Counter-Strike Global Offsets: reliable remote code execution

Post by jonnelafin » Sat, May 15, 2021, 10:46 AM UTC

gverrilla wrote: post #56

jonnelafin wrote: post #55

Earlier quoted context omitted.

This is a bit selfish view. I loved their controller, I love steam link allowing me to seamlessly play from any room (with whatever controller I want). I use Linux and think that vr is something everyone should try at some point. I know that you maybe couldn't care less about these things, but don't exacerbate the argument by saying "nobody". Besides, cs started with 3rd party servers and have always been there. Many…

Good for you mate that you enjoyed all that. I'm just pointing out they do a poor job on cs security and anti-cheat and communication in contrast to other efforts on the company like these, and it's cs who made steam possible, not that other stuff. 3rd party servers are different from 3rd party services.

Post by rasz » Sat, May 15, 2021, 11:00 AM UTC

throwawaythekey wrote: post #37

google234123 wrote: post #4

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

My experience with valve on HackerOne was when I discovered an easy way to lag, and if exploited crash, a dota 2 server. It was nothing technically fancy, but something that made it easy for griefers to ruin the game for everyone. I think even spectators to the match could trigger the functionality. They turned me down for any reward - I don't remember the exact wording in their policy but I think it was a generic ex…

Post by throwaway3699 » Sat, May 15, 2021, 11:16 AM UTC

randomaces wrote: post #43

Valve as a company needs fundamental change. It’s pure luck that CS and Dota2 are still #1 and #2 on steam. I don’t even know if I would call valve a game developer anymore. They are mostly a service provider who happens to own some profitable IP.

Post by smichel17 » Sat, May 15, 2021, 11:24 AM UTC

jhugo wrote: post #33

tantalor wrote: post #28

Burying the lead here! > in over 4 months, we did not even receive an acknowledgment by a Valve representative. After public pressure, when it became apparent that Valve had also ignored other Security Researchers with similar impact, Valve finally fixed numerous security issues Also, can we all agree "DD/MM/YYYY" is the worst possible date format?

MM/DD/YYYY is clearly worse. Not only is it only used in a tiny number of places, making it more likely to cause confusion, but it doesn’t go consistently from smaller unit to bigger unit or vice-versa. YYYY-MM-DD is ideal, of course, due to easy sorting and no ambiguity over the order of MM and DD, but I’d take DD/MM/YYYY over MM/DD/YYYY any day.

Post by r1ch » Sat, May 15, 2021, 11:35 AM UTC

tbronchain wrote: post #57

asperous wrote: post #20

Another example is why app level security is so important. Why shouldn’t games allow arbitrary code execution? It only matters because the access space for programs is still so broad. People complain when applications on Mac request permission to access files, but that makes such a huge difference. It’s time for kernel level permissions to be standard on desktops.

I haven't dug very much into it (in fact mainly because I couldn't find much detailed/technical information) but Windows 10 has this "core isolation" feature, which I believe tries to achieve a system/apps isolation by virtualizing everything. It used to be a little buggy, but I now have it enabled all the time and don't necessarily feel any performance issue - on a powerful laptop with reasonable usage. If anyone ha…