4 ms·

This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a t

This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a tool to get you something on Windows was just as bad as breaking FlashPlayer. I heard one Adobe executive say, "Hey you can use a baseball bat to bludgeon someone but that isn't the bat maker's fault is it? If they are forced to make foam bats their product is useless." That position isn't "wrong" so much as it isn't useful in reducing risk.

fortran77 7y ago
You're beating a dead horse. Flash served a purpose once, and now it's reached end-of-life.
- vorpalhex 7y ago
  > You're beating a dead horse With a foam bat. Just because the flash horse is dead doesn't mean it didn't deserve it's beating or can't continue to be a potent reminder of how bad Adobe was at handling security issues and why other platforms, like Steam, should learn instead of emulate.
  - dmix 7y ago
    This also has nothing to do with Flash specifically, rather as you said Adobe's policy. It could have been any software but especially for Flash. Flash was just such a unique special target, ala PDFs and Microsoft word, there were few wide open targets from which a hacker could predictably get the user to open (whether embedded or not) on a targets machine. So it was particularly sensitive to vulnerabilities by design, where a much broader security perspective was clearly needed than most software.
  - socceroos 7y ago
    I'd prefer to describe it as slashing a dead horse's rotten corpse with a katana. As the bloat and flesh of the ecosystem has disintegrated we're able to observe the framework more clearly - the bone structure of the horse, if you will. Using the katana we are making precise, incisive blows to the remnants as we extract meaning from it's corpse - or lessons learned, if you will. ...perhaps I'm taking the analogy too far?
- gilrain 7y ago
  No, they're making a point about Valve by comparing them to Adobe.
- m_eiman 7y ago
  Now I’m just waiting for Steam to follow their lead.
- crankylinuxuser 7y ago
  .... Hit the dead horse with the foam bat and win an iPod? Those were the old days. Or, that damned monkey!
- abtinf 7y ago
  Flash died because Adobe failed in the most obvious ways--even to lay outsiders at the time. They could never be bothered to fix the pervasive performance or security issues. It started to die, slowly at first: the desktop flash blocker plugins. Then very quickly: the lack of support from mobile OS--even though those companies practically begged Adobe to get its act together. Adobe had a practical monopoly on the interactive web and blew it.
- chris_wot 7y ago
  It reached its EOL because Steve Jobs considered it a buggy security threat. If no one will use or manufacture your baseball bat, then the danger of the bat is moot.
jessaustin 7y ago
Knowledgeable people can just add Steam to the set of applications that must be installed in its own isolated environment. How would the typical Steam user know to do that? Is there a prominent warning on the install screen informing users that Steam will be used to hack their machine and anything they have stored on it?
- wolco 7y ago
  Could steam be legally liable for the issues bugs give to the end users if they know of the issud. I know they have TOS forbidding this but ToS need to take into account laws.
  - tfha 7y ago
    At some point this is less of a steam issue and more of a Windows issue. An OS shouldn't allow applications to compromise eachother. Steam should maybe be liable if they are actively thwarting disclosure that would protect users but that's a tough thing to establish legally.
    - yellowapple 7y ago
      It's a Steam issue, given that background services don't have to run as SYSTEM, and yet Valve decided to have Steam's background service do precisely that. Thankfully, the Linux version doesn't seem to have this problem (AFAICT).
      - e_proxus 7y ago
        I think it should become a Windows/Microsoft issue, to be honest. A good example is the recent Zoom vulnerability, the software made it possible to perform certain exploits on the user and operating system, so Apple stepped in and disabled the exploit. In this case, I think Microsoft should do the same in order to protect their users. My guess would be that the install base of Steam on Windows is as least on par with Zoom on macOS, if not many times larger. In the end, Microsoft will get bad reputation for having an insecure OS (not to even mention Valve here, and in the long run it will hurt them as same as it did Adobe with their Flash stubbornness).
ratel 7y ago
No that position is wrong, because the analogy is wrong. If the baseball bat would hit the customer in the face every time he tries to hit the ball, that would get fixed pretty quick. Allowing privilege escalation is an unintended side effect of the product being used and should be fixed because the customer never asked to be exposed to that risk.
skocznymroczny 7y ago
Well, that's the issue with DRMs. I never went into the Steam ecosystem because I don't like dependencies, but most people have no choice and have to use Steam if they want to access their game libraries.

