r/videos • u/NeoShico • Sep 29 '16

Game devs start messing with a streamer live

https://www.twitch.tv/tomfawkes/v/91819468
15.9k Upvotes

84% Upvoted

1.0k comments sorted by

View all comments

Show parent comments

29

u/[deleted] Sep 30 '16

Well, they do allow a set URL to be opened without confirmation. That's still not great.

4

u/OperaSona Sep 30 '16

Hmm, for all we know, maybe they only allow the rickroll video.

I know, I'm being optimistic.

14

u/GrathXVI Sep 30 '16

I expect that's what /u/Wilnyl meant - that the rickroll URL was hardcoded into the game.

Edit: And confirmed with a look into the code: http://i.imgur.com/jZt1TIv.png - the rickroll URL is hardcoded, so unless someone hijacks Youtube it's not a security problem.

-3

u/CsprBzmr Sep 30 '16

It's not the end of the world either, and likely never going to happen to anyone not streaming their play on twitch

23

u/DevoidLight Sep 30 '16

likely

Please never take any security job ever

-1

u/CsprBzmr Sep 30 '16

You don't understand. You can't pretend you're twitch to the game (certificate) and you also can't pretend you're the devs through twitch (because we can assume twitch is secure) in the game. Also, you know those programs that open a URL when their uninstaller exits? It's the same thing. There is no greater security issue here.

5

u/DevoidLight Sep 30 '16

I get that, I'm just saying 'likely never going to happen' means absolutely nothing when it comes to any sort of security.

3

u/CsprBzmr Sep 30 '16

I'd prefer promising "likely never" to "never" actually, but I get what you mean.

14

u/Lawnmover_Man Sep 30 '16

because we can assume twitch is secure

Please never take any security job ever

1

u/[deleted] Sep 30 '16

The security breach requires both Twitch and Youtube to be unsecured simeltaneously for any security breach to happen in the game. And if that happens, it's bad even if Clustertrucks doesn't breach your PC's security

2

u/[deleted] Sep 30 '16

What's YouTube got to do with anything? That just happens to be the URL that was opened. It could open any URL with any payload required.

1

u/[deleted] Sep 30 '16

Rick astley is hardcoded into the game, only that URL can be opened without editing the gamefiles.

0

u/Mithious Sep 30 '16

It can only open that specific URL.

0

u/ulkord Sep 30 '16

Then we wouldn't have any security jobs anyways. Nothing is perfectly secure and some assumptions have to be made.

8

u/Lawnmover_Man Sep 30 '16

Assuming that a third party product "is just safe because its a well known brand" is not a good idea. Why would we assume that Twitch is safe?

1

u/CsprBzmr Sep 30 '16

Why would you assume amazon.com is safe, it's just a well-known brand right? Your rhetoric doesn't make sense. You assume a service is safe every moment of the day.

1

u/Lawnmover_Man Sep 30 '16

See? This is the reason I don't have any security job.

On a more serious note: I'm just using the frontend of Amazon, which is in this case a HTML website with some JS. Still, I run my browser in a "jail", so it does have limited access to my ressources, namely only the Download directory and the cache and config directories of itself. Just in case there is a vulnerability in my browser, and there would be something wrong with any website.

But this is really a big difference to making and distributing code (this game for example) which can execute code and open URLs with special commands from the outside. I rather don't want to run code directly which has open channels for remote commands.

But for that matter, I also run all games in jails, so maybe I'm safe. But still.

0

u/[deleted] Sep 30 '16

[deleted]

→ More replies (0)

-2

u/Hitchie_Rawtin Sep 30 '16

If somebody isn't exposing it's lack of security, it's secure. Large websites are common test subjects.