That's why Spitz said to be angry in the Steam reviews instead of their Discord. People mistakenly took it as a dismissive whine, but that was actually a very important comment that I feel many people overlooked. Sony ain't gonna do anything differently unless there is actual, tangible damage to their brand. That damage doesn't come from chat rooms, that comes from storefront reviews.
Keep the bad reviews coming if you want any hope of Sony relenting.
You’re absolutely correct, how many of those reviews are pointing the blame correctly? I haven’t seen a single one yelling at Steam or arrowhead for selling the game in these markets that wouldn’t be able to play the game.
There’s no way Steam is 100% in charge of what regions a game is available in. The publisher absolutely has a say in where, and if it was available in all regions at the start that was on purpose.
The company that published the game likely updated the region it can be sold in. Steam just offers a platform.
Steam/valve is literally not to blame at all for any of this. Do you work for epic games or something?
I’m all for putting the blame where it needs to be, but you’re just shooting at all parties involved indiscriminately. Like blaming a rental company for a death in a traffic accident because they own the car.
It is also wholly possible that Steam changed the availability themselves, so you can’t take all the blame away from them, but like I said originally, this is Sony’s fault first and foremost as the publisher would have first say on regional availability.
Multiple being TWO at most, one nestled in the effectively credits section of the Steam page which almost never contains information pertainant to the purchase of the game, and another nestled in the “Skip over this usually optional content” settings after you have already installed the game. I didnt even know this game was linked to PlayStation in ANY WAY until this whole fiasco. Its only uneducated because it was HIDDEN.
Reminder that the hours played rule is only a limit for the automated refund system. You can request a refund for a game at any time for any reason. It just has to be manually reviewed and deemed justified by a person.
This isn’t about Sony “relenting”, Arrowhead needs Sony’s PSN support network to deal with support tickets: it’s the whole reason Arrowhead signed up with a publisher instead of self publishing and developing an international workforce of support agents. I hate Sony as much as the next person but let’s be honest, Arrowhead needs Sony and PSN, and it makes sense given they want to spend their time making games rather than getting into being a publisher and help desk.
Ultimately, Arrowhead should have made it a day one requirement and delisted the game on Steam for every country that lacks PSN support. Instead Arrowhead and Sony decided to let it ride and enjoy the sales and accompanying popularity.
And now because of that the PSN requirement is a poison pill. If that was a requirement from the get go, I likely would have reluctantly agreed to it. It now being retroactively enforced means if Sony doesnt relent, I and likely a lot of others will abandon the game and do what we can to get a refund, which will end up costing them a lot of money
It was a requirement from the beginning but it was not enforced due to the initial server issues. It was always there…
Not saying it’s a good thing but a lot of the discourse I see online seems to overlook that crucial detail and imply this was pulled out of the blue with no warning.
I can fully understand the agreement between the two parties was “also requires a psn account” while AH being completely unaware that getting a PSN account is so restrictive.
Sony likely didnt explicitly add that the game cannot be sold in regions where they can’t create an account.
Edit: or the didn’t explicitly state which regions a psn account CAN be created in.
It was a bit frightening for me to see how quickly the mob turned on AH during this fiasco and just how much vitriol and propaganda has been generated on the subreddit like this is any other ingame operation with the associated shitposting... except this time it could very well shape the futures of real people and fate of the company for years to come.
Unfortunately this is the only way to accomplish anything. If there wasn't an outcry like this both AH and sony would just ignore any criticism and move on until it gets buried and forgotten. It's a world of extremes and the scales could have easily tipped into the other side, with people rightfully complaining about these shitty practices but getting ridiculed for complaining about just another account or sth.
And that second option already happened with this exact game when people expressed concern over the DRM, which is designed like a rootkit, giving it essentially full control/access to your system while it’s running.
Temp email+fake PII is my go to when this happens. I really appreciated Larian letting me skip straight to the game with BG3. Stuff like this should always be optional.
It SHOULD be optional but corporate greed wants your data. Just Cause 3 is still sitting unplayed on my Steam account for this exact reason and I fucking loved Just Cause 1 and 2
I personally don’t understand the whole thing of a fictional character in a video game where there is absolutely no romance anywhere having a preference. I don’t care whether my character in a game like Borderlands is straight, gay, lesbian, or anything in between so long as I can pop the heads off my enemies.
Okay, but then leave it ambiguous and let people think of the character whatever they want. It doesn’t matter if doomguy was gay, it matters that he slays
LGBT people deserve explicit representation as much as cishet people do, and cishet representation is all over media
Even if there’s a LGBT coded character people will fight to death to say that they’re actually very straight and that the degenerates are attacking them personally
The ratio of representation is off, because the ratio of clientele is off.
