Hacker News Reader

Comment by Barrin92 | Hacker News Reader

I haven't used Stadia so I don't know if this is the case already but cloud gaming providers need to give people the ability to download and back up their own data, or better yet just store them locally and online both by default.

When LAN parties were still a thing I and a group of friends once lost an entire day of Titan Quest progress because someone stepped on a power strip and turned everyone's PC off. I'm still so paranoid over this that to this day I always back up savegames to at least one other place.

View on HN

You can, using Google Takeout:

https://9to5google.com/2021/02/02/how-to-export-download-gam...

However you can’t import it back in, so this is a one-way feature at the moment.

Seems a terrible idea given how many code execution bugs have been found throughout the years in the "loading a savegame" part of games. You would have an RCE in your hands pretty quickly.

Just encrypt them with a per-client key or compute a HMAC and bundle it together, so user can download them and keep them but not edit them.

Next forum post is not "game save disappeared" but "Stadia lost my keys!".

doesn't matter each player is isolated from the others(unless they're insane), kind of like a rented instance on aws/gcp

but it goes against their interests, more reasons to stay if all your data is there

Geforce NOW was best for things like this. They'd let you run VM with Win10 and Steam. So you could easily leverage to admin, download let's say RDR2 from internet and play it on VM, hehe.

There is/was whole market going on, people sold "exploits" for Geforce NOW, so people would play whatever they want.

Pretty much every aspect of video games already make them “handle everything with extreme caution”-type software- eg there were RCE bugs in tf2 that could be triggered by a malicious client joining a server, or being able to write whole programs into various pokemon gameboy games just using the right sequence of inputs. I think if I’m not mistaken there was even a case of user picture sprays in source engine games being maliciously crafted.

You may as well plan your security mitigations in such a way that, ultimately, RCE is no more of a big deal than somebody being able to launch notepad.exe or chrome.exe to use a cloud gpu server as a remote desktop.

Now, that’s all to be said unless you’re dealing w somebody who has a GPU-/hypervisor sandbox escape exploit in addition to a RCE sploit they want to plant. In which case ya ur screwed. And I bet there’s serious effort spent by both eg NVIDIA and other cloud gaming providers, but, well, that’s a different beast than untrusted binary savegames

I still remember when Blizzard patched Warcraft III and half the custom maps broke because the maps were using an exploit to execute code.

When they remastered Starcraft, to preserve compatibility, they emulated the buffer overrun that many maps were using to directly write data to game memory.

Super cool talk: http://0xeb.net/2018/02/starcraft-emulating-a-buffer-overflo...

Seems antithetical to the idea of cloud gaming as a platform. I agree save data should be made available for games that can also be played locally, but my understanding is that cloud can exclusively offer games with completely opaque backends. You don't have players reverse engineering the client, the experience is completely controlled and proprietary. For those games, save data should be kept secret.

> For those games, save data should be kept secret.

I don't follow. Why?

Because it's really important for publishers that users can't edit their saves on their single-player-but-always-online-with-insane-amounts-of-grind-and-ingame-microtransactions. Think about the profits!

At the other extreme I love what Stardew Vally does here; saves are cross-platform and in a simple XML format. You can edit it and people even make things like https://upload.farm/ to share games and ideas.

I don't think it'd be a fool-proof mitigation but something I believe would move beyond a single point of failure (which, evidently, savegames alone are) is to hash the saves. You can then upload saves that match either one of your own hashes.

Hopefully, the system would be architectured so that even if the saves themselves went missing the table of hashes is still around.

You just move the point of failure from save games to the hashes in this case.

Yes, indeed, it would be problematic if they lost the hashes as well. I'm just imagining that it'd be easier to ensure there is redundancy on something like hashes which would not require as much storage to duplicate.

Minor improvement, not a full-blown solution.

You remove a whole host of cheat vectors in online games for one.

If the cheat is achievable via a save upload, does it matter? I don't see how someone having a bunch of extra call of duty weapons unlocked hurts anyone else.

> When LAN parties were still a thing

I miss LAN parties. I guess we can't have them because huge games developers can't monetise them.

It's not like developers forbid us to sit in a room together. We still regularly organize one, even if some of the games use cloud infrastructure.

The necessity is now lower because of high speed broadband internet.

GDPR section 20 theoretically counts here.[1] I guess the argument would hinge on whether save data counts as a machine representation of the state of the system after a series of user-generated controller inputs. A similar case was when Spotify stopped trying to block automated playlist export after a GDPR complaint.[2]

[1] https://gdpr-info.eu/art-20-gdpr/

[2] https://news.ycombinator.com/item?id=24764371

Reply on news.ycombinator.com