Valve Games Were Vulnerable to Software Exploits When Your Character Died

The One Up Security firm, who must be very new because this is their only published research article and their domain name appears to have been registered about 8 months ago, has released information on a vulnerability that Valve patched in their Source engine back in June.

It’s an amusing vulnerability because the exploitation of it occurs when your character dies on a game server, and your character model’s ragdoll is replaced with an exploitative payload that the researcher was able to exploit because certain security flags weren’t set on portions of Steam. This is what you see in action when you watch One Up Security’s video embedded above.

Steam Greenlight Shutdown; Direct Starts June 13th

Valve’s Steam Greenlight program has finally been shut down in favor of Steam Direct (which launches June 13th) after months without clarity about when this changeover would occur and what the cost would be to developers submitting their games into the new Steam Direct program.

There’s this interesting note in the announcement from Valve’s Alden Kroll:

Over the next week, a team here at Valve will be reviewing the list of titles that have not yet been Greenlit and will be selecting the final batch of titles to pass through the Greenlight process. Our goal is to Greenlight as many of the remaining games as we have confidence in.

It’s good that Valve are trying to help anyone who had been in the process, but I feel bad for anyone who had a game in Greenlight, or was considering submitting one, during the past 6 months.

Steam Direct Update from Valve

Back in February Valve announced that they were going to replace Steam Greenlight with Steam Direct. There was some confusion because Valve had not yet decided on a price per game for submissions, or a timeframe for this change to occur. The original announcement only gave a vague date of “Spring 2017.” Well, Summer starts on June 21st, so Valve’s Alden Kroll has an update for us on the transition to Direct.

The fee for a submissions to Direct is going to be $100, which is thankfully far lower than the top end that Valve had been considering of $5000. However, that is still kind of ridiculous when some of their competitors charge $0 for a game to be hosted on their service.

I don’t doubt that hosting a game incurs a cost to Valve but what they are doing is hosting a few web pages, downloads, maintaining the Steam application and APIs, and handling payments. Support is passed off to the developer or publisher of the game as is community management.

For all of this, Valve will still get a cut of sales, although they do not discuss what that cut is, it has been speculated to be about 30%.

I really wish that Valve had decided to get rid of this fee entirely, or had it straight to begin with instead of threatening developers with the possibility of a $5000 hit for each game submission back in February and then remained silent for five months while they sorted things out. Could you imagine being a game developer considering submitting your game to Steam in this time frame?

With the clarity of the $100 fee we can now know that this is really going to be a discount on Valve’s commission from 30% of the first $1000 in sales to 20%. Games that want to be distributed entirely freely on Steam will just lose out on that $100, and small developers will be punished by the hundred for each game they submit.

This will absolutely not keep out people who want to abuse Steam, which was Valve’s stated reason for the charge as they will just factor the $100 into the cost of doing bad business on Steam. Just like anti-piracy schemes that only hurt people who want to play games they have purchased, this fee will only hurt good people who want to release more games on Steam and not necessarily charge an arm and a leg for them.

It’s no surprise that Bungie and Activision’s Destiny 2 is going to be exclusive (on Windows) to the Blizzard Launcher (nèe Battle.net) instead of going onto Steam and letting Valve take their cut.

That’s not an option for most smaller developers who don’t have the name recognition of Bungie and Blizzard to make their own store and go it alone. They’re going to go to itch for free or Steam for the players and take the hit.

We still don’t have a date for when Direct will actually replace Greenlight. 

So many of the features of Valve’s platform are also passed off to their community of players. Players are encouraged to write reviews, moderate them with votes, and go through the “Discovery queue” that shows you games in a fashion roughly equivalent to walking down a candy aisle to get to the checkout at a store.

This update also included information for Steam Curators, Valve’s other favorite free labor taskforce. People who make videos about games are going to be able to embed their videos alongside the game review snippets displayed on game pages. Journalists and critics who include their reviews Valve’s curator abandoned it long ago, as did I. The curation system never directed enough readers to our websites. At least with the video embeds you should get a proper “view” on your video.

