Hacker News Reader

Comment by FatalLogic | Hacker News Reader

It's quite likely to be cheat-detection scanning filenames, maybe even file contents. Valve had an issue like this recently. (edit: the Valve issue was actually DNS cache scanning)

edit: Gabe Newell explained Valve's reasons for scanning DNS cache - http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_tru...

View on HN

Yes Steam I think tracks what websites you've been to, but they only do this when they are already suspecting you of cheating, and they only send a hash of the url to see if matches known cheat sites. That's just one of the things I remember.

In a perfect world EA would just use steam and give up on Origin. I'm sure they can pay Valve enough to get top billing on steam and it would be less than they spend on their own anti-cheat and origin engineering. They'd also have to cut steam in on sales, but it might still be worth it. It would definitely be worth it to the user as the Origin software is horrible.

That's still a bad thing, in my opinion. If I am suspected of cheating then they get access to my browsing history?. How is that acceptable?

Its not and sooner or later EU will investigate it and those companies will be in huge troubles.

Well.... As far as spying goes it doesn't sound that horrible. Since they are only checking hashes of your history against a list of common cheating site hashes they really gain minimal information. If their were clear opt-ins and transparency I would definitely be okay with this sort of anti-cheating measure.

Not acceptable at all. Whoever came up with that scheme is a psychopathic criminal for all I care.

But then again, once you start using proprietary software you expect there is a gorilla holding your banana and with him comes the jungle.

Not even once.

Well to be fair, you can often receive those gorillas from reputable shippers (torrents), keep them each in their own strong cage (different user account under wine, chroot/namespaces being the next step), and prevent them from getting overexcited by the jungle (iptables).

If you read the linked thread, they are not "accessing your browser history". Rather, as a specific countermeasure against specific cheats, they checked the DNS cache for access to a particular set of phone-home server addresses embedded in some cheats. Not websites, but backend servers (ironically) enforcing DRM for cheat software. Like all such countermeasures, it was effective for a short while, then counter-countered by the cheat. What they sent back to valve was only a "yes they appeared to have accessed cheat backend server X", not a list of all accessed servers or browsing history.

I'm not saying I love it, but it's important to be accurate before turning the outrage dial to 11.

So far as outsiders were able to tell, it sent back hashes of every DNS cache entry. Someone stuffed their DNS cache with a larger-than-usual number of entries and found the amount of encrypted data sent back consistently increased by exactly the amount required to send every hash twice, then went back to normal when they cleared their DNS cache.

Ah, thanks for the clarification.

This is worse than checking history in some ways. It's much easier to get a stray entry in your DNS cache than to accidentally visit a "bad" website (which isn't that hard either). If anyone links to an image on that domain's servers, Valve will use the presence of the domain in the resolver cache as evidence that you're a cheater. That's not a very reliable system, and I don't think it justifies the privacy invasion from either perspective.

ugh! I am actually glad not to see stupid buggy EA games on steam :)

> Yes Steam I think tracks what websites you've been to, but they only do this when they are already suspecting you of cheating, and they only send a hash of the url to see if matches known cheat sites. That's just one of the things I remember.

And this is perfectly okay, but looking through a list of start menu entries isn't? In fact I'd consider shipping off lists of URLs and domains I've been to worse than looking through installed programs.

> In a perfect world EA would just use steam and give up on Origin.

I disagree, competition is a good thing. By this same argument we should all ditch every other operating system because most users run Windows, so using others isn't necessary. Sure Origin has had its' share of bumps, but so did Steam in its early days, now look at it - Steam is adored by gamers and anything else is immediately shunned.

> would be less than they spend on their own anti-cheat

I'm not sure about this, but from my understanding Steam doesn't really offer much anti-cheat, mostly just DRM. Valve games all have VAC, but I'm not sure how widely used VAC is for non-Valve games.

> It would definitely be worth it to the user as the Origin software is horrible.

I partly disagree with this. The Origin interface really isn't that bad, I actually find it a lot faster/more responsive than Steam's. Steam's interface is also far from great - although they do have great cross-platform consistency, it is at the expense of being inconsistent with the users operating system.

> Sure Origin has had its' share of bumps

Still has. I can't even visit origin.com without either enabling my VPN or having it in German.

Region locking fun. The worst part being they say in the eula that you can not use VPN services with the Origin shop. So the choices is between either play guess the interface with real money or having them be able to say we blocked your account you no longer have access to your games.

Well, as a German I don't have problems understanding German, I just prefer having it like everything else in English. But it is a reason for me not to use them.

Steam's current client is basically terrible in all respects, try playing with SteamRE or one of its variants and it's insane how much better it is. Only a matter of time until someone drops a full featured open source client that performs much faster, more efficiently, and probably offers a better interface besides.

