Except it isn't like this is something you can just flip on. As the post says, its probably been in the pipe for weeks or months. They probably planned to roll it out right before the sale because it has less backend resource congestion.
Basically dude still got what he deserved.
It seems like I'm missing part of the story, here?
Yep, which is why no one should ever report or demonstrate security flaws. Because as Target, LivingSocial, Blizzard, Adobe and Ebay have shown: no one will ever exploit them anyway.
Especially ones that allow access to user's session IDs and also allows users to be unknowingly redirected to a screen(while still within the steam browser) that could say something along the lines of "Your stored credit card information has expired, please enter a new method of payment."
And peoples reactions like "Got what he deserved lol" is the reason that the silly gooses that think its ok to take months to fix that kind of flaw.
/InformationSecurityRAGE
...Oh, and I beat Hard Reset and was kind of pissed at the ending or rather lack there of, great game though otherwise.
Except to demonstrate them openly actually increases abuse! Surprise!
For every 'success' story you have SQL injection exploits that last for months because there just isn't any way to roll out the fixes that cover all bases but those 'helpful whitehats' just keep abusing it to 'prove it and OMG BE HELP.' because they want to be internet famous.
Sorry, but 90% of 'helping' proves to just be a pain in the ass unless its someone hired by security firms to do an actual analysis and be useful. I know people grew up on Hackers and shit and think the internet is full of good people, but that isn't really how it works either.
So, yes, what that person did was pointless and could have led to a lot of people abusing it that didn't even know it existed to begin with. Keep on with thinking the dude is some kind of folk hero though.
If it did anything, it probably forced them to roll out the new system even quicker which possibly have left in new and exciting exploits as Q&A time was cut short! Thank you random internet dude, for all your help!
Related to actual games: The MMX Legacy thing works just fine. Got my key instantly. Registered just fine. I think its a great deal and I'm probably going to plop down some hours on MMX because hey, I love this kind
Security through obscurity hasn't been a valid strategy for a while now. And in this case the exploit was pointed out months ago. This wasn't some random script kiddie trying to show off his epeen. This guy told them months ago and was blown off. Valve appeared to have flat out ignored someone pointing out a flaw without so much as a "we're working on it." You don't get to be surprised when they try to force your hand when you are endangering your users.
Actually, if you researched at all, you'd find that this only worked for registered steamworks community devs. You know, people Valve has the actual skinny on because they have to have actual legally binding accounts. Valve responded with a, 'It's cool, it only works for devs, we trust you guys, don't be dicks.' response and labeled it as not a bug that needed to be worked on. Probably because, as was just learned this very day, they were completely changing the backend so wasting time working on what probably wasn't a super simple fix would be a waste of time.
But hey I'm sure he knew better then the people working on the platform. I mean we can ignore that those same devs have access to uploading binaries so if they ever have account access compromised someone could just load binaries directly to games to do whatever they wanted anyway.
So in this fashion we should totally disable all dev access because they aren't trustworthy enough not to exploit a script issue (That was being replaced.) and force them through Microsoft style Q&A before any binaries can be released.
This is, of course, the only way security can be maintained. because devs are obviously untrustworthy.
I read the link. That's pretty much it the amount a effort I'm willing to invest in this. Also, the argument that someone could do worse so why fix the small issue is a fallacy of relative privation. And yes someone else besides the devs could gain access to a dev account, or one of the devs could take the money and run, or someone could find an entirely new exploit to allow them dev access. It takes less than five minutes to write up a matching phishnet vs trying to institute a change in the actual programming of a game. In my opinion "I know this thing could hurt people, but we trust people, after all only 3,000 people have access to it." is not a very good answer, especially when they could have simply said "We're changing the entire thing anyway." At best this was poor communication. At worst the switch too bbcode was actually hasty reaction to the exposure of the exploit to cover Valves ass. I tend to believe the worst of people.
EDIT: Yes I realize the argument is getting old so I'll drop it.
Usually each craft gets you three items, among which would be digital artwork, emoticons, et cetera.
You also get experience to 'level up' your account, which earns you more friend slots.
Wait ... you mean to tell me that I can't add more friends until I level up my account by crafting badges which is done by idling playing games I have no intention to play ... FFFFFFFF!
I'm going to have to go craft some badges aren't I ... and here I was thinking I could just ignore that trap card feature ... Dammit
Yeah most people will be fine with the default friend limits. I've had to delete some before they added the bonuses but that's because I trade a lot so frequently have new people adding me.
