How I got a game on Steam without anyone from Valve ever looking at it
medium.com
medium.com
The center of what this kid pulled off to get his game on the front page with no Valve oversight basically amounted to fiddling around with an HTML form data and feeding the back end illegal state information.
The fact that the back end's business logic layer didn't verify and authorize the request is hugely troubling from a big service like steam. What other dragons are lurking in there to exploit? Could I take ownership of someone else's game on the store? Get myself some free games by generating reviewer steam keys? All sorts of interesting activity is possible.
This feels to me like saying "I can just walk into a big box store, take something off the shelf and walk out".
Yes, you can. And people do. And yet, outside of extreme circumstances there isn't much these stores do to stop you. Loss prevention is a leaky sieve and can cost more than the loss did.
Heck just steal the steam key from a boxed set in a store. The key itself doesn't have protection. Take a picture of it. Whatever.
Stealing isn't hard, but still we don't do too much of it...
:)
Data security is where our intuition formed from real-world experience falls down.
Physical theft in a store is bounded by many factors, not the least of which is someone actually has to carry out the goods without being intercepted. Stores deploy additional security mechanisms to alert on high-value merchandise that is small enough to easily conceal. So stores' losses are bounded by the impracticality of "scaling up" the theft attack.
But digital systems are absurdly brittle. Most systems lack defense in depth and computers are just as good at scaling up the attacker's transactions as the legitimate ones. So once the attacker invalidates even the smallest-seeming assumption made by the developers it tends to lead to complete compromise of the system.
So when you hear "random web developer made the common mistake of relying on client side validation" it's kinda like finding a leak in your submarine's hull.
Very sad to see the closed-mindedness in this thread where users reject a very valid and apt comparison because it does not meet their preconceived notion of these models.
Ironically the only factor that "knocks down" our intuition is you, when you reject points without considering them. You knocked down my valid point not fairly, but unfairly, waiving it away without consideration.
>"Physical theft in a store is bounded by many factors, not the least of which is someone actually has to carry out the goods without being intercepted. Stores deploy additional security mechanisms to alert on high-value merchandise that is small enough to easily conceal. So stores' losses are bounded by the impracticality of "scaling up" the theft attack."
Very very sad that you cannot see the obvious and basic similarities.
Do you believe it is as simple to steal 1TB of data as it is 1MB? --- So you agree there are obvious "bounds" to digital that mirror real world?
How about content type? Do you think it's easier to steal data replicated on their general purpose CDN than say account data hosted internally at one of their data centers?
Do you believe that online services don't deploy additional security mechanisms on high-value data?
Do you not realize that digital data losses are bounded by the impracticality of stealing large amounts of data, too?
I hope that users reading this thread will read + think more than they reject + talk because it's very depressing seeing this response here.
Practical and common, however, are not the same...
(I'll also point out that in my comment I said: is it the same difficulty to steal 1TB as 1MB? I never said it was impossible, just drawing a distinction).
http://www.nytimes.com/2016/04/12/nyregion/thieves-take-2800...
We can point to outliers that I admitted exist in my original statement all day long.
Even more fun: my example is temporally relevant :)
No cryptographic signing process? No automated software analysis and sandboxing? What the hell was Valve thinking? Watching paint dry is pretty much the best case outcome for something like this. It could well have been Mass Effect 3 on Steam for $5, yet the actual code being ransomware...
(And Steam's front-end designers are not great to begin with. Have you used their UI much?)
Is this a record for number of reposts before an eventual front page one?
https://hn.algolia.com/?query=How%20I%20got%20a%20game%20on%...
Not sure what could cause an older timestamp. Was this somehow flagged and readded or something?
Another way to see this is by the looking at the post ID. The post before this one is 11445139 https://news.ycombinator.com/item?id=11445139 (posted 1 day ago), the post after this one is 11445141 https://news.ycombinator.com/item?id=11445141 (posted 1 day ago), but this post is 11445140 (posted 4 hours ago). By deduction, the original post was submitted 1 day ago sometime in-between the other two.
Basically the system gives credit to the original submission vs the resubmission. It does look like a bug, and I think it is quite confusing, IMO there should be a FAQ somewhere explaining how duplicates work.