11 ms·

Counter-Strike Global Offsets: reliable remote code execution

186 points by stefan_ 5y ago

nick0garvey 5y ago
Glad they published the process used to discover the exploit. Interesting to follow along on how the weakness was found and the relative simplicity of the actual exploit code. Can't help but feel like this entire class of problem should be avoided with modern tooling. Even in a relatively unsafe language like C++, a static analyzer could have flagged an unchecked array access.
alkonaut 5y ago
How can people contact big corporations and get no response? Are the messages not being read? Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? It wouldn’t be the first instance of US law having weird effects on human behavior but it does seem a bit far fetched.
- brutal_chaos_ 5y ago
  > Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? That is probably one aspect of it for sure. I think the gaming industry itself might have problems with sharing because 0days in games could really mean no more purchases, at least for awhile, and even then you have lost momentum from your marketing. Also, for non-zero days, just bugs in general, look at No Man's Sky or even more recently Cyberpunk 2077, so much social backlash.
- munk-a 5y ago
  I think game development companies are forced to take a very different approach from normal companies. Game developers face frequent abuse from customers due to passionate feelings involved with such an interactive media, programmers will get hate mail (generally vaguely directed at least) and female artists will get stalked pretty often - it's honestly a pretty toxic community. Look, for example, at what happened to Hello Games after the release of No Man's Sky - lots of people felt entitled to send death threats and demands to the developers - the UK authorities were regularly involved in threat assessment[1]. If some LoL players[2] are willing to swat the other team after losing a match then they're quite willing to go extreme lengths if their favorite character gets nerfed. I think this frequently toxic community interaction really impacts how game development studios interact with press and the public. The folks reporting legitimate bugs might just end up being buried in an avalanche of "BUG: My DPS damage is too low" that overwhelms an already tetchy CS department. 1. https://www.theguardian.com/games/2018/jul/20/no-mans-sky-next-hello-games-sean-murray-harassment-interview https://www.theguardian.com/games/2018/jul/20/no-mans-sky-ne... 2. I'd just like to reinforce that most of the people in a community can be fine - it's the crazies that start a lot of these problems, most folks won't swat you for beating them at LoL.
  - tryonenow 5y ago
    To be fair, Hello Games promised way more than what people ended up paying for. Also I really don't think internet death threats are anything to be worried about. How often do people actually act on them?
  - iancarroll 5y ago
    This is definitely true in general, but it’s worth noting that Valve pays HackerOne to validate submitted issues before they have to look at them. If it can’t be reproduced as a security issue, it will likely not get through.
- inetknght 5y ago
  > How can people contact big corporations and get no response? Are the messages not being read? Customer support is seen as an expense. So automate as much as their job as possible and then... stop paying for customer support.
- userbinator 5y ago
  How can people contact big corporations and get no response? In general, the bigger the company, the more bureaucracy and layers of indirection you have to get through to reach someone who even knows what you're talking about. This is regardless of whether the message is "bad security bug in your product" or "want to buy a million of your product".
- davidbanham 5y ago
  For Valve at least my experience is that’s pretty common. With the way they structure their company everyone works on what they want to. The result is that nobody chooses to work on the boring stuff so it doesn’t happen. I used to run some of the official servers for CS:GO and L4D2 on behalf of Valve. Mostly it was great but communication was always a challenge.
- f311a 5y ago
  Valve is a big company, but it has very small teams for CS GO and Dota relative to the industry.
google234123 5y ago
Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?
- throwaway3699 5y ago
  More likely is nobody at Valve cares enough to actually monitor or respond. There's plenty here about their bizarre corporate structure which really falls flat at critical times.
  - codabool 5y ago
    I would go with this assumption. Best to assume neglect over mal intent. This behavior was seen before too with the devs behind the new Gmod in Source 2 (Alyx engine). They spent months trying to get in touch with access and it came down to an employee who ended up getting fired for neglecting responsibilities. Now everything seems to be working out and open tooling is being developed.
  - freshair 5y ago
    Does it really make a difference, with respect to whether they should be kicked off HackerOne? Incompetence and disorganization is no excuse for what is essentially (if not literally) wage theft.
