The way you EOS is legally speaking theft and/or extortion. Practical suggestions to cheaply fix it

[cvr#seco]

Dear Valve,

being a senior SW engineer for over-a-decade , I fully understand why you need to EOS old OS support.

Still, there are different ways to do EOS. The decent and legal way to do End of Support is in the name itself - just stop providing *additional* support and updates, and renounce any legal responsibility for whatever happens to the unsupported instances. That's legal, ethical and okay way to go. That's the way we do it, BTW.

But that's not what you plan to do. Instead, you are about to revoke any and all access to play games which were bought for the full price (NOT on a reocurring-payment lease), by releasing a last "update" (actually a sabotage/malware) which will actively break and block all access to download and play all licensed games on the EOS'd systems. That is theft: I have paid you for a permanent license to a product, yet you want to effectively de-license me resp. actively sabotage and deny me access.

Yes, I understand that the "Unilateral amendment" troian horse in your legal terms gives you a perverse right to alter your Terms of Service in any way, so if you decide to require us all to submit 1000 photos of clown faces to unblock access to Steam, you could try to require that. Still, that doesn't alter the essence of your actions.

Your way of EOS is also textbok legal definition of extortion. Your EU Subscriber agreement is bound to the, quote, "law of the country where you have your habitual residence." Well this is our penal code extortion section:

"Whoever forces an other to do, not do, or suffer something using violence, threat of violence or threat of other severe detriment, will be punished by incarcenation for six months to four years, or financial penalty."

Your "EOS" is effectively saying - "Either you pay from your own wallet to a 3rd party, Microsoft, to buy their newest Windows 11, OR we will sabotage/steal/block everything you've ever purchased on Steam." Certainly a "severe detriment forcing to do something" in my book!


Being a Software Engineer who has worked on EOS-ing previous versions of our product myself numerous times, I fully understand the technical ramifications and complications - and also the alternatives. So I suggest these possibilities:

Option #1 - cheapest: Fine, cut me away from all the Steam Community and UI infrastructure, including any and all Steam Multiplayer, Community, Trade etc., to protect it against possible ITSEC compromise! But retain the last released version's capability to passively start, authorize, unlock and launch licensed and locally installed games, and recover local games from offline Steam Backup files. It's even cheaper than doing your "sabotage January 1 upgrade" - just adding a few firewall rules on your servers.

Option #2 - better: Before EOS, replace the problematic full-blown, GUI, Chrome-based Steam client on EOS-ed OSes with a simple commandline utility without any GUI. Still exclusively without Steam multiplayer support if the need be - that's legit for EOS.

That commandline utility would be automatically executed instead of the GUi Steam Client whenever the end user tries to manually run a game from it's installation folder, to authorize that launch versus the Steam Copy Protection - "steamcli.exe [PathToGameExe]" as the default argument[0]. It would also re-register to handle the "steam://" protocol handle in local Registry.

If the utility would even allow to download the licensed games using some CLI, eg. referencing a URL on steam website such as
"steamcli.exe -download store.steampowered.com/app/277820 -username=xxxx -password=yyyy -mfa=2AF1BC"
It'd be perfect and I'd even happily continue buying more Steam games over the browser. (And actually, some customers could even prefer it over the GUI client.)


But extortion, theft and sabotage are no way to do a legit End of Support.


P.S.: please don't redirect/hijack the topic to the excuses about why, malware, security risk and blah blah - that is NOT relevant to the point. The point is *how* to legally and ethically handle the EOS.

(Yes I know, deploy and manage dozens of WinSrv22/Win11 systems for our Dev Env and have good reasons not to upgade personally; no Linux Steam is not a solution as it doesn't support half the games; no remote-execution/streaming is not a solution license-wise; so please really stay on the how-to-EOS-legitimately topic.)

[Start_Running]

Diposting pertama kali oleh AmsterdamHeavy:

Diposting pertama kali oleh lsdninja:

I love how threads like this fail to realise that Valve’s own bean counters have already gone through this and what we’re looking at is the cheapest, most practical solution for them.

Exactly.

Yup. Its why this was sort of predictable. Once the userbase drops below 10% its on borrowed time. and once it hits 5% its dead.

Diposting pertama kali oleh Dendrobates Tinctorius:

Diposting pertama kali oleh cvr#seco:

being a senior SW engineer for over-a-decade

.....

