Civilization VI removes Red Shell ad-tracking software
rockpapershotgun.com
rockpapershotgun.com
When you view a red shell enabled ad, a script on the page (or perhaps the ad server itself, based on HTTP headers) computes a fingerprint of your browser (IP address, browser version, fonts installed, screen size etc.) and stores (ad_id, fingerprint) in a database somewhere.
When you install and run a red shell enabled game, it computes the fingerprint of your machine and sends (game_id, fingerprint) to the server, which stores this in another table.
By joining these tables on the fingerprint, you can get some info on which ads are correlated with which game purchases.
Apart from this, red shell does NOT modify your browser settings, inject code into all pages you visit, add a browser toolbar, constantly run in the background, MITM your TLS or anything else like that. [EDIT: not trying to defend red shell here, just checking whether I need do a full reinstall of my PC to get rid of this thing]
This is the part that made me think you were defending it. My apologies for misunderstanding.
Not sure if you play on Linux at all, but a good way to start is to run Steam in firejail. It isolates that environment from the rest of the OS.
Gamers seem to agree that this company should not get away with this. Wherever "we" have drawn the line, Red Shell has apparently crossed it.
I doubt the form they have on their website where you have to know your id to opt out of the spying would hold up in court.
Opt-out as someone already noted, is available on red shell company site but I would try to block it in hosts instead of going on site where you can be again tracked. In a nearly ideal world, Firaxis would ask their customers if they agree for this e-life "improvement" of more accurate ads and whatnot else. In a perfect one, they wouldn't bother including Red Shell at all.
First, and the biggest, is you have to trust these scum. That they are doing only what they say they are and won't decide to do more in the future. Are they being audited? What are the notification capabilities and contracts when they decide to look more invasively?
Second, you have to trust their programming capability. Who knows what update / reporting capabilities it has, and how well secured it isn't (every time Project Zero looks at stuff like this they find holes. Every. Time.)
Third, the lack of transparency. If this is so awesome for me as a consumer, then these companies should prominently disclose it.
Lack of transparency? Go check out redshell.io right now and see how they open up about everything they do pretty damn clearly.
Multiple devs who use redshell announced its integration in patch notes. What more do you want?
Not expect every user to read all the patch notes go to a third party website and fill out an opt out form, and then pray the third party to honour your request. This is slightly different from expecting a game dev to do so - tracking is not their sole business model after all
Facebook is regulated as a EU data processor too. And look what that's done (very little so far.)
There's a thread on Reddit that collates which games are still using Red Shell and which have removed it: https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell...
I think you can just uninstall the ones that aren't planning to remove it yet.
Also, you can opt-out from RedShell's website. Although it doesn't seem straight forward to me: https://redshell.io/optout
Take my corporate domain for instance: you could identify any machine on my domain since we'd all have a custom typeface installed (used on our company letterhead.) You could further identify our marketing coordinator, because she has a lot of strange typefaces used for signage and promotions. You could probably further identify me as a web developer since I have a lot of WOFF2 packaged fonts installed.
Typeface piracy is otherwise pretty difficult to detect isn't it? Is it part of normal enterprise asset tracking / inventory systems?
See the mechanisms used for this browser test, particularly the link for 'fingerprinting' after running the test: https://panopticlick.eff.org
You'd think it'd be more expensive to have another machine specifically for gaming. But the slowing of CPU advancements means that old systems can be usefully repurposed. I grabbed the husk of an older desktop from a few years ago, its CPU and memory being more than enough for gaming. Threw my GPU over to it (not needed for work or personal desktop usage), and I had a dedicated gaming rig for "free". Now I don't worry about scummy studios releasing malware masquerading as games.
For those more technically inclined, you can do a gaming VM. That used to be my setup prior to having a separate machine. GPU passthrough allows you to give your GPU to the VM. I had it running under Ubuntu, with Windows as the guest. Near identical performance. That was a cool setup, but kept breaking on OS updates so I decided to just use a separate physical machine.
But these are ultimately just defenses and are no excuse for knowingly running malware. Gamers should make it a point not to buy games or other software that plays loose with their privacy. These studios should be ashamed of themselves. But it's impossible to always know ahead of time what horrors lie within your software. So at least I sleep better at night knowing these "games" at least have their own cesspool to writhe around in.
As an aside, complaints might have been even more numerous if the game were actually good, as of now Civ 5 has a peak of 30K users playing daily, while Civ 6 a peak of only 20K.
A question to the gamers on HN: What makes Civ5 in your opinion/in the opinion of many gamers better than Civ6?
