5 ms·

You forgot sudo. IIRC Windows Steam asks for Admin rights.

by NullPrefix 7y ago

birdyrooster 7y ago
You are correct, it does.
Enginerrrd 7y ago
Uhm, sudo on a proprietary binary outside the repo? ...Yeah no thanks.
- baroffoos 7y ago
  What difference does it make really. Running a program on linux as a regular user can access all of your files, record your screen, keylog you, grab your passwords from your browser, do basically anything. Run it with sudo and what more can it do? Mess up your grub config? If a malicious program was run as a regular user it could basically ruin everything you care about unless you happen to be sharing a computer with multiple people but even then it could just wait until you run something with sudo and keylog your password.
  - choeger 7y ago
    How could a unprivileged program keylog my sudo typings? (I am running Wayland)
    - NullPrefix 7y ago
      What CPU are you running? Spectre mitigations enabled? Hyper Threading?
  - Enginerrrd 7y ago
    Greater issues with possible persistence, control over daemons and sockets, access to lots of files I don't let regular users have access to, etc. Plus the other half which is the whole proprietary binary side of things. IMO, lack of transparency invites more bad behavior.
matheusmoreira 7y ago
Multiplayer Windows games in general ship anti-cheating software implemented as kernel modules that are more invasive than even draconian DRM.
- vkizl 7y ago
  I've played several multiplayer games for Windows and I've only seen Fortnite do this.
  - therein 7y ago
    Many "serious" multiplayer games will feature this. I mean VAC, EasyAntiCheat, BattlEye. They all have a kernel module component.
therein 7y ago
Not necessarily. [0] Also, it is actually quite trivial bypassing UAC prompt in Windows. It simply gives a false sense of security. Something as simple as SilentCleanup [1] still works to this day. This will bypass UAC with little effort. Even worse, following that, it is also trivial to get NT AUTHORITY\SYSTEM using Windows Management Instrumentation Event Subscription. [2] I've done it as an exercise in Go out of all languages and it ended up fully undetected both on disk and during runtime. So Windows simply provides a false sense of security. After all Microsoft themselves said [3]: One important thing to know is that UAC is not a security boundary. UAC helps people be more secure, but it is not a cure all. UAC helps most by being the prompt before software is installed. [0] https://amonitoring.ru/article/steam_vuln_3/ https://amonitoring.ru/article/steam_vuln_3/ [1] https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/ https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10... [2] https://attack.mitre.org/techniques/T1084/ https://attack.mitre.org/techniques/T1084/ [3] https://blogs.msdn.microsoft.com/e7/2009/02/05/update-on-uac/ https://blogs.msdn.microsoft.com/e7/2009/02/05/update-on-uac...

You forgot sudo. IIRC Windows Steam asks for Admin rights.

birdyrooster 7y ago

You are correct, it does.

Enginerrrd 7y ago

Uhm, sudo on a proprietary binary outside the repo? ...Yeah no thanks.

baroffoos 7y ago
What difference does it make really. Running a program on linux as a regular user can access all of your files, record your screen, keylog you, grab your passwords from your browser, do basically anything. Run it with sudo and what more can it do? Mess up your grub config? If a malicious program was run as a regular user it could basically ruin everything you care about unless you happen to be sharing a computer with multiple people but even then it could just wait until you run something with sudo and keylog your password.
- choeger 7y ago
  How could a unprivileged program keylog my sudo typings? (I am running Wayland)
  - NullPrefix 7y ago
    What CPU are you running? Spectre mitigations enabled? Hyper Threading?
- Enginerrrd 7y ago
  Greater issues with possible persistence, control over daemons and sockets, access to lots of files I don't let regular users have access to, etc. Plus the other half which is the whole proprietary binary side of things. IMO, lack of transparency invites more bad behavior.

matheusmoreira 7y ago

Multiplayer Windows games in general ship anti-cheating software implemented as kernel modules that are more invasive than even draconian DRM.

vkizl 7y ago
I've played several multiplayer games for Windows and I've only seen Fortnite do this.
- therein 7y ago
  Many "serious" multiplayer games will feature this. I mean VAC, EasyAntiCheat, BattlEye. They all have a kernel module component.

therein 7y ago

Not necessarily. [0] Also, it is actually quite trivial bypassing UAC prompt in Windows. It simply gives a false sense of security. Something as simple as SilentCleanup [1] still works to this day. This will bypass UAC with little effort. Even worse, following that, it is also trivial to get NT AUTHORITY\SYSTEM using Windows Management Instrumentation Event Subscription. [2] I've done it as an exercise in Go out of all languages and it ended up fully undetected both on disk and during runtime. So Windows simply provides a false sense of security. After all Microsoft themselves said [3]: One important thing to know is that UAC is not a security boundary. UAC helps people be more secure, but it is not a cure all. UAC helps most by being the prompt before software is installed. [0] https://amonitoring.ru/article/steam_vuln_3/ https://amonitoring.ru/article/steam_vuln_3/ [1] https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/ https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10... [2] https://attack.mitre.org/techniques/T1084/ https://attack.mitre.org/techniques/T1084/ [3] https://blogs.msdn.microsoft.com/e7/2009/02/05/update-on-uac/ https://blogs.msdn.microsoft.com/e7/2009/02/05/update-on-uac...