Valve Steam is nice.

[Karan]

In any case, if they go bankrupt I feel justified to use a crack or pirated version.

It's even legal to do that (in Germany and I think the whole EU) - or almost. You're allowed to reverse engineer/dissassemble etc. to make a program work the way it should IF the developer won't/can't help. But I think you're not allowed to use programs like cracks...so you'd have to write one yourself to be completely legal

[:wumpus:]

True; and even for cracks, noone will generally chase copyright violations of games that haven't been sold for ages, especially if the maker is out of business, which puts in into a grey area of so-called abandonware.

In general I don't worry too much about DRM schemes and such, I know I can crack them if I want or need to. Finding time to do it is more of a problem, so I generally don't bother

[mkultra333]

nullsquared: In that case, you might want to uninstall any and all internet browsers from your computer. Anti-virus software should be removed as well, including any other program that accesses the internet.

On second thought, it's best you just turn off and completely unplug your computer. That way, you will be sure no one will have access to your content.

Or just simply have your computer not connected to the internet, as mine was. Alternatively, you can select you browsers and sources based on who you trust. If they are open source, you know the code within them and you can verify the md5 or sha hashes to check they haven't been modified.

At lower levels of security you can simply decide to trust a store bought firewall, keep track of it's hash to make sure it doesn't get modified, and then strictly limit what programs can or cannot access the internet. The basic kind of security we all use to stop the russian mafia stealing our credit card numbers. Or maybe null doesn't bother with firewalls...

xavier: Until they break in while you're away and look through your machine. If the NSA is interested in what you are doing, then Steam is going to be near the bottom of the list of things you need to worry about...your time would be better spent sweeping your place for bugs and looking around you for surveillance.

That's actually a lot of work, and a lot riskier than simply planting a key logger on someones computer via an external internet link. Do you really expect China to break into all the embassies and dissident groups computer with physical people rather than the ghostnet virus I linked to? Especially since they used it to turn on the cameras and microphones of the compromised computers. Really, the man-power, cost and risk of such breakins makes it strictly last resort stuff. And it's lousy for broad based information fishing. Things like http://en.wikipedia.org/wiki/Project_Echelon and http://en.wikipedia.org/wiki/GhostNet are much cheaper, more practical, and allow much easier plausible deniability.

Plus, if you want to plant a keylogger on someone's office computer, it helps to if you can see that they've just attached to Steam from their home computer. Good ol' traffic analysis.

Not that I personally consider all this a huge danger to myself, but it's worth keeping in mind for people who aren't political voids. If I were Islamic, or a Tibetin exile, or an environmental activist, or whatever the next mass hysteria demon is, I'd think about.

But enough politics, I swore I'd avoid it with my mkultra333 persona so I'll leave it at that.

[:wumpus:]

Simple solution: use two PCs

One pretty insecure for games and general mucking around 'fun' stuff on the internet

One secure one with all services closed and a big firewall for serious work (and politics, if you bother with that)

Of course you can use things like VMWare and virtualisation as well, but those aren't too secure either. And how cheap is a second PC/laptop these days? Especially second hand... and no, dual boot won't do either.

[mkultra333]

Yeah, that's actually the solution I use. I had my old computer for internet stuff and my new computer isolated. But now my old computer is too old, my new computer is on the internet, and I need to get that new super computer some time soon.

Only problem is you really need the "cheap" computer to have a very expensive graphics card because of... Steam! (Since you're secure computer shouldn't use Steam.)

[:wumpus:]

Instead of a cheap and an expensive computer you could also distribute the cost more balanced, that's up to you. Security (at least, the common sense variant, not the high tech magic snake oil variant) doesn't come cheap.

Luckily, there are also practical reasons for separating those things on different machines, for example in making backups you only have to backup the secure machine, and not gigabytes of game data. Also, you can run different operating systems on both.

[nullsquared]

I think someone is just overly paranoid.

[mkultra333]

I think someone is just overly paranoid.

Someone... Someone? Hmm, I wonder if they're talking about me...

[:wumpus:]

I think someone is just overly paranoid.

Maybe, but it's better to err on the safe side, isn't it? I'm not really afraid of political groups, or even corporate espionage, but I like to protect what is mine against much closer-to-earth threats such as scriptkiddies etc. Vulnerabilities are being found in everything, and they don't take that much to exploit.

It won't be the last time the source code to a (closed source) game, operating system or even military fighter jet leaks to the internet. Data security is important.

[nullsquared]

I think someone is just overly paranoid.

Maybe, but it's better to err on the safe side, isn't it?

It sure is. Until you cross the line as if the government is out to get you through the internet.

[mkultra333]

So when a Tibetin exile worries that the Chinese government might be out to get them through the internet, do you feel they've crossed the line? I'm just curious, since thats an example I gave from the real world.

