1st question: Why does this DRM-free and single-player only game ask for outbound connections? And next, if the first was allowed, for INBOUND connections as well?

2nd question: What does it want? What downside is there to blacklisting The Witcher 3 in my firewall?


So far I stick to temporary rules to deny for the current process id - but I very much tend to make them permanent.

The game has been installed via Galaxy Client - are there nested process chains or something? Otherwise I'd say that a launcher *might* want to check for updates - but the offline-game itself? Weird... please explain. Thanks :-)

The client might be updating time played as well as achievments, I have no idea really as i have not looked into this yet but those could be the reason.

No DRM, it's the Galaxy integration for updates, achievements and stuff. If you remove the galaxy DLL (some other thread explained how), there is no connection anymore.
Why inbound exactly IDK, friend chat and online status could be done via polling, but that's protocol details. If you don't care for the Galaxy features (including achievements), just block those connections - or remove the galaxy DLL.

Okay, understood. Thanks for the hint - are there official sources to this?

Nonetheless I disagree regarding the chosen path of development. If it's Galaxy Client related, it should tunnel through local communication, using Galaxy Client as proxy. That way Galaxy Client would pop up and thus the reason and use would be clear. It's what the GC is there for after all and if I allow GC to communicate with GoG, I can do this once and don't have to repeat it for every game using that service. The latter on the other hand should be an option that one sets in the GC for the individual game.

The game itself does not need to check for updates. There are only a few possible constellations: Either I'm using Galaxy Client and get my updates via this, or I'm not using it, which basically means that I don't want any service to be run automatically for me and that I download, install and update my games manually - so a "fetch me updates" connection is misplaced in any case.

One word: achievements. The game has achievements, and achievements means cloud communications. As for incoming, there can be no communication only one way. Even your web browser need incoming calls.

I'm pretty sure that ain't true. The answer to an outbound request might count as inbound traffic, but not as inbound request. Inbound requests occur when some remote system tries to access my local system, which should occur almost never. For that very reason most applications (like the browser we're currently using) only asks for outbound connections.

Plus I'd like to kindly ask you to try and understand what I wrote in that part you quoted. Here's the summary: The game itself does not need any internet connection for achievements if it can communicate with GC on 127.0.0.1 (aka localhost) while GC got internet access. Please look up the word "proxy" if you're not familiar with that concept. Thank you :-)

The part you quoted states my opinion on the decision they obviously made during development. Being a developer myself I just hoped someone there might read it and carry the idea of tunneling through GC into their ranks - that way they'd avoid some issues (and complaints) in the future.

*Sigh* Are you always this condescending?

I had the impression that you were opposing without having fully read the part regarding GC as gateway/proxy. This impression in combination with me not typing my native language might have created what you call condescending.

I didn't mean to offend. In fact I tried to be extra kind and thoughtful. Maybe just the result of poorly chosen words without intonation. In any case: My apologies.