Hacker News Reader

Comment by msla | Hacker News Reader

> The main culprit, according to Valve, is the built-in Chromium-based browser that Steam actually uses to render the Steam store and other bits of the UI. Chrome dropped support for Windows 7 and Windows 8 right around the same time that Microsoft ended support for the operating systems earlier this year. Versions that still work in Windows 7 and 8 will be susceptible to security bugs and, increasingly, rendering bugs and other functional problems as time goes on.

View on HN

I doubt Valve is doing anything on the leading edge of web design that only a minority of systems are able to support. I figure it is just HTML, CSS and Javascript. If they stick to standards, it'll just work. Security bugs aren't really an issue because you are just using the Steam app to navigate 1 site, Valve's. You only see what Valve presents.

OS support being dropped by an app should only be done because the app is dependent on APIs, etc. that only exist in newer versions of the OS. Not because it is "fashionable" to drop support.

so you're saying Valve should release software that, if a bug appears in this now unsupported Chrome version, is now susceptible to this bug that will literally never get fixed?

Perhaps I am not thinking dastardly enough, but why would a bug appear though? All the user can do is click on links that Valve has provided. If the inputs are from pre-defined sources and within pre-defined parameters, why would anything happen? Nothing is being executed on the end-user side, it's all running off the server. All the client does is renders/plays what it is sent.

Steam's in-game overlay has a fully user-controlled browser running on the same engine. Some people use that to open something like a game wiki, and malvertising is a real risk. (In addition to just wanting somewhat secure browsing as a baseline)

Also: I'm not sure if links sent in Steam chat, when viewed in the overlay, open there or with the system browser.

Steam has been on the forefront of security and things like two-factor because their attack surface is so wide. If they used an old browser, someone is and would work to try to figure out how it can be hacked somehow.

"We've decided it's ok to have a dependency on a software component that's no longer supported. We believe security bugs won't be an issue because of [XYZ]"

I would not want to be the engineer that has to explain/defend this position.

> Security bugs aren't really an issue because you are just using the Steam app to navigate 1 site, Valve's. You only see what Valve presents.

I don't think you want to explain that to the payment processors that also run within that same embedded Chromium when you buy a game on steam.

> OS support being dropped by an app should only be done because the app is dependent on APIs, etc. that only exist in newer versions of the OS.

"In addition, future versions of Steam will require Windows feature and security updates only present in Windows 10 and above."

Reply on news.ycombinator.com