Valve makes a significant amount of their money from the gambling they've attached to their games, and profits immensely from the culture of farming loot boxes to gamble on for skins and such.
They also take an absurd cut of developer income and saddle devs with costs that they don't always want. (Selling on Steam? Valve takes 30% and forces you to moderate the forums on your listing page that you cannot opt out of.)
They also have an internal culture that's been fairly regularly criticized as being pretty uncomfortable for women and minorities.
Valve has done some cool stuff, but let's not lionize them too much. They are probably better than an average company, for sure, but it's important to remember that they are also sketchy in some very gross ways as well.
If you were a dev selling a game years ago when physical distribution was the only method, you'd likely end up with a lot less than 70% after both the publisher and retailer take their cut.
The difference is that the company had to risk manufacturing cartridges, distributing them, etc. If the game didn't sell, you ended up with lots of money lost.
Steam is much much easier for Valve.
I am not saying it has a value, but 30% seems a lot.
Of course, in the end that 30% we end up paying it ourselves.
It clearly isn’t easy, given that nobody else is doing it their way. Maintaining the company culture might be the toughest challenge of them all. The other game storefronts simply can’t resist muddying the water for the consumer, making the shopping experience hostile for some stupid ass monetization reasons. Shopping on Steam is a breeze, and it always feels like the store is on your side trying to help, instead of trying to get in the way. The developer-side publishing experience is much similar.
I look at neither for reviews. Steam Reviews are often bombed to hell for things like, "Game has woman. Woke." or "Game has racism." or other culture war nonsense. Or the very common, "Creator I follow on Youtube liked/disliked this game, so I left a similar review" or "Creator I dislike liked/disliked this game, so I left the opposite review". Or, the worst of all, "Game uses Unity/Unreal/Godot/Something Else, automatic dislike".
Ultimately, reviews of games tend to be pretty useless because people who play games have very little understanding of a) what makes games fun, and b) the complexity involved in making the games.
I have creators I follow whose tastes are closest to my own, and I watch their content for reviews, then go to the store that makes the best offer.
I genuinely strictly disagree; The Steam review section is usually an accurate description of the game’s quality.
The overall score tends to fairly represent the likelihood that I’ll like the game, and when in doubt reading a couple of reviews tends to give a clearer picture. And then, the reviews themselves can be rated, and there’s a “recent reviews” score that protects against review bombings and gives a clearer picture of the game’s current state. Not to say that there aren’t exceptions - there’s a poorly-received game that I’ve poured hundreds of hours into recently - but I literally wouldn’t know how to set up a better system myself.
In contrast, the Epic storefront is fucking laughable.
I use steam for the community as well. Just look at how bad reviews are on Xbox store, they are more like app store reviews... mostly complaining about a version update.
Steam also has a solid update/beta pipeline. Game companies post blog posts about new game updates so you keep up to date with development. They also did an amazing job with SteamOS which feels rock solid.
> I am not saying it has a value, but 30% seems a lot.
I’d suggest that it’s cheap, at least historically compared to just about any other product that’s been sold. If I had a popular marketplace platform that basically sold my product without much need for human intervention on the transaction, that has real value. Honestly 30% seems like a bargain to me.
In marketing and sales of the product, any human that touches the process ultimately is getting a piece of that transaction. We may not have physical media, but that was actually probably the least of the expense associated with software products back in the day. Consider the army of people needed just to wholesale to retail, coordinate distribution, distribute…
My recollection from those days is that if the dev got 10% royalties of a purchase price they would have been ecstatic. If you offered them 70%? They probably would have thought “what’s the catch?”
No, when you asked Nintendo to manufacture you a run of cartridges, you paid for them whether they sold or not. You took that risk. Nintendo took zero risks per game, they took the risk in the physical hardware. Legacy game distribution also never took the risk. Retailers were able to return unsold inventory. There were court cases about this when companies tried to go around Nintendo's cartridge building services to save money. Those companies largely won their court cases, so then we made the DMCA to say "No, get fucked"
The up front risk you take on Steam is $100. It still ends up being a meaningful risk because the numbers show almost nobody makes that back, because developers are so interested in selling their game on steam that the market is outright supersaturated.
>Of course, in the end that 30% we end up paying it ourselves.
