5 ms·

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compen

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

throwaway3699 5y ago
More likely is nobody at Valve cares enough to actually monitor or respond. There's plenty here about their bizarre corporate structure which really falls flat at critical times.
- codabool 5y ago
  I would go with this assumption. Best to assume neglect over mal intent. This behavior was seen before too with the devs behind the new Gmod in Source 2 (Alyx engine). They spent months trying to get in touch with access and it came down to an employee who ended up getting fired for neglecting responsibilities. Now everything seems to be working out and open tooling is being developed.
- freshair 5y ago
  Does it really make a difference, with respect to whether they should be kicked off HackerOne? Incompetence and disorganization is no excuse for what is essentially (if not literally) wage theft.
rozab 5y ago
These researchers could have earned plenty from making cheats instead. Would make sense for Valve to pay these types to fix their software instead of breaking it.
njbooher 5y ago
They pay, eventually. They're particularly slow for game client exploits. Much quicker for server-side issues.
- iancarroll 5y ago
  Yeah, it is certainly a wide spectrum. Server-side fixed in days to months, but these game client bugs have been sitting for years. I had one server bug in HackerOne’s “mediation” for over a month, after 4-6mo of no reply, which did nothing until mentioning it to a Valve employee on another report they had actually responded to. Disappointing for a program that has paid $1m+ in its lifetime.
arkadiyt 5y ago
If you check their hacktivity you'll see that the previous negative press spurred them into action: https://hackerone.com/valve/hacktivity?type=team https://hackerone.com/valve/hacktivity?type=team
reasons 5y ago
I like Valve's approach. Who is the real bad guy here? Why should they prioritize people who break their hard work and coerce them into paying for protection? I might be biased; always wanted to work @ Valve Software since HL1.
- jmgao 5y ago
  Because that's what they signed up for?
  - reasons 5y ago
    See it from Valve's perspective. They've had pre-launch source codes leaked by hackers, gameplay ruined by hackers; they probably don't like hackers. I wouldn't be surprised if they signed up purely out of spite to tarpit and frustrate hackers.
    - diarrhea 5y ago
      That is such a bizzare take. Valve's stance on hackers won't change the fact they exist and are out there doing their thing. Valve's stance can now be the deciding factor between exploits being disclosed to them for a reward, or sold on black markets as cheats. If you don't want people "breaking your hard work", don't release software. However, being on hackerone can help alleviate the negatives.
    - _kbh_ 5y ago
      Sounds like a great idea, now instead of them getting issues fixed they get sold and not reported.
    - anonymousab 5y ago
      > they probably don't like hackers Many of their breadwinners were made by 'hackers'.
- lilSebastian 5y ago
  > I like Valve's approach. Who is the real bad guy here? Valve are, leaving millions of users at risk, despite having been informed of an issue.
throwawaythekey 5y ago
My experience with valve on HackerOne was when I discovered an easy way to lag, and if exploited crash, a dota 2 server. It was nothing technically fancy, but something that made it easy for griefers to ruin the game for everyone. I think even spectators to the match could trigger the functionality. They turned me down for any reward - I don't remember the exact wording in their policy but I think it was a generic exclusion of DOS and DDOS vectors. I thought I should've still been eligible as my exploit was simple and only required a low input frequency. The bureaucratic process of the whole thing scared me from doing anything more and I was happy enough that they would fix the vulnerability and I could get back to enjoying the game. I think it's five years later and the problem still exists, and regularly reduces the quality of my games.
- rasz 5y ago
  It would be awful if after 5 years someone independently rediscovered this vulnerability and tweeted reproduction steps.
- anonymousab 5y ago
  At some point it is more responsible to make the exploit public and spark public pressure for a fix, than to let Valve ignore exploits while each day is a roll of the dice on a bad actor discovering them. If they don't feel the pain, again and again for things like this then there will never be any impetus to change. This isn't your responsibility of course. I'm just saying that disclosure at this point would be anything but irresponsible. Maybe not in the middle of a big tournament, I suppose.
eitland 5y ago
No experience with Valve but are not alone in being cheap: I submitted the bug where you I proved you could make predictions about a password in Microsoft just by using ctrl + arrow keys. It wouldn't have been much anyway but I wouldn't have been surprised if they sent me some swag or something - instead I was surprised about how short the thank you mail was ;-) (They said it wasn't a security issue but at least it was fixed in the next release :-P) Edit: I later found a reliable way to run the encryption tools the correct way with the tooling in Azure Information Protection that still leaves the files unencrypted (so simple it can happen by accident, that's how I found it, useful for data exfiltration with plausible deniability) and besides the integration of information protection in Sharepoint is so extremely broken that depending on how you log in, SharePoint will easily serve you the files unprotected. Between not finding the correct way the report it and the very "meh" feeling on my first find I only tried to report those onve or twice and then gave up.

