91–100 of 214 posts
They're arrogant and lazy. Just say thank you and fix it. I hope GOG and HumbleBundle get a nice boost in sales.
While there are some DRM-free games, majority of games on HumbleBundle are sold as Steam keys, so you still need Steam to launch them.
Drama aside. Valve...I have your software installed. It has a hole. Fix it. This mudslinging isn't helping your PR or making me feel more secure about my steam install regardless of the details.
I basically uninstalled Steam client after first 0day was found. At least with gog I don't have install galaxy. But thats a different rant..
Valve figured out how to print money by hooking teenagers with gambling on loot boxes. They stopped having to create AAA titles, they stopped having to do anything remotely creative, and now they are a giant cancer with no value left to add. Their client is an insecure, slow, instable piece of shit and has been this way for well over a decade. I regret being a customer of theirs.
And yet, it's still the best client out there.
If you want slow and instable(sic!) try competition. Steam client is actually fast and stable compared to what else is on offer.
Earlier quoted context omitted.
Wouldn't you be able to do the same simply by looking at the file system without any access to admin privileges? I'm not arguing that this vulnerability isn't one, it's a privilege escalation vulnerability, however in your situation you got physical access which is as far as I know, pretty much game over for your system.
Not if they haven't granted access to the files to you. In fact by default the files in a user's home folder (including Documents, Videos etc.) are inaccessible to other (non-privileged) users on Windows.
I wonder if this is a product of Valve's free-form company structure. If as a Valve employee, you have the autonomy to float between projects, how do you maintain a strong security team? Do they even have a dedicate security team?
I've worked with extremely competent security professionals before. Those people love and are fanatical about security. Based on my experience, it seems a near certainty that Valve doesn't employee even a single such person. These people raise hell if security is ignored and have a job freedom that makes typical software engineers look like panhandlers.
Earlier quoted context omitted.
I agree with you from the other side. Before these programs people would disclose issues to the public. The company found out like everyone else. They would fix it immediately because they had to. Now they can hide it for months(ever) allowing others to discover them and keeping the researchers quiet.
A normal process goes like this: - Researcher finds bug - Researcher discloses to vendor - Vendor fixes (or not) - Researcher discloses bug publically once vendor has fixed, or after X time (whichever is first) This is roughly how Project Zero goes, and it's a good mix between giving the vendor the opportinity to fix it and deploy the update before it gets exploited. It's very naive to assume that bugs can be fixed b…
Earlier quoted context omitted.
I uninstalled Steam the moment I read the previous disclosure and Valve's approach to it. Any company that treats security as it used to be in the 90s ought to be shunned.
If you don't need it, why did you have it installed in the first place?
Earlier quoted context omitted.
I uninstalled Steam the moment I read the previous disclosure and Valve's approach to it. Any company that treats security as it used to be in the 90s ought to be shunned.
If you don't need it, why did you have it installed in the first place?
If you look at just the assets Valve produces minus rent seeking, are they losing money?
Earlier quoted context omitted.
H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).
How is N/A not a synonym for WONTFIX? There comes a moment when inaction translates to deception, and if you need clarification for what that looks like in the wild, look no further than Facebook.