I think, Im kinda late for party, but whatever. At the begining - thanks so much for @Gamer7281 for tip about dlls, @skeletonbow for IPs and @plagren for highlighting my little gogmix :D

Talking about third party telemetry - I think, GoG has no way to exclude it (ever most (if not all) of unity developers cant do that), as they have no access to source codes. Its all belong to devs. But, from GoG's side - they could, atleast, somehow highlight games, that may harm your privacy. Whatever - if they cant, we (users) can do so, right?

But, what really dissapointed me, is that GoG does same here. On galaxy page ( https://www.gog.com/galaxy ), they say, that they "We deeply respect our users, so we’ve also built GOG Galaxy to respect your privacy. We don’t track your personal data... we don’t even look for it.". Moreover - in p 7, they say "If you want to make sure that we receive no information at all, the client can still function in offline mode.". But, as you said above - ever if you have no client installed at all, games with galaxy features will still try to connect to GoG's servers, which is, as minimum, lie from their side.

I want to be smart person and really dont want to harm anyone, including gog team, without reasons, so - my quesiton is: since this thread is month old stale, did they patch information leak, highlighted by topicstarter, recently? Or it still exist?

I don't know what GOG's "stance" is on telemetry, but Galaxy gathers telemetry itself and reports back to GOG owned domains, as well as a 3rd party domain. It appears to all be related to helping automatically diagnose Galaxy client crashes. Some parts of the GOG website also gathers such data I believe. I seem to recall the new support website using a 3rd party service or something but would have to check.

As for what actual data is transmitted to GOG or 3rd parties, that's unclear as it is encrypted over TLS. I block all traffic outbound by default and only allow connections necessary for a given program to work, so the telemetry stuff is blocked here.

Also, they're using Microsoft Visual Studio 2015 and by default it built telemetry gathering into all executables that were built with the compiler, and that data would feed back directly to Microsoft. Developers were unaware of this but it hit the news last year and many application developers updated their apps to turn off this "feature", and I believe GOG did as well but I'd have to investigate to be sure.


If you use Galaxy, it does connect to the list of domains I mentioned previously, as well as some additional ones I've discovered since then, some of which are new. Individual games may connect to just about anywhere and that may change from one game update to another and it's beyond GOG's knowledge or control for the most part.

The only way to know for cure that a game or program isn't "phoning home" behind the scenes is to have a default deny firewall and actively admin it with a fine toothed comb, which is something most people just are not comfortable nor knowledgable to do unfortunately.

The only safe assumption one can make is to treat the gun as loaded and assume that all games phone home and talk to the remote end possibly just gathering data such as game news or whatnot, but also possibly transmitting usage information or other telemetry, and that in some cases they do it even without the developer's own knowledge thanks to Microsoft (if the developer hasn't become aware of that and purposefully disabled it on their end).

^ This mix: Spyware is optional (for the developer) in Unity.

Well, a quick look into CD PROJEKT RED – Gwent – Privacy Policy gives a good idea, what is actually collected. By far too much, if you ask me. Take a look at "4. WHAT INFORMATION IS COVERED?".

there should be wall of text, but GoG removed my reply, when I've tried to quote few people at once, for some reason. So, I ll just quote unity's privacy policy and note, that all (like 30) of paid singleplayer unity games, I've played on pc, tried to "call home" on boot. And it wasnt developer's site or steam, but one of adresses, belong to unity.

But if you dont? Gamer7281 mentioned, that Is it still a thing? Thats actually reason, why I was intrigued by this thread. Or you can just get rid of galaxy.dll and calm down, and nothing will break? Or you wont get galaxy.dll, if you downloaded game from browser? I didnt buy/update anything for a long time and have no idea, how it works now, since galaxy left beta and many games got its support

Whitelists?
Only problem with firewalling is that you will have fun time, setting it up, if you ll wish to play with your friends over network, but dont want to leak your info to someone else (ya-ya, I know, that its not always possible, coz of ways, some games netcoded. No need to note)

Kind of necro, but anyway.

Bought Grim Dawn on this sale. Downloaded galaxy-free version from site. Game tries to connect somewere on each launch. Galaxy.dll exist, but you cant remove it, coz game will insta-crash with error about missing dlls.