- rozab 5y ago
  These researchers could have earned plenty from making cheats instead. Would make sense for Valve to pay these types to fix their software instead of breaking it.
- njbooher 5y ago
  They pay, eventually. They're particularly slow for game client exploits. Much quicker for server-side issues.
  - iancarroll 5y ago
TechBro8615 5y ago
Fun writeup, thanks. FYI to the author, on mobile there is a horizontal overflow due to one image being too wide (the dereference illustration). I really like the blog’s style otherwise. There is one part I’m not clear about. Presumably the vector to exploit this is a malicious server, not a proxy. So if you control the server, why do you need to set two Content-Link headers to trick the parser into thinking it’s empty? Could you use a legit file and a fake content header with extra (empty) bytes? Or does that have too many side effects due to the client actually parsing the file rather than ignoring it?
- stefan_ 5y ago
  The idea is that you don't want to fill the memory chunk with real data from the server but keep the contents that happen to be in there from previous allocations. Then when the proxy later retrieves the contents of the memory chunk they get essentially a random block of old heap contents. Thats valuable because those will contain (vtable) pointers that reveal where in memory the game was loaded - most executables nowadays use ASLR so a prerequisite to an exploit is having some sort of information leak like this that can tell you the base address.
Rebelgecko 5y ago
Is this the same exploit that was reported to Valve in like 2018?
- hn8788 5y ago
  No, the site has a timeline that says it was reported in January, but Valve didn't fix it until they got publicly shamed for not fixing the 2 year old RCE.
  - Rebelgecko 5y ago
    Weird, when I read the article earlier the page content stopped after the 'convars as a gadget' section. That did seem like an abrupt ending
any626 5y ago
Backend dev here. How can one learn these types of skills? Recommendations?
- hn8788 5y ago
  Corelan Cybersecurity Research[1] is a good starting point. There haven't been any new articles in ~5 years, but some of the techniques in the linked article are covered. The /r/netsec subreddit is also a suprisingly good source of security info. A big part as well is just experimenting on your own. Vulnerability research is a very "creative" field, so being able to think outside the box is just as important as having technical knowledge. [1] https://www.corelan.be/ https://www.corelan.be/
- jpeter 5y ago
  Liveoverflow ist pretty good https://m.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://m.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
  - creamytaco 5y ago
    Script kiddie at best. If you want to learn from the best, and it has to be youtube, go watch Gynvael's channel.
asperous 5y ago
Another example is why app level security is so important. Why shouldn’t games allow arbitrary code execution? It only matters because the access space for programs is still so broad. People complain when applications on Mac request permission to access files, but that makes such a huge difference. It’s time for kernel level permissions to be standard on desktops.
- breakfastduck 5y ago
  Yeah the way macOS handles permissions can be annoying to some but generally the way it places an additional barrier between code execution and ability to read/write files beyond the application files itself is welcome imo. If you accept the admin prompt in windows that code can just run anything. In macOS the first time it'll run the code but prompt again if it starts trying to access the core file system. You may, as a developer, have an expectation some simple app you've downloaded should be able to run in a sandbox quite simply. A random app seemingly unnecessarily trying to access your user/systems files is worth a second thought.
- jchw 5y ago
  > Why shouldn’t games allow arbitrary code execution? Well, for one thing, to maintain the integrity of online games, protect personal data from the game itself and help prevent theft of in game assets... so I think there’s no strong win here. Yes it would be good if CS:GO exploits couldn’t reach out and hit your Bitcoin wallet or what have you, but you can’t really just give up entirely either. There’s by-design going to be things the game can access or at least indirectly access that can be sensitive. (At least in the context of online games like CS:GO.) > People complain when applications on Mac request permission to access files, but that makes such a huge difference. It’s time for kernel level permissions to be standard on desktops. I agree that improving security is good. However, the way macOS has implemented security has a heavy focus on not trusting the apps themselves and in some cases not even the user. While it is a reasonable principle on some levels, I suspect this mentality actually has more to do with greater control over the ecosystem and the security benefits are a nice