Just your normal everyday casual software dev. Nothing to see here.

People can share differing opinions without immediately being on the reverse side. Avoid looking at things as black and white. You can like both waffles and pancakes, just like you can hate both waffles and pancakes.

been trying to lower my social presence on services as of late, may go inactive randomly as a result.

  • 0 Posts
  • 265 Comments
Joined 3 years ago
cake
Cake day: August 15th, 2023

help-circle
  • I wouldn’t classify that as dodging steam policy at that point. There is no product to parity. The 15$ starter pack wasn’t offered on steam during the exclusivity period. The actual wording for the price parity rule is You should use Steam Keys to sell your game on other stores in a similar way to how you sell your game on Steam. It is important that you don’t give Steam customers a worse deal than Steam Key purchasers.. If there is no steam key to parity with, then it’s not in violation of the policy. They were using the terms given to them by steam, and steam didn’t like that and allegedly threatened to delist all of their r6s products if they didn’t provide the same product on steam. That’s blatant monopolistic behavior in my eyes, especially considering that uplay variants of the game steam has no part in. Steam has no listings that you must sell products on both platforms, they do have a rule that states if there is one on both, you must give steam key purchasers an equivalent or better deal. On items that can use steam wallet/items that are on both platforms they do price parity it seems, but I have to disagree with it obviously dodging the policy.

    Also for your analogy sake, it’s important to add that r6s wasn’t free to play at the time of this complaint. Free to play wasn’t even a thing for the game until mid 2025. While no date was provided, its safe to say these complaints are from at least 2017 (which also coincides with the year provided with the other company complaint) since that’s when the starter pack bundle was made to be a uplay exclusive without it being on steam, but this was back when the game was p2p instead of f2p. The 15$ starter pack included the game, a couple operators and some ingame currency, and if memory serves right, in buying it you would need to download and install it via uplay. Since it was a uplay product key and they lacked cross-progression during that time span.


  • The amount of people in this thread that are arguing that steam is fully within the right here due to the fact that they have a restriction on steam key pricing blows my mind.

    for example with the UbiSoft case, It’s clear they have never actually opened or used Uplay because if they had they would realize that Uplay does not use Steam keys period at all. They are their own distribution platform that distributes off of uplay servers.

    The entire point of the lawsuits is going one step further, which is that despite steam having a policy that says it’s for keys only, they unilaterally enforce it on all platforms regardless of the usage of the keys.

    Now whether that’s actually true or not is what the lawsuits have to determine. But that is what the claim is. Personally I’m leaning towards it’s true because I’ve seen some screenshots posted about customer service saying that’s how it worked and threatening to delist steam games for cheaper first party distribution pricing elsewhere.

    I’ll be curious where these cases go.






  • I do have to say, electricity is much cheaper than gas which was why I was thinking about it(but I wouldn’t actually break even as I don’t drive constantly), being said people keep giving the huge price differences on the models, but when I look into them I never seem to see the price actually hold up. Like for example the BYD website gives price ranges of what they think the difference is converted to USD (although I question how accurate that conversion is because their estimates don’t seem to follow conversion rate). When doing my research on US ev’s I usually see vehicles in the 28-45k range which I agree is a large range but the cost range is sporadic on models. I have not seen any vehicles significantly cheaper than that on the market anywhere

    That being said, I’m against blocks in the first place, If they do end up coming in, and they do end up being 10k less than the rest of the competition, I would be super happy for that and jump on it so fast, realistically even if they were allowed in I don’t think we are seeing those prices level prices. Like even looking at the cost of said vehicles in other countries and converting the value to USD and trying to account for taxes, I don’t see anything mindblowingly different.

    I hope you end up being right though, it would be nice for the market to get blindsided. I know the last time i did my calculations on it it would take close to 6 years for me to break even after needing to install a charging station and the increase in price from the ICE to the EV.

    Being said, I also noticed that companies in the US are starting to phase EV’s into their normal lineup more, which im also happy with. my current chevy model was discontinued for an EV. So EV’s are going to be the future regardless, so eventually I will have to join


  • even if all of them were, its unlikely many would want to get them sadly. at least in the current state of things

    Especially considering the current congress bipartisan support for an eventual 150$ annual registration fee tacked onto the yearly registration costs as an apparent attempt to combat the lack of the fuel tax.