[nullsquared]

So when a Tibetin exile worries that the Chinese government might be out to get them through the internet, do you feel they've crossed the line? I'm just curious, since thats an example I gave from the real world.

I don't even know what a Tibetin exile is. But considering it sounds important, ask yourself this: are YOU the Tibetin exile?

Obviously, the president isn't going to have his own little personal computer connected to the internet while typing up a document containing all of his future plans. But you're not the president. Neither am I. No one cares about us, other than the usual trojan/spyware/adware.

[xavier]

So when a Tibetin exile worries that the Chinese government might be out to get them through the internet, do you feel they've crossed the line? I'm just curious, since thats an example I gave from the real world.

Congrats on the first strawman in the debate.

[:wumpus:]

Obviously, the president isn't going to have his own little personal computer connected to the internet while typing up a document containing all of his future plans. But you're not the president. Neither am I. No one cares about us, other than the usual trojan/spyware/adware.

Well, noone cares about you maybe, but I won't be so sure about me... sorry, kidding

But please keep super scary things such as secret goverment factions out of the discussion. Indeed they don't matter for most people. For you and me, there are still various valid reasons to be concerned about security:

• There might be people that just don't like you, for some reason, and happen to have hacking skills. That's a lot of people these days...
• You're a teacher, and students might want to change their marks
• If you're a developer, you might have NDA'd stuff on your machine that is worth stealing. You will be sued if it becomes known that things got out via you.
• You might have a VPN connection to your company. Just think what someone could do if he could route through that.

And the list continues. The fact is, most 'hackers' aren't doing it for some government agency, and they don't need the resources of one either; a kid can mess up 100,000 computers if he decides to make a botnet.

[mkultra333]

Congrats on the first strawman in the debate.

Congrats on an empty post.

Since the people telling me not to worry about how the secret services of the world spy on citizens don't even know what a Tibetan exile is, and think that the NSA has the worlds largest concentration of mathematicians and computers in order that they can physically bust into houses like it's a Mission Impossible movie, I'm not so sure the sublter points of civil liberties, cyber risk assesment and the balance between personal privacy and the role of an intelligence agency will carry much sway.

And note, I've already said I don't consider these things a major threat to myself and I'm giving Steam a try, so the first strawman was to accuse me of paranoia. However, on a matter of principle regarding the future of privacy, I don't like the trend of forcing people to allow unknown remote code complete access to peoples computers just because they want to use some app or other.

There are a number of covert threats from such a system:

a) Foreign or domestic government agencies. I've given the example of China's recent spying. I didn't say I was a Tibetan exile, but it is an example of how your political activities can get you red flagged and covertly observed. I won't bother linking to ghostnet again, I'm getting the impession people aren't reading it anyway. But just because nullsquared and perhaps xavier have no political positions of interest, doesn't mean everyone is so politically blank. If you aren't politically blank, this might be worth considering.

b) Corporate agencies. The purposes here can be pretty varied. Maybe they're snooping for trade secrets. Perhaps they want dirt to blackmail you to avoid some patent lawsuit. Or perhaps they want to know your bid on some contract. It's estimated that billions of dollars worth of contracts a year are affected by this kind of espionage. Here's an example: http://www.guardian.co.uk/world/2000/mar/31/ianblack

Echelon, established during the cold war and operated by the US, Britain, Canada, Australia and New Zealand, is reportedly capable of intercepting millions of telephone, fax and email messages.

James Woolsey, who headed the CIA from 1993-95, has already admitted what to many had long seemed obvious - that the US secretly collects information on European firms.

He wrote in last week's Wall Street Journal: "That's right, my continental friends, we have spied on you because you bribe. When we have caught you at it, you might be interested, we haven't said a word to the US companies in the competition.

"Instead we go to the gov ernment you're bribing and tell its officials that we don't take kindly to such corruption."

He insisted however that it only targeted firms which violated UN sanctions or offered bribes to gain business.

Again, this doesn't especially effect me, but this doesn't mean it isn't a problem of principle to me, and it doesn't mean that isn't a real, practical concern to any number of people.

c) Hackers and organized crime. These people are constantly looking for weaknesses in systems so they can plant key loggers and steal identies and card numbers. And you never know where a hole might appear.

A recent surprising security hole was found in Quake 3 Arena after the source code was released. It turns out a flaw in the client-server download system meant that a client could be infected with any code a hacker desired just by connecting to a server setup by the hacker. The code would automatically download and launch.

http://www.securityfocus.com/advisories/2189

Impact:

This vulnerability allows an attacker to have read or write access to a
Quake3Arena user's filesystem when the user connects to a server run by the
attacker. This could allow attackers to install Trojan horse programs,
gather passwords, and read or write files.