bonus. Apple isn’t really alone in this either. For this particular issue, the issue isn’t with trusting CS:GO itself, it’s with isolating the game so that it doesn’t have more privileges than necessary. That’s actually less difficult of a problem to improve on with less annoying implications. A Linux solution might be shipping an SE Linux profile or Firejail configuration with your app to help lock it down. In this case you still trust the app, and good developers can improve their security easily. No annoying prompts, albeit it would not protect against malicious developers at all. I still have a lot of mixed feelings because I think concepts like secure boot and principle of least privilege are good ideas. However, they have been met with scorn in their introduction to desktop because traditionally, on desktop platforms, you want to trust the software vendor anyways. The trust boundaries are changing and consolidating trust mostly with the OS vendor and device vendor. I realize this long-held tradition of trusting desktop applications has been crumbling under pressure and less people trust software they depend on than ever. But, I still think that macOS is basically neglecting the demographic that absolutely wants granular and intensive security, but wants more control over how it is enforced and against what. In general, that demographic is being forced into the same pigeonhole as everyone else whether they like it or not, much to the detriment of their ability to hack, repair and otherwise use the device, maybe in ways the vendor objects to. Apple famously believes in a world free of porn. Why should the company that makes my phone be hindering the types of content I can consume on it so stringently? I am also feeling stronger lately that we’re headed towards less and less sustainable conundrums as the grip tightens. One key insight is that back in the day, you generally trusted software vendors because they mostly had incentive to not betray that trust, and you used websites because you wanted to and not because you felt you had no other options. Even if we make security a priority and drop as many privileges as possible, will that solve the problem? We hate the software we use. Everyone wonders why the web is so slow and disliked; it’s because every time you scroll Twitter spends 100ms blocking the main thread on a modern multicore processor doing god knows what while the browser desperately tries to hide this fact. Even when you don’t scroll enough to cause any virtualized viewport changes. Is it ads, telemetry? Who knows. It’s a mess. Nearly every webapp and probably many mobile apps do things we hate. And they all seem to pull this elaborate bait and switch on users where it’s nice and user friendly and developer friendly until they no longer need your help to thrive. Users should have ways to run apps they don’t trust that will help protect their security and personal information. Security by default is also a laudable goal, too. But if the future is going to be OSes trying to protect us against apps we hate that hate us that we feel compelled to use due to social pressure, legal requirements or business needs, I think we’re really just headed to a generally dark place. I’m not saying I don’t understand the legitimate motivations here. It just also is convenient that part of this model of security necessarily takes control away from the user, and it seems like the endgame is that we hate everything and everything hates us. It is possible we’ve run into a situation where a technical solution is simply not enough to untangle the mess. I have no idea what is. For a long time I was on the side of sympathizing with OS vendors. They were just doing what the security paranoids wanted, right? Well, kind of. But the implications of what it really means for computing feel bleaker every time the subject comes up. And yet are we safe? The threats just keep adapting. I’m sure at one point many thought “as soon as those pesky buffer overflows are gone, computers will be safe.” It’s good that the security baseline on a technical level keeps improving, but I really think we need to find a way to have healthier relationships between end users, device vendors, and software vendors...
deleted 5y ago
[deleted]
tantalor 5y ago
Burying the lead here! > in over 4 months, we did not even receive an acknowledgment by a Valve representative. After public pressure, when it became apparent that Valve had also ignored other Security Researchers with similar impact, Valve finally fixed numerous security issues Also, can we all agree "DD/MM/YYYY" is the worst possible date format?
- ed25519FUUU 5y ago
  I’m ready for us all to standardize on the DATEINT format.
- jhugo 5y ago
  MM/DD/YYYY is clearly worse. Not only is it only used in a tiny number of places, making it more likely to cause confusion, but it doesn’t go consistently from smaller unit to bigger unit or vice-versa. YYYY-MM-DD is ideal, of course, due to easy sorting and no ambiguity over the order of MM and DD, but I’d take DD/MM/YYYY over MM/DD/YYYY any day.
  - Talanes 5y ago
