Sandbox games and mods for security

[Poison Dart Frag]

I just saw this vid:

YouTube™ Video: they found ANOTHER back door (game mods are crazy) 

Views: 338,989

This is why I don't download game mods. Another backdoor has been found, this time in a popular modular for City Skylines 2 by paradox games. Checkout what happened in this video.

And it got me thinking; Steam would have quite a big extra selling point if it could provide an additional layer of security by keeping games from doing bad things to the system they're running on, accessing files they have no business accessing etc.

[Brian9824]

Why not ask Microsoft to do it, or your antivirus? They have just as much ability as Steam.

Steam doesn't know what the software does, what files it accesses, etc. It's not monitoring your PC, etc

[Poison Dart Frag]

Originally posted by Brian9824:

Why not ask Microsoft to do it, or your antivirus? They have just as much ability as Steam.

Steam doesn't know what the software does, what files it accesses, etc. It's not monitoring your PC, etc

Steam sells you games, and you launch games from it; they seem to be in a particularly good position to add additional protections for this kind of software in specific, and it would be an additional benefit they would have over the competition.

[Mad Scientist]

Originally posted by Poison Dart Frag:

Originally posted by Brian9824:

Why not ask Microsoft to do it, or your antivirus? They have just as much ability as Steam.

Steam doesn't know what the software does, what files it accesses, etc. It's not monitoring your PC, etc

Steam sells you games, and you launch games from it; they seem to be in a particularly good position to add additional protections for this kind of software in specific, and it would be an additional benefit they would have over the competition.

Anti-virus and anti-malware companies that have been doing so for decades are better suited for the tasks of system protections.

It would also add needless redundancy and thus bloat to the client when the OS has integrated malware/av but security apps with said decades of experience are better suited for system protections than people that made and maintain a video game store library client.

[Poison Dart Frag]

Originally posted by Mad Scientist:

Originally posted by Poison Dart Frag:

Steam sells you games, and you launch games from it; they seem to be in a particularly good position to add additional protections for this kind of software in specific, and it would be an additional benefit they would have over the competition.

Anti-virus and anti-malware companies that have been doing so for decades are better suited for the tasks of system protections.

It would also add needless redundancy and thus bloat to the client when the OS has integrated malware/av but security apps with said decades of experience are better suited for system protections than people that made and maintain a video game store library client. :humiliation:

Specialization has some benefits over trying to do a more general work; a lot less edge cases to worry about, much narrow scope to focus on.

[Mad Scientist]

Originally posted by Poison Dart Frag:

Originally posted by Mad Scientist:

Anti-virus and anti-malware companies that have been doing so for decades are better suited for the tasks of system protections.

It would also add needless redundancy and thus bloat to the client when the OS has integrated malware/av but security apps with said decades of experience are better suited for system protections than people that made and maintain a video game store library client.

Specialization has some benefits over trying to do a more general work; a lot less edge cases to worry about, much narrow scope to focus on.

Specialization is why if you want good security software you buy from a reputable security software company.

When it's well made it handles anything being downloaded, installed, moved, what's being accessed & how it's being accessed etc. Good ones wont give false positives either.

If you want AV/Anti-malware, buy from a company that specializes in that.

[Ben Lubar]

Originally posted by Poison Dart Frag:

Originally posted by Mad Scientist:

Anti-virus and anti-malware companies that have been doing so for decades are better suited for the tasks of system protections.

It would also add needless redundancy and thus bloat to the client when the OS has integrated malware/av but security apps with said decades of experience are better suited for system protections than people that made and maintain a video game store library client. :humiliation:

Specialization has some benefits over trying to do a more general work; a lot less edge cases to worry about, much narrow scope to focus on.

If you're looking for sandboxed versions of Steam, try the flatpak version.

Sandboxing doesn't magically become easier when you know that the software is supposed to be a video game. Video games still have a huge list of things they could need to do, and file access isn't even a slightly uncommon one.

[Brian9824]

Originally posted by Poison Dart Frag:

Originally posted by Brian9824:

Why not ask Microsoft to do it, or your antivirus? They have just as much ability as Steam.

Steam doesn't know what the software does, what files it accesses, etc. It's not monitoring your PC, etc

Steam sells you games, and you launch games from it; they seem to be in a particularly good position to add additional protections for this kind of software in specific, and it would be an additional benefit they would have over the competition.

Again, Steam doesn't have the capability to monitor and control your system. That is what anti virus software does.

Also they can't do what your saying, if you run Game X steam doesn't know if they need to access File X or not. They didn't develop the game nor do they have any way to know what files it needs access to in order to run.

This type of functionality is better kept to the OS and Antivirus level, and it would require Steam having full access to your PC to a level that most people wouldn't want and require Steam to track everything that is occurring on your PC, all your actions, all the files being accessed, etc.

[Poison Dart Frag]

Originally posted by Ben Lubar:

Originally posted by Poison Dart Frag:

Specialization has some benefits over trying to do a more general work; a lot less edge cases to worry about, much narrow scope to focus on.

If you're looking for sandboxed versions of Steam, try the flatpak version.

