Ace42 2023 年 1 月 31 日 上午 2:16
Design Problem: You will get your account locked if you upvote reviews.
So this is a problem I've run into twice recently, and it's a major info sec design issue that needs to be addressed:

Twice I've (briefly) had my account community-locked for upvoting reviews with "malicious content".

I'm guessing (and it has to be a guess because Steam won't show you the content of the reviews it has found to be problematic) that some random user creating reviews I felt were informative lost their review blog's domain, and whoever bought the URL threw up some phishing / malware.

This is plausible given that I received two notification e-mails that my account was locked, each referring to a different review by the same user.

I appreciate users need to be protected from malicious content, but this implementation is unacceptable for a number of reasons, and needs to be reworked.

#1 It expects the userbase to be vetting reviews for dodgy links

Is it reasonable to expect users quickly parsing dozens of reviews to get an overview of a game to identify the existence of a scam solely by noticing that a review both has a link nestled somewhere in it - maybe at the bottom as part of a signature block, and then performing an impromptu investigation to determine if that link leads to a phishing site?

Because if people *following* the link are duped, then it is somewhat unreasonable to expect users who are barely registering that the link exists to have *greater* insight than the next user.

There's a fundamental - subconscious - assumption that Steam isn't hosting malicious content, and that casual use of the platform by legitimate users isn't going to result in penalties.
The current rule upends this, and means that you interact with Steam Community's features at your peril. It's antithetical to the purpose of Steam Community.

#2 It carries a severe penalty for what is a trivial and inconsequential action

There's been times when I've misclicked an up/downvote on a review, and been "meh, whatever" and kept scrolling. Look at all the low-effort identical ascii-meme reviews with hundreds of upvotes. This isn't an activity people are engaging in and going "this could maybe get my account perma-locked for repeat infractions!".

The penalty is so severe that it should deter users from interacting with Steam reviews at all.

#3 It's technologically unsound

Again, the information provided to the user is opaque, so I can't be certain of how the system is implemented. But judging by when I bought the games in question, I'm pretty sure the up-votes I cast must been at least a year old. The notification e-mails I received said that I had "recently" interacted with these reviews - which strikes me as simply false.

A year is ample time for a domain to be abandoned / hijacked / repurposed for malicious reasons - and don't give me a "delayed ban wave" excuse, that doesn't fly if you're deliberately exposing your userbase to malware by sitting on your hands for a year.

I have no way to be certain that the review wasn't altered after my upvote occurred

I'd like to think the design team are smart enough to realise that reviews can be edited post-facto to change their content and insert malicious links, but because of the opaqueness I have no way of being sure.

The system can't distinguish between a heavily invested user and a bot-farm's burner account

One of the two flagged reviews had *two* upvotes as far as I could tell from the e-mail, one of them mine - and I'm a legitimate user (as you can tell by the fact that my account is currently unlocked).
It seems likely that the system's method for identifying problematic upvotes is just "has this user upvoted a problematic author on more than one review" - which is pretty shoddy detective work.

If a reviewer publishing a review containing a malicious link *is* being pushed by a Chinese bot-farm, then naturally users browsing a category are going to come across reviews by the same user again and again - you'd expect legitimate users to be directed to reviews by that users.

There's no way to fix this issue post-facto

How would I go about unliking literally *every single review* I've ever clicked a thumbs up for? Because any of them can be edited by a user post-facto. I've been on Steam well over a decade - I wouldn't have a clue which of those reviews included off-site links that could now be dead / redirected / whatever.

For all I know, some long abandoned cruddy game that someone did a 3rd party patch for 12 years ago has a review with a link to that patch, the link's dead and now redirects to a phishing site - how am I supposed to remember that, go back and police it, and fix it?

We need an opt-out of Steam Communities button

Yes, I know it sounds drastic, and it is a bit hyperbolic - but I've got Guides on Steam that link to off-site information (game wikis, youtube videos, patches, mod pages, etc); I've got reviews that might link to a publisher's site or a screenshot hosted elsewhere, or who knows what; I've upvoted probably tends of thousands of games over the last decade.

I can't afford the time to go back through all of that and sort it with a fine-tooth-comb .

Give me a button to opt-out of all of that user-generated content I've provided for Valve, so that I don't risk losing access to my VAC secured games just for using the features provided in good-faith.

Because "Just stop interacting with Steam Reviews going forward" isn't an option when I've got years worth of upvotes behind me - any one of which could be pulled out of thin air to beat me with, evidence of me being a repeat offender, no less!
最后由 Ace42 编辑于; 2023 年 1 月 31 日 上午 2:49
< >
正在显示第 1 - 10 条,共 10 条留言
wuddih 2023 年 1 月 31 日 上午 5:28 
it is not an account lock. it is a temporary and section-limited restriction unless you are a repeat offender, then it ends in a community ban. it is not just "malicious content", it is all things that breaks rules, spam, hatespeech, etc.

solution: don't elevate/promote/upvote garbage that breaks rules and is likely to get removed.

something else you wanna know?
Ace42 2023 年 1 月 31 日 上午 6:08 
引用自 wuddih
it is not an account lock.

Tell it to the Valve employee who came up with the boilerplate e-mail text. In fact, tell it to the Support guy who used the exact phrase "your account is now unlocked" in his reply.
While you're at it you can tell him off for specifically sending me here, to raise this exact issue, with him stating that Valve staff routinely check on this forum for feedback.

unless you are a repeat offender,

Perhaps I wasn't clear: The delay on this moderation seems to have been at least a year if not longer. You could be identified as a repeat offender for maybe as few as three individual upvotes conducted over the course of *years* - with these upvotes cast *before* you ever receive your first notification that you have inadvertently been upvoting malicious content.

