Can I trust Steam-powered games? Is there any unwanted behavior installed with Steam?

Question

(Migrating my superuser.com question to here, as it was off-topic & closed at SU. I've left off the "What is Steam?" part, though, because it's already been asked here. This question is now just about trust.)

---

So – I just bought the new game Supreme Commander 2. This question is not about the game, but about the online software installation platform that it seems to require. I haven't bought a game in a long time, and I'm puzzled: Apparently, SC2 is a "Steam"-powered game.

When I went to install the game, it asked me to either create a new Steam account, or log in with an existing account. I clicked "Cancel" because I don't plan to play online and I don't want anything unnecessary installed on my computer, since I only plan to play single player!

However, after clicking "Cancel", the installer asked for my confirmation that I indeed wanted to cancel installation of the game! I thought I was just canceling the "online" portions!

I understand now that Steam is required by many games, as a form of DRM. But, any software claiming to be DRM and requiring connectivity makes me worried. So I really want to know:

• Can I trust this "Steam" DRM (Digital Rights Management) software platform?

• Has anybody done any independent verification on how this platform works? (I'm very leery of any DRM after the Sony BMG CD copy protection scandal. Thank goodness for Mark Russinovich.)

• Does the "Steam" platform install anything particularly nasty or unwanted on my computer?

Answer

Yes, you can trust it. It is non-intrusive and all it does (at minimum) is manage your games and patches for you. Anything else is optional.

Steam has an offline mode, where you can play your games without a connection to Steam, granting you total freedom from Valve's servers.

It doesn't install anything but the software you need (like DirectX and drivers for example) and the games and patches. Nothing you don't want, unless you don't want the game you're installing. The only downside is that these patches are kind of forced on you, even for single-player games. If the developer decides to 'downgrade' the game or make a change you don't like, there's not much you can do about it.

I'm not aware of any 'independent verification', but the DRM Steam is itself is very harmless, you can choose to run Steam in offline mode and there would be absolutely no way for them to pull access to your game, except for the fact you wouldn't get patches. Any other DRM can be chosen to be used by the game itself of course, but that has nothing to do with Steam.

Anyway, the choice to use Steam has already been made by Square Enix. If you don't trust them, why are you installing the game itself?

Check more discussion of this question.

How do I safely sell a Wii with VC games on it?

Question

I want to sell my Wii with the VC games included, but am afraid there might be some personal info on the system somewhere.

If I delete my shop account & format the system memory, will the next owner be able to re-download the games free?

If I leave the VC games on there, is there any reason to worry? I looked at my account activity and saw the last 4 of my CC#. Can anything be done with that?

Answer

You can't wipe your Wii without wiping the VC games, and they can't download them without having full access to your Wii Shop account and any credit card information it stores.

You can't sell a Wii with VC installed without handing the buyer considerable amounts of personal and financial information.

It's also, aside from that, against the licensing of VC content to resell it: it's explicitly non-transferable when you buy it. As a consequence, it will come as no surprise that Nintendo has set up the system such that you can't clear personal info off a Wii in preparation for reselling it without also wiping the Wii Shop downloads.

Check more discussion of this question.

Can I trust X-TRAP?

Question

I have recently installed Rusty Hearts with the intention of trying it out, even though I'm not really an MMO person. Something in the game's aesthetic just really appeals to me.

While the gameplay videos I've seen looked decent, the installation experience itself had me questioning the game's credibility. The installer and subsequent launcher look slightly shady, with several suspicious windows popping up and disappearing.

When I finally got to launching the actual game, I suddenly saw the following icon before the game went full-screen:

Snooping around online, I discovered that this is some sort of cheat-prevention module called X-Trap, that is aimed to detect the following, amongst other things:

1. The user has modified game files
2. The user is running a 3rd party program that is not allowed
3. The user is modifying the program dynamically

While I understand why cheat prevention is important in such games, my instincts are to be highly suspicious of this module. This is exacerbated by the fact that I can't seem to find any official information about it.

