Quoting: KlaasWhy do they claim that they did not request a takedown of the itch.io domain, when that is exactly what happened as a result of their requests?

They're completely honest, their takedown partner issued the request.
It's a little like hiring someone to beat someone up and clarify that you paid them for it and than claim in court that you didn't beat this person up.

Lots of companies use external partners to do takedown requests for them.
Takedown requests are bad marketing and automated takedown requests are a legally grey area(it can be done legally, but nobody actually does it.)
Those partners are specialized companies who get paid to take these risks for their customers, but sometimes they fail at keeping their customers out of the wind like here.
An example of such a partner. [External Link]

Edit:
This is a great example of "it can be done legally, but nobody actually does it" by the way.
The itch.io founder challenged the takedown.
In such a case they should receive a response from the rights holder within 24 hours.
They didn't.
If this was a DMCA takedwon request, they can now come and try this out in court, but the burden of proof lies with them and not everyone with a website has the budget and guts to take a coorperate behemoth to court.
Which is why this guy saw only the path of public shaming as a way out, which worked by the way.
He has a response.

View this comment - View article - View full comments

Doxing on enterprise scale.

View this comment - View article - View full comments

Quoting: ArehandoroThis is the only thing that comes to mind each time I read Sovereign:

To protect your privacy, external media requires approval to load.

Source: vignette.wikia.nocookie.net

View cookie preferences.
Accept & Show Accept All & Don't show this again   Direct Link

It's EU politico speak.
I think it's best translated to American with "America first!"
If European governments try to rid themselves of dependencies of goods and services from parties, whose reliability and stability they're too polite to question they call it a push for sovereignty.
France pleads for an EU army for this reason.
Germany maintains a pretty big military industry for it.
The EU is importing lots extra expensive gass from the USA for this reason.
Its why the EU sometimes tries to get an internal mining industry(until they discover that the reason they don't have one is, because they care about human rights, environmental protections, etc)

Most of the time it means moving away from USA provided goods and services, but not always.

View this comment - View article - View full comments

Quoting: LinasWait, what? Is speech synthesis something that is built into Windows, and games actually use it?

Yes, it's build in and I've already experienced that I had to get something working on Linux that used it and I failed.
It's part of the dotnet framework(which is the part of C# specifically designed to be Windows specific(a.k.a everything that was not reverse engineered by the XAMARIN before Microsoft bought it))

A classmate wrote some code we wanted to get running on a pi and I failed.

View this comment - View article - View full comments

Quoting: _MarsThere has no doubt been a compromise to get all the inputs on the controller but I trust that they did enough testing on it.
I doubt they would release something like that if it weren't comfortable for at least 95% of testers. So even if the sticks look quite far away, it's probably going to be fine.

So excited for this. I might've considered the Hori controller when they sell them in Europe (assuming) but now I will wait for whenever this comes out. This has been enough confirmation of its existence for me.

I assure you that this hasn't been tested statisfactory yet.
Had it been we would've seen a release statement instead of a leak.

View this comment - View article - View full comments

Quoting: Pyrate

Quoting: pleasereadthemanualThere are only three ways to beat the Anti-Cheat problem:

1. Force the game developers to weaken their anti-cheat for your system (not going to happen with the current number of players)
2. Start cryptographically verifying kernels and bribe a bunch of game companies into supporting those particular kernels. This also does not seem likely to work long-term.
3. Cloud gaming...

Would kernel verification really be satisfactory for these anti-cheat companies? Why isn't that a thing already?

It's how they do it on Windows currently(yes, this has issues), but whether or not it's satisfactory is the "convincing" part @pleasereadthemanual mentioned.
It's a thing already it's how Android and Apple do it(Android's version is slightly more complicated, but it also does this).

Difficult to implement?

yes(It's cryptography, market politics, infosec and hardware design combined), but most of it has already been implemented by the AOSP(android open source project), the trusted computing group, Microsoft and hardware manufacturers.
Some distros even have packages with signed bootloaders(for secure boot).

I don't mind if all it takes to prove I'm "safe" is just checking if my kernel comes straight from Fedora unmodified, doesn't sound like an issue st all for me.

You don't many others with a lot of power in the Linux space do.
Remember these people wrote their own compiler, kernel, bootloader and bios, just to be able to change on their computer whatever they want.
Read the website of the FSF to get a sense what these are capable of to achieve this.