Option #2 - better: Before EOS, replace the problematic full-blown, GUI, Chrome-based Steam client on EOS-ed OSes with a simple commandline utility without any GUI.

sounds good. as a senior software engineer this should be pretty easy. please update us on the github repository when you get it working.

Guy seems to forget that the UI doesn't mean jack ♥♥♥♥♥. its the certificates and protocols which are tied to the OS.

Diposting pertama kali oleh Dendrobates Tinctorius:

Diposting pertama kali oleh D. Flame:

Both of you. That is literally what he is describing. Alternative authentication servers

That's not what I'm describing. I'm talking about a client that has to authenticate with valve's servers. It can't download or play things that the account it's logging in with doesn't own.

For example, there are suggestions on these discussions to use steamcmd. Or forcing an old client to not update (which will break, lol).

The point is to make something that works on old systems while respecting the fundamental ownership to play requirement. Heck, if OP writes something reliable maybe valve will say it's ok to use. In any case, it would be nice for one of these suggestions to spend more time typing in notepad and less time posting repetitive yet unconventional legal analyses.

You'd need to create servers that use the old certificates and protocols. Or create what a mounts to a low security side door into a high security server, which basically oputs everyone else at risk.

Clients need to communicate with the servers to do anything and the server will only accept certain security protocols and certificates after a point.

[nullable]

Ah yes, software developer has an opinion, thinks their opinion reflects the law and ethics.

Dear OP, Valve operates differently than you believe you would under similar circumstances. Get used to it. You're not a lawyer, and it shows. Some users being unhappy their obsolete systems are no longer supported, and being forewarned ahead of time and choosing to do nothing about it is not "legally theft".

[Spawn of Totoro]

Diposting pertama kali oleh Start_Running:

Yup. Its why this was sort of predictable. Once the userbase drops below 10% its on borrowed time. and once it hits 5% its dead.

Less to do with the user base and more to do with OS support and support of other software common in the tech industry.

I am sure if XP was still fully supported, as well as Chrome for XP (and likely other software), then Steam would still be usable on XP, regardless of the market share.

[RiO]

Diposting pertama kali oleh Start_Running:

Wow. A senior software engineer that doesn't understand how CLient ->Servers work. If you have a cklient that is out of sync with the server what happens?

Nothing, if you apply proper versioning and allow the server to continue to talk in the old protocol format. Which for 99% of all cases that are existing features rather than shiny new features (which the old protocol won't ever ask for anyway) will just be a thin translation wrapper over the top.

Doesn't have to impact any security aspect either. (And won't, if you built your stuff properly.)
Not the least of which cryptography, as line cryptography is something handled at the network transport level and not the concrete program level APIs. (And even now, the old versions of Steam that work on old Windows still support HTTPS with the full modern cipher suite; and support both HTTP/2 and even HTTP/3.)

Diposting pertama kali oleh Crashed:

Diposting pertama kali oleh Start_Running:

Wow. A senior software engineer that doesn't understand how CLient ->Servers work. If you have a cklient that is out of sync with the server what happens?

And if you make the CLI cut down enough it will depend on the operating system for protocol and certificate support. That means EOL operating systems will lose coonectivity when server certificates are refreshed and use newer root certificates not understood by the old OS.

Except that wouldn't have to happen.
Chrome already ships with its own networking and cryptography stack, which will remain compatible with Windows 7 for ... well; probably for a long time. There's nothing in those libraries that wouldn't compile for Windows 7 or 8. And yes-- you can just use that library separately. Multiple Google products afaik do just that.


The main reason Chromium is dropping support for 7 and 8 is that Windows 10 and up contain some new system APIs that are very helpful with sandboxing of web content child processes and basically allow that sandboxing to be simplified; which doesn't just remove a heck of a lot of maintenance burden on that front, but also makes it safer. Because simpler code is easier to understand. And easier to understand; means easier to reason about threats and potential susceptibility to them; or easier to spot weaknesses or outright bugs that lead to vulnerabilities for sandbox escapes.

Diposting pertama kali oleh Start_Running:

Guy seems to forget that the UI doesn't mean jack ♥♥♥♥♥. its the certificates and protocols which are tied to the OS.

They aren't.

[Malfunctioning Robot]

Hey now he's pretending to be a software dev alongside a lawyer

[RiO]

Diposting pertama kali oleh Lithurge:

Diposting pertama kali oleh D. Flame:

My prediction:

Nothing will happen until Jan 1st or until makes their concrete plans known. Because Steam has terms in place to protect themselves from class action lawsuits from customers, customers will instead file complaints with EU regulatory bodies (you know, like the ones that already shutdown geo locking), then those EU bodies will be the ones to bring legal action against Valve and Steam.