    The only problem with YYYY-MM-DD is that most of my non-digital use-cases don't require the year, and often not the month. Truncating information from the front-end isn't as intuitive.
  - smichel17 5y ago
    +1 on ISO 8601, but MM/DD/YYYY does have a certain logic to it. The month essentially tells you what time of year it is. "Want to go on vacation in July 10th?" carries less mental overhead than "..on the 10th of July", unless it's currently July (ie, you just say "..on the 10th"). Because "in July" is more meaningful than "on the 10th of any random month".
    - Macha 5y ago
      Is it? Either we're asking to pick a date (in which case it's just "in July" or "mid July" or "in a couple of months"), or you're asking about a specific date which works for you, in which case both components are equally important. I could make similarly silly arguments in favour of dd/mm/yy - if you're writing it down on a paper list and dates aren't yet final, it's easier to cross out the first item as you'll have space in the margins to put in the new value rather than the middle item, and for that kind of short term projections, the day is more likely to change. The real reason we find a system preferable is just familiarity, no matter what post-facto justifications people try bringing up.
randomaces 5y ago
Valve as a company needs fundamental change. It’s pure luck that CS and Dota2 are still #1 and #2 on steam. I don’t even know if I would call valve a game developer anymore. They are mostly a service provider who happens to own some profitable IP.
- waheoo 5y ago
  Luck...? Dota2 is an extremely well managed esport. Have you seen literally any of their productions on youtube?
- Tuna-Fish 5y ago
  > Valve as a company needs fundamental change. Counterpoint: No, they really don't. > They are mostly a service provider who happens to own some profitable IP. They are a staggeringly profitable service provider who occasionally has their employees work on games as a hobby. They just are not a game dev company anymore, and that's okay.
- throwaway3699 5y ago
  They're a technology company. Most of their games in the past ten years have been about showcasing tech, e.g Source, Steam, Trading/Market, VR...
gverrilla 5y ago
meanwhile they spend billions with VR nobody wants, controllers nobody wants, linux OS nobody uses, smart tv integration nobody cares about, etc cs:go at this point is a cheater's game. because valve's server ain't reliable at all, some people choose to play on third party servers, and not surprisingly a lot of players had the third party client mining bitcoin on their computer [0]. much blame the service, but it's obvious to me it's Valve's responsability. 0: https://www.theverge.com/2013/5/2/4292672/esea-gaming-network-bitcoin-botnet https://www.theverge.com/2013/5/2/4292672/esea-gaming-networ...
- jpeter 5y ago
  Valve doesn't even fix VAC bypasses you can find on github
- bruce343434 5y ago
  I don't know about you but I use linux. I was pleasantly surprised to find CSGO running smoothly on it.
- jonnelafin 5y ago
  This is a bit selfish view. I loved their controller, I love steam link allowing me to seamlessly play from any room (with whatever controller I want). I use Linux and think that vr is something everyone should try at some point. I know that you maybe couldn't care less about these things, but don't exacerbate the argument by saying "nobody". Besides, cs started with 3rd party servers and have always been there. Many people have never transitioned to the official matchmaking and I don't think that's necessarily a bad thing. I just think that your comment is a bit too salty on HN's standards.
  - gverrilla 5y ago
    Good for you mate that you enjoyed all that. I'm just pointing out they do a poor job on cs security and anti-cheat and communication in contrast to other efforts on the company like these, and it's cs who made steam possible, not that other stuff. 3rd party servers are different from 3rd party services.
VMtest 5y ago
after reading the comments, I think the takeaways for games are 1. sandboxing - restrict read/write/execute folder/file access at kernel level 2. sandboxing - restrict games to execute arbitrary code, only the game binary itself is allow to be executed 3. anti-cheat software should not be installed at client's computer 4. implement anti cheating from server side instead of relying on client side anti-cheat software
- esyir 5y ago
  For 3 and 4, good luck. The verdict is in, and server side anti cheat has decidedly lost. The issue here is that cheat prevention is defense in depth. Drop a couple layers and your cheater rate rapidly rises. Doesn't take much from there to a dead game.
instagraham 5y ago
I have always been afraid of this. Never playing a community server again.
JoeyBananas 5y ago
Gamers don't care about invasive anticheat because they already use Microsoft Windows. They have nothing to lose
daguava 5y ago
Valve's handling of security reports is abhorrent, and I absolutely believe they should be kicked from any platform that supports good-faith reporting of bugs until they decide they're ready to play. Sup Gaben?