All I want out of the curation system is for nazis and other trolls to be blocked from it, which Valve seems loathe to do when they still allow games from MRA assholes onto their platform.

Valve Destroys Steam Gifting

Valve’s Kristian (no surname given) with a Steam blog post titled “Steam Gifting Changes”:

Today we’re announcing changes to gifts on Steam. The gifting process has had a bunch of friction in it for a while, and we want to make it easier for you to share the games you love with friends. Steam Gifting will now be a system of direct exchange from gift buyer to gift receiver, and we will be retiring the Gift to E-mail and Gift to Inventory options.

The post goes on to elaborate about enabling the scheduling of Steam gifts, which is new and should have been in years ago, but also has a few more changes that aren’t good:

Declined Gifts Resolve The Way They Should
In the old system, a declined gift would sneak back into the giver’s inventory and remain on their bill. Now, if a recipient already has the title, or just doesn’t want it, they can click decline and the purchase is refunded directly to the gift giver.

A refund of a declined gift should be an option, but it shouldn’t be the default.

Picture this: Sally buys Fran Civilization V on sale. Fran decides she doesn’t want Civilization V. The only thing that can happen now is that Sally gets her money back.

Two other things that should be options, in addition to a refund for the gift purchaser, are:

  1. Fran gets the refund as Steam credit (or cash, which is probably better), so that Fran can decide what she would rather have. This is what normally happens if Fran gets a gift that she returns from a store.
  2. Fran sends the gift back to Sally. Sally is presented with the options of keeping the gift in her gift inventory to decide what to do with it later, or Sally can keep the gift for herself, or Sally can return it for a refund. This means that Sally doesn’t miss out if she bought Civilization V during a sale and would like to do something else with the gift without losing out on the sale price.

I also wonder how this will work out for developers. If a gift is refunded 5 months or a year from now, how is Valve going to claw those dollars back from the developer’s future profits?

Safe Cross-Country Gifting
No more worrying if a Gift to E-mail or Gift to Inventory is going to work for a friend, gifts sent through the new system will always work on the receiver’s account. When there is a large difference in pricing between countries, gifting won’t be available and you’ll know before purchase.

This is Valve working around a problem they had where people in countries that had lower prices on games could purchase games for people living in countries where game prices were artificially inflated.

For example, games can be very expensive in Australia or Canada so folks in the United States would buy games for their friends overseas. There’s absolutely no good reason for the price of games to be inflated elsewhere, they’re digital goods and aren’t extra difficult to virtually ship. It does make sense in some cases to drop the price when the local economy can’t support purchases, however.

Either way, this is a really shitty move on Valve’s part. They talk a lot about decisions only being made in favor of the people buying games from them. This is not benefiting anyone but Valve and publishers.

Valve’s War on “Fake Games”

Nathan Grayson:

Valve is about to overhaul Steam in order to ensure that good games are visible and lazily developed games created for the purpose of making a quick buck—which Valve apparently calls “fake games”—sink beneath a sea of algorithms.

I’m not sure how this works, Valve have gone from saying that they want to take a more hands-off approach (back in 2014) to this new war on “fake games.”

The problem with this system, of course, is that it risks burying a handful of good games, as well. To combat this issue, Valve is going to introduce a program called Steam Explorers. Explorers will play through queues of games that haven’t been selling super well. If they dig a game, they can flag it. The more games get flagged, the more the algorithmic gods will smile upon them.

Anybody will be able to be an Explorer, much like Steam Curators. They’ll also get their own forum, so they can do things like arrange multiplayer matches in games that nobody else is playing.

The solution to all problems is unpaid labor from their community while they’re raking in profits. If this were EA with Origin, or Ubisoft’s uPlay, or basically anyone besides Valve, there would be a lot more people upset about not being paid to work. Or you would hope that people would be upset about their passion for games being exploited when Valve could just hire people to help curate the service.