Perhaps you should stop focusing on the EU's concerns re Geoblocking and look at their concerns re cybersecurity.

https://www.taylorwessing.com/en/interface/2022/the-year-ahead-ii/updating-software-will-the-obligation-in-2022-become-a-necessity-by-2024

This sets the stage for significant changes to take place in forthcoming years for all those Commission, updates should in future also play a part in ensuring product safety.

https://digital-strategy.ec.europa.eu/en/news/new-eu-cybersecurity-rules-ensure-more-secure-hardware-and-software-products

The Cyber Resilience Act introduces mandatory cybersecurity requirements for hardware and software products, throughout their whole lifecycle.

Note the reference to lifecycle, acknowledging that it has a set lifespan before it gets replaced. So no they're not going to force Valve to ensure their software works on an obsolete piece of software.

The Cyber Resilience Act is currently only in draft status and the legal text of said draft is available here:
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0454

Under Article 10.6 it already states that manufacturers are only required to guarantee conformance with the act's requirements when the product is placed on the market and the following period of its expected lifetime, or the first five years. Whichever is shorter.

Steam as a platform entered the market in the EU in, what? 2013? 2014?
They can pretty much do what they want wrt these requirements. They no longer apply.

The act does not have any handling for long lived digital platform services like Steam. Because it wasn't designed for it. It was designed for "products with digital elements" where those products are one-shot buy-and-use; that reaches an end-of-life and may then be treated as discarded.

The CRA is predominantly meant for stuff like smart-phones; the traditionally poorly secured IoT crapware flavor of the month; and off-the-shelf versioned software packages.

It was not designed for SaaS and long-living digital platforms.
The current legislation governing cyber-security for those is the Cybersecurity Act, which -- as the recitals for the Cyber Resilienc Act also point out again -- is voluntary, and basically amounts to an "EU-approved!"-certification that the platform is safe for use. The digital-space equivalent of the CE-marking, and nothing more.
(Actually; even less. Because the CE-marking is legally required for you to be allowed to import products into the EU and sell them to consumers. And getting your digital platform certified, isn't.)

The Cybersecurity act does have one mandatory component to it; but that is a governance component. It arranges for EU member states themselves the obligation to create an authority to serve as a competence center to provide education; awareness; and advice to legislators in the drafting of new legislation.
Its effects on the private sector are indeed all voluntary.

Outside of that, there are a few other regulations and directives wrt cyber security; but the mandatory nature of those again mostly only concerns the public and semi-public sectors. Not the private sector.

Diposting pertama kali oleh SlowMango:

Diposting pertama kali oleh D. Flame:

There is already push back against big tech and raising concerns about privacy, and going from Win 7 to Win 11 comes with a massive invasion of privacy. The EU is already clapping back against Steam (as seen in previous post) and Microsoft as of late:

https://www.reuters.com/technology/eu-investigation-into-microsoft-likely-after-remedies-fall-short-sources-say-2023-07-03/

You're deluding yourself if you think this is the same climate as 16 years ago.

Except the EU's "clap back" was something that's been going on for years and was their 3rd try at flinging ♥♥♥♥ to a wall. Which, ironically, made it worse for consumers.

If by 3rd attempt you mean the case against Valve wrt geo-blocking:
it's the other way around.

It's Valve's failed 3rd attempt to get out from under paying their fine in appeal.
The 5 indicted publishers already took the L; cordially complied with further investigation; paid their dues and moved on. Valve is the only one that keeps resisting and keeps appealing against the same verdict, which so far has consistently stood: they're guilty, and they have to pay that fine.

But each time they appeal, they can postpone paying that fine. And there's always the possibility that they may find a court that's willing to see things their way. So why not gamble on a few 100k worth of legal fees to try and cut back on a 1m+ fine?

It's a consideration of risk vs reward.

Diposting pertama kali oleh The End:

Diposting pertama kali oleh D. Flame:

That's what Steam said about Geo locking game keys too. They said, "it's in out ToS so you have to comply." Then they lost in court. They appealed. Then they lost in court again, unless I am misremembering something here.

And yet, geolocking is still a thing.

Not within the EU market it isn't.
Which is what that case was about.