I used to buy video games at walmart. Unlike games I bought at walmart, Valve has done things that retroactively add value to games I bought decades ago, like remote play together, adding internet multiplayer to games that never even thought about it, and a controller system that allows pretty much anything you can think of. Games that had zero controller support for a decade just do now, no extra download, and the required configuration is often the single button press to select whatever configuration someone else made. Valve created an entirely new software platform for games that makes it so even games that are utterly broken on modern systems can work again, and it's just built in. If I buy a game today, I'm pretty confident I can play it in 20 years. An actual system for sharing digital games with other accounts, with large caveats.
Refunds, despite Valve only offering them because it's the law in several countries and they were losing court cases, are not a thing for physical game purchases here in the US. Once you take off the shrink wrap, you are fucked.
Steam has built in support for Beta branches and old game versions that the game dev can enable. Steam has built in support for DLC, and market systems for trading and selling digital "goods", not that I really think that's a good thing but some people seem to. Steam has fully built in support for cloud saves.
Steam has a fully integrated "friends" system, and that system is convenient for the end user and includes features like screen sharing and voice chat and gifting people games.
Steam offers fully integrated mod management for at least a large subset of all possible mods for any game.
Like I cannot stress enough how even if video games were 30% more expensive in steam (they aren't, devs distributing through steam are making a larger portion of the profit than they used to), retroactively adding functionality to games I bought a decade ago and producing a system that makes it very likely I can play these same games in 20 years is so worth it. Everything else is just a bonus. Their hardware also shows great value per dollar, so the "They are overcharging" narrative just doesn't track.
Meanwhile, steam avoids problems that plague other digital storefronts. Easy returns (again, forced on them), their launcher mostly respects my resources and doesn't destroy my computer every time there's an update, the way Valve negotiates terms they have a much better setup: Even if a publisher or developer pulls their game, as long as you bought it before then you can always install it and play it. Transformers Devastation was pulled from the store years ago and cannot be purchased by anyone I think anywhere, but I can still download and play it on a new machine because that's the contract Valve got Activision to sign. The game literally doesn't have a store page anymore.
Fuck Valve's child gambling profits and invention of loot boxes, but their distribution business is unambiguously the most respectful of the consumer and developer. Only GOG with their work towards preservation and lack of DRM comes close.
I own 4000 games on steam. That's about 3900 more than I would have ever bought in a world without Steam. Their wishlist system is a direct driver of sales that wouldn't happen otherwise. When the Epic Store launched, it didn't even have a damn shopping cart.
I think it's a bit disingenuous to blame Steam for a decision Rockstar made. The final decision lies with the publisher as to what game actually ships. If they want to remove their old listings and replace them with a worse offering, that's on them.
GOG can't do this because (nearly all) of the hosted games have stand-alone installers that users can archive themselves. AFAIU that's not possible with Steam.
As someone who sold a few pieces of (non-gaming) software I (co-)wrote in a box in the 90s, I seem to recall that just the retailer kept ~70%. With the remaining 30%, you had to pay for the physical aspects (the box, the discs, the manual, etc.), the publisher and the developers.
I'm happier to pay Valve's 30% than Apple's. With Valve you could always switch to Itch or something if you didn't want to pay, but with Apple you have no alternative. Valve gives you access to a huge player base and lots of useful marketing tools and such.
You are happy now and will probably be for as long as Gabe Newell is in charge of Valve. (He's 63, by the way; not quite elderly but not young either.) After he retires, well, Valve, as the dominant gatekeeper for PC gaming, has a lot of opportunities for cranking up monetization that investors would just love to get their hands on.
So it's either choosing to buy from a company that might become public after the owner dies which then succumbs to the rot that you admit is inevitable with public companies. Or choosing the companies that are already public that is already exploitative and only interested in short term gains?
Investors did not imply public. Enshittification is not limited to public companies. They did not say it was inevitable. Are GOG exploitative and only interested in short term gains?
Don't they have a disgusting most favored nations clause that prohibits you from pricing anywhere else lower (e.g. you can't raise price X by 42% and sell on your site for X)?
I think they're being sued over delisting someone for this last I checked, even if their public policy might not interpret their MFN that way
Imagine if roads weren't public, but were built by a single private company. You have a business that moves goods by truck. You can use the private company's roads, but only if you pay 30% of the profit of your goods to the company that owns the roads. It only takes 2% of the profit to maintain the roads; the other 28% is profit (rent) for the road-owning company.
