5 ms·

> A security researcher alerted Valve about the bug in June of 2019. Holy shit, Valve. Really? Nearly two years later and this is still exploitable. Edit, fur

by Forbo 6y ago

> A security researcher alerted Valve about the bug in June of 2019. Holy shit, Valve. Really? Nearly two years later and this is still exploitable. Edit, further on: > This is not the first time Valve has been slow to respond and fix reported vulnerabilities. In 2018, Motherboard reported that a security researcher found a bug in Steam that allowed hackers to take over victims' computers—a bug that had been present for 10 years. In 2019, Valve banned a security researcher from its bug bounty program, prompting him to publish the exploit publicly. I'm pretty appalled by this.

Chlorus 6y ago
the dedicated server situation was (is?) pretty dire back when i hosted a few SRCDS instances. here's a small taste: https://wiki.alliedmods.net/SRCDS_Hardening#Current_Exploits https://wiki.alliedmods.net/SRCDS_Hardening#Current_Exploits not to mention that the commands themselves obey absolutely zero *NIX conventions at all. Left a bad taste in my mouth ever since
enjoiful 6y ago
If you want to see something really appalling, looking into the "coaching bug" that was recently exposed. It was known for years by Valve and it wasn't patched. It wasn't until the exploit was made public that dozens of professional CS coaches were banned.
- weird-eye-issue 6y ago
  That wasn't a security or privacy issue and nobody forced those coaches who abused it
  - spicybright 6y ago
    I don't know any context on the situation, but if there was a mechanic that's known and been around for years, bug or not, wouldn't anyone using it have an edge over anyone not using it? Therefore people need to use it to stay competitive?
    - weird-eye-issue 6y ago
      No because in sports you have rules that you must follow or there are consequences. This bug is considered an exploit and therefore it is against the rules to use.
      - asdff 6y ago
        Yes but this is Esports. Bugs are famously used competitively. The entire super smash brothers melee tournament circuit uses bugs to wave run; if you don't use the bug you won't be competitive. People practice using this bug and others like skipping animations. Most competitive FPS games had something similar, like being able to reload cancel or bunny hop. Things that are legitimately bugs, that you won't learn until you hear about them.
        weird-eye-issue 6y ago
        Like I said - "This bug is considered an exploit and therefore it is against the rules to use." Exploits aren't allowed. If a bug isn't considered an exploit and isn't explicitly against the rules they are fine to use them.
        asdff 6y ago
        I wonder who sets these rules? Like when wave dashing came to the competitive super smash bros scene, who decided that this would be allowed or banned? It seems to me it would depend how widespread it is. Maybe the tournament runners already knew how to wave dash so it was in their interest to keep this technique they already mastered legal, versus if they didn't know how to do it yet they might have banned it, like how they've been so careful to empirically place each character into different tiers for the sake of balance. I can see how leaning into exploits for competitive can ruin the noncompetitive community, and later take out the competitive one that feeds off this community. I used to play chivalry: medieval warefare, which was a lot more fun of a game before the competitive community figured out the frame perfect meta and ruined the game for everyone else who doesn't have hours and hours of free time to throw at practicing the metagame alone, which is most gamers I imagine.
- takoid 6y ago
  > It was known for years by Valve and it wasn't patched. This is not true. Once the exploit became known, Valve released an update same day.
  - mhh__ 6y ago
    It seems genuinely unbelievable it was being used for as long as it was without someone finding out
    - charcircuit 6y ago
      If it was known it could have just been low priority since it's a weird bug that doesn't even apply to the built in competitive mode.
  - noxvilleza 6y ago
    According to pro players, this isn't true - Pita claimed he contacted Valve's twitter a long period of time before the whole ESIC investigation blew up.
uncoder0 6y ago
Now think about this... Steam is running on nearly every gamer's PC. That's what I'm more worried about than exploits in individual games.

by Forbo 6y ago

Chlorus 6y ago

the dedicated server situation was (is?) pretty dire back when i hosted a few SRCDS instances. here's a small taste: https://wiki.alliedmods.net/SRCDS_Hardening#Current_Exploits https://wiki.alliedmods.net/SRCDS_Hardening#Current_Exploits not to mention that the commands themselves obey absolutely zero *NIX conventions at all. Left a bad taste in my mouth ever since

enjoiful 6y ago

If you want to see something really appalling, looking into the "coaching bug" that was recently exposed. It was known for years by Valve and it wasn't patched. It wasn't until the exploit was made public that dozens of professional CS coaches were banned.

weird-eye-issue 6y ago
That wasn't a security or privacy issue and nobody forced those coaches who abused it
- spicybright 6y ago
  I don't know any context on the situation, but if there was a mechanic that's known and been around for years, bug or not, wouldn't anyone using it have an edge over anyone not using it? Therefore people need to use it to stay competitive?
  - weird-eye-issue 6y ago
    No because in sports you have rules that you must follow or there are consequences. This bug is considered an exploit and therefore it is against the rules to use.
    - asdff 6y ago
      Yes but this is Esports. Bugs are famously used competitively. The entire super smash brothers melee tournament circuit uses bugs to wave run; if you don't use the bug you won't be competitive. People practice using this bug and others like skipping animations. Most competitive FPS games had something similar, like being able to reload cancel or bunny hop. Things that are legitimately bugs, that you won't learn until you hear about them.
      - weird-eye-issue 6y ago
        Like I said - "This bug is considered an exploit and therefore it is against the rules to use." Exploits aren't allowed. If a bug isn't considered an exploit and isn't explicitly against the rules they are fine to use them.
        asdff 6y ago
        I wonder who sets these rules? Like when wave dashing came to the competitive super smash bros scene, who decided that this would be allowed or banned? It seems to me it would depend how widespread it is. Maybe the tournament runners already knew how to wave dash so it was in their interest to keep this technique they already mastered legal, versus if they didn't know how to do it yet they might have banned it, like how they've been so careful to empirically place each character into different tiers for the sake of balance. I can see how leaning into exploits for competitive can ruin the noncompetitive community, and later take out the competitive one that feeds off this community. I used to play chivalry: medieval warefare, which was a lot more fun of a game before the competitive community figured out the frame perfect meta and ruined the game for everyone else who doesn't have hours and hours of free time to throw at practicing the metagame alone, which is most gamers I imagine.
takoid 6y ago
> It was known for years by Valve and it wasn't patched. This is not true. Once the exploit became known, Valve released an update same day.
- mhh__ 6y ago
  It seems genuinely unbelievable it was being used for as long as it was without someone finding out
  - charcircuit 6y ago
    If it was known it could have just been low priority since it's a weird bug that doesn't even apply to the built in competitive mode.
- noxvilleza 6y ago
  According to pro players, this isn't true - Pita claimed he contacted Valve's twitter a long period of time before the whole ESIC investigation blew up.

uncoder0 6y ago

Now think about this... Steam is running on nearly every gamer's PC. That's what I'm more worried about than exploits in individual games.