73 people found this review helpful
3 people found this review funny
3
3
3
5
Not Recommended
0.0 hrs last two weeks / 819.3 hrs on record (818.9 hrs at review time)
Posted: Jun 5, 2024 @ 1:36pm
Updated: Jan 25 @ 4:04pm

This is not a full game, it's a half-finished prototype that is also malware. The client is insecure, many features don't work, and the documentation is frequently wrong.

To give you an example: There are two different "world map" views you can choose from. Both of them are extremely slow to load, often making you wait 10+ seconds before you can see stuff. (And then it has to load again every time you drag to view another area.) One of the map views doesn't allow you to see player-drawn visuals (which the documentation doesn't mention), which makes it unhelpful as you can't have your code display anything about what it's doing. The other map view does display player visuals, but does not display the correct room terrain; it seems to be rendering totally different rooms. It also doesn't show the location of any of my units, and for other players it displays their units in a color of their choice, which means if that player chose grey as their color, I can't see their units as they blend into the background. This feels like something someone threw together in a week and then shipped without any testing.

It's a shame, as I love the idea, and I've had fun playing around with it even despite all the issues. But it's been very frustrating trying to get anything to work when the documentation is so lacking; I just spent a while debugging a pathfinding issue, which turned out to be because the documentation claims that the built-in PathFinder module always finds the best possible path, but that was not true, it uses a heuristic that sometimes finds very inefficient paths.

Even worse than the in-game bugs are the client bugs.

First off, the game doesn't work on any version of MacOS that uses the new Apple Silicon chips. The Steam listing that says it's Mac-compatible is false.

Secondly, the client contains an XSS vulnerability that can potentially allow any player in the same server you're playing on to remotely take over your computer. They get full command-line access to the user account on the computer that has the Screeps client installed; they can read or edit any file anywhere on your computer, read your email, etc. This vulnerability is very easy to exploit, I tested it on myself and got it working in just a few minutes. This bug was reported more than 9 months ago, and has been completely ignored by the developers, despite having a simple one-line fix. This is flabbergastingly irresponsible, and it's only a matter of time before someone malicious uses this to steal private data or install ransomware.

As such, I can't recommend paying any money for this, nor even installing the client on your device if you don't know how to protect yourself from the XSS attack. It's a wonderful game concept, but the developers clearly don't care about delivering a quality product, and are willing to put up a deceptive Steam listing and put their customers in danger just to earn a few thousand dollars.

Edit: I see one of the game devs has replied claiming that no such vulnerability exists. You can easily verify for yourself that this is false, Github issue #162 has steps to reproduce.

Edit 2: The RCE vulnerability has finally been fixed after an article I wrote about it went viral. So the game is now safe to play.
Was this review helpful? Yes No Funny Award
Developer response:
artch  [developer] Posted: Jan 25 @ 11:01pm
The mentioned lack of console log filtering has been fixed on January 25, 2026: https://store.steampowered.com/news/app/464350/view/516358814171138803

I would also like to assure you that over the past 10 years, this approach has never been used by any user to cause harm; we have been monitoring this throughout that time.
10 Comments
HerrKai Jan 26 @ 6:43am 
🤡
Daxten Jan 25 @ 8:06am 
You should make a post about curl having a XSS vulnerability
RayderBlitz Aug 1, 2024 @ 3:05am 
This review seems to be riddled by half-informed slippery slope fallacies at best, and malicious at worst.
To address my major concerns with it:

1.) XSS attack vector:
The game gives you freedom to implement scripts and such in various output formats for your convenience. Without you executing stuff nothing will happen. Dont wanna risk it? Dont implement it.
It's akin to saying we should ban cars because people could run them into buildings...

2.) Docs and Updates:
Granted, there are some things that are not quite clear and parts of it should be improved. Some stuff is also in an in between state. The *alpha* map for example is planned to be the new map once done, but the docs already partially treat it as implemented, which can be an issue.

3.) Client & Server Optimization:
This is one of the major grievances of the community. They should be optimized since it'll give a better experience for the players and even save the devs money on server costs.
Hangrybear Jul 28, 2024 @ 3:08am 
Appreciate the review, it has made me reconsider buying the game. The developers seem dense if they are willing to leave open an XSS attack vector.
wtfrank Jul 26, 2024 @ 12:55pm 
I disagree that this is any more a prototype than any other live service game with periodic updates
HerrKai Jul 25, 2024 @ 11:29am 
You Are Not a Clown. You Are The Entire Circus.
Zed Jul 23, 2024 @ 7:14am 
Wow that's disappointing you have to patch this out on your end in the server.
KingSupernova Jul 11, 2024 @ 1:18pm 
I don't believe any of the issues I mentioned have been patched. And in fact for the XSS vulnerability, the devs just responded to the bug report, saying they're not planning on fixing it.
AssassinBear Jun 10, 2024 @ 8:26am 
@Zed, seeing as its been 3 months since last update/changelog, i doubt it
Zed Jun 9, 2024 @ 8:27am 
What is the patch for this, and has this been patched yet?