You could choose not to use the roads. But then the only way to deliver the goods is by parachute (which may be possible, but isn't practical). So you use the roads. But this means you have to jack up your prices to make any profit for yourself. Competing is much harder (tighter margins), and your customers are paying more than necessary. Everyone's life is harder, except for the road company.
Except in this example, there is nothing preventing other companies from building new roads. And in fact other companies have attempted to build new roads, competing by lowering the 30% fee to 10%, and even paying trucking companies to start using their roads. Except their roads are so poorly maintained that trucking companies choose to continue using the existing roads despite the higher fee. Also EA made some roads that went directly into the ocean for some reason.
This doesn't match with the definition of rent-seeking at all, as described in your wikipedia link:
> Rent-seeking is the act of growing one's existing wealth by manipulating public policy or economic conditions without creating new wealth.
To my knowledge, Valve has not manipulated public policy or economic conditions to maintain Steam's dominance. Steam hasn't pushed for legislation to prevent competitors, it hasn't prevented developers from selling their games on other platforms, and it doesn't even prevent you from installing non-Steam games on Valve's own proprietary hardware and operating system.
While I hate always connected DRM, and lamented the death of physical media when steam got huge (and also refused to get a steam account for years for that reason), we would have multiple shitty stores if steam didn't exist, I think.
Look at epic and all the other distributors. Their stores are terrible and that's with the inherent competition of going against steam. Imagine if they were the only game in town. . .
Also looking at history. Download stores run by game stores. Or some startup. Some random extra DRM involved. Shut down in a few years without recourse... Just imagine that repeating every few years. Maybe fine for Linux and Mac users who expect no longevity from their purchases. But as PC user, no not acceptable.
Happier is a fine place to be. They are both still too high. Not everything has to be binary -- I can think Valve is offering some utility and also think that Valve is charging too much for that utility.
The fact that Gabe has a billion dollars worth of yachts probably suggests that maybe, just maaaaaybe, that 30% could be lower and Steam could still provide you the same level of marketing support and player base.
It's like being a first party for a Video Game Console. Gabe Newell having a billion in Yachts, Bill Gates might have a billion dollars tied up in Real Estate. It has less to say about the personal greed of Gabe Newell and more to say about the relative size of the market.
I think while PC is a good example of epic struggling to compete with someone who took full advantage of being first mover, the apple appstore/google play mobile stores are also where they've put in significant financial/legal effort trying to create a more lucrative openings in that market as well.
Of course now it does, but it was bootstrapped off the back of commercial success. The parent poster was suggesting Epic could only finance a game store off the commercial success of Fortnite. Which seemed to be the exact same path Valve took, so I was curious to explore why the parent felt they were different.
Difference is that Valve made a platform to support their own products. And run it fiscally responsibly from start. Where as well Epic is dumping. Trying to gain market share by giving out free stuff and possibly undercharging. Now thinking whole license model for their engine might also be harmful for any bigger competing engines...
Gabe made his initial fortune working at Microsoft. He almost lost it all putting it into Valve/Steam. At one point they were close to not even being able to make payroll. He bet everything on the company.
You are welcome to start your own progressive game market place for PC. Go undercut him and charge 5% fees. You literally just need to dump game files on a CDN right? How hard can it be? /s
I do find it odd that this account is new and the type of posts it leaves. Seems almost like an LLM...
Indeed, when big publishers like EA and Ubisoft started leaving Steam they introduced a tiered pricing system which progressively reduces the cut to 25% or 20% after tens of millions of dollars in revenue, to lure those AAA juggernauts back. The price is now indirectly based on how much leverage you have over Valve - Ubisoft can get away with not releasing their games on Steam, so they pay 20%, while small-to-medium studios effectively have no choice, so they pay 30%.
It's especially backwards when you consider that those AAA games put far more strain on Steams infrastructure with their >150GB install sizes.
Heck, I've not bought games because they were not on Steam or required another launcher. Ubisoft and Rockstar are so bad that I held off on buying some games I really wanted to play; they're just that awful. EA's Origin was also pretty bad last time I checked.
I guess it's an actually hard problem to make a somewhat decent launcher in big companies with too many PMs playing turfwars, but still, almost everyone except Valve is shitting the bed so hard that as a consumer I'd happily pay quite the markup if it would allow me to avoid other launchers. They're that bad.