Diposting pertama kali oleh Dr.Shadowds 🐉:

- Geo locking can only happen if approved within EU by said country that want to block said content, otherwise it's not allowed to block content if sold in the EU such as EEA.

The relevant legislation here is EU 2018/302[eur-lex.europa.eu] - the Regulation on addressing unjustified geoblocking and other forms of discrimination based on customers' nationality; place of residence; or place of establishment.


And it reveals your statement to be incorrect.
Article 4 disallows the trader to apply different conditions of access to goods or services based on nationality; place of residence or place of nationality. But Article 4.1b provides an explicit exemption from this prohibition where said services have as their main feature, the provision of access to copyrighted works or the selling of such works.

This exemption was put into the legislation to avoid the friction and problems that would otherwise exist with free commerce and regional distribution rights on intellectual property.

However, Valve cannot use this as a legal defense because at the time of the events they were being indicted for, this legislation didn't exist yet in that form. The old legislation afaik did not have this exemption.

But even if it would, a main point of contention would be that there is precedent the purchased key does not represent a finalized transaction; but is still a transaction that is in-process until it is actually consumed and the content is added to the account.
As such it would conceivably count as being treated under Article 3 of that same regulation, which disallows different conditions of access to an online interface - which is defined as including store fronts; purchase management; etc. And that one does not offer aforementioned exemption wrt (access to) copyright protected works.

(Ironically; it would be legal to let you register the key; let you add the game to your account; and then refuse to let you install it unless you physically moved to an allowed region, and could provide proof of residence.)

Diposting pertama kali oleh Dr.Shadowds 🐉:

- Geo locking is acceptable when it outside of EU as EU can't force companies that is not EU, to provide access to same deals that outside of the EEA/EU. That means people from EU can't demand rights to have access to buying a regional key in country outside of EU, example Argentina that is in South America, as much people love, and drool at the idea being able to buy games at ~98% off for regional price difference.

Yup. That is correct.

Diposting pertama kali oleh Dr.Shadowds 🐉:

- Steam doesn't make profit from key, as all keys are free, and has zero sale cut, keys are sold by publishers/devs, and 3rd party stores as all money goes to them, not steam so it not possible for steam to make profit as you're trying to pin it, as this case is about geo block on keys, not the store itself.

What was relevant to the case was that Valve used the ability of Steam's platform to offer price segregation within the EU market as a selling point towards publishers to publish through the Steam platform. And as such, that directly translates to their 20-30% take on the copies of those titles they did sell through Steam.

This is the line of reasoning under which the court judged Valve to have a financial stake in things. And is the reason they were added to the indicted parties.

Look up the case documents on CURIA. It's all in there. They've been opened to the public.

[cvr#seco]

Regarding client-server:
Excuse me, I didn't notice that this functionality is written in the legacy Win32 API, so it breaks down with the OS... Oh wait, it isn't. It uses those magical things called "frameworks", even "open source frameworks" which implement REST, XML, SSL/TLS, TCP, HTTP and everything else. The only thing which remains closely coupled to the OS are the TCP Sockets. Would you please explain to me how client-side sockets implementation affects the server?

Regarding the exodus:
Unfortunately, Steam managers are right. Steam has achieved a near-monopoly - ever since they did it first time with XP, I tried hard to buy CD/DVD versions as before Steam... Only to find out that it's pretty impossible. All the stores are selling pseudo-DVD releases which are actually a Steam Key+Steam Backup! The only alternatives are GOG (great but with limited selection) and vendor-specific & vendor-limited Steam-like systems like EA's.

Regarding legal:
You are wrong on the basic premise, my friends. Per the Steam Subscription Agreement, it is fully fine if the Client is EOS-ed for the legacy systems as you say. But EOS means just that - no longer support, no longer updates. It DOES NOT mean pushing a "sabotage update" which kills/breaks/disables the previously-working installation. Can you comprehend this difference?

I work on a multi-million dollar product in Enterprise SW. If we did this to our customers - send them a "sabotage patch" to break their legally licensed, but EOS instances? They would stomp us to the ground and sue us to bankrupcy. But these guys kinda have a different access to top-end lawyers than Steam's customers, which is exactly what Valve is counting on.

Regarding normality of updates:
My friends, you have no idea. In Enterprise Software, it's completely normal that some customers are years behind on updates and sometimes years behind EOS - we've had a Japanese bank who was happily 10+ years behind EOS, doing just fine in their exotic-specific environment!

