Suggestion: Stop violating security permissions.

[Marikhen]

I finally got tired of the idiotic "What's New" "shelf," found a solution to get rid of it, and found that that solution is only good until the next time I restart Steam since it involves modifying the libraryroot.css file. At that point I figured, "Hey, this is an easy fix. Just prevent Steam from modifying the file and it's good." So I changed permissions to deny write/append/delete permissions as well as denying permission to change permissions for all accounts that had access to the file. I even went one step further and did the same with 'Everyone."

Steam just ignored all of that and reset the file to its default with a visible "What's New" shelf smirking at me like a malignant tumor.

I'll freely admit that directly editing security permissions for an individual file or folder is not my forte, but I don't think that Steam should be messing around with the libraryroot.css folder after I disable permissions like that. This indicates Steam taking an unhealthy level of control over my file system, and I'd like to suggest that it be stopped.

We the users should be final arbiters over the files on our PCs.

[Brujeira]

That’s unfortunate as you gave Valve legally binding permission to update Steam related files on your machine as and when they find it necessary - it’s in the SSA.

[Vandread]

Marikhen, try adding launch parameters to your Steam.exe shortcut: -noverifyfiles -norepairfiles

Put your libraryroot.css file in (and keep a backup elsewhere still!) and Steam will no longer touch it with those parameters in place.

[Start_Running]

If you modify the libraryroot.css you can't let the filesize change. Meaning it has to be the sam number of characters. Solution. when you edit it, set your editor ibnto overtype mode and type over the old attribute. You'll have a few letters left over so just put blank spaces (yes spaces are characters)

[Marikhen]

Originally posted by Brujeira:

That’s unfortunate as you gave Valve legally binding permission to update Steam related files on your machine as and when they find it necessary - it’s in the SSA.

Ignoring the issue as to whether or not de facto permission holds up in court, especially when absent a signature or any other remotely legally binding sign of acknowledgement,I will simply say that that wasn't my point.

My point was that Steam was overriding security permissions I was setting with admin rights, and I don't feel that it has any right, or need, to override a computer admin. My suggestion might have been worded better, but it deals with Steam acting in a fashion that could be potentially harmful to my system in the event that it attempts to modify files outside of the scope of Steam and games managed by Steam.

Originally posted by Start_Running:

If you modify the libraryroot.css you can't let the filesize change. Meaning it has to be the sam number of characters. Solution. when you edit it, set your editor ibnto overtype mode and type over the old attribute. You'll have a few letters left over so just put blank spaces (yes spaces are characters)

While not the point, even if it was the cause, of my suggestion I appreciate your response and will check it out.

[Gambit-3k]

Think about it, your account has permission to set the permissions. You would have to use Steam from an account that didn't have those permissions. Basically your account has permission to delete and modify any files, which means the Steam app has permission to delete or modify those files unless you run Steam from an account which doesn't have those permissions.

[Marikhen]

Originally posted by Gambit-3:

Think about it, your account has permission to set the permissions. You would have to use Steam from an account that didn't have those permissions. Basically your account has permission to delete and modify any files, which means the Steam app has permission to delete or modify those files unless you run Steam from an account which doesn't have those permissions.

Ayup, and I set write/modify/delete and even "change permission" permissions to Deny for System, Administrators, Users, and even "Everyone" for good measure even though by all rights that should be overkill. I couldn't modify or delete the file after I was done with it.

Not that Steam should be messing with file/folder permissions in the first place. :-/

[Gambit-3k]

Originally posted by Marikhen:

Originally posted by Gambit-3:

Think about it, your account has permission to set the permissions. You would have to use Steam from an account that didn't have those permissions. Basically your account has permission to delete and modify any files, which means the Steam app has permission to delete or modify those files unless you run Steam from an account which doesn't have those permissions.

Ayup, and I set write/modify/delete and even "change permission" permissions to Deny for System, Administrators, Users, and even "Everyone" for good measure even though by all rights that should be overkill. I couldn't modify or delete the file after I was done with it.

Not that Steam should be messing with file/folder permissions in the first place. :-/

hmm, Well I'm not expert either, but something sounds off about that to me.

[The HopelessGamer™]

So that fix can be done the same way just in a different file...

Read this as it will remove the whats new shelf easily and safely:
https://steamcommunity.com/discussions/forum/1/1744512633114104865/

They are not breaching security of any kind by having a whats new shelf containing some news articles...

If steam cannot see the file, it will redownload it upon launch. Its a good system to have. Helps keep their software up to date.

Steam has lots of files. Almost every single one is what makes it run. If you go ahead and delete a file, the program may have issues functioning. So to prevent these issues steam makes sure all its files are existent and up to date.

Fun Fact: You are not the administrator of your computer. Windows is... Unless you set higher permissions.

[RiO]

Originally posted by The HopelessGamer™:

They are not breaching security of any kind by having a whats new shelf containing some news articles...

They are breaching the Windows security model by resetting file permissions.

If a user with administrative permissions takes away the permission to modify or delete a file; as well as the permission to alter permissions; then the only way Steam can reset those permissions, is by still having a service running with full system-level permissions which can unlock the permissions and allow modification.

This is still part of the same ramshackle security-hole-waiting-to-be-found turd called "Steam Client Service" that almost got Valve in hot water when a security researcher who was denied entry to Valve's bug bounty program, went rogue and published how the way the service manipulated registry keys could allow arbitrary malicious code to exploit Steam to run any software under the SYSTEM account which has full systems permission. (And could in fact have been facilitating this as far back as 2015, if not earlier.)