You get as many as you'll probably need without the trading cards. I think without trading cards it's like 100 or something.
Whew ... being socially inept has never been more gratifying (I'll never need more than 100 friends just like I never needed more than 20Mb HD LOL). Now if I could just find a way to give away the cards that I have ... is there a way to give them away? Nevermind, I will go and do some research ... Thanks anyway.
You get as many as you'll probably need without the trading cards. I think without trading cards it's like 100 or something.
Whew ... being socially inept has never been more gratifying (I'll never need more than 100 friends just like I never needed more than 20Mb HD LOL). Now if I could just find a way to give away the cards that I have ... is there a way to give them away? Nevermind, I will go and do some research ... Thanks anyway.
Just start a trade with someone. They don't have to give anything in return. It works completely one sided if you want it to.
@Big Classy the gift before s/h and tax was less than $15, so you get to designate 2 hours to myself, smoke, bery, or Krummith. (Krummith has been sneaky and laying low, i suggest piling on him too)
CorriganX on Steam and just about everywhere else.
Oh, damn. Before @Jhraggen can match the donations, we're already up to over $1000 for charity! That means @shade will do a LP of a game of the forum's choosing! Woo! You guys are amazing. Check our progress here and click the incentives tab on the bottom to see our goals so far
CorriganX on Steam and just about everywhere else.
Hi guys! I actually did two transactions. I didn't see that @jragghen was matching until after my first transaction, bwhaha. I hope he's still doing it.
Holy shit guys, with @MsMya's generous donation, we're at $1130. Thats $5 more than we made the entirety of last year, and we haven't even gotten to the steam sale yet. You guys are amazing.
CorriganX on Steam and just about everywhere else.
Edit - I forgot to mention that this donation drive made me resub to amazon prime, and I wanted to rant about how they increased it from $79 to $99. Rabble rabble!
Still a bargain, depending on how much you actually take advantage of it. They could make it 2x or 3x that and I would probably still come out ahead every year. I've been a Prime member since day 1 and have always considered it money well spent.
And now Amazon Prime allows streaming music which is a good replacement of Spotify for me because I hate listening to the commercials. Pretty awesome for work.
Oh, damn. Before @Jhraggen can match the donations, we're already up to over $1000 for charity! That means @shade will do a LP of a game of the forum's choosing! Woo! You guys are amazing. Check our progress here and click the incentives tab on the bottom to see our goals so far
I'm not sure I've ever felt this conflicted before. Is there a term that means yay and balls at the same time?
Oh, damn. Before @Jhraggen can match the donations, we're already up to over $1000 for charity! That means @shade will do a LP of a game of the forum's choosing! Woo! You guys are amazing. Check our progress here and click the incentives tab on the bottom to see our goals so far
I'm not sure I've ever felt this conflicted before. Is there a term that means yay and balls at the same time?
its called Badrattitude.
CorriganX on Steam and just about everywhere else.
I've just received a donation from someone who wished to be anonymous, but they've generously donated $294.25 to the charity drive at 11:57 EST. Hopefully it can still be matched, but even if not thats a huge donation. Thanks so much.
This puts us up to $1,444. Whoever gets us over $1500 gets a gift from USAgent, and gets to pick VeeVee's new steam avatar! Holy shit guys, we're almost there.
Also we've unlocked Berylline streaming Among the Sleep, and a group stream from all 4 of us playing something together.
CorriganX on
CorriganX on Steam and just about everywhere else.
I've just received a donation from someone who wished to be anonymous, but they've generously donated $294.25 to the charity drive at 11:57 EST. Hopefully it can still be matched, but even if not thats a huge donation. Thanks so much.
This puts us up to $1,444. Whoever gets us over $1500 gets a gift from USAgent, and gets to pick VeeVee's new steam avatar! Holy shit guys, we're almost there.
Also we've unlocked Berylline streaming Among the Sleep, and a group stream from all 4 of us playing something together.
If you play League of Legends (not a steam game ) I can be the fifth. I have been trying to get back into playing again.
And @Minor Incident was the one to put us over the $1500 mark! He gets to pick a new steam avatar for @VeeVee and @Cardboard Delusions has prizes for him. This si amazing guys, you're all amazing.
btw Minor, now you have to play bad rats. just fyi.
CorriganX on Steam and just about everywhere else.
