
Was there false banning based on DNS?
- anonymousab 9y ago
  False bans is hard to prove - you always have people claiming it, especially the cheaters themselves - but IIRC they came out and said they were scanning user DNS cache entries and using them as a basis for VAC actions. Gabe's response more or less boiled down to "cheating is a hard problem". I hope I'm not misremembering or being uncharitable. EDIT - I called it a false ban debacle because they was one half of the issue; the privacy implications were equally important.
  - arrivance 9y ago
    I believe you are misremembering: what Valve said within their statement on /r/games is that the DNS entries were being used after the detection of the cheats. Here's a quotation from Gabe's post: >VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result. [1] [1]: https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
    - anonymousab 9y ago
      Ah, ok. Thanks for the correction.
FRex 9y ago
Exfiltrating what websites you've accessed. That's basically what a spyware does. What in actual fuck.
- stordoff 9y ago
  I'm not exactly fine with it, but my understanding[0] is that it did a local check and only send the "bad" domains remotely. Still a privacy leak, but in a different class as bulk-uploading your entire DNS record. [0] Per https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
  - FRex 9y ago
    And my understanding is that Gabe Newell who runs this circus just happens to have claimed so when the milk was already long split. If he is so concerned that Valve will be associated with spyware then he shouldn't have let VAC team create a literal piece of (definition fitting) spyware. Somehow the examples on VAC page say it looks for third party modifications to game files, not rummages through your entire machine. As if they knew it sounds sketchy to users. Even if they are working in good faith they might screw up during one of these raids against my machine (like they did with rm -rf on Linux in the uninstall script) and leak something or save it to some temporary file that something else might pick up. This is still very out of line. I buy games via a proprietary platform that doubles as a DRM while pirates have no DRM, open source torrent clients and verified cracker teams and I'm the one having privacy worries here?

gsich 9y ago

Was there false banning based on DNS?

anonymousab 9y ago
False bans is hard to prove - you always have people claiming it, especially the cheaters themselves - but IIRC they came out and said they were scanning user DNS cache entries and using them as a basis for VAC actions. Gabe's response more or less boiled down to "cheating is a hard problem". I hope I'm not misremembering or being uncharitable. EDIT - I called it a false ban debacle because they was one half of the issue; the privacy implications were equally important.
- arrivance 9y ago
  I believe you are misremembering: what Valve said within their statement on /r/games is that the DNS entries were being used after the detection of the cheats. Here's a quotation from Gabe's post: >VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result. [1] [1]: https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
  - anonymousab 9y ago
    Ah, ok. Thanks for the correction.

FRex 9y ago

Exfiltrating what websites you've accessed. That's basically what a spyware does. What in actual fuck.

stordoff 9y ago
I'm not exactly fine with it, but my understanding[0] is that it did a local check and only send the "bad" domains remotely. Still a privacy leak, but in a different class as bulk-uploading your entire DNS record. [0] Per https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
- FRex 9y ago
  And my understanding is that Gabe Newell who runs this circus just happens to have claimed so when the milk was already long split. If he is so concerned that Valve will be associated with spyware then he shouldn't have let VAC team create a literal piece of (definition fitting) spyware. Somehow the examples on VAC page say it looks for third party modifications to game files, not rummages through your entire machine. As if they knew it sounds sketchy to users. Even if they are working in good faith they might screw up during one of these raids against my machine (like they did with rm -rf on Linux in the uninstall script) and leak something or save it to some temporary file that something else might pick up. This is still very out of line. I buy games via a proprietary platform that doubles as a DRM while pirates have no DRM, open source torrent clients and verified cracker teams and I'm the one having privacy worries here?