Warning: The following is off-topic. I apologise and I won't do it again.

All software beyond a certain complexity contain non-trivial bugs. Hell, hardware has bugs (check out the errata published by Intel or AMD for example). That includes updates. If your idea of being secure is relying on always having the next update, then you will never be secure because there will always be a next update (or something that needs fixing), leaving you "vulnerable" in the meantime. If you want actual security in the here and now, you need to change how you use your computer (IoT devices are irrelevant for this discussion):

1) Most "hacks" are done through social engineering. Never reveal information to anyone who isn't authorised to have it and do not trust web sites or software if you don't know what they do. Use strong passwords for everything and change them on a regular schedule. Physically secure computers and equipment. If you take a computer to a public location, don't leave it unattended, lock it down, disable and plug your USB ports.

2) Don't download or execute random files from random places. Always know exactly what you are getting and where it is coming from.

3) Use proper permissions. I have seen many people who simply use an account with admin/root privileges for everything that they do. This is incredibly naive and a huge security risk. You should almost always use restricted user accounts that only have access to the specific files, directories and network locations that you need. Root permissions should only be used briefly when doing administrative tasks and never for general purpose use (that includes running games).

4) Disable all background services/daemons that you don't use. Remove all software that you don't use.

5) Use hypervisors, virtual machines, sandbox programs or programs with integrated sandboxing. GOG Galaxy is based on CEF which, as far as I am aware, does sandboxing by default.

6) Firewall everything and only allow specific applications access to the network if you have confidence in what it is doing and where it is connecting. Only open ports or setup port triggering for the specific ports that are required. It's also a good idea to have both local software firewalls and a perimeter firewall in place, especially when dealing with laptops and other computers that may connect to multiple networks. My own LAN router and firewall is an OpenBSD, Mini ITX form factor PC - cheap, tractable and secure.

7) Use the hosts file to null route everything and only whitelist trusted domains. If you operate your own DNS server, you can do the same there.

8) Encrypt sensitive data or better yet, use whole drive disk encryption. On the slim chance that an unauthorised person does get through and has access to your data, they won't be able to use it for anything.

9) If you are using Windows, make sure you have an active virus/malware scanner in place or at the very least, perform manual scans on every single file that enters the system. Even if you aren't using Windows, it's a good idea to at least perform manual scans so that you don't propagate infected files.

10) ALWAYS keep backups, keep them up to date and rotate backups off-site regularly. Right now, any of my own computers could get wiped out and it would take me twenty minutes or less to have it fully restored and operational again as though nothing had happened.

There is simply no substitute for being aware and in control. Software updates can sometimes fix things and/or sometimes break things and should not be your first line of defence. Newer is not always better.

I know companies like Microsoft try to misrepresent the importance of receiving most forced, bleeding edge, barely tested, duct-tape updates, but that has more to do with marketing Windows 10, getting free beta testing at users' expense and taking control of users' systems and data. Just two weeks ago they had to come clean and warn users off from installing a major Windows 10 update because it was causing significant problems, as have every major Windows 10 update (it's almost as if they terminated their entire QA team! ;) ) In fact, I'm going to add a couple more suggestions.

11) Don't use Windows 10. Windows 10 meets the criteria for being malware and any computer running it is already compromised by design. It includes a whole host of issues ranging from buggy, unavoidable updates and forced system restarts to bloatware, adware, spyware, excessive background services and it restricts user control over it all. If you are using Windows 7 or 8, be careful of which updates you install as Microsoft has backported some of the Windows 10 spyware to those operating systems. If you are using anything else, follow good security practices and remain vigilant.

12) Don't use Microsoft Internet Explorer or Edge. I use Pale Moon as my primary browser (on my Debian and Gentoo boxen) and Vivaldi as a secondary (on my Windows/gaming box). Disable scripting and cookies universally, then only whitelist what is needed for the (hopefully trustworthy) sites that you visit.

In the enterprise, we deploy LTS releases and roll out patches on our own time, not when developers push them out. That is both because we cannot risk breaking anything by being hasty and because we tend to follow good security practices which obviates threats more effectively than most software updates do. None of the thousands of computer or PBX systems that have been under my care over the past 35 years has ever been compromised and it's not because of auto-updates.

Same here.

Off-line installers must remain, regularly patched, and no client.

Anything else, then no further purchases here.

This. The line must be drawn here. This far, no further.

Nobody is arguing with you that good computer practices such as using a firewall, running in a standard account instead of an admin account, having virus/malware protection, etc. etc. and following certain precautions will make you more secure. This is common sense honestly, you are 100% correct.

