7 ms·

>The launcher makes an encrypted local copy of your localconfig.vdf Steam file. This should not be done preemptively.

by foxes 8y ago

sigmar 8y ago
Totally agree. It is too difficult for the average consumer to find out what is does with that "local copy." Software shouldn't touch another program's file without user consent.
- AnIdiotOnTheNet 8y ago
  It's high time we started enforcing that by default at the OS level.
  - ocdtrekkie 8y ago
    That's what UWP does on Windows. And it was immediately derided by nearly everyone for being too closed down.
    - AnIdiotOnTheNet 8y ago
      That's because any benefit UWP brought was outweighed by all its drawbacks, at least for me.
    - noxxten 8y ago
      UWP was broadly criticized because of how it operated. Every notification I got from UWP was something along the lines of "In order to rename this file, _____ program needs access to LITERALLY EVERY FILE AND PERMISSION AVAILABLE ON YOUR COMPUTER AND/OR HOME NETWORK" Maybe if these notifications were less vague, they wouldn't be hounded as annoying and useless... Just saying.
  - Wowfunhappy 8y ago
    It’s notable that you bring this up in a news story about PC gaming, which is a prime example of why this shouldn’t be enforced. There are huge community efforts around modding games—adding features, updating old titles, improving performance, etc etc. All of this is essential to PC gaming, and all of it becomes impossible if software is sandboxed.
    - tacomplain 8y ago
      You can surely think about a model of sandboxing with public and private (even internal for company wide) restrictions.
    - stordoff 8y ago
      I'm not sure why this is the case. I don't see why you wouldn't be able to edit things that are in the sandbox (you create it in the first place, after all), whilst making sure things in the sandbox can't access anything outside it. AFAICT, it's basically just running as a different user. User user gets edit access, Epic user only gets access to its own folder.
      - Wowfunhappy 8y ago
        The problem is that third-party-Dark-Souls-modding-tool.exe needs access to Dark-Souls.exe’s sandbox. Note, I use Dark Souls as an example here (as opposed to, say, Skyrim) because Dark Souls mods were very much not developer-sanctioned at the outset. If From Software had needed to explicitly allow mods, you can bet they never would have happened.
        ztjio 8y ago
        So then you give it access. Nobody is saying that you, the user, should not have control over these sandboxes.
        lifthrasiir 8y ago
        I think most current examples of sandboxing also implies app signing and whatever restricts users' own control, hence the confusion. Users are sometimes allowed to lift the restriction but it's mostly an all-or-nothing bet.
    - pfranz 8y ago
      You can look at macOS as an example. Using the command line I start searching through my home directory. I get a pop up saying, "Terminal wants to access your Contacts: yes/no" "Terminal wants to access your Calendar: yes/no." This is the kind of behavior I think most people would like. An example of the bad side is that Nvidia says they cannot develop drivers for their cards because Apple hasn't allowed them to (Apple develops the drivers). I technically believe they can, but they would have to make the user jump through some very unreasonable steps (reboot into a maintenance mode and disable integrity protection).
  - jayd16 8y ago
    This is kind of a legacy desktop issue these days. The mobile OSs and all the cloud stuff use things like containerization and chroots.
  - TeMPOraL 8y ago
    Sure, but don't forget about user consent part. Preferably with an option to give that consent just once. Otherwise, you'd destroy a whole dimension of software interoperability and end-user scripting.
  - deleted 8y ago
    [deleted]
- ramy_d 8y ago
  GP says it does have consent. what's the issue?
  - hug 8y ago
    It copies the info prior to consent, just in case you might consent later. That behaviour is a little bit gross.
    - saintPirelli 8y ago
      But is it malevolent or just a little lazy? I can't decide.
      - y4mi 8y ago
        if it were malevolent, they'd just load it into ram and send it to the server without persisting on the drive... (and without asking)
    - wgoodall01 8y ago
      I mean really, what's the difference? They can access that file at any time they want anyhow---as long as they only send it to their server after user consent, I'm really failing to see a problem here. Making a copy of one file they can already access to another place they can also already access isn't really violating anyone's privacy. It's what they DO with the information that matters.
      - sigmar 8y ago
        >It's what they DO with the information that matters. 99% of end users will not be able to reverse engineer the binary and find out that copy is never transmitted. The fact it is 'touching' private files at all without any consent degrades trust. Furthermore, if I want to delete all traces of Steam from my computer how the hell would I know there is a copy of steam's localconfig in a different program's folder? or what if I backup or share privately/publicly my EpicLauncher directory without realizing all my steam contacts are in there?
snthd 8y ago
It's probably to keep things working through a change in steam.

