Hacker News Reader

Comment by ryukafalz | Hacker News Reader

I think most people don't fully understand the implications of things like this - it's not obvious in normal usage, so how would they? Cheating in online games is salient, but if you told the average person they had a program running on their computer, I imagine their answer would be "so?"

But if it was clearly pointed out in the OS, and the OS said something along the lines of:

"Riot anti-cheat is running in the background. This program may monitor all of your activity on this computer and track your physical location while you use your computer."

...more people might have some second thoughts.

View on HN

> This program may monitor all of your activity on this computer and track your physical location while you use your computer.

This is just disingenuous.

If you are talking about what could technically be done, then sure, they could do that. But if they wanted to own your machine then they technically could do it the moment you installed any software that they provided regardless of what it says in the EULA.

So then you must be talking about what they are legally allowed to do. And guess what, they also have a privacy policy that limits what information they are allowed to collect and for what purpose they may collect it. Them carving out the legal ability to run programs on your machine for anti-cheat purposes doesn't change any of that.

Now I'm not saying you might not have other reasons for not wanting to run their crap on your machine (I certainly don't want it either) but this here is just FUD and not a good argument.

>If you are talking about what could technically be done, then sure, they could do that. But if they wanted to own your machine then they technically could do it the moment you installed any software that they provided regardless of what it says in the EULA.

Yes, I am talking about what could technically be done, not what could legally be done. That's the only thing the OS is in a position to know about.

Yes, they technically could do all of this the moment you install any software, on current desktop OSes. Don't you think that's a problem? Is that the best we can do for OS security?

You said earlier: > I think most people don't fully understand the implications of things like this

The "things like this" of which you speak were presumably to do with the topic at hand, which is a legal text.

You didn't provide any reason to suspect that your complaint was generally about OS security. But sure. It would be great if desktop OSes were capability based.

It just doesn't seem relevant to the issue at hand.

It's relevant insofar as granting a program that level of access in a capability based OS would be the exception, not the norm.

Today's OSes aren't in a position to make such a statement at all as they don't keep such tight control over a program's authority. But in a capability based OS, it would be - so a program that's in a position to monitor all your activity on your computer can be easily called out as such.

In other words, the notifications I mentioned that I'd like to see are only really practical in a capability-style system.

Caveat emptor allows me to assume the worst. Plus nobody is actually reading the EULAs every month to find the legalese clause that allows them to collect and sell even more of your data.

Yeah, although wrongly. The "may" there is a bit of a weasel word. Literally, it only indicates possibility, but lay-people read "may" as indicating probability. To a nerd, whether something is technically possible is interesting, but what ordinary folks want to know is whether Riot is likely to be acting against their interests (i.e. selling location or activity information to third parties, vs. simply conducting whatever monitoring they deem necessary to ensure cheats are not being deployed).

Fair - replace "may" with "is able to," and my statement still stands.

That type of language is up front and center every time you get a UAC prompt in Windows. Doesn't seem to do much. You'd really need to put the message forward, far more so than is warranted by any probability of actual harm, to get 99% of users to feel anything about it one way or another.

> This program may monitor all of your activity on this computer and track your physical location while you use your computer.

What incentive would they have to do that? They currently are making ridiculous amounts of money and you think they're going to risk all of that to know trivial details about you? Most people aren't that interesting and the information that could be obtained is worth far, far less than the money they make by keeping their player base happy.

A remote exploit in Vanguard is a much more reasonable concern.

I don’t think anyone is suggesting Riot would do anything underhanded.

Ironically, the idea that only Riot will ever be able to leverage the capabilities of this software service is probably why many don’t mind running it.

Unfortunately, that idea is flawed for the much the same reason the idea of backdooring encryption algorithms is flawed.

> Ironically, the idea that only Riot will ever be able to leverage the capabilities of this software service is probably why many don’t mind running it.

Just wait until someone finds a vulnerability in Riot's anti-cheat software and abuses it for more sinister purposes. No software is ever completely bug-free.

Some of the most profitable companies in the world today are in the business of collecting seemingly menial metadata about you, creating a profile, and leveraging/selling it.

"They currently are making ridiculous amounts of money and you think they're going to risk all of that to know trivial details about you?"

I hear this argument for the unlikelihood of corporate malfeasance all the time.

But look all throughout history and you'll see countless examples of very rich and powerful people and corporations taking extreme risks, including doing massively illegal things or risking consumer outrage and loss of good will.

It doesn't help that the real-world consequences of such acts are often just slaps on the wrist, no matter how illegal/immoral/reputation-trashing the acts might be. Very rarely do the rich and powerful suffer severe personal consequences... usually they can buy their way out or exit with a big bonus and just get hired somewhere else that's happy to turn a blind eye to their past (or might even prefer to work with sleazy/corrupt types)... and the public's memory is short.

Reply on news.ycombinator.com