Now, I've been playing Q3A for years, but I've been playing offline. Since nothing was forcing me to connect to any external servers I was completely safe despite this terrible security flaw. But if any of these new DRM system that force frequent internet access develop such flaws, it could cause serious and widespead damage.

(BTW, Quake 3 Arena has been patched, and provided you use the source from http://ioquake3.org you'll be fine, since they found the flaw in the first place.)

So my concerns about these issues are both based on principle and actual practice.

No strawmen were harmed in the making of this post.

[stoneCold]

Since the people telling me not to worry about how the secret services of the world spy on citizens don't even know what a Tibetan exile is, ...

All people who generalize are bad

A recent surprising security hole was found in Quake 3 Arena after the source code was released.

... just like it would happen with any closed source software, if the source code would be released someday.
And I really doubt that anyone, who is interested in breaking into your computer would have to rely on you playing Q3A.
Any software contains security holes, so the only way to secure your computer is to disconnect it from the internet, build out every wireless technology that is attached to it, and detaching the power cable wouldn't hurt either.
About the spionage from governments and/or similar, I'd say you're out of luck if they're really interested in what you are doing. The trick is to stay out of the line of sight, once you're on their list you've already lost imo, since there's always a way for them to break into your computer (as said above).

Other than that...

1. Steam is garbage
2. Politcal discussion
3. ??????????
4. Profit

Cheers

[mkultra333]

Since the people telling me not to worry about how the secret services of the world spy on citizens don't even know what a Tibetan exile is, ...


All people who generalize are bad

Actually I wasn't generalizing, I referred to nullsquared and xavier specifically, since they've been the main people discussing these recent issues and the ones who claimed not to know what a Tibetan exile is and that the NSA prefers to burgle their info over hacking and remote infiltration.

... just like it would happen with any closed source software, if the source code would be released someday.

...or if they found the flaw before the source was released, as also sometimes happens. Such as past Java runtime buffer overflows, before Sun made the source to Java available.

Any software contains security holes, so the only way to secure your computer is to disconnect it from the internet, build out every wireless technology that is attached to it, and detaching the power cable wouldn't hurt either.

Well, as I've repeatedly said, normally I do have my more important computer not connected. I'll mention now that it also has no wireless technology. The power cable, apart from the occasional annoying power surge, is not a problem. BTW, I do find it surprising how many people just leave the wireless ports on their computers open. Even supposedly secured, wireless connections are aparrently quite easy to crack. I personally think they're mostly pointless tech. Wires aren't that annoying and a lot safer.

And I really doubt that anyone, who is interested in breaking into your computer would have to rely on you playing Q3A.

I think you have that back to front. You must have overlooked the fact that I put this concern in the third category, that of haccker and organized crime. First the hacker finds out that theres a hole in the software, then they infect who ever happens to come along. For example, sometimes movie files and mp3 files on peer to peer networks are infected with viruses and trojans. They weren't put there to target someone in particular, but simple to infect whoever they can catch.

That would be the ??? part before profit.

[stoneCold]

First the hacker finds out that theres a hole in the software, then they infect who ever happens to come along. For example, sometimes movie files and mp3 files on peer to peer networks are infected with viruses and trojans. They weren't put there to target someone in particular, but simple to infect whoever they can catch.

I agree/know, but since most of such "broadcast" attacks are easily countered with todays anti-virus/firewall/anti-adware/... software, I don't bother much about these.
(anyone who cares about security and has got an idea about the "dangers" of the internet should have those programs installed, and if he doesn't ... "shame on him" )

</thread>

[Kojack]

But just because nullsquared and perhaps xavier have no political positions of interest, doesn't mean everyone is so politically blank. If you aren't politically blank, this might be worth considering.

Ok, now as surprising as it may first seem, there are actually more political topics in the world than tibetan exiles. As such, using knowledge of what a tibetan exile is as the measure of "political blankness" is a rather flawed metric.
Also, despite your repeated claims, xavier never said he didn't know what a tibetan exile is, he said you were using a strawman argument.

For example, sometimes movie files and mp3 files on peer to peer networks are infected with viruses and trojans.

http://www.virus.fi/hoaxes/mp3vir.shtml

The really important question is how many tibetan exiles currently download games with steam?



Steam can be annoying (like wanting to install everything into the steam directory), but generally it works fine for me. I can get games that aren't available here in stores (such as Zeno Clash) at lower prices than they would have cost. Plus it lets me know that none of my friends have beaten my Portal achievements.

Although my internet quota can suck a bit at times, so it's often easier to grab a game from JB Hifi or EB during my lunch break.

[mkultra333]

But just because nullsquared and perhaps xavier have no political positions of interest, doesn't mean everyone is so politically blank. If you aren't politically blank, this might be worth considering.