This will not always, however, generally speaking protect you from software vulnerabilities... especially when that software interacts with other people and systems online.

Let's go with an example that doesn't directly impact you. Let's say someone was to discover a major bug that allowed said person to access someones account information by using Galaxy, if you allow updates to be disabled and still connect online, then someone who has bad intentions could stay on the old version and connect to Galaxy's servers and exploit that vulnerability.

In that case GOG may be unable to stop that from occurring unless they could block that exploit or user at the server level because the user would never be forced to update when connecting online to get the patch that fixes that vulnerability.

They would have to specifically make sure they account for something like that occurring by making sure the updater still checks for updates and that they could force the update on their end even if the user disables it. Certainly do able sure, but generally speaking it just makes more sense to keep everyone on the same version. At that point it gets more complicated and a principle followed in software development is KISS.

If you have software that is contained locally and doesn't need to interact with the internet (at-least not in a significant way) then yes you can go without updating that software and still be fine most likely unless someone physically accesses your PC.

Software vulnerabilities will exist and be acceptable to attack as long as they remain unpatched by the developer once discovered. And to fix such things one usually needs access to the source code.

As I said it not all just about security either. With complicated software like Galaxy or Steam, if you have users that can get online on outdated version, this can cause a lot of unforeseeable issues.

Such as if a new feature is introduced that involves the community being able to interact with each other and your outdated client doesn't know how to deal with that then the client may crash or even have minor/major bugs that users on the newer client will not get. This could potentially increase bug reports and even waste support time on issues already fixed or issues being caused by people on outdated software.

It's not in GOG's best interest to allow client updates to be disabled, if that bothers you then I'm sorry...but I would hope they would know better and you are always free to not use Galaxy.

And GOG does this most likely internally for their own business... in this case though you are the end user and the consumer. It's an entire different ball game, as they don't generally follow basic computer security and maintenance. The company I was at did basically the same thing. We only put updates out quickly when major security or stability issues were found, but generally updates were fully tested and rolled out in a slow manor.

Again you are 100% correct that software updates are not the only thing that will keep you safe... I would argue they are a small part of the overall aspect of computer security. This does not mean they don't play an important role in that however.

Totally agree with that.

I would personally be very annoyed if I would have to stop buying games here :/
If the system of DRM-free up-to-date offline installers disappear, like a lot of others, I simply won't have any interest in buying a game here anymore. In short, if I would have wanted steam, I would already be using it.
But I'm waiting to see what will be done, and try to be optimistic :) (and I'm taking the blue's answer as a good sign of a good will :))
And I think GOG should continue the way of the "quality" gaming, including "old & DRM-free gaming", and shouldn't try to be a frontal concurrent to Steam (I think).
I know the good old "good old games" is already gone in good parts. But for me, there are still some nice pieces remaining, and I hope they'll last for long :)
But yeah, they simply try to go on Steam's market... aaaaand like I said for me it's a bad idea, even if of course, I understand perfectly that they want to attract new customers.
I understand the recent changes, even if I don't really like it. But for now, I still like the store. I simply hope they won't go "too far" from what I'm expecting from them, which is simply what led me to purchase my games here, especially at the beginning. And I think that there's a way for GOG to continue their policy of expanding with Galaxy -even if I don't totally agree with it-, and giving me (and a lot of us) what we want. That would need work, sure, but I'm sure it's possible, and I prefer to be optimistic and to see what they'll do :)

which implies to find/think steam website and client being user-friendly... which is not quite true afaic, to begin with :)

Exactly, I totally agree.

If you read through the "What did just update thread" you'd see that you are wrong. A Blue has stated more than once in that thread that they don't use a script, though he wishes they did. You've repeatedly made this (the bold(ed?) part of your text) statement and it's just not true. That's why people keep talking about how it will be difficult for gog to maintain TWO installers.

And like I told you before they haven't been doing a good job of keeping up with one.

I'm just saying that GOG's website isn't well-suited to getting Steam users hooked up with Galaxy.

In absolute terms, I agree with you.

Thanks for the reply.

I'd like to note a few things though.

Obviously that was not the best way to listen to feedback. Instead of making blind decisions, you could have discussed your plans with the community first.

GOG has created its community based on some principles. I'm sure they knew from the beginning what kind of users they attracted. Of course some flexibility is needed to stay competent and that's acceptable. Some things may not be flexible though. I believe the DRM-free principle is the main reason many of us have joined GOG (at least this applies to me). This principle should never be dropped and is closely connected to the offline installers.

Also Galaxy is so much promoted everywhere on GOG, that a user should be blind to miss it. You may be sure that all of us, who don't use it, have chosen to do so.