SYSTEM is basically the lowest, most-strict security level at which the OS kernel itself as well as highly sensitive stuff like anti-virus solutions do their work. Any malicious software gets in there and your system is screwed. (Look up what a rootkit is.)

Valve has absolutely zero business using it the way that they are, but they still do. Almost surely because it makes life easier for them to do things this way, rather than the proper way following OS guidelines.

[76561198407601200]

Originally posted by Brujeira:

That’s unfortunate as you gave Valve legally binding permission to update Steam related files on your machine as and when they find it necessary - it’s in the SSA.

I've found when the ssa is brought up to people, they suddenly become lawyers and dismiss the issue at hand. Op forgets that they are modifying steam files. If it is unable to restore the file as it should be, then the other option is for steam to not run at all which will of course cause yet another whine about rights to use services, etc. The long and short is things are working as intended and op is mistaken.

[Marikhen]

Originally posted by The Living Tribunal:

Originally posted by Brujeira:

That’s unfortunate as you gave Valve legally binding permission to update Steam related files on your machine as and when they find it necessary - it’s in the SSA.

I've found when the ssa is brought up to people, they suddenly become lawyers and dismiss the issue at hand. Op forgets that they are modifying steam files. If it is unable to restore the file as it should be, then the other option is for steam to not run at all which will of course cause yet another whine about rights to use services, etc. The long and short is things are working as intended and op is mistaken.

You mean like how you're dismissing the issue out of hand?

The issue isn't Steam modifying files associated with Steam. The issue is Steam violating security permissions at a level is has zero business operating at.

If it can't access or modify files it thinks it needs to change then it should stop working, not blow who knows how many holes in your PC's security permissions.

[The HopelessGamer™]

Originally posted by RiO:

Originally posted by The HopelessGamer™:

They are not breaching security of any kind by having a whats new shelf containing some news articles...

They are breaching the Windows security model by resetting file permissions.

If a user with administrative permissions takes away the permission to modify or delete a file; as well as the permission to alter permissions; then the only way Steam can reset those permissions, is by still having a service running with full system-level permissions which can unlock the permissions and allow modification.

This is still part of the same ramshackle security-hole-waiting-to-be-found turd called "Steam Client Service" that almost got Valve in hot water when a security researcher who was denied entry to Valve's bug bounty program, went rogue and published how the way the service manipulated registry keys could allow arbitrary malicious code to exploit Steam to run any software under the SYSTEM account which has full systems permission. (And could in fact have been facilitating this as far back as 2015, if not earlier.)

SYSTEM is basically the lowest, most-strict security level at which the OS kernel itself as well as highly sensitive stuff like anti-virus solutions do their work. Any malicious software gets in there and your system is screwed. (Look up what a rootkit is.)

Valve has absolutely zero business using it the way that they are, but they still do. Almost surely because it makes life easier for them to do things this way, rather than the proper way following OS guidelines.

Regardless you agreed to all of this through the SSA.

[Marikhen]

Originally posted by The HopelessGamer™:

Regardless you agreed to all of this through the SSA.

https://store.steampowered.com/subscriber_agreement/

Originally posted by Steam Subscriber Agreement:

For reasons that include, without limitation, system security, stability, and multiplayer interoperability, Steam may need to automatically update, pre-load, create new versions of or otherwise enhance the Content and Services and accordingly, the system requirements to use the Content and Services may change over time. You consent to such automatic updating. You understand that this Agreement (including applicable Subscription Terms) does not entitle you to future updates, new versions or other enhancements of the Content and Services associated with a particular Subscription, although Valve may choose to provide such updates, etc. in its sole discretion.

That's about the only thing I found involving this subject, and at no point is there a statement that I give Steam or Valve permission to alter security permissions on my computer and/or exploit security loopholes and/or flaws to work around legitimately set security permissions. It is not and cannot be presumed that such permission is inherent to the concept of "updating" files.

Now if there's a section I missed, or your use of "SSA" refers to a different document, then by all means, link and cite it. I'll be more than happy to admit being in the wrong when you provide clear, verifiable proof that I explicitly gave Valve permission to monkey around with my PC's security settings in complete violation of my own personal actions or actions I authorize other parties or software to engage in via the Steam software.

I would also like to point out subsection 1C.

Originally posted by Steam Subscriber Agreement:

You are responsible for the confidentiality of your login and password and for the security of your computer system.

"You are responsible for the ... security of your computer system."

That means that setting, changing, and restricting security permissions, among many other legitimate tasks and activities associated with maintaining system security, is *my* responsibility, *not* Steam's or Valve's.

[Death]

Reminds me that...Sony scandal I think, with their stupid app using root to check if media files was aquired legally. Then that breach was used, it was hell of a ♥♥♥♥♥♥♥♥♥. Might be Steam start next ♥♥♥♥♥♥♥♥♥ after all, who knows. Lets hope not, though.

And you are right anyway, they shouldn't tinker with our PC's like that, though, it seems, they don't want to learn from other companies mistakes, and prefer to wait for the boiling point, then ♥♥♥♥ bursts out, which is sad.

[zerogravity171]

all you have to do is prevent steam from verifying the install at startup.

open notepad and paste the following:

BootStrapperInhibitAll=enable
BootStrapperForceSelfUpdate=disable

save the file in the steam directory:

C:\Program Files (x86)\Steam

Thats it, your edits will not be updated when you relaunch. this will work until valve updates the sdk in a game you are playing. If you cannot see any game servers in multiplayer:

remove the steam.cfg file

allow steam to update

re-edit your UI

replace the file.

Done, hope this helps