The reason they will probably give first is Tivolisation. The trusted vendor will find themselves in a dominant position and start exploiting that position by implemenenting more api's that only they've(cough, cough, google play services and safety net), so nobody else will be able to run any program that can run on their platform and thus make them the only game in town(yes, microg exists, but that is just wine for android).

Also would you be willing to give up most of to all of your distro's packages for this, because the current package managament system on most Linux distros(yes, also Fedora) gives everything installed through it root(flatpack and snap are attempts at fixing this, but we're still far away from a good local package manager)

And if one uses custom kernels, then I think an easy solution is to just have the distro's official kernel installed alongside the modified kernel, and whenever one wishes to play one of those spyware games, just reboot into the distro's kernel and play the game.

Good point especially with "Game Mode" already existing.

In summary what would be needed for this:
A major distro or vendor(like Valve) needs to implement measured boot on their distro, convince some anti-cheat providers to use it and convince some games to trust it.
Secure boot isn't enough, because it only proofs to someone with physical access to the device that the kernel is trusted.
This is supported on both ARM an X86(_64).
Also the players should be willing to risk tivolisation.

Contrary to @pleasereadthemanual I don't believe these to be the only three possible ways, but that is worth its own post.

View this comment - View article - View full comments

Quoting: legluondunet

Quoting: LoudTechie

Quoting: legluondunetIf only Steam had the courage to force Ubisoft and other video game publishers not to use their own launcher when selling their games on Steam, Steam being the launcher. I don't want a launcher in a launcher in a launcher...#inception It generates potential additional technical problems and it uses resources for nothing.

I'm really happy they don't.
I'm pretty sure that would be anti-competative and monopolistic behavior.
It costs resources, but it comes from a good place.

Steam has already what a second launcher like Ubisoft or...gives:
- DRM protection
- discussions
- achievements
- Steam workshop
- tchat
...

When you sell a game on Steam, editors should use Steam tools.

It has all those things, but you can choose to not use and/or purchase most to all of them when you publish a game on steam, which is their market dominant product.
If they did it would be "tying".
Microsoft did this with their office suite and Teams.
It's what Valve's currently in court for about Steam keys and Steam.
It's what M$ does Windows bloatware(and why you've to be able to remove it in the EU).

View this comment - View article - View full comments

Quoting: legluondunetIf only Steam had the courage to force Ubisoft and other video game publishers not to use their own launcher when selling their games on Steam, Steam being the launcher. I don't want a launcher in a launcher in a launcher...#inception It generates potential additional technical problems and it uses resources for nothing.

I'm really happy they don't.
I'm pretty sure that would be anti-competative and monopolistic behavior.
It costs resources, but it comes from a good place.

View this comment - View article - View full comments

Quoting: PyrateStill waiting on how they're gonna tackle anti-cheat stuff.

Since they're into crypto and "web3", I'm also waiting for the inevitable rugpull.

I think they will fully lock the kernel down.
Blockchain fans often scream a lot about openness without practicing it.
Expect: secure boot, tpm, utilization of the TXT patch and proprietary drivers.
Probably also: hsm.

I would when placed in this position lock down the boot loader, but not the rest of the kernel and advertise and improve KASSLR(kernel address space layout randomization) and add ASSLR capabilities to Godot and/or a popular FOSS game installer.

I would lock down the bootloader, because although I think I've designed a KASSLR protocol that can proof to games that it's implemented with a non-compromised seed, I've yet to find a way to proof that the seed wasn't shared in a way that structurally compromises the the security of the system without locking down the bootloader(which is still an improvement to the full lockdown/Android solution, but not the best).
I see the most hope in assymetric cryptographic primitives for fixing this.

View this comment - View article - View full comments

Quoting: whizse

Quoting: redneckdrow

Confidential issue #12092

What? I switched to AMD specifically to use drivers that offer a first-class FOSS experience, and to avoid this kind of vague chicanery.

Part of the point of FOSS is, you know, being open about issues! I get paranoid about this crap ever since I first started reading the likes of Brian Krebs and Bruce Schneier years ago.

This seems to be the fix for the confidential bug:
https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/31914 [External Link]

It's related to WebGL so I'm guessing a security issue in a browser, that's about to be disclosed?

Kind of, based on their description it's WebGL reachable, implying that it's a wider attack demonstrated to them in the form of webGL code, which is an understandable angle to take, because webGL is basically the least trusted rendering tool in the entire system.

Edit: based on the patch I would guess it's a buffer overflow attack.

View this comment - View article - View full comments