>The launcher makes an encrypted local copy of your localconfig.vdf Steam file. This should not be done preemptively.

by foxes 8y ago

>The launcher makes an encrypted local copy of your localconfig.vdf Steam file. This should not be done preemptively.

Totally agree. It is too difficult for the average consumer to find out what is does with that "local copy." Software shouldn't touch another program's file without user consent.

AnIdiotOnTheNet 8y ago
It's high time we started enforcing that by default at the OS level.
- ocdtrekkie 8y ago
  That's what UWP does on Windows. And it was immediately derided by nearly everyone for being too closed down.
  - AnIdiotOnTheNet 8y ago
    That's because any benefit UWP brought was outweighed by all its drawbacks, at least for me.
  - noxxten 8y ago
    UWP was broadly criticized because of how it operated. Every notification I got from UWP was something along the lines of "In order to rename this file, _____ program needs access to LITERALLY EVERY FILE AND PERMISSION AVAILABLE ON YOUR COMPUTER AND/OR HOME NETWORK" Maybe if these notifications were less vague, they wouldn't be hounded as annoying and useless... Just saying.
- Wowfunhappy 8y ago
  It’s notable that you bring this up in a news story about PC gaming, which is a prime example of why this shouldn’t be enforced. There are huge community efforts around modding games—adding features, updating old titles, improving performance, etc etc. All of this is essential to PC gaming, and all of it becomes impossible if software is sandboxed.
  - tacomplain 8y ago
    You can surely think about a model of sandboxing with public and private (even internal for company wide) restrictions.
  - stordoff 8y ago
    I'm not sure why this is the case. I don't see why you wouldn't be able to edit things that are in the sandbox (you create it in the first place, after all), whilst making sure things in the sandbox can't access anything outside it. AFAICT, it's basically just running as a different user. User user gets edit access, Epic user only gets access to its own folder.
    - Wowfunhappy 8y ago
      The problem is that third-party-Dark-Souls-modding-tool.exe needs access to Dark-Souls.exe’s sandbox. Note, I use Dark Souls as an example here (as opposed to, say, Skyrim) because Dark Souls mods were very much not developer-sanctioned at the outset. If From Software had needed to explicitly allow mods, you can bet they never would have happened.
      - ztjio 8y ago
        So then you give it access. Nobody is saying that you, the user, should not have control over these sandboxes.
        lifthrasiir 8y ago
        I think most current examples of sandboxing also implies app signing and whatever restricts users' own control, hence the confusion. Users are sometimes allowed to lift the restriction but it's mostly an all-or-nothing bet.
  - pfranz 8y ago
    You can look at macOS as an example. Using the command line I start searching through my home directory. I get a pop up saying, "Terminal wants to access your Contacts: yes/no" "Terminal wants to access your Calendar: yes/no." This is the kind of behavior I think most people would like. An example of the bad side is that Nvidia says they cannot develop drivers for their cards because Apple hasn't allowed them to (Apple develops the drivers). I technically believe they can, but they would have to make the user jump through some very unreasonable steps (reboot into a maintenance mode and disable integrity protection).
- jayd16 8y ago
  This is kind of a legacy desktop issue these days. The mobile OSs and all the cloud stuff use things like containerization and chroots.
- TeMPOraL 8y ago
  Sure, but don't forget about user consent part. Preferably with an option to give that consent just once. Otherwise, you'd destroy a whole dimension of software interoperability and end-user scripting.
- deleted 8y ago
  [deleted]
ramy_d 8y ago
GP says it does have consent. what's the issue?
- hug 8y ago
  It copies the info prior to consent, just in case you might consent later. That behaviour is a little bit gross.
  - saintPirelli 8y ago
    But is it malevolent or just a little lazy? I can't decide.
    - y4mi 8y ago
      if it were malevolent, they'd just load it into ram and send it to the server without persisting on the drive... (and without asking)
  - wgoodall01 8y ago
    I mean really, what's the difference? They can access that file at any time they want anyhow---as long as they only send it to their server after user consent, I'm really failing to see a problem here. Making a copy of one file they can already access to another place they can also already access isn't really violating anyone's privacy. It's what they DO with the information that matters.
    - sigmar 8y ago
      >It's what they DO with the information that matters. 99% of end users will not be able to reverse engineer the binary and find out that copy is never transmitted. The fact it is 'touching' private files at all without any consent degrades trust. Furthermore, if I want to delete all traces of Steam from my computer how the hell would I know there is a copy of steam's localconfig in a different program's folder? or what if I backup or share privately/publicly my EpicLauncher directory without realizing all my steam contacts are in there?

snthd 8y ago

It's probably to keep things working through a change in steam.