6 ms·
I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in th
by Crinus 7y ago
I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in their own folders) and avoiding the need to show the UAC prompt when installing dependencies (VC++ runtimes, etc) in many newer games - especially if you take into consideration Steam's Big Picture mode and that it needs to be usable with a controller (though perhaps the Steam Controller can also function as a regular desktop mouse, assuming it doesn't rely on Steam itself to move the cursor around - which may not work when the UAC prompt is shown - and on the other hand some older games do need to run as Administrator and/or a compatibility mode that shows a UAC prompt, so perhaps SC can work with that).
BTW...
> Are you sure that a free game made of garbage by an unknown developer will behave honestly? Do you believe that for a 90% discount you will not get a hidden miner?
...beyond this being FUD, games do not need to run with Adminstrator privileges to put hidden miners and even if they did, all they'll need to do is simply... show the UAC prompt. So many things show it that people will accept it anyway, especially when they're trying to start a game. But more importantly, such a game will be removed instantly from Steam and thus wont spread much while the developer could be sued (before publishing anything on Steam you have to give them your full details) making the entire endeavor not worth the effort.
Though of course this issue can be taken advantage of outside of Steam.
- imtringued 7y agoThe problem is that the privileged service modifies permissions of arbitrary registry keys that don't belong to the steam client. Simply checking that the path is below the steam path before calling RegSetKeySecurity would fix the problem.
- beders 7y agoYup. It is probably a single line of code. Make it two, if they are using C# :)
- utouq 7y ago>I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in their own folders) Maybe they should use "c:\users\all users\appdata" for this purpose instead of using "c:\program files"?
- giancarlostoro 7y agoNowadays you can install Steam on a separate drive. I have a 500GB PCIe SSD but install my more intensive games on a regular SSD and then the rest on a 1TB spin disk. So in a way you wont always install it in Program Files if you pick a new location to install.
- Crinus 7y agoYeah, i never install it on Program Files myself, i always use a root level folder like C:\Steam (and a reason is UAC too, while Steam does more or less seem to bypass it, some patches and mods for older games do not always work that well if Steam is in Program FIles).
- jandrese 7y ago> some patches and mods for older games do not always work that well if Steam is in Program FIles). How old? Like DOS old? Because most programs from this century should assume they were installed somewhere inside of Program Files.
- Crinus 7y agoIf you get into running old games in modern Windows, i think you'll find that when it comes to games such assumptions are the first to fly out of the window :-P. Games tend to be among the most brittle desktop software.
- Nullabillity 7y ago> especially if you take into consideration Steam's Big Picture mode and that it needs to be usable with a controller (though perhaps the Steam Controller can also function as a regular desktop mouse, assuming it doesn't rely on Steam itself to move the cursor around - which may not work when the UAC prompt is shown - and on the other hand some older games do need to run as Administrator and/or a compatibility mode that shows a UAC prompt, so perhaps SC can work with that). The Steam Controller has a "lizard mode" for when it can't connect to Steam where it just acts as a dumb mouse. I have no idea whether it enables that for UAC prompts, but it probably could.
- DCoder 7y agoI just checked, and yes, you can use Steam Controller to get through UAC prompts. The joystick mimics the arrow keys, the right trackpad moves the mouse cursor, the trigger buttons represent mouse clicks, and A is Enter.
- yrro 7y agoHow does Steam capture the secure desktop that displays the UAC prompt?
- DCoder 7y agoIt doesn't. The controller simply acts as a mouse/minimal keyboard outside Steam.
- yrro 7y agoSo if you're using Steam streaming and the session switches to the secure desktop due to a UAC prompt, what happens... does the screen just go blank (a la VNC), leaving the remote user locked out?
- mikewhy 7y agoJust tried. If you're already streaming, it manages to show you the prompt, but there's no way to interact with it. The mouse moves (both on the host and client), but clicks don't go through. Keyboard navigation doesn't work either. If you try to stream something that first pops up UAC, the client just sits there waiting for it to be dealt with on the host.
- Dylan16807 7y agoComplaining about privilege escalation is not FUD.
- jyrkesh 7y ago> all they'll need to do is simply... show the UAC prompt. Yeah, this is a good point. Not sure how many folks here play a lot of Steam games, but a ton of them install their own specific VC++ runtime redists (sometimes multiple) at first run, and each of them throw their own UAC prompt. It's absolutely an established pattern for me to mindlessly click through 1-5 UAC prompts on first run of Steam games. (Though they're typically all Microsoft Corp signed in the prompt, which is helpful.)