Just your normal everyday casual software dev. Nothing to see here.

  • 0 Posts
  • 2.19K Comments
Joined 3 years ago
cake
Cake day: August 15th, 2023

help-circle



  • Alternative Operating Systems other than Windows.

    Yes most alternatives probably /could/ work but I don’t want to become the tech support for it and I also don’t want to give the trial by fire method. If someone was actually interested in it, chances are they would reach out themselves any time I mentioned about being on Debian, at which case I would help them get started and answer questions but, I’m not about to actively try to persuade people to change.





  • Yeah, I do agree your jurisdiction may vary.

    In the US at least, you can’t change a terms of purchase via a terms of service.

    So if it was stated at point of purchase that your system will be getting 10 years of updates, and then they decided six years in, you know what? We’re actually only going to do six years of updates, and then posted a terms of service that changed how long they were able to update it. That wouldn’t be legally binding.

    In this case, though it doesn’t sound like they’re changing existing buyer’s agreements, it sounds like they are changing the purchase agreement for new consumers who haven’t purchased the product. which is far more legally enforceable as no agreement has been done in that case.

    Still a shitty thing for them to do though, considering that they had promised that Chromebooks would have 10 years of updates but I don’t think they’re in violation of anything since it sounds like it’s only going to new consumers.








  • That would make sense, although I think it’s unlikely that it embeds itself into the mods. It would probably replace itself. Since in order to embed itself into the mod, it would have to know how the mod is made/structured but I guess it would be possible if it was able to completely replace the existing mods with the worm.

    edit: Yeah, a post-work summary was posted today, and it basically did exactly that, it replaces all workshop mods created by the user with a copy of the worm, which then spreads. Honestly, I feel like this is also a vulnerability on Steam’s behalf as well because I don’t see any realistic use case of why it shouldn’t require either a 2FA or some form of validation before pushing an update to the game, especially one that changes the entire mod out for something else.

    This one happened to be allowing C-sharp integration, which is how the original infection happened, because that allowed for compilation at runtime. However, this vulnerability could technically happen with any Steam Workshop-enabled game. It’s really concerning that there’s no check system in place. The Steam depot should not allow you to be able to do a full mod replacement using a session or with token.