Andy Kelly’s Steam Link Review

PC Gamer’s Andy Kelly also posted his review of the Steam Link. In addition to having some success with playing over wi-fi, he’s also got a different perspective on what kind of game play it’s suitable for:

I’ve also noticed the Link having a positive impact on my terrible attention span. When I’m playing at my desk I’m forever alt-tabbing to check Twitter or any number of stupid distractions. And I’ll usually last an hour in a game before quitting and doing something else. But camped out on the sofa, my attention doesn’t wander as much. I pay more attention to what I’m playing, and play it for longer, which is a discipline I thought I’d lost. 

Steam Link Review

The Steam Link is Valve’s tiny computer that links any HDMI display to your gaming computer, running Steam, over a local network connection. I’ve had it for a few months and have been enjoying it despite a few obstacles, some of which Valve can’t work around.

The Link doesn’t take up a lot of space but it manages to fit several ports:

  • 3 USB 2.0
  • 1 Ethernet
  • 1 HDMI

As well as Bluetooth 4.0 and 802.11 AC wifi.

You can connect wired Xbox One and 360 controllers as well as wireless 360 controllers with the Windows adapter. Valve also has their wireless Steam Controller, which is a middle ground for games that don’t support the Microsoft gamepads. If you need a mouse and keyboard they can be used as well.

Once everything is hooked up and the Link is connected over a wired Ethernet network to your gaming computer, you get a one-time code that allows the Link to verify your access to the remote gaming computer.

The computer’s display will be mirrored to the TV over the local network almost as if it were directly connected. Steam’s big picture mode boots up and it reformats their regular desktop interface for a more console style appearance and input from devices attached to the Link is sent back to the host machine over the network.

From big picture mode you can launch any games that Steam supports, though if you’re not using a Steam controller or mouse and keyboard, and the game doesn’t advertise controller support to Steam, you’ll have to pass a warning checkpoint to continue playing the game.

Although there is also an option to minimize big picture and use the desktop directly, I haven’t had much success navigating the desktop with a gamepad.

Performance on the Link is impressive. I had previously tried Steam’s built-in streaming to a micro computer hooked up to my TV and it never worked well. There were bursts of latency and a “slow network” error message would appear in a tiny font in the lower left corner of the screen. I don’t have a lot of time to diagnose networking issues and was surprised that it wasn’t up to snuff. My networking equipment isn’t that old, and while streaming will be difficult for a wireless network it should have been OK on the wired network.

The diagnostic steps I tried, reducing the number of pieces of networking equipment between the desktop gaming computer and the TV, swapping out network switches, none of them worked and I had given up on streaming. I figured the challenge wasn’t the streaming so much as keeping it to a low latency that Steam would need for a game to be playable. That’s why it is less likely to work over a wireless connection where interference and distance could prevent a solid connection.

When the Steam Link was discounted to $35 (down from $50) I purchased it and kept the receipt thinking that it might perform better than the pre-release developer-focused Steam Machine had, and was surprised to find that the Steam Link performed perfectly on my network. It streamed 1080p, 60 FPS video fluidly.

So if the Steam Link performed well, what are those obstacles? There are a few.

When a game doesn’t work right for whatever reason, maybe it locks up when launched, maybe it crashed while you were playing, when this happens the Link can get stuck in limbo and you’ll be forced to walk away to the desktop computer and force the game to quit.

Technical issues with games aren’t something Valve can prevent. Quality control is up to the developer and publisher. When this happens and it feels like something specific to games running on computers that they’re just going to crash in ways that aren’t recoverable from a controller because computer operating systems aren’t built with gamepads in mind.