Hence, in the absence of changing the policy, the need for an "opt out" button to retroactively remove community interaction.

solution: don't elevate/promote/upvote garbage that breaks rules and is likely to get removed.

I gave an example of why this simply doesn't apply here.
But I'll reiterate it for the hard-of-thinking:

Imagine a diligent user spends time creating thoughtful, insightful, informative, professional quality Steam reviews. Imagine they include a link to their legitimate blog that collates and expands upon their reviewing.

Now imagine - months, if not YEARS later something happens - we'll say the reviewer is preoccupied with other stuff and can't be bothered to pay for hosting or whatever. The former content is now replaced by a phishing page, or whatever.
Whether automatically, or by a diligent user reporting the review - the Content Moderation system becomes aware of the problem and blocks the content - so far so good.

But it ALSO locks the accounts of all the people who historically upvoted this valuable content before this content broke a single rule.

So your solution actually leads to the hyperbolic point I was making: You can't elevate/promote/upvote *anything at all* that contains an external link - because any 3rd party site is vulnerable to being hijacked, hacked, sold off, etc, etc.

If, as seems possible, the content moderation isn't even checking to see if upvotes occurred before a review (or any other upvoteable Steam Community object, potentially) was edited - even a review not including a link at all could be problematic - as it can always be edited to insert a malicious link or other problematic content at a later date.

something else you wanna know?

Yeah, there is something. Why didn't it occur to you that the best bait for a scam would actually be high-value content that actually gives a user reason to follow a link in it?

Why would you assume someone going to the trouble of generating malicious content, content which is reliant on not getting down-voted for its prominence, would bother telegraphing the fact with disengaging "garbage" reviews?

Don't answer, I'm not interested in your half-baked knee-jerk hot-takes.
wuddih 2023 年 1 月 31 日 上午 6:34 
your choice.
TNDR 2023 年 1 月 31 日 上午 7:13 
e
RiO 2023 年 1 月 31 日 上午 10:47 
引用自 wuddih
your choice.

It's indeed your choice to assume all the risk that Valve piles on your account by partaking in the features of the platform that Valve designed.
You either use the features like Valve really wants you; because they want long player retention and they want users to engage with the community features to make that happen, or you discard those features. At which point one has to conclude that the features themselves are a failure.

The suggestion here is reasonable: Valve has nothing to lose in updating the platform to mitigate some of that risk, because some - if not most - of what the platform is doing in regards to upvote botting & fraud is really; really freakin' asinine. It's a system that is literally broken by design.

(This isn't the first time most of this stuff has been discussed either.)
最后由 RiO 编辑于; 2023 年 1 月 31 日 上午 10:54
Ace42 2023 年 4 月 15 日 上午 11:28 
最后由 Ace42 编辑于; 2023 年 4 月 15 日 上午 11:37
Garou 2023 年 4 月 15 日 下午 2:00 
They should really be deleting reviews and restricting accounts that make low effort "garbage" reviews and community content. Punishing people who upvote that stuff won't make it disappear.
最后由 Garou 编辑于; 2023 年 4 月 15 日 下午 2:00
Tanoomba 2023 年 4 月 15 日 下午 2:10 
引用自 reaper
They should really be deleting reviews and restricting accounts that make low effort "garbage" reviews
Why? Their opinions are as valid as anybody else's regardless of their ability to express them.
Count_Dandyman 2023 年 4 月 15 日 下午 3:51 
引用自 reaper
They should really be deleting reviews and restricting accounts that make low effort "garbage" reviews and community content. Punishing people who upvote that stuff won't make it disappear.
They already are taking action to remove reviews and deal with the accounts that post them when they violate the rules in place problem is people are very happy to use hacked or disposable accounts to do the posting and not care what happens to that account once the review has been placed this feature exists as a way to cut down on the mix of bots, willing accomplices and unaware assistants boosting the reviews visibility rapidly by voting.
Ace42 2023 年 4 月 15 日 下午 4:02 
引用自 Count_Dandyman
this feature exists as a way to cut down on the mix of bots, willing accomplices and unaware assistants boosting the reviews visibility rapidly by voting.

A feature which doesn't work to achieve this, and actually opens up more methods of abuse.

As you said, disposable / hacked accounts getting temporarily restricted from voting doesn't undo the votes; and the system is delayed enough for them to boost visibility for literally a year on countless reviews before it takes effect.

And then it runs into the dichotomy of: Any legit review can be edited once it has garnered up-votes, to make it malicious.
So either Valve have to ban people who upvoted a legitimate review; or else their system breaks because any co-ordinated attempt to grief the system could make a legitimate review, get the upvotes from all the hacked accounts, and then edit it knowing all of those spambots won't actually get banned because they voted before the review was objectionable.

It's fundamentally flawed as a system, and arguably unworkable:

Someone producing shovelware and trying to manipulate reviews could simply make their own negative review from a sock-puppet, garner all the upvotes, edit the view to something malicious, and thus get all the people critical of their shovelware banned from upvoting negative reviews on their game in one big go.
They've then got a full month to churn out other shovelware titles, knowing that most of their critics have been silenced and that negative reviews will have less prominence.
< >
正在显示第 1 - 10 条,共 10 条留言
每页显示数: 1530 50

发帖日期: 2023 年 1 月 31 日 上午 2:16
回复数: 10