throwaway3699 5y ago

More likely is nobody at Valve cares enough to actually monitor or respond. There's plenty here about their bizarre corporate structure which really falls flat at critical times.

codabool 5y ago
I would go with this assumption. Best to assume neglect over mal intent. This behavior was seen before too with the devs behind the new Gmod in Source 2 (Alyx engine). They spent months trying to get in touch with access and it came down to an employee who ended up getting fired for neglecting responsibilities. Now everything seems to be working out and open tooling is being developed.
freshair 5y ago
Does it really make a difference, with respect to whether they should be kicked off HackerOne? Incompetence and disorganization is no excuse for what is essentially (if not literally) wage theft.

rozab 5y ago

These researchers could have earned plenty from making cheats instead. Would make sense for Valve to pay these types to fix their software instead of breaking it.

njbooher 5y ago

They pay, eventually. They're particularly slow for game client exploits. Much quicker for server-side issues.

iancarroll 5y ago
Yeah, it is certainly a wide spectrum. Server-side fixed in days to months, but these game client bugs have been sitting for years. I had one server bug in HackerOne’s “mediation” for over a month, after 4-6mo of no reply, which did nothing until mentioning it to a Valve employee on another report they had actually responded to. Disappointing for a program that has paid $1m+ in its lifetime.

arkadiyt 5y ago

If you check their hacktivity you'll see that the previous negative press spurred them into action: https://hackerone.com/valve/hacktivity?type=team https://hackerone.com/valve/hacktivity?type=team

reasons 5y ago

I like Valve's approach. Who is the real bad guy here? Why should they prioritize people who break their hard work and coerce them into paying for protection? I might be biased; always wanted to work @ Valve Software since HL1.

jmgao 5y ago
Because that's what they signed up for?
- reasons 5y ago
  See it from Valve's perspective. They've had pre-launch source codes leaked by hackers, gameplay ruined by hackers; they probably don't like hackers. I wouldn't be surprised if they signed up purely out of spite to tarpit and frustrate hackers.
  - diarrhea 5y ago
    That is such a bizzare take. Valve's stance on hackers won't change the fact they exist and are out there doing their thing. Valve's stance can now be the deciding factor between exploits being disclosed to them for a reward, or sold on black markets as cheats. If you don't want people "breaking your hard work", don't release software. However, being on hackerone can help alleviate the negatives.
  - _kbh_ 5y ago
    Sounds like a great idea, now instead of them getting issues fixed they get sold and not reported.
  - anonymousab 5y ago
    > they probably don't like hackers Many of their breadwinners were made by 'hackers'.
lilSebastian 5y ago
> I like Valve's approach. Who is the real bad guy here? Valve are, leaving millions of users at risk, despite having been informed of an issue.

throwawaythekey 5y ago

My experience with valve on HackerOne was when I discovered an easy way to lag, and if exploited crash, a dota 2 server. It was nothing technically fancy, but something that made it easy for griefers to ruin the game for everyone. I think even spectators to the match could trigger the functionality. They turned me down for any reward - I don't remember the exact wording in their policy but I think it was a generic exclusion of DOS and DDOS vectors. I thought I should've still been eligible as my exploit was simple and only required a low input frequency. The bureaucratic process of the whole thing scared me from doing anything more and I was happy enough that they would fix the vulnerability and I could get back to enjoying the game. I think it's five years later and the problem still exists, and regularly reduces the quality of my games.

rasz 5y ago
It would be awful if after 5 years someone independently rediscovered this vulnerability and tweeted reproduction steps.
anonymousab 5y ago
At some point it is more responsible to make the exploit public and spark public pressure for a fix, than to let Valve ignore exploits while each day is a roll of the dice on a bad actor discovering them. If they don't feel the pain, again and again for things like this then there will never be any impetus to change. This isn't your responsibility of course. I'm just saying that disclosure at this point would be anything but irresponsible. Maybe not in the middle of a big tournament, I suppose.

eitland 5y ago

No experience with Valve but are not alone in being cheap: I submitted the bug where you I proved you could make predictions about a password in Microsoft just by using ctrl + arrow keys. It wouldn't have been much anyway but I wouldn't have been surprised if they sent me some swag or something - instead I was surprised about how short the thank you mail was ;-) (They said it wasn't a security issue but at least it was fixed in the next release :-P) Edit: I later found a reliable way to run the encryption tools the correct way with the tooling in Azure Information Protection that still leaves the files unencrypted (so simple it can happen by accident, that's how I found it, useful for data exfiltration with plausible deniability) and besides the integration of information protection in Sharepoint is so extremely broken that depending on how you log in, SharePoint will easily serve you the files unprotected. Between not finding the correct way the report it and the very "meh" feeling on my first find I only tried to report those onve or twice and then gave up.