Sending a one-way hash of a hack phone-home URL only AFTER the hack was detected is far less disturbing than sending a ROT-13 list of recently used programs indiscriminately.

It isn't sending ROT13 encoded data anywhere (Well, it may, but the screenshots do not have any evidence of this), all the screenshots show is Origin reading registry entries that Windows stores about opened programs.

Here is some info on what the UserAssist keys are: http://www.aldeid.com/wiki/Windows-userassist-keys

> Yes Steam I think tracks what websites you've been to

This was addressed here:

http://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and...

Agreed about EA and Origin.

you're an idiot if you think origin is more invasive than steam, lol

Prove that Steam collects data about your system, except for hardware statistics that it asks you want to send. Being the first platform for gaming, I think that Steam gets audited by a lot of people quite often; despite that, I have heard nothing about Steam spying on its users.

The only "invasion of privacy" found was in VAC, which uses security through obscurity to deceive cheaters. When somebody got concerned about that, Gabe Newell immediately explained publicly the security mechanism, letting everybody with basic IT knowledge deduce that Valve has thought this quite thoroughly for privacy.

Last time I refused to participate in the Steam hardware survey, it was because the description of the data sent in the survey included "software installed on the system." If you use anything other than Steam on your system, that's not really acceptable. AFAIK, though, that is only if you join the Steam hardware survey.

Honestly, though I actually use and like Steam, I absolutely hate how the walled garden / vendor lock in approach is making its way into PC gaming. There are games I 100% would have bought except for the fact that they force you to buy it through Origin. The only way to play without it is to use a pirated version.

Part of me wishes they could outlaw these types of things, but I don't really see any way you could logically force someone to make their platform available to competitors.

Lock-in is the holy grail of all software vendors. If they can achieve a pervasive lock-in, they're golden. We should always have that present in mind when we're discussing the actions of software companies, because it's a conflict of interest. It means consumers need to be extra vigilant about demanding data portability and cross-compatibility, since software vendors are not going to be happy to provide them voluntarily.

Almost every action Microsoft has taken in the last 20 years has been about furthering their lock-in. The Xbox exists solely to promote DirectX, which tightens Windows' foothold; other consoles were (and are) mostly based on a derivative of OpenGL, which made it easier to port games to non-Windows platforms.

.NET exists solely to ensure that more business software requires Windows, and Windows Phone exists to ensure that more mobile software requires Windows. Java's write once, run anywhere philosophy is one of Microsoft's main targets, and has been since Java gained popularity in the early-mid 90s. Cross-platform compatibility is the bane of software vendors within their sphere of influence. Since MS primarily sells operating systems and office software, everything they do is about ensuring it's difficult to use a different operating system or office software.

You can go through a similar history for almost every major software vendor. It's in their monetary interest to make it difficult for users to switch platforms, which means it's in their interest to keep your data locked up and/or obfuscated.

Maybe. But the examples aren't solid.

Xbox sales were #1 for years - had to be a profit motive there regardless of software 'lock-in'.

.NET maybe, but Windows Phone? Last place in phone sales. How does that lock anybody into anything?

IE supports Java - no lock-in possible there.

Sometimes companies complete by writing software people want to buy. Microsoft has demonstrably done that, and in a market where they are clearly incapable of locking anybody to anything.

The Xbox barely kept up with GameCube sales, and was ultimately a grossly unprofitable adventure.

Any business' end-goal is profit. With the Xbox, this is through both vendor lock-in and "owning the living room". Some MS exec once also talked about using it as a way to transition the masses of console gamers to PC, but that was probably just a "nice to have" at best.

> Xbox sales were #1 for years - had to be a profit motive there regardless of software 'lock-in'.

No. You're confusing sales with profits. The Xbox division lost Microsoft over $3 Billion '03-'12. This has been covered extensively but see eg) http://www.neowin.net/news/report-microsofts-xbox-division-h...

Profit, other than perhaps hope of long-term profit derived from spending their competitors out of business, was certainly not their motivation

> .NET maybe, but Windows Phone? Last place in phone sales. How does that lock anybody into anything?

Wanting to use something as a lock-in tool doesn't make it one. I'm pretty sure Microsoft would prefer Windows phone to be at place 1.

>IE supports Java - no lock-in possible there.

IE runs Java applets through a third-party plugin, and Java runs on Windows because the Java guys write and distribute a VM that supports Windows. Microsoft already got itself in very hot water for trying to strongarm people off of its platform entirely (Netscape antitrust case), so they're not about to try that again. You can make software for Windows, but Microsoft is going to use their clout in legally "fair" ways to make sure you don't damage their lock-in. Java was a very serious threat to MS, which is why they created .NET and built an enterprise sales apparatus around it.