So my question is, can I trust X-Trap not to:

1. Spy on me.
2. Alter my computer in ways I am unaware of.
3. Interfere with other programs.
4. Do other bad things I can't necessarily think about.

Answer

NOTE: I have not actually tried running X-Trap on my system - I looked it up while downloading the game, and canceled the download when I learned of this.

I found this thread at the official forums, and apparently, programs like these can intefere with your ability to play the game:

1. Anti-virus programs that use SONAR or active background scanning
2. Internet security packages
3. Software for keyboards and mice LOGITECH im sorry guys but your G15s and macro keyboards will cause you PAIN
4. Multimedia software Itunes, WMP, Xfire, Steam overlay, Podcast, fraps
5. Torrent programs Utorrent bittorrent. etc.

Additionally, X-Trap requires administrative privileges, even to just run, which is a big no-no by today's standards.

I don't think X-Trap is malicious, and I understand why the developers feel the need for a system like this, but I consider it far too aggressive and invasive, more so because I have one of those Logitech keyboards. That's a shame, because I too want to try the game - but IMO, no game is worth dealing with that kind of problems.

Check more discussion of this question.

About security on Minecraft plugins

Question

My son discovered MineCraft some months ago.
I decided to buy him a premium account.
He hosts a server to play with his friends.

Now, he wants to install kind of plugins to "hack" (in his term) his server to be able to dig larger part of land at once...

He told me that he would like to install the "bukkit" plugin
He told me also about a "server starter" "server starter" I'm less confident about installing this stuff...

Does exist a kind of "official" repository for these stuff ?
Which one I should not install for security reasons ?

The server is running on a window computer. I've read that exist an OS for running a server on Linux

Answer

Does exist a kind of "official" repository for these stuff ?

Google, really, easy to find official URLs for mods that result in the Minecraft or Bukkit forums.

For example, Minecraft TooManyItems yields Minecraft Forum - TooManyItems (306 pages).

Which one I should not install for security reasons ?

As long as you stay on (and read) trusted forums like the ones I mentioned above, nothing goes wrong. If your son does the same, and doesn't steer away from that, he knows what he is doing.

He told me also about a "server starter" I'm less confident about installing this stuff...

http://forums.bukkit.org/threads/winos-minecraft-delayed-server-starter-tame-your-restarts.11690/
explains "What is this", "Why would you need this", "How to Use", "Notes" and more...

The user that posted that has 1,700 messages and 40 likes, has been around for a year. Trustworthy.

Check more discussion of this question.

SC2 keeps asking for authenticator code (new 'intelligent' login feature not working anymore)

Question

I'm using Blizzard Authenticator and Starcraft II login screen prompts me each time to enter the code. Everything would appear to be fine, unfortunately it isn't:

Blizzard recently announced that they have updated the authentication system to intelligently track login locations and, if one is consistently connecting from the same place, may not be asked for an authenticator code.

That new feature worked flawlessly for a few days, but suddenly it stopped. Nothing changed in my machine, and I'm using the very same computer to play. I'm being prompted again to enter the code every time, even after watching a legacy replay.

I want to find out what's causing the problem. I would really appreciate any advice you may have.

UPDATE: I have a static IP (Sorry I didn't mention that sooner)

Answer

It's either because your IP address changed (which is likely if you haven't specifically purchased a static IP plan from your internet service provider) or it's been a week since you last authenticated:

From the the Blizzard WoW Forums:

your account no less secure than it was before, the only change is that you will only be prompted once a week to enter unless you change IP address, from where you'll need to enter your authenticator code.

Unfortunately, the Blizzard FAQ is worded in a way that sounds like he new functionality won't always trigger

The Authenticator system will now intelligently track your login locations, and if you are logging in consistently from the same location, you may not be asked for an authenticator code. This change was made to make the authenticator process less intrusive when we are sure the person logging in to your account is you.

Also, according to the EU FAQs, this isn't active for SC2 accounts at this time:

Please note that this feature is not yet live for StarCraft II accounts.

Check more discussion of this question.