It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Community
General discussionValve/steam gets trolled via security glitch...(25 posts)(25 posts)
(25 posts)
Pages:
1
2
This is my favourite topic
Posted March 30, 2016
Someone found a security problem showing how bad steam can be at times, to the extent that he released a game page on steam without it getting any sort of inspection from Valve/steam, after some months of trying to report the problem.

https://medium.com/@rubiimeow/watch-paint-dry-how-i-got-a-game-on-the-steam-store-without-anyone-from-valve-ever-looking-at-it-2e476858c753#.d96m2o9hc

Posted on Reddit by the guy that did it:

https://www.reddit.com/r/Steam/comments/4cetfj/watch_paint_dry_how_i_got_a_game_on_the_steam/

At least it is fixed now, but shows what a mess it is tbh.
Posted March 30, 2016
Its not security problem, its security hole; and its not "trolled via", its actually more ... physical. =)
Posted March 30, 2016
Just like as bad as other websites can be. Security holes are everywhere and can be expected.
Posted March 30, 2016
avatar
zeroxxx: Just like as bad as other websites can be. Security holes are everywhere and can be expected.
No, security holes are regularly found because devs do stupid things like that. They really shouldn't be expected, they should be criticised for the poor practice they demonstrate (and you attempt to justify).

That valve mistake was beyond rookie, they were trusting tokens in html requests, without any server side validation, to the point that they just believed a request containing a raw userid and started issuing out further tokens.

I don't know how familiar you are with programming, I haven't been doing web programming for a few years (been caught up in the lovely world of thick client stuff), but if one of the web programmers on my team had introduced that bug, I would have sat them down and had a conversation that began "What the fuck?".
Posted March 30, 2016
avatar
wpegg: if one of the web programmers on my team had introduced that bug, I would have sat them down and had a conversation that began "What the fuck?".
Which is what probably happened at Valve.
Posted March 30, 2016
avatar
wpegg: if one of the web programmers on my team had introduced that bug, I would have sat them down and had a conversation that began "What the fuck?".
avatar
sunshinecorp: Which is what probably happened at Valve.
Not the first time either. Anybody remember the Steam Linux wipe-all-user-files bug?
Posted March 30, 2016
avatar
sunshinecorp: Which is what probably happened at Valve.
avatar
Wishbone: Not the first time either. Anybody remember the Steam Linux wipe-all-user-files bug?
LOL! No way! This is actual code?! COMMENTED with # Scary! ???
Posted March 30, 2016
avatar
Wishbone: Not the first time either. Anybody remember the Steam Linux wipe-all-user-files bug?
avatar
sunshinecorp: LOL! No way! This is actual code?! COMMENTED with # Scary! ???
Oh yes. The developer obviously knew exactly what he was doing, and still couldn't be assed to make a simple check for whether the variable was empty or not. I mean, what's the worst that could happen? Well...
Posted March 30, 2016
avatar
sunshinecorp: LOL! No way! This is actual code?! COMMENTED with # Scary! ???
avatar
Wishbone: Oh yes. The developer obviously knew exactly what he was doing, and still couldn't be assed to make a simple check for whether the variable was empty or not. I mean, what's the worst that could happen? Well...
FFS...
Posted March 30, 2016
Steam prints them money, they couldnt give less of a fuck.
Posted March 30, 2016
avatar
Wishbone: Oh yes. The developer obviously knew exactly what he was doing, and still couldn't be assed to make a simple check for whether the variable was empty or not. I mean, what's the worst that could happen? Well...
That's pretty awful programming... I'll admit to occasionally not being bothered to check a variable exists if I know it should, but not if the consequences could be as severe as that if I'm wrong...
Posted March 30, 2016
avatar
sunshinecorp: LOL! No way! This is actual code?! COMMENTED with # Scary! ???
avatar
Wishbone: Oh yes. The developer obviously knew exactly what he was doing, and still couldn't be assed to make a simple check for whether the variable was empty or not.
And not even an added lol... such times we live in.
Posted March 30, 2016
avatar
Wishbone: Oh yes. The developer obviously knew exactly what he was doing, and still couldn't be assed to make a simple check for whether the variable was empty or not.
avatar
Titanium: And not even an added lol... such times we live in.
Surely that would be a ROFL for that one?
Posted March 30, 2016
avatar
Titanium: And not even an added lol... such times we live in.
avatar
wpegg: Surely that would be a ROFL for that one?
Too dangerous on a QWERTY.
Posted March 30, 2016
avatar
wpegg: Surely that would be a ROFL for that one?
avatar
Titanium: Too dangerous on a QWERTY.
...

Have you looked at a QWERTY keyboard?
Pages:
1
2
This is my favourite topic
Community
General discussionValve/steam gets trolled via security glitch...(25 posts)(25 posts)
(25 posts)