186 points by stefan_ 5y ago

Glad they published the process used to discover the exploit. Interesting to follow along on how the weakness was found and the relative simplicity of the actual exploit code. Can't help but feel like this entire class of problem should be avoided with modern tooling. Even in a relatively unsafe language like C++, a static analyzer could have flagged an unchecked array access.

alkonaut 5y ago

How can people contact big corporations and get no response? Are the messages not being read? Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? It wouldn’t be the first instance of US law having weird effects on human behavior but it does seem a bit far fetched.

brutal_chaos_ 5y ago
> Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? That is probably one aspect of it for sure. I think the gaming industry itself might have problems with sharing because 0days in games could really mean no more purchases, at least for awhile, and even then you have lost momentum from your marketing. Also, for non-zero days, just bugs in general, look at No Man's Sky or even more recently Cyberpunk 2077, so much social backlash.
munk-a 5y ago
I think game development companies are forced to take a very different approach from normal companies. Game developers face frequent abuse from customers due to passionate feelings involved with such an interactive media, programmers will get hate mail (generally vaguely directed at least) and female artists will get stalked pretty often - it's honestly a pretty toxic community. Look, for example, at what happened to Hello Games after the release of No Man's Sky - lots of people felt entitled to send death threats and demands to the developers - the UK authorities were regularly involved in threat assessment[1]. If some LoL players[2] are willing to swat the other team after losing a match then they're quite willing to go extreme lengths if their favorite character gets nerfed. I think this frequently toxic community interaction really impacts how game development studios interact with press and the public. The folks reporting legitimate bugs might just end up being buried in an avalanche of "BUG: My DPS damage is too low" that overwhelms an already tetchy CS department. 1. https://www.theguardian.com/games/2018/jul/20/no-mans-sky-next-hello-games-sean-murray-harassment-interview https://www.theguardian.com/games/2018/jul/20/no-mans-sky-ne... 2. I'd just like to reinforce that most of the people in a community can be fine - it's the crazies that start a lot of these problems, most folks won't swat you for beating them at LoL.
- tryonenow 5y ago
  To be fair, Hello Games promised way more than what people ended up paying for. Also I really don't think internet death threats are anything to be worried about. How often do people actually act on them?
- iancarroll 5y ago
  This is definitely true in general, but it’s worth noting that Valve pays HackerOne to validate submitted issues before they have to look at them. If it can’t be reproduced as a security issue, it will likely not get through.
inetknght 5y ago
> How can people contact big corporations and get no response? Are the messages not being read? Customer support is seen as an expense. So automate as much as their job as possible and then... stop paying for customer support.
userbinator 5y ago
How can people contact big corporations and get no response? In general, the bigger the company, the more bureaucracy and layers of indirection you have to get through to reach someone who even knows what you're talking about. This is regardless of whether the message is "bad security bug in your product" or "want to buy a million of your product".
davidbanham 5y ago
For Valve at least my experience is that’s pretty common. With the way they structure their company everyone works on what they want to. The result is that nobody chooses to work on the boring stuff so it doesn’t happen. I used to run some of the official servers for CS:GO and L4D2 on behalf of Valve. Mostly it was great but communication was always a challenge.
f311a 5y ago
Valve is a big company, but it has very small teams for CS GO and Dota relative to the industry.

google234123 5y ago

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

throwaway3699 5y ago
More likely is nobody at Valve cares enough to actually monitor or respond. There's plenty here about their bizarre corporate structure which really falls flat at critical times.
- codabool 5y ago
  I would go with this assumption. Best to assume neglect over mal intent. This behavior was seen before too with the devs behind the new Gmod in Source 2 (Alyx engine). They spent months trying to get in touch with access and it came down to an employee who ended up getting fired for neglecting responsibilities. Now everything seems to be working out and open tooling is being developed.
- freshair 5y ago
  Does it really make a difference, with respect to whether they should be kicked off HackerOne? Incompetence and disorganization is no excuse for what is essentially (if not literally) wage theft.
rozab 5y ago
These researchers could have earned plenty from making cheats instead. Would make sense for Valve to pay these types to fix their software instead of breaking it.
njbooher 5y ago
They pay, eventually. They're particularly slow for game client exploits. Much quicker for server-side issues.
- iancarroll 5y ago

