hey guys whatsup

it would be so awesome.
it would be cool.

summer update pls

Bring back AnAkIn

Issue transferred already per the Github by a Valve Employee

https://github.com/ValveSoftware/source-sdk-2013/issues/1427

this (afaik) isn't valve employee, doesn't mean that it will be implemented, this person is literally just a moderator - he marks duplicate issues, sorts them into correct categories etc.

Aww bummer

Now I am not a developer by any means, and not the most technically minded individual. But I really do not see your logic in not only making this public, but providing a step by step guide and posting it on TFTV and two TF2 subreddits.

You claim that this is to "raise awareness and hopefully prioritize creating a fix, and / or make it easier to come up with a community fix in the meantime". Yet, I don't see how making a laymans guide for replicating it public helps Valve in any way. You even disclose to Valve that you intend on making this public in your report with a fixed date, which isnt exactly blackmail but definitely in that ballpark.

I know that you have been communicating with community leaders / admins about this and that is the way it should have been. Reaching out to only Server Owners and League Operators with these issues and allowing them to share it in their circles is a much safer way of communicating these issues and would allow people do develop countermeasures in some level of secrecy. What you have done in doing this is made AC's already tough job even harder.

So until Valve fix it in an indeterminate amount of time, you've made a VAC-safe exploit that has been known for around 6 years, to my understanding, much more widely known. In my view this is incredibly irresponsible.

Edit: I've taken out part of my argument in light of people correcting me, many thanks. My overall point still stands however. Valve have public channels not commonly used by the general player base that are more appropriate than TFTV and Reddit, and this is known since you put up the issue on GitHub. I still think providing a step-by-step guide and sharing that with these forums was the wrong step.

If this was already spreading around in cheating circles then it probably makes sense to release, but if not then I agree that releasing it publicly doesn't make a lot of sense.

Looks like this has been a known issue within AC a while (at least, the stem of the issue which is the sv_pure bypass portion with a preloader).

From the Github post by cukei there was an attempt at trying to prevent the bypass by having the mapmakers run through this python script cukei created, which would have authenticated the map files using MD5 verification. Ultimately it would allow sv_pure to work as intended for attempted visual modifications. If I'm wrong and someone has better input on what has been attempted behind the scenes feel free to correct me

thanks for sharing, looks like i can finally get rid of my paid subscription! WE will ALL be using this throughout seasons to come :D

It's been known to have already been used in the wild by a few people, and has been known about in those circles for years.

disclosing stuff in this way is common for software vulnerabilities, and 3 months is a generous amount of time if the fix does end up boiling down to "add a signature file to check this file wasn't tampered with". more info keyword is Coordinated vulnerability disclosure.

there are significant issues with keeping issues like this behind closed doors and only essentially leaking this information to certain parties:

• what stops them from leaking it to others who don't have good intentions?
  
• what is actually the common knowledge in the community as it is right now? we already knew about sv_pure bypass stuff with muzzle flashes and the like.
  
• can you imagine what league bans would look like? "why was i banned?" "you used an exploit." "which exploit?" "well we can't tell you since valve hasn't fixed it yet"

https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure

it is very funny/silly to me that this is the procedure followed but ah well who the fuck knows anymore

it also makes me laugh at my very serious attempts at not leaking the command that shows you the enemy team's composition (successful so far!)

before admins get excited

https://i.imgur.com/5M6qrqH.png

Last time someone "revealed" something like this in order to create awareness on this forum, we got a step by step guide on how to modify Spy decloak sounds. We are 6 years later and Valve has not done anything to mitigate that; all it did is put it on the radar of bad actors who didn't previously know. I don't understand how people can look at that and think giving Valve x amount of time to address an even worse issue, and then going public with this will lead to anything. But I would love to be wrong about this.

It's not a security or economy vulnerability, but i still wanted to loosely follow something like Project Zero's Vulnerability Disclosure Policy from my first email. Though, from this FAQ:

There's no "exploit chain" in this case... it's too simple to do and not really technically difficult at all. If I left out how to reproduce it and was more vague in my bug report and post, it'd take more effort for Valve to read while still being nearly as accessible to exploit for those who wanted to.

+1 then, hope the benefits of releasing outweigh the costs...

That is crazy, how long has that been around?

forever probably

looking forward to the rgl announcement next week that binding multiple actions to one button is banned while this goes unmentioned

The rule that bans wallhacks needs to be renewed at least once per month, otherwise it automatically expires and wallhacks become allowed

Having had 6 years to think about it I think you're right. The decision was mostly fueled by hearing that at least one player had been using it in invite, and it was relatively unknown (from my pov). My HOPE was that it would show people how easy it is for a player to convince themselves that it was just another tf2 customization like the explosion script, and provide a reference for players to identify if someone responding suspiciously to a spy cloak/uncloak could be exploiting.

I will say 4 years ago I felt extremely vindicated: https://www.teamfortress.tv/post/1008124/cheating-to-hear-spies-is-painfully-easy
But I believe there has been incorporation of mastercom's fixes into tf2's code and as far as I'm aware this still works.

I'm removing the instruction part of my post, but I know this is a Pandora's box situation where I have no way to take back the shared knowledge at this point.

I won't suggest mur remove this information but I do think we have definitively shown that Valve does not care about the competitive integrity of the game, if you don't find something that breaks the money making machine you probably won't find a Valve employee who cares.