When the demand grows, demand from actual paying customers, the representation will rise. Get more diverse people playing and creating games, and you’ll get more diverse games.
Forcing representation has never helped any group, ever.
I don’t necessarily disagree, but my question would be how to quantify the number of LGBT characters/games. If we assume LGBT people comprise about 10% of the population, we would expect about 10% of the content should reflect that perspective/experience. To argue that LGBT content should be actively encouraged and expanded, one would have to demonstrate some kind of data regarding the relative prevalence of LGBT content, no?
Or is that point moot, because you believe it’s a desirable outcome to have an inflated media presence due to the fact that the LGBT community is a minority? I wouldn’t necessarily disagree with that either, but it’s a very different argument than fighting for equal representation.
It seems to me that you’re the one doing some weird gay ratio calculus. As far as I’m concerned, there is plenty of LGBT representation in video games and LGBT creators and consumers are perfectly able to create and consume all sorts of content that suits their sexual preferences. Sexuality can be emphasized or it can be minimized, depending on the individual preferences of the creators and consumers.
But you think that this state of affairs is problematic, and that we need to be making a strong effort to make sure that video game characters are explicitly stated to be LGBT as much as possible. Feels pretty egocentric; your obsession with having characters in media reflect your own traits would seem to indicate a difficulty empathizing with people from other groups with different experiences.
You can have whatever headcanon you like, but imagining that fictional characters are gay and getting angry when others don’t indulge your fantasy doesn’t seem like the most enjoyable activity. Just let everyone interpret art however they want. Thank you for your cooperation.
Why do I think that? Because that’s how a capitalist market works.
Demand creates potential value. And no game developer would leave potential value untapped.
If there were a few really bestselling LGBT games, others would hop on the wagon, the market will get saturated for a while, and then it levels out a bit and some good concepts remain.
And then of the characters significant other is important? Like they complained about Spimer-Man 2, despite the playable characters not even being gay. We know that because we know who they are after.
It Takes Two. Me and my boyfriend played it. Beautiful game. Loved it. Plan to wait a few years and play it with him again. It’s about a straight couple. I can’t imagine how that game would work if we didn’t know that. Like I guess we could keep stretching the argument to “Well they could be bi”, I guess. We don’t need to know that. But it kind of helps to know they’re married to know the story. Otherwise it’s gonna get weird with the kid involved.
We don’t have to try and out progressive everyone for everything. A story can have a romance and we can see the romance and we can know who they’re dating and we can know they’re sexuality. None of this is the issue.
Your example would make sense in Doom. Sure. I’ve literally never seen anyone ask for it in doom. It’s a terrible example because it’s not that kind of game.
But for many games where the story is actually a big part, and not for games like Doom where the story really doesn’t matter, it’s fine. We can still celebrate love in really any shape or form(thats not harmful). If a game wants to avoid it, thats also fine. Once again, not arguing every game needs it. But if that’s the story, that’s the story, and it seems pointless to be angry that you know who a character is dating.
The movement for queer acceptance isn’t for people to be hush hush and for us to make the closet bigger to invite straight people in. It’s to get people out.
That’s an interesting one because I actually always headcannon doom guy as gay ever since I was a kid and it was just being silly, always pictured him as a badass marine that loves sucking cock and he’s fighting his way to hell because his bf died and was sent there.
Duke Nukem on the other hand was explicitly hetro which is fun, I would have also enjoyed in a different game a character like the duke who was aggressively homosexual or even better a good representation of a ego obsessed badass power bottom that has all sorts of fun quips like ‘I’m here to suck cock and kick ass, and I already drained everyone’s balls…’ it would be silly, fun, and we could have lots of shots of his toned butt and stuff… But no, thirty years later and people are still scared of fun. Sad.
Once you get the hang of Markdown, you’ll enjoy it far more than Reddit’s shitty syntax. You’ve got way more options here since they implemented a well-tested and widely used system.
Don’t forget to use the formatting help link next to preview button!
That’s very unlikely. It’s running UBB Threads, which, from what I can tell, has an auth subsystem, which au minimum would do hashing. If it’s providing you with a default at sign-up, that’s different and is what appears to be a configurable setting.
If it is completely generated for you, here’s what probably happening:
User creation module runs a password generator and stores this and the username in memory as string variables.
User creation module calls back to storage module to store new user data in db, including the value of the generated password var.
Either the storage module or another middleware module hashes the password while preparing to store.