TechBro8615 5y ago

Fun writeup, thanks. FYI to the author, on mobile there is a horizontal overflow due to one image being too wide (the dereference illustration). I really like the blog’s style otherwise. There is one part I’m not clear about. Presumably the vector to exploit this is a malicious server, not a proxy. So if you control the server, why do you need to set two Content-Link headers to trick the parser into thinking it’s empty? Could you use a legit file and a fake content header with extra (empty) bytes? Or does that have too many side effects due to the client actually parsing the file rather than ignoring it?

stefan_ 5y ago
The idea is that you don't want to fill the memory chunk with real data from the server but keep the contents that happen to be in there from previous allocations. Then when the proxy later retrieves the contents of the memory chunk they get essentially a random block of old heap contents. Thats valuable because those will contain (vtable) pointers that reveal where in memory the game was loaded - most executables nowadays use ASLR so a prerequisite to an exploit is having some sort of information leak like this that can tell you the base address.

Rebelgecko 5y ago

Is this the same exploit that was reported to Valve in like 2018?

hn8788 5y ago
No, the site has a timeline that says it was reported in January, but Valve didn't fix it until they got publicly shamed for not fixing the 2 year old RCE.
- Rebelgecko 5y ago
  Weird, when I read the article earlier the page content stopped after the 'convars as a gadget' section. That did seem like an abrupt ending

any626 5y ago

Backend dev here. How can one learn these types of skills? Recommendations?

hn8788 5y ago
Corelan Cybersecurity Research[1] is a good starting point. There haven't been any new articles in ~5 years, but some of the techniques in the linked article are covered. The /r/netsec subreddit is also a suprisingly good source of security info. A big part as well is just experimenting on your own. Vulnerability research is a very "creative" field, so being able to think outside the box is just as important as having technical knowledge. [1] https://www.corelan.be/ https://www.corelan.be/
jpeter 5y ago
Liveoverflow ist pretty good https://m.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://m.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
- creamytaco 5y ago
  Script kiddie at best. If you want to learn from the best, and it has to be youtube, go watch Gynvael's channel.

asperous 5y ago

Another example is why app level security is so important. Why shouldn’t games allow arbitrary code execution? It only matters because the access space for programs is still so broad. People complain when applications on Mac request permission to access files, but that makes such a huge difference. It’s time for kernel level permissions to be standard on desktops.

