Hacker News Reader

Comment by Forbo | Hacker News Reader

> A security researcher alerted Valve about the bug in June of 2019.

Holy shit, Valve. Really? Nearly two years later and this is still exploitable.

Edit, further on:

> This is not the first time Valve has been slow to respond and fix reported vulnerabilities. In 2018, Motherboard reported that a security researcher found a bug in Steam that allowed hackers to take over victims' computers—a bug that had been present for 10 years. In 2019, Valve banned a security researcher from its bug bounty program, prompting him to publish the exploit publicly.

I'm pretty appalled by this.

View on HN

the dedicated server situation was (is?) pretty dire back when i hosted a few SRCDS instances. here's a small taste: https://wiki.alliedmods.net/SRCDS_Hardening#Current_Exploits

not to mention that the commands themselves obey absolutely zero *NIX conventions at all. Left a bad taste in my mouth ever since

If you want to see something really appalling, looking into the "coaching bug" that was recently exposed. It was known for years by Valve and it wasn't patched. It wasn't until the exploit was made public that dozens of professional CS coaches were banned.

That wasn't a security or privacy issue and nobody forced those coaches who abused it

I don't know any context on the situation, but if there was a mechanic that's known and been around for years, bug or not, wouldn't anyone using it have an edge over anyone not using it? Therefore people need to use it to stay competitive?

No because in sports you have rules that you must follow or there are consequences. This bug is considered an exploit and therefore it is against the rules to use.

Yes but this is Esports. Bugs are famously used competitively. The entire super smash brothers melee tournament circuit uses bugs to wave run; if you don't use the bug you won't be competitive. People practice using this bug and others like skipping animations. Most competitive FPS games had something similar, like being able to reload cancel or bunny hop. Things that are legitimately bugs, that you won't learn until you hear about them.

Like I said - "This bug is considered an exploit and therefore it is against the rules to use."

Exploits aren't allowed. If a bug isn't considered an exploit and isn't explicitly against the rules they are fine to use them.

I wonder who sets these rules? Like when wave dashing came to the competitive super smash bros scene, who decided that this would be allowed or banned? It seems to me it would depend how widespread it is. Maybe the tournament runners already knew how to wave dash so it was in their interest to keep this technique they already mastered legal, versus if they didn't know how to do it yet they might have banned it, like how they've been so careful to empirically place each character into different tiers for the sake of balance.

I can see how leaning into exploits for competitive can ruin the noncompetitive community, and later take out the competitive one that feeds off this community. I used to play chivalry: medieval warefare, which was a lot more fun of a game before the competitive community figured out the frame perfect meta and ruined the game for everyone else who doesn't have hours and hours of free time to throw at practicing the metagame alone, which is most gamers I imagine.

The tournament organizer chooses the rules.

Read about the bug: https://en.wikipedia.org/wiki/Counter-Strike_coaching_bug_sc...

Yes, bugs are used competitively but communities will often come to consensus on which bugs are allowed and which aren't.

I think for the most part when you see a bug it's easy to tell if it'll be acceptable for competitive use. Bugs that allow enable more counterplay or raise skill ceilings are usually fine. Bugs that give you an unfair advantage or go against the spirit of the game are usually not.

FWIW I think bugs in the latter bucket should be fixed asap. While you can forbid exploits in a tournament, these kinds of bugs can ruin ladder play.

Counter-Strike's culture is not like that.

Bunny hopping is an exploit that characterizes counter strike from other FPSs actually. It's a glitch that takes practice to use effectively and was never an intended feature of the game. People use scripts and mods to use this glitch more effectively.

Yeah and if you do it on most servers you will get permanently banned.

In tournament play you are allowed to bunnyhop without scripts. It's harder and less usefull in csgo but still done. Most servers aren't gonna ban you for bunnyhopping unless you are doing nothing but bunnyhopping around the map the entire game. You won't get a vac ban.

Bunneyhopping is nerfed. You cannot do it for more than a few seconds without scripting.

You can do it for quite a while with mousewheel = jump (which isn't considered scripting). Doing it effectively / keeping the speed does require practice. Was way easier in 1.6 and source tho.

Are you also under the impression that most Olympic medalists aren't doping?

Following the rules doesn't get you very far when cheaters don't get punished.

Well in this case the cheaters did get punished. Quite harshly. So I'm not sure what your point is, if you even had one?

That the mere existence of rules is not enough. They must also be enforced.

Basically, I think you're letting Valve off the hook. Sure, the competitors shouldn't cheat, but Valve should also make sure they create an environment in which cheating isn't incentivised. In the world of software, a few years is a long time. Leaving a known bug that gives a massive competitive advantage unfixed for that long borders on negligence, especially when the fix is relatively trivial.

They are enforced and, again, this exploit was an example of that.

Yes Valve could do a better job at supporting esports. But there will always be in-game exploits as well as out of game methods to cheat so ultimately it is down to the individual participants to cheat or not.

Also these tournaments are run by third parties on third party servers. Valve isn't even involved except for a small role in the once a year majors (that haven't happened for like two years now). So saying this isn't enforced just because Valve didn't fix a bug makes no sense because Valve isn't the company that enforces these things anyways.

> It was known for years by Valve and it wasn't patched.

This is not true. Once the exploit became known, Valve released an update same day.

It seems genuinely unbelievable it was being used for as long as it was without someone finding out

If it was known it could have just been low priority since it's a weird bug that doesn't even apply to the built in competitive mode.

According to pro players, this isn't true - Pita claimed he contacted Valve's twitter a long period of time before the whole ESIC investigation blew up.

Now think about this... Steam is running on nearly every gamer's PC. That's what I'm more worried about than exploits in individual games.

Reply on news.ycombinator.com