Maybe Im unlucky, since other games, I own on GoG so far (torchlight, nwn and so on - old titles, overall), still feature trully galaxy-free installers on downloads page. But thats it

Yes, its been like it for a while on various games. Victor Vran does a dial home also, there have been others. Need to be careful and block them with firewall. As for the galaxy.dll, again thats been around as long as galaxy. It is there for two purposes, first to handle calls for achievements and things like that, otherwise they might break, but it doesn't actually do anything as it doesn't link anywhere. Much like the steam.dll found in some installs.

Second is to provide a hook for if you might install galaxy later, so galaxy can pick up the install. Thats my understanding anyways.

Afraid that is where we are, its not going to go away and it will just get worse and worse each release as more galaxy features are implemented and classic installers are edged further out the door.

Hm, i remember a while ago seeing the windows firewall coming up for some games. I assumed since it hasn't been bugging me that nothing's been asking for access. Now that i think about it, i might've disabled the asking for all the problems it was causing. Anyone know off hand how to get a list of what is and isn't allowed outgoing connections? Might be handy to see what's been asking for access and been automatically allowed. Might also be helpful to see how to lock it down.

EDIT: FIgured it out myself. Sure enough, many programs are set to allow connections through. Given so many games tend to throw the firewall into a fit when i installed them before and accessed multiplayer menus, i find it strange that games with no multiplayer have entries in the firewall. I find this very concerning, and alot of these are very obscure.

Yes, I always block any app trying to contact. If it breaks somewhere down the line then I might go in a put in a manual exclusion, or I just bin the app. Unfortunately the world has moved to a stage where being offline is almost unthinkable, and this filters down into all development new and old, even going back and adding galaxy items to old games.
Only safe way now is to turn of the net altogether, unplug the cable. Even then its likely amazon or facebook have a drone camera looking through your window monitoring everything you do!
And if you think that's far fetched:
http://www.bbc.com/news/av/science-environment-43775593/uk-spacecraft-watches-moving-vehicles
Its just around the corner.

If you'd like, i have some better examples. I've talked over teamspeak already, only to get advertisements on facebook hours later revolving around the topic on teamspeak (on more than a few occasions). Mind you, I wasn't googling the topic. And that's not even the scariest.

That bothers me, too. It'd be cool if no one would use that data maliciously, but Uncle Sam cannot be trusted.

Below are some fragments from a post I made in a thread about Unity engine telemetry.


Here's a blog from Windward's developers confirming that Unity collects some anonymous statistics about hardware. Windward is made with Unity 4, I think, and it doesn't create those analytics files, but it tried to reach the internet first time I launched it. As I don't play multiplayer, I block all the games in the firewall.

The Unity 5 games will create their config, analytics and save files inside the folder:
C:\Users\*user name*\AppData\LocalLow\*company or dev's name*\*game's name*\

Here can be a bunch of folders and/or files, but what you need to look for is the Unity folder, which keeps the analytics files, so you'll see something like this:
\Unity\*big string of letters and numbers*\Analytics\ArchivedEvents\

Inside the ArchivedEvents folder are lots of other folders which contain 2 small files, e and s. You can safely delete everything in this folder. Those 2 small files can be viewed with a text editor, like Notepad.


I personally make a custom entry in CCleaner for every game that makes this crap. People who don't know about this, will probably have thousands of these files and folders. Or maybe they get deleted after are sent to those servers? Don't know, I won't give it internet access to test it. So it wasn't enough that many Unity games run like crap, now they're filling our drives with telemetry junk.

The problem with Unity games is that you can't really figure out much without having super-pro level of reverse-engineering skills.

It's a closed source proprietary code. Wireshark will only show you encrypted traffic for the parts that are interesting.

I would not be surprised if Unity games end up disclosed to have a way to harvest all metrics stored on a specific machine. Unity loves its data too much for me to be comfortable with, even though I firewall anything trying to knock on the gateway without a damn good reason.

Interestingly enough, a lot of games on GOG require localhost loopback or they crash... and that itself could be used to hook into svchost.exe to get access to network (Windows relies on it to maintain network connection, so unless you have a really fancy firewall that will differentiate between each instance of it running, you're SOL on blocking things).

Mostly, though, I'm concerned at GOG's direction lately. More and more it smells like they are planning to cash in on their userbase metrics. It's a company, that data sure is in demand, but I'd like to have one goddamn source of games that won't fuck me over on the flip-back.