Storage module reports success to user creation.
User creation module prints the vars to the welcome template and unloads them from memory.
TL;DR as this is running on a long-established commercial php forum package, with DB storage, it is incredibly unlikely that the password is stored in the DB as plaintext. At most it is likely stored in memory during creation. I cannot confirm, however, as it is not FOSS.
Yeah if they send the password in an email in plain text that’s not storing it. You can send the email before you store the password while it’s still in memory and then hash it and store it.
Stored in memory is still stored. It’s still unencrypted during data processing. Still bad practice and a security vulnerability at best. Email isn’t E2E encrypted.
You have the text input feed directly into the encryption layer without an intermediary variable. The plaintext data should never be passable to an accessible variable which it must be to send the plaintext password in the email because it’s not an asynchronous process.
I’m surprised so many people are getting hung up on basic infosec.
The front end to backend traffic should be encrypted, hashing occurs on the backend. The backend should never have access to a variable with a plaintext password.
I’m going to have to stop replying because I don’t have the time to run every individual through infosec 101.
how long have you been a web developer? Because I’ve been doing it for six years and almost every web app I’ve ever seen uses http with TLS to send the plaintext password to the backend, where it’s popped into a request var at the controller level, then passed as an instance var to the service level, salted, hashed and stored. This includes apps that have to submit themselves for HIPAA compliance because they deal with PHI.
Maybe I’m misunderstanding you, but backend servers will almost always have the user-submitted password in plaintext as a variable, accessible to the backend server and any upstream proxies.
It’s even how it’s done in Lemmy. The bcrypt verify accepts the plaintext password and the expected salted hash.
I haven’t looked into it but I was wondering about the logistics of setting up a federated honeypot for server side stream sniffing to build a plaintext email/password database.
Not without compromised certificates they haven’t. You can tell because if they did they’d be world famous for having destroyed any and all internet security. Then again, they’d probably already be famous for having figured out a way to salt, hash and store passwords without ever holding them in memory first like they claim to do above, so maybe someone is lying on the internet about their vague “proprietary network protocols”.
Man, you sound like you’re just using random words you heard in class. Clearly you have no clue how user registration actually works, let alone backend development.
There are ways to have passwords transmitted completely encrypted, but it involves hitting the backend for a challenge, then using that challenge to encrypt the password client side before sending. It still gets decrypted on the backend tho before hash and store.
I asked because what you’re describing doesn’t do much if you understand how common web frameworks and runtime environments work.
The framework needs to parse the HTTP request. That means holding the parameters in a variable somewhere just to arrange them in a datastructure for processing.
But let’s ignore that and say we have some kind of system that stream parses the request right out of the buffer (which itself still needs to be held in memory for a bit, but let’s ignore that), and when it matches a preconfigured password parameter, passes it directly to the hashing system and nowhere else. I don’t think any framework in existence actually does this, but let’s run with it.
We’ll still need to pass that value by whatever the language uses for function passing. It will be in a variable at some point. Since we rarely write in C these days unless we have to, the variable doesn’t go away in the system until the garbage collection runs. Most systems don’t use ref counting (and I think it’s a mistake to disregard the simplicity of ref counting so universally, but that’s another discussion), so that could happen whenever the thread gets around to it.
But even if it runs in a timely fashion, the memory page now has to be released to the OS. Except most runtimes don’t. First, the variable in question almost certainly was not the only thing on that page. Second, runtimes rarely, if ever, release pages back to the OS. They figure if you’re using that much memory once, you’ll probably do it again. Why waste time releasing a page just to make you spend more time getting it again?
And we’re still not done. Let’s say we do release the page. The OS doesn’t zero it out. That old variable is still there, and it could be handed over to a completely different process. Due to Copy on Write, it won’t be cleared until that other process tries to write it. In other words, it could still be read by some random process on the system.
And we haven’t even mentioned what happens if we start swapping. IIRC, some Linux kernel versions in the 2.4 series decided to swap out to disk ahead of time, always having a copy of memory on disk. Even if you’re not running such an ancient version, you have to consider that the kernel could do as it pleases. Yeah, now that var potentially has a long lifespan.
To do what you want, we would need to coordinate clearing the var from the code down through the framework, runtime, and kernel. All to protect against a hypothetical memory attack. Which are actually quite difficult to pull off in practice. It’d be easier to attack the client’s machine in some way.
And on top of it, you’re running around with an undeserved sense of superiority while it’s clear you haven’t actually thought this through.
Yes. I agree 100% with the things I can and I defer to your experience where I can’t. I used to write proprietary networking protocols 20 years ago and that’s the knowledge and experience I’m leaning on.