These problems happen most often for me with non-Steam games. While some work fine if they’re added to Steam in desktop mode first, like Overwatch, others just won’t work well. That makes me want to try Nvidia’s competing Shield TV console that also includes game streaming. It has the benefit of not being affiliated with any particular digital download system, so it might be better at handling games from Origin, for example. The downside to their Shield console is that it is $200 new when the Steam Link is priced at $50 (without a controller) and I’ve seen it on sale as low as $20 during holiday sales.

Overall I am very satisfied with playing Steam games over the Steam Link. It’s a terrific experience to sit down on the couch, turn on a gamepad and have the Link remotely turn on my desktop computer and start playing Fallout 4 without hauling your computer around or using an extremely long HDMI cable. I just wish the Link had better support for games from third party services, or that third parties would stop exclusively releasing their games through other desktop download stores. There’s an opportunity for a third party to develop software that encapsulates gog, Origin, itch, Blizzard, and Uplay games into Steam for more streamlined streaming and game library management.

The Scarlet VAC Ban

How does Valve handle cheating?

When Valve’s anti-cheat system, VAC, detects a user has cheated in a multiplayer game they’re marked for seven years on their Steam profile page and blocked from VAC protected servers.

Patrick Klepek interviewed cheaters who were branded:

“When you have big red letters on your profile announcing everyone you have a ban, the experience is never going to be good,” said Oliveira. “If you don’t suck at a game, they will right away point a finger at you and accuse you of cheating. You get told so many times that ‘Once a cheater, always a cheater.’ I knew I did it, I knew I would never do it again, and I wanted to prove that that was not me. But how do you do that? How will they believe you? Yeah, no. It’s the biggest badge of shame a person can have in an online world.”

Oliveira found himself taunted when playing games, years after his initial offense. He couldn’t shake the stink, and Valve offered no recourse. He was, for at least seven years, a cheater.

Bizarre to me is that everyone interviewed agreed the policy was generally acceptable.

This program lacks nuance. Policies against cheating are good, but without more granularity in enforcement it’s kind of ridiculous. Someone who cheats at Counter-Strike for ten minutes shouldn’t necessarily be punished the same as another person who cheats for a month.

A few years ago I asked at a Valve GDC booth for job-seekers if they ever had room for online community managers. It’s not surprising the Valve employee thought the idea of them hiring an online community manager was ridiculous after reading this article from Patrick. The one-size-fits-all kind of anti-cheat enforcement has the stink of developers making community decisions all over it.

Steam Has Over 3000 Linux Games

Liam Dawe:

Steam has hit another milestone for Linux games. We now have over 3,000 Linux games to fill our time with. The exact count for me right now is 3,008!

An impressive number of games with Linux support. I wonder how many are native ports versus Windows pretendulation.

My search comes up with 3164 for Linux and 13433 total games on Steam.

Goodbye Greenlight, Hello Direct

Valve is replacing Steam Greenlight. Alden Kroll:

The next step in these improvements is to establish a new direct sign-up system for developers to put their games on Steam. This new path, which we’re calling “Steam Direct,” is targeted for Spring 2017 and will replace Steam Greenlight. We will ask new developers to complete a set of digital paperwork, personal or company verification, and tax documents similar to the process of applying for a bank account. Once set up, developers will pay a recoupable application fee for each new title they wish to distribute, which is intended to decrease the noise in the submission pipeline.

While we have invested heavily in our content pipeline and personalized store, we’re still debating the publishing fee for Steam Direct. We talked to several developers and studios about an appropriate fee, and they gave us a range of responses from as low as $100 to as high as $5,000. There are pros and cons at either end of the spectrum, so we’d like to gather more feedback before settling on a number.

Steam Direct sounds like Valve is moving a little bit closer to the free-for-all of itch, which is good but $5000 is a bit much. They should have had the dollar amount straight before going live with this.

Valve are also still making money off of software that encourages rape. That shit needs to go.

How will this work for free games? They wouldn’t recoup a fee unless it can be done after a certain number of downloads.