Civ 5 was a mess when I originally played it and Civ 4 still plays much more seamless. I honestly didn't mind stacking units and I think it makes perfect sense for a video game -- not to mention it made the AI much simpler and therefore much less stupid when comparing vanilla versions of Civ 4 and 5 (or 6, for that matter)
Still beats the Beyond Earth development experience for me, but that's not really saying much...
The sustained users are ones that have good mods that improve the AI, and other aspects of the game. Civ 6 hasn't released the DLL, so us as modders, are in a holding pattern. Most of the major modders have quit (as have I) until the DLL is released.
As an AI modder, I just can't improve the AI without the DLL.
That's it right there. The Civ5 mod(s) "vox populi" is a must in any game I play. And it changes much of the game. Not possible to do in Civ6.
Also, I don't like the cartoon graphics of Civ6.
Civ6 will eventually be the same, probably once Civ7 is released.
Civ 6, who knows. The longer they wait, they more they have to rely on their game to drive play. And the AI for example, is a trainwreck that needs help
Civ 6 hasn't released the source for the DLL, so none of the AI modders can do anything about it's AI. We have the tools, we're aware of how it works, we're just completely held back until Firaxis releases it.
Base Civ 5 AI is terrible. Modded Civ 5 AI is glorious.
Every single AI modder has quit, waiting for the DLL. I don't even know if we get everyone back the longer they wait. Really disappointing.
* https://forums.civfanatics.com/forums/community-patch-projec...
As a result, it's not unusual for people to vocally prefer an older, already-expanded Firaxis title to its newer, still rough-around-the-edges successor at the successor's initial release. Lots of people strongly preferred Civ 4 over Civ 5 for years, until Firaxis fixed the big complaints they had with the latter.
I expect at some point we'll see expansions to Civ 6 that address the major issues people have with it now, and then Civ 7 will come out and we'll all have to listen to people longing for the good old days of Civ 6 for a year or two.
But also because Civ VI feels like it's much more combat focused.
I'm curious if these are in the DNSLB easy lists or the lists used by PiHole.
If they aren't I'd like to add them to my blacklists on Pfblocker-NG.
__________
1. https://www.gamestop.com/pc/games/sid-meiers-civilization-vi...
Since you buy these PC games through Steam there's no easy way to associate an ad impression with a resulting purchase like there is on mobile. Red Shell creates a device fingerprint for each ad and each play session and compares the two sets to see which ads were followed by purchases.
So on one hand, no ads in game and unlike Superfish or something it's perfectly reasonable info for devs to want. But on the other hand, it's achieved by way of a deep fingerprint which is uniquely identifying, and which could in theory be matched to other device fingerprints elsewhere.
I'm glad to see it gone, but I'd be fine if it came back as something fancy like a client-side hash of the data; the ad correlation is fine with me, the retained fingerprint isn't.
Better targeted ads == less money wasted on ads and more money spent on development == less people annoyed by ads they're not interested in == better games. Shame.
The way Red Shell targets ads involves building and storing full device fingerprints when you play a game. It's a privacy risk totally separate from the targeted advertising question. And yes, individual devs could do that also, but at least I've chosen to deal with those devs, and my data can't be tracked across different games by different companies.
If Red Shell switches to something like a device-side hash of the fingerprint, so that it can recognize returning users but not give out (or lose) the underlying data, I'd feel vastly better about it. Basic targeting analytics don't bother me, and "did this game ad work?" is vastly more justified than most tracking. I just don't want it tied to an externally-stored device fingerprint.
If they had been open about this, it'd be a different argument, but they kept it hidden
You're gonna have to expand more on that point.
"less money wasted on ads and more money spent on development"
There's no guarantee at all that the money not spent on ads (if that does happen) will be spent on development instead of just being pocketed.
"less people annoyed by ads they're not interested in == better games."
This doesn't follow at all.
The first is broad strokes. The second is extremely intrusive.
The best targeted ads, for me, are no ads. I don't like wasting my time on ads, I don't like being manipulated by ads, I like to decide for myself based on my needs instead. I'm done with the "hey, do you need this?" crap shoved down my throat. Its like walking around in Eindhoven getting cocaine offered on every street corner. No, I'm not interested!
Now you could argue, "it isn't targeted enough on this person". I'm a cheapskate and I don't wanna play RNG lotteries.
Also, your logic is very much from an advertising company PoV. For the rest of the world it does not follow. What will likely happen is the exact amount of money (based on budget) will be spend on ads. Targeted ads just lead to more sales, at the expense of privacy. If I have the choice between targeted ads vs general ads I rather have general ads, because I don't want to see ads in the first place since I don't want to get manipulated (and I feel I often succeed on that one).