fortran77 7y ago

You're beating a dead horse. Flash served a purpose once, and now it's reached end-of-life.

vorpalhex 7y ago
> You're beating a dead horse With a foam bat. Just because the flash horse is dead doesn't mean it didn't deserve it's beating or can't continue to be a potent reminder of how bad Adobe was at handling security issues and why other platforms, like Steam, should learn instead of emulate.
- dmix 7y ago
  This also has nothing to do with Flash specifically, rather as you said Adobe's policy. It could have been any software but especially for Flash. Flash was just such a unique special target, ala PDFs and Microsoft word, there were few wide open targets from which a hacker could predictably get the user to open (whether embedded or not) on a targets machine. So it was particularly sensitive to vulnerabilities by design, where a much broader security perspective was clearly needed than most software.
- socceroos 7y ago
  I'd prefer to describe it as slashing a dead horse's rotten corpse with a katana. As the bloat and flesh of the ecosystem has disintegrated we're able to observe the framework more clearly - the bone structure of the horse, if you will. Using the katana we are making precise, incisive blows to the remnants as we extract meaning from it's corpse - or lessons learned, if you will. ...perhaps I'm taking the analogy too far?
gilrain 7y ago
No, they're making a point about Valve by comparing them to Adobe.
m_eiman 7y ago
Now I’m just waiting for Steam to follow their lead.
crankylinuxuser 7y ago
.... Hit the dead horse with the foam bat and win an iPod? Those were the old days. Or, that damned monkey!
abtinf 7y ago
Flash died because Adobe failed in the most obvious ways--even to lay outsiders at the time. They could never be bothered to fix the pervasive performance or security issues. It started to die, slowly at first: the desktop flash blocker plugins. Then very quickly: the lack of support from mobile OS--even though those companies practically begged Adobe to get its act together. Adobe had a practical monopoly on the interactive web and blew it.
chris_wot 7y ago
It reached its EOL because Steve Jobs considered it a buggy security threat. If no one will use or manufacture your baseball bat, then the danger of the bat is moot.

jessaustin 7y ago

Knowledgeable people can just add Steam to the set of applications that must be installed in its own isolated environment. How would the typical Steam user know to do that? Is there a prominent warning on the install screen informing users that Steam will be used to hack their machine and anything they have stored on it?

wolco 7y ago
Could steam be legally liable for the issues bugs give to the end users if they know of the issud. I know they have TOS forbidding this but ToS need to take into account laws.
- tfha 7y ago
  At some point this is less of a steam issue and more of a Windows issue. An OS shouldn't allow applications to compromise eachother. Steam should maybe be liable if they are actively thwarting disclosure that would protect users but that's a tough thing to establish legally.
  - yellowapple 7y ago
    It's a Steam issue, given that background services don't have to run as SYSTEM, and yet Valve decided to have Steam's background service do precisely that. Thankfully, the Linux version doesn't seem to have this problem (AFAICT).
    - e_proxus 7y ago
      I think it should become a Windows/Microsoft issue, to be honest. A good example is the recent Zoom vulnerability, the software made it possible to perform certain exploits on the user and operating system, so Apple stepped in and disabled the exploit. In this case, I think Microsoft should do the same in order to protect their users. My guess would be that the install base of Steam on Windows is as least on par with Zoom on macOS, if not many times larger. In the end, Microsoft will get bad reputation for having an insecure OS (not to even mention Valve here, and in the long run it will hurt them as same as it did Adobe with their Flash stubbornness).

ratel 7y ago

No that position is wrong, because the analogy is wrong. If the baseball bat would hit the customer in the face every time he tries to hit the ball, that would get fixed pretty quick. Allowing privilege escalation is an unintended side effect of the product being used and should be fixed because the customer never asked to be exposed to that risk.

skocznymroczny 7y ago

Well, that's the issue with DRMs. I never went into the Steam ecosystem because I don't like dependencies, but most people have no choice and have to use Steam if they want to access their game libraries.