73
A Slay the Spire Fan Expansion: Downfall (Steam Standalone) was Breached.
(steamcommunity.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 Dec 2023
73 points (100.0% liked)
Games
16757 readers
958 users here now
Video game news oriented community. No NanoUFO is not a bot :)
Posts.
- News oriented content (general reviews, previews or retrospectives allowed).
- Broad discussion posts (preferably not only about a specific game).
- No humor/memes etc..
- No affiliate links
- No advertising.
- No clickbait, editorialized, sensational titles. State the game in question in the title. No all caps.
- No self promotion.
- No duplicate posts, newer post will be deleted unless there is more discussion in one of the posts.
- No politics.
Comments.
- No personal attacks.
- Obey instance rules.
- No low effort comments(one or two words, emoji etc..)
- Please use spoiler tags for spoilers.
My goal is just to have a community where people can go and see what new game news is out for the day and comment on it.
Other communities:
founded 1 year ago
MODERATORS
This is how you communicate a security breach.
Seriously, 27 hours from when it first happened to report it to users? Especially when most of that intervening time was spent recovering things? That's stellar. We're lucky to hear about corporate breaches in 6 months.
It's also incredibly clear and gives a lot of information on when you do and don't need to be worried. I'd probably take the extra steps to verify I wasn't exposed even if I was in one of the "you're OK" categories, but I appreciate the detail on principle.
It's weird that "we got hacked" is going to get me to try out a mod, but here we are lol.
The same is true for other stuff too. For example, I'm more likely to use a password manager if they handled a breach responsibly than an unproven service. I'm looking for essentially three things from a breach:
Breaches happen, so I'm mostly interested in how their existing security ops mitigated the fallout (e.g. did they properly salt passwords, have transaction limits on the DB, etc), and how thorough the investigation was. A good org will be much stronger after a breach than most competitors, so if everything checks out, they're probably a safer bet going forward.
Given the scope of this project (a non-commercial free mod), I would honestly not judge them harshly for a much poorer response. It's not their job; if they took a couple days to notice during the holiday season, then weren't able to say much more than "we think you're fucked if you have this mod installed", a lot of harm might be done, and they'd definitely see a lot of criticism, but I'd understand. For a small team that don't do security, especially one who aren't even selling their product, getting hacked has the potential to be extremely overwhelming, and you very possibly don't have the expertise or resources to investigate properly.
Instead, they put a bunch of real companies to shame. (Some of those companies have breaches that are a lot more complex in scope, but still.)
Yup, I 100% agree. I absolutely take the size of the org, the risk to me (e.g. medical info is more impacted than game playtime), and how much I paid into account when evaluating a response.
This was a way better response than I could ever hope for from such a project.
Yeah that was incredibly incredibly clear