As a matter of practice we would ensure to process passwords by encrypting the datasteam directly from the input, and they were never unencrypted in handling, so as to protect against various system and browser vulnerabilities. It would be a big deal to have them accessible in plaintext beyond the user client, not to mention accessible and processable by email generation methods and insecure email protocols.
I’m going to have to stop replying because I don’t have the time to run every individual through infosec 101.
Sorry, but you’re missing the point here. You cannot do anything with a password without storing it in memory. That’s not even infosec 101, that’s computing 101. Every computation is toggling bits between 1 and 0 and guess where these bits are stored? That’s right: in memory.
The backend should never have access to a variable with a plaintext password.
You know how the backend gets that password? In a plaintext variable. Because the server needs to decrypt the TLS data before doing any computations on it (and yes I know about homomorphic encryption, but no that wouldn’t work here).
Yes, I agree it’s terrible form to send out plain text passwords. And it would make me question their security practices as well. I agree that lots of people overreacted to your mistake, but this thread has proven that you’re not yet as knowledgeable as you claim to be.
You encrypt the datastream from the text input on the client side before storing it in a variable. It’s not rocket science. I did this shit 20 years ago. Letting a plaintext password leave the user client is fucking stupid.
there is no possible way to handle sensitive data without storing it in memory at some point
it’s where you do all the salting, hashing, and encrypting
emailing out credentials like this after sign up is certainly not best practice, but probably not a huge deal for a video game forum of all things. if you are re-using passwords then you already have a way bigger problem.
emailing out credentials like this after sign up is certainly not best practice,
Understatement of the year right here. Everyone in this thread is more interested in dunking on OP for the few wrong statements they make rather than focusing on the fact that a service is emailing their users their password (not an autogenerated “first time” one) in plaintext in an email.
there is no possible way to handle sensitive data without storing it in memory at some point
Since we’re nitpicking here - technically you can. They could run hashing client side first, and instead of sending the password in plain-text, you’d send a hashed version
This opens up the possibility of replay attacks in the case of data breaches, though, and those are much more common than http mitm attacks (made even less likely with the proliferation of https).
I’m not entirely sure whether hashing twice (local and server) is wise, having not thought through that entire threat vector. Generally I try to offload auth as much as I can to some sort of oauth provider, and hopefully they’ll all switch over to webauthn soon anyway.
I’m not really sure how it opens up replay attacks, since it doesn’t really change anything to the default auth. There are already sites that do this.
The only difference is that instead of sending an http request of { username = “MyUsername”, Password = “MyPassword” } changes to { username = “MyUsername”, Password = HashOf(“MyPassword”) } - and the HashOf(“MyPassword”) effectively becomes your password. - So I don’t know how that opens up a possibility for replay attack. There’s not really any difference between replaying a ClearText auth request vs an pre-hashed auth request. - Because everything else server side stays the same
(Not entirely auth related), but another approach of client side decryption is to handle decryption completely client site - meaning all your data is stored encrypted on the server, and the server sends you an encrypted container with your data that you decrypt client side. That’s how Proton(Mail) works in a nutshell
I’m not really sure how it opens up replay attacks
Put simply, jt allows an attacker with a leaked database to use the hashed password as a password. In your original comment, it seemed like you were suggesting hashing only before transmission, on the client; but hashing both before and after would indeed patch that particular vulnerability. I don’t know if there are potential problems with that strategy or not.
another approach of client side decryption is to handle decryption completely client site
Here’s potentially an opportunity for me to learn: how does such a service (like Proton Mail) perform this in a web browser without having access to the data necessary to decrypt all of the data it’s sending? Since you can’t count on a web browser to have the private key, do you send down an encrypted private key that can only be decrypted with the user’s password? Is there some other way to do this that I’m not aware of?
In your original comment, it seemed like you were suggesting hashing only before transmission
Ok, that wasn’t what I was suggesting, no. That would effectively make your password hash the password itself - and it would kinda be stored in PlainText on the server, if you skip the client auth and send that value to the server directly through the api or something
how does such a service (like Proton Mail) perform this in a web browser without having access to the data necessary to decrypt all of the data it’s sending? […] do you send down an encrypted private key that can only be decrypted with the user’s password?
Yes, pretty much. I can’t really find a good, detailed explanation from Proton how it exactly works, but LastPass uses the same zero-knowledge encryption approach - which they explained with some diagram here - with a good overview of the client/server separation of it’s hashing.