Sun lost its way and Microsoft ate up most of the custom enterprise software market with .NET. A pity really; the future could've looked much different if Sun had successfully and aggressively countered .NET. MS made sure it didn't happen because write once, run anywhere meant that Windows wasn't going to be very important anymore. .NET touted similar features, but the catch was they only wrote a VM for MS platforms, incidentally.

Pre-reply: Yes, Mono exists, Microsoft made minor contributions here and there to it, but it is now and always has been a second-class citizen in this space, and Microsoft will ensure that it always will be. It seems Mono typically gets support for an API just as it becomes deprecated and its new big brother starts to emerge on Windows. That's intentional.

The Xbox doesn't exist to support DirectX, most AAA games write to bare metal for better performance.It exists because Microsoft wanted a living room presence the way the Soviets coveted a warm water port.

There is no bare metal on Xbox, you always go through DirectX. The difference is that the Xbox version of DirectX has much lower overhead than the Windows version and provides access to all the functionality of the GPU, not just whatever's in the comparable PC version of DirectX.

Vendor lockin should be outright illegal it benefits no one but the vendor and in fact harms everyone else.

Why is vendor lock in NOT illegal? (Besides lobbying)

I totally agree with your sentiment. But, how exactly would you enforce it? All they have to do is say "The games make use of Origin technology and won't work without our software". I am not really sure how you could prove otherwise or compel them to somehow provide it without the feature.

You have a good point.

This paints it as more of a societal problem than a legal one, and I think you're correct in hindsight.

I think about my gamer friends, and they've resigned themselves to vendor lockin because "What choice do I have if I want to play with my friends?", something I've come to call the Facebook Argument.

However, when I think about [some of] my colleagues, many of them don't like vendor lockin when it's applied to them, but aren't against implementing similar features in their own projects with a different name, and I have a hard time believing they don't see it for what it is.

Edit: typo

Lots of things that only benefit one party are legal, why should they be illegal?

Why don't you use your ability to purchase software from somebody else (or use open alternatives) rather than increase the ability of governments to threaten and imprison people? While there are societal benefits from regulating monopolies, making "anything that might annoy a consumer" illegal is a dangerous path and does little but erode freedoms.

Probably because of the massive power asymmetry between vendor and user.

Suppose my only option for earning a living depends on software from Vendor X, who has used lock-in techniques to eliminate their competition. At this point there would be nothing to be done except make vendor lock-in illegal.

It would be easy to do, too, simply by requiring either A. up-to-date, detailed documentation of file formats and protocols necessary for data migration, or B. support for an interchange format that provides the same features as a proprietary format.

I'm still not understanding why it should be illegal. We can start with an assumption that Vendor X eliminated their competition by fair practices or they would already be subject to antitrust regulations. If Vendor X uses their position to unfairly prevent competition (either in their own space or others), they are already breaking the law. If they aren't doing that, I fail to see why just having lock-in should be illegal.

This is not to say I'm a fan of vendor lock-in. Quite the opposite, actually. But I do know laws like this will always have unintended consequences, will always be manipulated by those same large companies ostensibly being regulated to give them advantages over new entrants, and, as a result, will always make the competitive landscape more difficult than it would have otherwise been. How big does your market have to be? How big does your company have to be? Is the broadband chip on your phone subject or just your whole phone? What about trade secrets?

The advantage of the antitrust laws is in the lack of specificity. It takes a complete trial to actually show wrong-doing.

Because a case can always be made that the lock in provides some benefit, such as providing a consistent user experience. What you are really arguing is that the benefits they can provide through controlling the experience end to end are clearly outweighed by the negative aspects. While this is probably apparent to most people, proving it as a legal argument may be much harder.

Why is "everything on steam" a perfect world scenario? Give all the power to one system that already has significant problems with DRM and offline play?

We learned monopolies are bad this decade, again. Or is that again again? Or again again again? Or maybe it was again again again again again. I can't keep track. But we have a large portion of our population clamoring for every game to be on Steam or every house to be on Google fiber.

Why is "everything on steam" a perfect world scenario?

It's not, but it's far better than "everything on Origin".

Steam used to check your DNS cache for cheat sites, they don't anymore.

You are mistaken. Steam looks at your local DNS cache to see if you've got the DNS entries of known cheat sites (since some of the cheating tools have their own convenient licencing mechanism that requires them to phone home at a special URL, this is easy-mode detection) in your cache. They do not look at your browsing history.

Reply on news.ycombinator.com