Removing features from the web page and making them available only through Galaxy does not fit with the client's optional scheme. For example, obviously GOG's back-end API supports user notifications, but GOG chose to remove them from the web page. Don't treat us as second (or even worse) class customers.

The phrase "This is our reasoning for including the option to install GOG Galaxy during the game installation, and we do stand by it." is still making me worry about what GOG will become in the future. Time will show.

Anyway, no matter what GOG will choose I'm going to stand my ground keeping my principles, even if that means I should have to leave from here.

I always used GOG because it was DRM free. I don't have, and never will have a Steam account. I never buy from ther Humble store because almost all the games require Steam, GOG was the one place I could go and buy games, make backups and deal in an honest and direct manner. That is no longer the case.

When I tried to use Galaxy and install it, it failed four times to launch despite being installed and reinstalled four times, so now I guess I am screwed at downloading the rest of my library and no longer have any reason to purchase games from GOG.

Now that GOG has decided to go complete DRM BS on customers, tell me again why, or give me just one good reason why, I shouldn't just rip off The Witcher III DRM-free pre-galaxy copy from the internet?

And GOG can no longer claim because they are a good company that supports DRM-free practices or because the company and its people deserve to be treated fairly after this bait-and-switch shit.

Bundling installers with GOG Galaxy is stupid. But why?

1. If you bundle the whole installer, then you would have a ton of redundant GOG Galaxy installers, all of them out of date in a matter of months. And that, assuming you even want the game installers to be bundled with GOG Galaxy. This would rather be insane considering only 10 games would take up to 1.5GB for the bundled GOG Galaxy.

2. Bundling merely a downloader that is a few hundreds of KB in size makes sense compared to #1 because it wouldn't take such a toll on storage. But wait... if the client is optional, then why the hell should I get the downloader even if I don't want GOG Galaxy in the first place? It feels stupid to have an optional client advertised when it has its downloader bundled into your game installers whether you want it or not. It's a good thing we will still have the "classic" installers, but maintaining two installer versions is NOT! what I'd like GOG to waste their time on creating/testing/supporting, but rather doing something useful, like fixing bugs in GOG Galaxy and make a GNU/Linux compatible client.

3. Creating/testing/maintaining separate installers having only the GOG Galaxy downloader is dumb, considering the small downloader would rarely need to be updated because it only makes sense to get the latest GOG Galaxy data for your client. And you would use the downloader when you're online anyway - obviously. Why bloat so many game installers for a downloader that could be advertised as a banner on the last slide of your game's installer? Just place a banner linking to the online GOG Galaxy downloader and whoever wants it can get it. Not pre-loaded, and not "optionally" pre-checked. That's TWO TIMES NOT OPTIONAL.

So you want GOG Galaxy out to more people? I'd love the idea. It's out of beta. Maybe it's time to expand to GNU/Linux, considering how patiently we've awaited for it. But you could also fix some nasty issues in the updater.

How would I like to see GOG Galaxy?

A. Actually optional. Don't bundle it in any game installer. The whole (selling) point of GOG is the fact that you're free to play your games without DRM crap, without bloatware. As I concluded in #3 above, bundling the downloader and pre-checking a check-box makes GOG's selling point TWO TIMES WRONG. Always keep in mind what you represent here, because I for one believed you so far. Now I just wanted to tell you to go f* yourselves with this kind of stupid crap. But it's a good thing you listened, at least partially.

B. Create a GOG Galaxy downloader that performs the following:
B.1 Check the internet connectivity and inform you can't install GOG Galaxy if there's no connection;
B.2 Check the size of the GOG Galaxy client installer (which should be a copy of the offline installer of GOG Galaxy, which could be saved for later use) and inform the user about the size of the download and ask to proceed (it's best if you know how much you have to download when you're on a mobile data connection - for cost control);
B.3 Download the offline installer in the Downloads directory by default, but offer a browse button to allow the user to select the path to save this file to;

GOG Galaxy should always care about the data being transferred, because using it on a laptop you want full control over your network traffic.

C. The client needs some important updating features:
C.1 Offer a setting to control the checks for updates on the GOG Galaxy client:
- Don't check for GOG Galaxy updates on start-up
- Check for GOG Galaxy updates on start-up and notify on new version but don't download+install it (default)
- Check for GOG Galaxy updates on start-up and automatically install the new version
C.2 Whether you check for updates manually or automatically, always inform the user of the download size before downloading the offline installer;

D. The user should be able to easily control the update policy for their games, using the same schema presented on C.1 (schema, not setting!):
D.1 Offer a global setting that becomes the default update policy for all the games installed after applying this setting;
D.2 Offer an "Enforce update policy to all installed games" button so you can easily change the update policy to all your games, when you must disable auto-updates on a traffic-limited connection;


I'm aware I went off-topic with my A/B/C/D, although I consider GOG's attempt to bundle GOG Galaxy in game installers not only absurd, but against their promise of it being entirely optional. And by being optional, it's crucial having the options to update/upgrade IF you want/can under whatever networking/internet conditions you're at the time.