    Or at least thats what it’s being claimed it’s for. I personally see it to be a dissuasion tactic from EV’s as if you compare it to the standard fuel tax which is 18¢ per gallon so you would need an insane amount of miles in order to break even with a standard ICE vehicle. (a little more than 722 gallons of fuel to save anyone some math. If you would like to see it with your vehicle you can take your average MPG and times it by 722.22 and you would get how many miles at the theoretical max it would take to break even with this fee. mine is EPA certified at 29 mpg which would be 20,944.44 miles a year to break even)

    Being said, at current fuel prices you would need to calculate the savings annually you would make per charge vs the same mileage on fill up, then remember to add 130$ to it. Since gas price has gone up a bit it could be, but I lack the numbers to really be able to calculate that.







  • I don’t think downplaying them is the way to go though, Some of these issues have been in existence since 2019.

    Like I mentioned though, it does seem like its starting to be worked on, a few of them are in progress the one I really don’t like is #13991 which is a combination of:

    • #13982 which allows for an alternative user to be able to interact with the client readonly as if they are another user as long as they have the user id and any valid auth token (which includes that current users auth token). original issue: #5210 2/10/2021; status: partially mitigated 5/11/24 with v10.9 which locked modifying data behind elevation but getting the data still is able to be done in select endpoints still
    • and #13990 Which gives any user with standard login access(like say the common family tv’s account) the ability to access the getUser endpoint and retrieve said previous user id. In progress since 12/2/25 reported via the megathread creation 3/8/2021

    For example I just made a user with no access period to any collection, just a login access and took the auth token for the user. I was able to grab every user on the servers ID including hidden and administrative users as well as users who don’t use jellyfin’s auth system, then couple that to see what the users login method was, when their last access was, what folders they were allowed to use[note these are represented as id’s the client can’t actually parse them so you need to traverse the api for it], how many max sessions they could have, etc. without actually having access or logging in as that user or even being an administrator. If you snag an admins userid it even gives you internal server data such as logging paths that the server uses on the dashboard, the transcode path, the metadata path, what networking settings the server is using such as trusted ip nets the port jellyfin is using by default your certificate file and password if configured[although password may be ommited/the field left blank i didn’t test internal certs]. From there you can even recurse through the folder UUID’s provided via “enabledfolders” and the other folder restrictions on the users endpoint and get the name of the folders which could leak personal information about the library or the user because the 403 request it returns leaks the name of the library as part of the error message. “username is not allowed to access Library name

    Thankfully it’s finally being worked on but, I do think it’s worth stating the timeframe on them and that those issues do still exist.

    Just like I think it’s worth stating that media endpoints are still fully unauthenticated as well, so as long as you can guess the full file path, you can md5 it and get unauthenticated media paths, but that’s in progress as well, its just super slow because that breaks third party clients.



  • I’m not using Plex, but I feel like I can answer my complaints about using jellyfin.

    My biggest complaint is the lack of clients. It is such a pain in the butt to install jellyFin on all of my products.

    My second complaint is the security design. They’ve had open issues about unauthenticated endpoints for three or four years now. And whenever the issue gets so old that it starts to look bad, they refactor the issue into a newer issue abd bury it in the sand.

    For a while this was done under the guise of maintaining legacy client support, but just recently it looks like they’re starting to focus on more security, and I’ve noticed some of those security holes are being closed finally, but it’s a major concern for me that they’ve been open for as long as they have.


  • I feel like work passwords are just always the worst security you will ever see, which sucks because you would think they would be the most important security.

    I had a job once that you could put a password in and it was across multiple intranet services

    Some services wanted the password case sensitive. Some wanted the password either as all caps or all lowercase.

    So anytime you put your password in, you essentially had to put the password in up to three times unless you knew how that service had it.

    Documentation would have please put password in as all caps or please have password completely lowercase

    Honestly, there was an unwritten rule that when you put your password in, you just did it in all caps. That way you only had to try two different passwords instead of three different passwords if you couldn’t remember what service it was.

    Very concerning for comp sec. Fortune 100 company as well.


  • At least that’s better than when the site accepts the password but doesn’t actually let you log in with it.

    My old college was like that with their SSO. It would accept any type of password you threw at it. But then you just wouldn’t be able to sign into anything, so you’d be forced to reset your password again, but it doesn’t tell you that’s what the problem is, so you just have to sorta guess what it was.