Ok, now as surprising as it may first seem, there are actually more political topics in the world than tibetan exiles. As such, using knowledge of what a tibetan exile is as the measure of "political blankness" is a rather flawed metric.
Also, despite your repeated claims, xavier never said he didn't know what a tibetan exile is, he said you were using a strawman argument.

For example, sometimes movie files and mp3 files on peer to peer networks are infected with viruses and trojans.

http://www.virus.fi/hoaxes/mp3vir.shtml

The really important question is how many tibetan exiles currently download games with steam?



Steam can be annoying (like wanting to install everything into the steam directory), but generally it works fine for me. I can get games that aren't available here in stores (such as Zeno Clash) at lower prices than they would have cost. Plus it lets me know that none of my friends have beaten my Portal achievements.

Although my internet quota can suck a bit at times, so it's often easier to grab a game from JB Hifi or EB during my lunch break.

Well, first up, I referred to null's lack of knowledge on political exiles and xavier's denial that the NSA used remote methods of information retrival. I suppose I can see how someone might deliberate misinterpret that as meaning I meant both of them said both things, but I expected a certain level of, well, honest debate...

Now, regarding the MP3 virus, from what I'm reading there have been several cases in the past of mp3 and playlist files being able to overflow the buffer of winamp.

http://www.juniper.net/security/auto/vu ... 33226.html
http://news.cnet.com/Serious-Winamp-fla ... 32787.html
http://www.extremetech.com/article2/0,2 ... 207,00.asp
http://www.zdnet.com.au/news/security/s ... 929,00.htm

That "hoax" page you linked to is from 1998... perhaps not quite up to date.

However, as I've posted before, I can see a big plus in getting games entirely online. I'd just like it without the negatives.

(BTW, I don't know if I've yet alienated every Ogre moderator and expert user... so I guess the thread isn't quite closed yet, despite Stonecold's </thread> )

[xavier]

Congrats on the first strawman in the debate.

Congrats on an empty post.

Not at all. I was not the one that introduced the notion that the Steam client might be used to track down and monitor Tibetan exiles...

[mkultra333]

Congrats on the first strawman in the debate.

Congrats on an empty post.

Not at all. I was not the one that introduced the notion that the Steam client might be used to track down and monitor Tibetan exiles...

Surprisingly, for an OO philosophy guy, there seems to be some difficulty in moving from a specific example to a general concept.

Ah well. I've stated my case, supported it with related examples. Having to regularly connect to external sources that download unknown code to your computer, just so that you can use an app that should easily operate in a stand-alone fashion, adds unnecessarily to the security vulnerability of that computer. There shouldn't really be any reason to have to connect to the internet just to install a game from a dvd, let alone to play it again later. The counter arguments I've seen have not been at all convincing, and have been badly researched. Since at this stage its getting close to having defend against stuff I didn't say, I'll quit while I'm ahead before any unnecessary animosity rears its head.

[xavier]

Hehe, nor I. I don't think that even counts as a strawman so much as a total fabrication on your part. I specifically said the Chinese government used Ghostnet to track the political exiles and break into embassies, and linked to several references on the topic.

At the point in the thread where I made this post, it was an unconnected statement. Maybe it wasn't a strawman, so much as a reductio ad absurdum that failed to relate in any way to the Steam service.

Having to regularly connect to external sources that download unknown code to your computer, just so that you can use an app that should easily operate in a stand-alone fashion, adds unnecessarily to the security vulnerability of that computer.

I think you'll find we agree on the absurdity of this notion, but it's apparently also been clarified that you don't need Steam to play DVD-based games

[jacmoe]

Having to regularly connect to external sources that download unknown code to your computer, just so that you can use an app that should easily operate in a stand-alone fashion, adds unnecessarily to the security vulnerability of that computer.

I agree that the safest would be to go back to the good old unconnected days.
If you do connect, guess who's screwed?
Those who turn off software updates, be it the OS, applications or games.
When you bought the DVD, you should have read the prerequisites.
Define 'unknown code'?
You make it sound like a virus.
Viruses you get when you don't update your software.

[ToeNails]

I personally stay away from steam. I haven't touched a game released on it, and will not touch a game that uses it or is released exclusively on it.


As for not having to keep your cds. I've backed up every cd I've owned onto 2, 1tb Harddrives as Iso's so I can just mount and use them. When I get another 100bucks, i'll get one to use as a backup, and archive the Harddrives. No scratched disc, no downloads, just point to the folder and mount the iso.

Lastly, as said earlier about having one computer for games and one for security, I run a three computer system. One computer for programming and video games. A Linux box for the security/internet. And a play computer for all those weird pr0n sites I go to. Granted I just moved, so right now i'm just on my laptop .