You have no idea what is the customer's Concept of Operations and what is the Topology of the customer's end-use. Forget the notion that evereyone else in the world uses the software the same way you do - much less that everyone else should or even must use SW the way you do! That's Junior Developer assumption which must be beaten out of the head of any new hire. Respect the customers in their weird ways.

Regarding Linux Steam:
Since they did it first time, I angrily avoided shopping on Steam unless when they misued their monopoly for a game I absolutely wanted - for ArmA3, for Insurgency Sandstorm, and I denied myself a want for Ready or not and Aerofly FS4.
Are you saing that these games work on Linux Steam although they are not listed as Linux-compatible?

[William Shakesman]

Diposting pertama kali oleh Malfunctioning Robot:

Hey now he's pretending to be a software dev alongside a lawyer

This entire forum is for people to pretend to be valve employees and/or gamers.

[cvr#seco]

Philosophical addendum: the only thing I want is the freedom and fundamental consumer right to use product's I've bought before. I have a full shelf of CDs and DVDs with games from Windows 95 to anything supported on Win7. Their license terms always stay the same as when I bought them decades ago, and I can always install and run (well attempt to run) the SW on my computer.

The online-activation itself is a huge dent into the customer's fundamental rights, because what you've legitimately bought is castrated when the license key server goes down. But at least some of such SW will keep working in offline mode if it was unlocked once and never uninstalled.

That's the only thing I demand from Valve - not to actively sabotage my installed products. I don't want to be forced to crack the software which I legally licensed for full price - much less that even though completely justified and ethical when owning the license, such act is (absurdly) illegal under both DMCA and EU law.

[William Shakesman]

Not for nothing but in the time it took you to write just the OP of this thread you could have done that for basically everything.

[Mad Scientist]

Diposting pertama kali oleh cvr#seco:

Unfortunately, Steam managers are right. Steam has achieved a near-monopoly

They are popular, not a "near monopoly" seeing as many other sites successfully exist and they do nothing about it. We've been over this one, a lot.

Diposting pertama kali oleh cvr#seco:

If we did this to our customers - send them a "sabotage patch"

The updates simply work with some things and not others, any software engineer would know that. It's like trying to run a 64bit app on a 32bit system, which a software engineer should know is the gist of how things can cease working when updated; it becomes incompatible with some things to remain up-to-date.

Diposting pertama kali oleh cvr#seco:

You have no idea what is the customer's Concept of Operations and what is the Topology of the customer's end-use.

As far as Steam users are concerned; launch steam, it updates, you login. Sometimes, OS support is dropped. Update the OS or restrictions may happen due to incompatibility. The End.
Kind of like how newer games need newer drivers/versions of the OS to work correctly or else they'll just crash nonstop.

Diposting pertama kali oleh cvr#seco:

Regarding Linux Steam:
Since they did it first time, I angrily avoided shopping on Steam unless when they misued their monopoly for a game I absolutely wanted - for ArmA3, for Insurgency Sandstorm, and I denied myself a want for Ready or not and Aerofly FS4.
Are you saing that these games work on Linux Steam although they are not listed as Linux-compatible?

Again, not a Monopoly.
Any Windows game should work on Proton as long as the hardware is able to handle the load.

Proton - ARMA 3 is Compatible
https://www.protondb.com/app/107410

Proton - Insurgency Sandstorm is compatible
https://www.protondb.com/app/581320

[Malfunctioning Robot]

You'd think a selfproclaimed expert would have already known that

[William Shakesman]

Oh yes totally not a monopoly just like the banking system offers dozens of credit cards through the same two companies with identical policies there are dozens of game sites that sell steam keys. Real monopolies have never been tried.

That said Proton is well worth researching. Valve doesn't like upgrading Windows any more than you do and Proton is an effort they have funded to make Linux gaming actually viable. If you want niche games you can only get on Steam (musou for instance), those will probably also be the ones that perform lousy in Proton but it handles a lot of stuff really well. Next time you see the Win 11 banner coming you could jump ship to Linux instead

[William Shakesman]

Diposting pertama kali oleh Malfunctioning Robot:

You'd think a selfproclaimed expert would have already known that

Now I am convinced you are an actual valve forum moderator.

[Malfunctioning Robot]

Diposting pertama kali oleh William Shakesman:

Diposting pertama kali oleh Malfunctioning Robot:

You'd think a selfproclaimed expert would have already known that

Now I am convinced you are an actual valve forum moderator.

Don't care, didn't ask