+13
Options
minor incidentexpert in a dying fieldnjRegistered Userregular
@malakaius has donated $10 as seen Here and wants an extra hour tacked onto myself and Bery for the marathon stream. Fuck we're getting close to me actually having to stream for like 24 hours. Thats a lot of time.
CorriganX on Steam and just about everywhere else.
+13
Options
KrummithDJ LogicDeath can't take me until I finish my backlogRegistered Userregular
Posts
I was just looking for the TF2 thread to talk about this. But, it seems we don't have a TF2 thread anymore.
Anyway, It's AMAZING and I would watch more, plz.
I read the link. That's pretty much it the amount a effort I'm willing to invest in this. Also, the argument that someone could do worse so why fix the small issue is a fallacy of relative privation. And yes someone else besides the devs could gain access to a dev account, or one of the devs could take the money and run, or someone could find an entirely new exploit to allow them dev access. It takes less than five minutes to write up a matching phishnet vs trying to institute a change in the actual programming of a game. In my opinion "I know this thing could hurt people, but we trust people, after all only 3,000 people have access to it." is not a very good answer, especially when they could have simply said "We're changing the entire thing anyway." At best this was poor communication. At worst the switch too bbcode was actually hasty reaction to the exposure of the exploit to cover Valves ass. I tend to believe the worst of people.
EDIT: Yes I realize the argument is getting old so I'll drop it.
Steam ID: Good Life
@Krummith and @Berylline both get another hour then. They were currently tied.
CorriganX on Steam and just about everywhere else.
I'm going to have to go craft some badges aren't I ... and here I was thinking I could just ignore that trap card feature ... Dammit
Playstation: Dipuc4Life
Warframe_Switch IGN: ONVEBAL
I hope that counts. Where are people going to get the other form when your done? This is all I got?
corrigan, you get more time.
@Iolo
@Jragghen
@CorriganX
Playstation: Dipuc4Life
Warframe_Switch IGN: ONVEBAL
only so it has the date.
Sniped Gifted me Strike Vector while I had my back turned.... Guess we are gonna have ourselves a classic gift war this summer eh?
CorriganX on Steam and just about everywhere else.
CorriganX on Steam and just about everywhere else.
Hi guys! I actually did two transactions. I didn't see that @jragghen was matching until after my first transaction, bwhaha. I hope he's still doing it.
I hope this is good enough.
This is the important one.
CorriganX on Steam and just about everywhere else.
And now Amazon Prime allows streaming music which is a good replacement of Spotify for me because I hate listening to the commercials. Pretty awesome for work.
I've just been waiting for the Dale to begin retaliating... heheheh....
3DS: 0473-8507-2652
Switch: SW-5185-4991-5118
PSN: AbEntropy
Steam ID: Good Life
I'm not sure I've ever felt this conflicted before. Is there a term that means yay and balls at the same time?
its called Badrattitude.
CorriganX on Steam and just about everywhere else.
Let me be clear. This is NOT for the children. Purely for a chance to torture a random person;)
Proof:
1) corr
2) smoke
3) bery
4) Krumm
Geth roll 1d4 for Torture
edit: Messed up spoiler tag
That is just goddamn wonderful. And it was apparently co-written by Ashly Burch (of HAWP fame), who voices Pauline.
"Thees eez a bucket."
"DEAR GOD."
"There's more."
"NOOOOO."
This puts us up to $1,444. Whoever gets us over $1500 gets a gift from USAgent, and gets to pick VeeVee's new steam avatar! Holy shit guys, we're almost there.
Also we've unlocked Berylline streaming Among the Sleep, and a group stream from all 4 of us playing something together.
CorriganX on Steam and just about everywhere else.
I will join in the fun after work. In the meantime, Make me proud.
@CorriganX
If you play League of Legends (not a steam game ) I can be the fifth. I have been trying to get back into playing again.
btw Minor, now you have to play bad rats. just fyi.
CorriganX on Steam and just about everywhere else.
Wait. What? Fuck you guys, I'm taking my money back. =[ =[ =[
I'm glad that you're excited for this MI. It makes it a lot easier on everyone involved.
CorriganX on Steam and just about everywhere else.
FTFY!
CorriganX on Steam and just about everywhere else.
Some new goals might need to be devised.
Feel free to switch out with the Hail Hydra! button if the Awesome button needs a rest. It works just as well, but is marginally more sinister.