6 ms·

Because the company wasn't acting in good faith? IMHO they put that there on purpose and they deserve to be exposed as evil bastards that they are.

• simias 14y ago
  Do you have any evidence they put that here on purpose or are you just spreading rumors? It could as well be shoddy programming.
  • Paul_S 14y ago
    I don't subscribe to "never attribute to malice that which is adequately explained by stupidity". I'm not citing sources - hence it's just my opinion. Reminds me of google wifi slurping and hundreds of other cases where everyone plays dumb and swears it was all a misunderstanding. It never is. Until you get caught. And if not that it's a rogue trader, rogue reporter, rogue programmer, rogue scapegoat.
    • wseymour 14y ago
      "I can't prove it through fact, but I feel it to be true."
      • Bootvis 14y ago
        Not subscribing to malice what can explained by stupidity is just a feeling too. The question is: do you believe the perpetrator to be malicious or dumb?
        • gigitrix 14y ago
          It's not a "feeling" when all evidence points to the fact that, like every security vulnerability ever, a feature was added that had unintended consequences. There's no way it's malicious: Ubisoft can't do anything with this that they can't do everywhere else in the actual applications themselves!
          • pyre 14y ago
            Who says it was malicious on Ubisoft's part? It could easily have been a rogue developer that saw an opportunity to install a backdoor on a ton of machines.
            • polyfractal 14y ago
              It could also have been the Russians, who planted a mole in Ubisoft's quality assurance division and, over time, laying low in a foreign country gaining the respect of his peers and bosses, slowly worked his way to the top of the food chain... ...where at last he installed his Russian Rootkit. Or maybe some programmer added a feature that was insecure and they moved on to work on some bug that was crashing level three?
        • billswift 14y ago
          Usually both. (Note that with the internet you also have to be dumb, too, to believe you are not eventually going to be caught, no matter how malicious you are.)
      • rmc 14y ago
        That's not how reality (or science) works.
    • jbrechtel 14y ago
      Since we have no additional evidence to select between the two options, do you really think that malice is simpler than stupidity?
      • Paul_S 14y ago
        I'm not going to do any kind of full disclosure here (I know this is lame) but I work in video games so I know what it looks like from the other side. We're not all idiots here, we just do as we're told.
        • danudey 14y ago
          As a Vancouverite, I've seen enough layoffs to believe this entirely (you're fungible and replaceable). Still, I don't think that Ubisoft intentionally created a security issue, just that they didn't care about one that happened and deadlines were coming.
        • jbrechtel 14y ago
          I didn't mean to imply that video game programmers were stupid... :) I was saying it seems more likely to me that any random developer making a stupid mistake like this seems more likely than a company having real motivation to create this kind of security hole. I suppose, alternatively, this could have been an individual developer's intent. An exploit like this would get a pretty penny on the exploit market, I'd think.
      • retr0rocket 14y ago
        actually it fucking is, after the entire securom debacle you think they dont know they are putting in rootkits? ubisoft is known for this stuff. shut the fuck up you toady. the only way you can say its stupidity at this point is if they are MASSIVELY retarded at ALL levels, thus malice, is simpler. fuck i hate people like you, you are the ones that ask for sources on shit you can google.
  • raverbashing 14y ago
    If they are going to install low level software on my computer they better be very sure it's properly coded. Instead, they ask for their interns to build the "solution" that makes my computer part of the Borg. I really don't feel compassion in this case towards the company (towards the users is a different story, no doubt)
    • rmc 14y ago
      If they are going to install low level software on my computer they better be very sure it's properly coded. Companies are often incompetant with security code. If you are expecting high quality secure code with consumer level software, you will often be disappointed.
      • Edman274 14y ago
        Which is why going the full disclosure route prevents them from being insulated from their mistakes - otherwise, it becomes a moral hazard to keep playing nice with the approach to disclosure.
  • rmccue 14y ago
    The fact that the line contains "dev" twice is probably indicative of forgetting to disable it.
    • campnic 14y ago
      Or really tight dates to meet and rushing.
• ewillbefull 14y ago
  What makes you believe they put it there on purpose? It appears to have a genuine (if insecure) purpose. Even the researcher's message on seclists implies he thought of it as a bug.
  • alexanderpas 14y ago
    it's completely unneeded. I can launch Steam games from my browser without any plugins. https://developer.valvesoftware.com/wiki/Steam_browser_protocol https://developer.valvesoftware.com/wiki/Steam_browser_proto...
    • DavidPP 14y ago
      Well those games are not only sold through Steam you know so they still "needed" this feature to work without Steam.
    • cgbystrom 14y ago
      Protocol handlers are a pretty shitty way of interfacing with desktop apps. There's no two-way communication and no error handling. Lots of potential screw-ups and incompatibility issues will/can happen. Sure, they don't require a browser plugin but that's about the only advantage.
• zokier 14y ago
  What would "they" have to gain from this ability? Ubi has already capability to execute arbitrary code on your machine via it's uplay software, they don't need a hole in browser plugin for that.
  • teamonkey 14y ago
    A web-based portal. List all the games you have registered and click on the link to launch it, whether it's a game installed on your PC or a link to a facebook game.