breakfastduck 5y ago
Yeah the way macOS handles permissions can be annoying to some but generally the way it places an additional barrier between code execution and ability to read/write files beyond the application files itself is welcome imo. If you accept the admin prompt in windows that code can just run anything. In macOS the first time it'll run the code but prompt again if it starts trying to access the core file system. You may, as a developer, have an expectation some simple app you've downloaded should be able to run in a sandbox quite simply. A random app seemingly unnecessarily trying to access your user/systems files is worth a second thought.
jchw 5y ago
> Why shouldn’t games allow arbitrary code execution? Well, for one thing, to maintain the integrity of online games, protect personal data from the game itself and help prevent theft of in game assets... so I think there’s no strong win here. Yes it would be good if CS:GO exploits couldn’t reach out and hit your Bitcoin wallet or what have you, but you can’t really just give up entirely either. There’s by-design going to be things the game can access or at least indirectly access that can be sensitive. (At least in the context of online games like CS:GO.) > People complain when applications on Mac request permission to access files, but that makes such a huge difference. It’s time for kernel level permissions to be standard on desktops. I agree that improving security is good. However, the way macOS has implemented security has a heavy focus on not trusting the apps themselves and in some cases not even the user. While it is a reasonable principle on some levels, I suspect this mentality actually has more to do with greater control over the ecosystem and the security benefits are a nice bonus. Apple isn’t really alone in this either. For this particular issue, the issue isn’t with trusting CS:GO itself, it’s with isolating the game so that it doesn’t have more privileges than necessary. That’s actually less difficult of a problem to improve on with less annoying implications. A Linux solution might be shipping an SE Linux profile or Firejail configuration with your app to help lock it down. In this case you still trust the app, and good developers can improve their security easily. No annoying prompts, albeit it would not protect against malicious developers at all. I still have a lot of mixed feelings because I think concepts like secure boot and principle of least privilege are good ideas. However, they have been met with scorn in their introduction to desktop because traditionally, on desktop platforms, you want to trust the software vendor anyways. The trust boundaries are changing and consolidating trust mostly with the OS vendor and device vendor. I realize this long-held tradition of trusting desktop applications has been crumbling under pressure and less people trust software they depend on than ever. But, I still think that macOS is basically neglecting the demographic that absolutely wants granular and intensive security, but wants more control over how it is enforced and against what. In general, that demographic is being forced into the same pigeonhole as everyone else whether they like it or not, much to the detriment of their ability to hack, repair and otherwise use the device, maybe in ways the vendor objects to. Apple famously believes in a world free of porn. Why should the company that makes my phone be hindering the types of content I can consume on it so stringently? I am also feeling stronger lately that we’re headed towards less and less sustainable conundrums as the grip tightens. One key insight is that back in the day, you generally trusted software vendors because they mostly had incentive to not betray that trust, and you used websites because you wanted to and not because you felt you had no other options. Even if we make security a priority and drop as many privileges as possible, will that solve the problem? We hate the software we use. Everyone wonders why the web is so slow and disliked; it’s because every time you scroll Twitter spends 100ms blocking the main thread on a modern multicore processor doing god knows what while the browser desperately tries to hide this fact. Even when you don’t scroll enough to cause any virtualized viewport changes. Is it ads, telemetry? Who knows. It’s a mess. Nearly every webapp and probably many mobile apps do things we hate. And they all seem to pull this elaborate bait and switch on users where it’s nice and user friendly and developer friendly until they no longer need your help to thrive. Users should have ways to run apps they don’t trust that will help protect their security and personal information. Security by default is also a laudable goal, too. But if the future is going to be OSes trying to protect us against apps we hate that hate us that we feel compelled to use due to social pressure, legal requirements or business needs, I think we’re really just headed to a generally dark place. I’m not saying I don’t understand the legitimate motivations here. It just also is convenient that part of this model of security necessarily takes control away from the user, and it seems like the endgame is that we hate everything and everything hates us. It is possible we’ve run into a situation where a technical solution is simply not enough to untangle the mess. I have no idea what is. For a long time I was on the side of sympathizing with OS vendors. They were just doing what the security paranoids wanted, right? Well, kind of. But the implications of what it really means for computing feel bleaker every time the subject comes up. And yet are we safe? The threats just keep adapting. I’m sure at one point many thought “as soon as those pesky buffer overflows are gone, computers will be safe.” It’s good that the security baseline on a technical level keeps improving, but I really think we need to find a way to have healthier relationships between end users, device vendors, and software vendors...

deleted 5y ago

[deleted]

tantalor 5y ago

Burying the lead here! > in over 4 months, we did not even receive an acknowledgment by a Valve representative. After public pressure, when it became apparent that Valve had also ignored other Security Researchers with similar impact, Valve finally fixed numerous security issues Also, can we all agree "DD/MM/YYYY" is the worst possible date format?

ed25519FUUU 5y ago
I’m ready for us all to standardize on the DATEINT format.
jhugo 5y ago
MM/DD/YYYY is clearly worse. Not only is it only used in a tiny number of places, making it more likely to cause confusion, but it doesn’t go consistently from smaller unit to bigger unit or vice-versa. YYYY-MM-DD is ideal, of course, due to easy sorting and no ambiguity over the order of MM and DD, but I’d take DD/MM/YYYY over MM/DD/YYYY any day.
- Talanes 5y ago
  The only problem with YYYY-MM-DD is that most of my non-digital use-cases don't require the year, and often not the month. Truncating information from the front-end isn't as intuitive.
- smichel17 5y ago
  +1 on ISO 8601, but MM/DD/YYYY does have a certain logic to it. The month essentially tells you what time of year it is. "Want to go on vacation in July 10th?" carries less mental overhead than "..on the 10th of July", unless it's currently July (ie, you just say "..on the 10th"). Because "in July" is more meaningful than "on the 10th of any random month".
  - Macha 5y ago
    Is it? Either we're asking to pick a date (in which case it's just "in July" or "mid July" or "in a couple of months"), or you're asking about a specific date which works for you, in which case both components are equally important. I could make similarly silly arguments in favour of dd/mm/yy - if you're writing it down on a paper list and dates aren't yet final, it's easier to cross out the first item as you'll have space in the margins to put in the new value rather than the middle item, and for that kind of short term projections, the day is more likely to change. The real reason we find a system preferable is just familiarity, no matter what post-facto justifications people try bringing up.