GOG, I know you have the right to don't give a fart about our opinions. Also, I hope you are aware of the fact that "Starting this Friday" is NOT proper notice. I'm on vacation for one week, so I can't download my collection if whatever happens. When it's out of your control, like some publisher taking off their games from the store for whatever reason, I still expect a decent advance notice. But in this case you did a lot of wrong things, and it sucks terribly.

If it weren't for Destro's reply I would've assume GOG is a lost cause, and DRM-free is just some slogan you would rather get rid of at some point. By bundling (and maintaining packages with) GOG Galaxy you will actually become worse than Steam, Origin, Uplay and similar because at least they are honest about shoving their clients on their users' PCs. Bundling even the smallest thing except for banners and links in the installer, is not what the GOG community signed up for in the first place, and you'd better never forget that. The day you will waste your time and our time with this kind of crap you will be no better than Steam. And if Steam will be better, then you would become irrelevant by your own doing.

Please, don't go down that path. Most of us are here because you're on a different one, and because you promised you'd keep away from such behavior. You've come an inch close to destroying a lot of faith that many people invested in you.

Personally I think someone in the decision progress, who was overruled by the majority of the team or boss wanted to have a "told you so" moment. "I told you, our customers won't like it, just try it, you'll see"

I still don't understand why gog struggles to cater to its customers.

I begrudgingly use Steam. The prices are cheap enough, and if I want to play new AAA titles I can't get them anywhere else.

I loathe Origin and UPlay and only have them for the one or two games that I don't want to live without

I don't have much use of gog galaxy.
It's still inferior to steam, poorly optimised and can barely hold its ground against Origin and Uplay.
Okay, that was probably a bit too harsh. It boasts big advantages over those latter two. Uplay is utterly broken and Origin just wants to shove more superexpensive games down your throat.

So thank you gog and gog galaxy that you are marginally better than Origin and Uplay. That's something noteworthy.

Yet, I mostly got the titles I want in my library, downloaded most of them to my hard disk for times when I don't have access to the internet. And just occasionally pop by to grab the GOG-Connect Steam-Galaxy transfer bonus games.

Occasionally some indie titles or some obscure old game turns out to be interesting enough to buy, but I don't see many reasons why I should be a regular customer here anymore.

The "niche" experience has expired years ago, my libraries are brimming with games I will probably never play and I'm saturated with semi-reliable, half way decent clients, which are upsetting and barely tolerable but essential for my game playing experience.

The closer the "gog experience" gets to Uplay, Origin and Steam, the less I need gog for gaming. Because those other clients are simply bullying the market with their unquestionable dominance.

I'm not going to be impressed by having a convoluted download sections or a bloated installer with useless bandwith and hard disk space wasted.
Heck even needing to click through all parts of the installer instead of downloading them all at once feels like a chore.

Niche, hipster or trendy? What's gog going to be, I supposed it's tries to do the Apple iPod/iPhone trick and become mainstream overnight but it's not intuitive and slick for that yet.
It's not that I'm angry or emotional, I'm just losing interest. I just want a platform for games that is worth my time (and my money)

https://youtu.be/0d2LAs-WL_4?t=59s

If GOG seriously & honestly wants to regain my trust they need to stop being so sneaky about things like this. The initial announcement made 4 days ago wasn't publically announced as a headline link posted on the frontpage, it was hidden within the regular forum. The list of the initial 102 games in the announcement thread isn't even directly hosted on GOG's website, it's hosted on Google Docs.

If GOG seriously & honestly wants to regain my trust they need to make a public announcement as a headline link posted on the frontpage that Galaxy will not be included in any of the offline installers offered by GOG. Anything short of that too easily allows GOG to quietly discontiue offering Galaxy free offline installers once they think this current uproar & furor has died down.

Exactly... as I said above...

Obviously I am in total agreement with all of the above. In fact I even go as far to say that they need to make a public headline news announcement that they will no longer be including Galaxy in any offline installers for me to spend money with GOG again. I don't want GOG to have an easy out from offering Galaxy free offline installers if the actually expect me to spend my money with them.

You stutterin' prick you. lol I love that movie.