It is the same book where Jesus walks into the Frisian temple (or something) gurgles Weapons free and starts laying into them merchants selling vapes and abortions.
I dislike this trend of invisible UI. I’m (usually) on a 4k screen, I’ve got plenty of room for it, it’s not the early 2000s anymore; stop hiding the fuckin scroll bar or video progress bar
I think most people are on laptops now. Blows my mind but yeah.
My comparison is that screen size is like desk size. A laptop being those tiny pull out side desks at college, and a monitor being a desk. I was massively downvoted for that. People like their small screens.
I get a poked fun at a little bit on mechanical keyboard communities for preferring a full-size (I gotta type IP’s, need a numpad!).
I don’t think I could work solely on a laptop without external peripherals, it’s just not a good experience (also giant hands and chiclet keys is not a good combo). My work laptop exists permanently folded closed connected to a dock.
I’d put the analogy as trying to cook a multi-course meal in a saucepan on a single burner vs a full stovetop and set of pans (also you only have a paring knife).
Not to be "that keyboard guy," but you can still have a full numpad on a smaller keyboard using a separate layer that's triggered by a key being pressed or held.
I know because I've done it - the keys are all grouped into the same orientation, they're just not labelled. It's an adjustment, but it's worth it to me for the extra desk space.
I get that that's not really an attractive option for some though.
I tried a TKL and a numpad for a while, but it just wasn’t comfortable for me for some reason. Not a fan of layering, just doesn’t come to me naturally
I like the trend of invisible UI. It keeps the display free of clutter and persistent UI elements (hello, OLED) and doesn’t hinder usability at all. I hide scroll bars whenever possible because middle clicking is far more convenient than click-dragging. Hidden elements always appear by using a related action–moving the mouse reveals the play bar, scrolling reveals the scroll bar. It’s completely intuitive. I even remove the forward, backward and reload buttons on my browser because gestures and shortcuts are just faster.
UIs are near-universally as clean and functional as ever… at least on macOS. Windows appears to be a clusterfuck. Linux is alright.
Larger documents that I can drag the scroll bar to specific points, rather than PageUp/down or scroll manually (also wtf is up with acrobats scroll speed?? Shits slow as balls)
How about first we charge the real people doing real war crimes, e.g., Netanyahu and Putin? Then we can talk about whether mashing buttons is comparable.
Instead of lowering their prices over time and so sales are less significant of a percentage, they keep the original price indefinitely and just have lots of sales. This makes the percentage off much higher than if they had depreciated the regular price as it should. Pretty common these days.
This also pleases the Steam Store algorithm god. A big spike will bump the game up in the charts, then the algo will serve it to more people in the store and more people will buy it. The more sales momentum a game has the more the algo will show it in the recommended sections.
The slow burn lowering prices over time also maintains a bit of long term income for a maintenance team to patch and improve the game. This game is 2 years old and is getting slammed down to $5, that says to me they’re just trying to cash out on whoever is left that wants to buy it but hasn’t, and then I’d bet this game never sees an update ever again afterward.
This shit winds me up so much. It used to be that a game would be full price for 6-12 months before moving onto a budget label at a vastly rexuced price.
Nowadays games are full price forever, except for the few days a year when they go on “sale” and get reduced to what they should’ve been all along. During which time the publishers get to act like they’re being altruistic and doing us a massive favour.
I also loved my Wii U. It’s such a shame it wasn’t more popular. I basically used it like a switch with a box that needed to be plugged in, just took the console places and anywhere with an outlet I could plug in and play on the screen. Obviously the switch is the superior console but the Wii U was a banger.
A guy I used to work with was convinced the whole thing was a scam. “Did his own research” and determined that all he needed was the console to upgrade his Wii. So he bought one secondhand. For his kids. Didn’t quite work out the way he had hoped. Eventually broke down and bought the pad etc.
He was not the brightest bulb, just the type to think of himself as such.
Hello guys, I’ve noticed a lot of people here are hungry for more games like the Stanley Parable. After playing the O.G. game and the Deluxe edition I’ve found myself wanting more of this. More of these meta, narrator led, weird humour games! I started work on my called Do Not Press The Button (To Delete The Multiverse). You can check it on Steam and give a wishlist if you want to encourage the development.
Anyway the other day I’m randomly checking Steam Most Wishlisted games and DNPTB is on there! How wild is that?
Currently enjoying the demo. I’ve definitely wanted more nonsense like this in gaming.
One simple thing to fix is widescreen FOV, which is fortunately trivial. Simply add the following lines to Engine.ini in the config files and it should handle any screen width just fine:
lemmy.world
Ważne