Sandboxing doesn't magically become easier when you know that the software is supposed to be a video game. Video games still have a huge list of things they could need to do, and file access isn't even a slightly uncommon one.

But there's a huge list of thigns the large majority games would not be expected to need to do; and you can always have an customizable exceptions list for any remaining edge-case the user may encounter.

[Brian9824]

Originally posted by Poison Dart Frag:

Originally posted by Ben Lubar:

If you're looking for sandboxed versions of Steam, try the flatpak version.

Sandboxing doesn't magically become easier when you know that the software is supposed to be a video game. Video games still have a huge list of things they could need to do, and file access isn't even a slightly uncommon one.

But there's a huge list of thigns the large majority games would not be expected to need to do; and you can always have an customizable exceptions list for any remaining edge-case the user may encounter.

Large majority means lots of exceptions, and as a STORE that sells games it wouldn't look good for Steam if they were flagging their own games they sell and interfering.

Again, not to mention that means Steam would have to have pervasive control of your PC which most people don't want.

[Poison Dart Frag]

Originally posted by Brian9824:

Originally posted by Poison Dart Frag:

But there's a huge list of thigns the large majority games would not be expected to need to do; and you can always have an customizable exceptions list for any remaining edge-case the user may encounter.

Large majority means lots of exceptions, and as a STORE that sells games it wouldn't look good for Steam if they were flagging their own games they sell and interfering.

Again, not to mention that means Steam would have to have pervasive control of your PC which most people don't want.

It's the opposite of taking over your PC, it's keeping things it does (including additional apps it launches) from touching the rest of your PC except when you tell it it's ok.

[Ben Lubar]

What scary things can a game actually do to your system? Start a server? No, the Windows firewall blocks that by default. Read and write files? Pretty much every game has to do that already. The game runs on Windows, not "on Steam", so Steam would have to intercept calls to Windows APIs in order to do any kind of filtering. Install device drivers? Can't be done unless you run Steam games as admin. Play loud noises? Strobe lights? Say bad words where your mother can hear? Steam can't reasonably be expected to be able to control any of this.

[Brian9824]

Originally posted by Poison Dart Frag:

Originally posted by Brian9824:

Large majority means lots of exceptions, and as a STORE that sells games it wouldn't look good for Steam if they were flagging their own games they sell and interfering.

Again, not to mention that means Steam would have to have pervasive control of your PC which most people don't want.

It's the opposite of taking over your PC, it's keeping things it does (including additional apps it launches) from touching the rest of your PC except when you tell it it's ok.

Nope, its actually the opposite of what you are claiming. Its giving Steam full control over your PC and the ability to do things that Steam should not be able to do It requires Steam to be able to stop software from launching on your PC, track file use, etc

Originally posted by Ben Lubar:

What scary things can a game actually do to your system? Start a server? No, the Windows firewall blocks that by default. Read and write files? Pretty much every game has to do that already. The game runs on Windows, not "on Steam", so Steam would have to intercept calls to Windows APIs in order to do any kind of filtering. Install device drivers? Can't be done unless you run Steam games as admin. Play loud noises? Strobe lights? Say bad words where your mother can hear? Steam can't reasonably be expected to be able to control any of this.

Yep, this is something that is the domain of the OS and the anti virus software, gaming stores should not have that ability.

[Poison Dart Frag]

Listen, what exactly Steam currently cannot do, that you are expecting would become possible with this idea, that would be detrimental to the user?

[BJWyler]

Originally posted by Brian9824:

Originally posted by Poison Dart Frag:

It's the opposite of taking over your PC, it's keeping things it does (including additional apps it launches) from touching the rest of your PC except when you tell it it's ok.

Nope, its actually the opposite of what you are claiming. Its giving Steam full control over your PC and the ability to do things that Steam should not be able to do It requires Steam to be able to stop software from launching on your PC, track file use, etc

Originally posted by Ben Lubar:

What scary things can a game actually do to your system? Start a server? No, the Windows firewall blocks that by default. Read and write files? Pretty much every game has to do that already. The game runs on Windows, not "on Steam", so Steam would have to intercept calls to Windows APIs in order to do any kind of filtering. Install device drivers? Can't be done unless you run Steam games as admin. Play loud noises? Strobe lights? Say bad words where your mother can hear? Steam can't reasonably be expected to be able to control any of this.

Yep, this is something that is the domain of the OS and the anti virus software, gaming stores should not have that ability.

Exactly. Steam is there to buy and launch games. It should not be doing anything more than that, nor do I want it to.

Steam has systems in place to check games and the workshop against malware. That is all it needs. No system is perfect, nor will it ever be.

[Brian9824]

Originally posted by Poison Dart Frag:

Listen, what exactly Steam currently cannot do, that you are expecting would become possible with this idea, that would be detrimental to the user?

Yes, Steam having the ability to stop software from working, triggering false positives, etc is incredibly detrimental to the user. I can choose which Antivirus I use for instance, many are notorious for false positives.

That isn't even taking into account that many games on Steam have no DRM at all, and don't even need steam running to work. I do not want steam to be able to track what files I am using, what is running on my PC, etc. It's none of their business.