randomaces 5y ago

Valve as a company needs fundamental change. It’s pure luck that CS and Dota2 are still #1 and #2 on steam. I don’t even know if I would call valve a game developer anymore. They are mostly a service provider who happens to own some profitable IP.

waheoo 5y ago
Luck...? Dota2 is an extremely well managed esport. Have you seen literally any of their productions on youtube?
Tuna-Fish 5y ago
> Valve as a company needs fundamental change. Counterpoint: No, they really don't. > They are mostly a service provider who happens to own some profitable IP. They are a staggeringly profitable service provider who occasionally has their employees work on games as a hobby. They just are not a game dev company anymore, and that's okay.
throwaway3699 5y ago
They're a technology company. Most of their games in the past ten years have been about showcasing tech, e.g Source, Steam, Trading/Market, VR...

gverrilla 5y ago

meanwhile they spend billions with VR nobody wants, controllers nobody wants, linux OS nobody uses, smart tv integration nobody cares about, etc cs:go at this point is a cheater's game. because valve's server ain't reliable at all, some people choose to play on third party servers, and not surprisingly a lot of players had the third party client mining bitcoin on their computer [0]. much blame the service, but it's obvious to me it's Valve's responsability. 0: https://www.theverge.com/2013/5/2/4292672/esea-gaming-network-bitcoin-botnet https://www.theverge.com/2013/5/2/4292672/esea-gaming-networ...

jpeter 5y ago
Valve doesn't even fix VAC bypasses you can find on github
bruce343434 5y ago
I don't know about you but I use linux. I was pleasantly surprised to find CSGO running smoothly on it.
jonnelafin 5y ago
This is a bit selfish view. I loved their controller, I love steam link allowing me to seamlessly play from any room (with whatever controller I want). I use Linux and think that vr is something everyone should try at some point. I know that you maybe couldn't care less about these things, but don't exacerbate the argument by saying "nobody". Besides, cs started with 3rd party servers and have always been there. Many people have never transitioned to the official matchmaking and I don't think that's necessarily a bad thing. I just think that your comment is a bit too salty on HN's standards.
- gverrilla 5y ago
  Good for you mate that you enjoyed all that. I'm just pointing out they do a poor job on cs security and anti-cheat and communication in contrast to other efforts on the company like these, and it's cs who made steam possible, not that other stuff. 3rd party servers are different from 3rd party services.

VMtest 5y ago

after reading the comments, I think the takeaways for games are 1. sandboxing - restrict read/write/execute folder/file access at kernel level 2. sandboxing - restrict games to execute arbitrary code, only the game binary itself is allow to be executed 3. anti-cheat software should not be installed at client's computer 4. implement anti cheating from server side instead of relying on client side anti-cheat software

esyir 5y ago
For 3 and 4, good luck. The verdict is in, and server side anti cheat has decidedly lost. The issue here is that cheat prevention is defense in depth. Drop a couple layers and your cheater rate rapidly rises. Doesn't take much from there to a dead game.

instagraham 5y ago

I have always been afraid of this. Never playing a community server again.

JoeyBananas 5y ago

Gamers don't care about invasive anticheat because they already use Microsoft Windows. They have nothing to lose

daguava 5y ago

Valve's handling of security reports is abhorrent, and I absolutely believe they should be kicked from any platform that supports good-faith reporting of bugs until they decide they're ready to play. Sup Gaben?