There are even games you can buy on one service and play multiplayer with people who buy it on steam! I chose to buy MSFS2020 through steam for example because the steam platform is dramatically better than the absurd way the Windows Store does anything, but we fly in the same skies!
There's no lock in or exclusivity. You can literally buy the same exact executable from multiple places, and the only change is the feature the store program supports. Buying a game through the Epic Store for example won't let you use steam input, but you can even then play it on the steam deck with some effort! I think you can even use Proton on executables you don't get through steam!
A dev can even make it so that, if you buy their game on steam, you do not have to have steam running or installed to play it. They have that freedom. They also have the freedom to mark a version of the game such that steam allows you to access that old version forever
If you are a dev who releases a game on steam, you can mint a bulk quantity of steam keys and sell or distribute those outside of steam!. Probably if you abused it, Valve would tighten it up or ban you, but why would you bite the hand that feeds you? It's how, for example, Humble Bundle initially worked.
That's right, you don't even need to buy your game from Valve to use all their features! A substantial portion of my library paid money to Amazon instead, through humble bundle.
People use Steam because it has 20 years of established trustworthiness in an industry otherwise made up entirely of assholes who hate you.
Meanwhile, in the place that Steam does poorly: Old games, GOG has much more of the market.
People actually are willing to pay for trust and care. Steam has repeatedly and regularly improved how their storefront displays information and informs consumers, because their primary problem is discoverability and wading through the mountains of games from people desperate to collect some of the money waterfall that Valve enables.
When you put a game on Steam, the contract ensures that anyone who purchases it cannot lose access without it being Valve's decision. Developers or publishers who do stupid things or pull games five years down the line cannot prevent you from playing a game you buy on steam if it isn't dependent on some server somewhere. None of the other storefronts have ANYTHING like this, mostly because they are run by the exact companies who WANT to be able to prevent you from ever playing an old game again, so they can sell the same thing to you in a new box.
Compare that to Apple's 30%, which similarly has lots of features their platform enables including unlocking significant consumer spending, but they do not give you any alternative. If you want even a single dollar from someone on an iPhone, you HAVE to pay apple 30%, and at least for a while they wanted that even to cover netflix subscriptions for example.
If you as a developer do not want to pay valve 30%, you are free to do like Notch did for Minecraft and distribute it yourself, and you are free to run into the same problem it had where my friend was unable to purchase minecraft for decades because his bank refused to send money to the Scandinavian bank involved, whereas even a literal child without a debit card can use birthday money to buy a steam gift card and purchase your game with no adult involvement. (maybe that's not a good thing for society, but it's great for game dev business).
Valve does not have a moat other than simply consumer trust. Minecraft sold a hundred million copies through a dude's website. There has literally never been a moat in computer game distribution. An entire industry of British children existed writing games and selling them in local stores. A moat has never been possible, because Valve cannot make your computer not run other software.
Valve charges 30% for access to their marketplace, and allows you to sell Steam keys for your game at whatever price you want through your own sales channels, without paying Valve a cent.
I'm not sure how any of that is sketchy or gross. As far as marketplaces and platforms go, this is quite reasonable, and there are many successful games which are either not on Steam, or are cross-listed on multiple platforms, or are cross-listed on both Steam and the developer's own distribution channel.
It seems like the flat management structure allowed an ad-hoc hierarchy of cliques to form in the office anyway, pitting entrenched teams of old-timers against new hires, but implicitly. When you think of the lack of support for TF2 over the years, this is illuminating.
It's astounding that Valve/Steam are still as successful as they are in spite of this culture.
The second link is paywalled, but from the various sources I looked at, the diversity problems with Valve seem limited to "Valve refuses to spend company time/effort to support my cause". I have not seen any concrete claims of misbehavior, in direct contrast to some other video game companies.
Additionally, when I actually look into the alleged statistics of claims that "Valve is primarily white and male", the numbers ... don't actually look that bad? We shouldn't expect any company to fit national demographics exactly.
I was a member of STS and I can say crowdsourced translations were a million times better than the now-paid translation teams Valve hires.
And yes, while it was mostly "unpaid", during my time there (2016-2020), we had a year-end rally every year which the "fastest" teams to complete translations would receive Steam wallet codes for their effort. I received up to $350 the first year of rally.
The next year they gave us Artifact keys...
and then the one Valve employee managing the server left Valve, and STS was slowly being replaced by Crowdin
they essentially killed crowdsourcing starting with Artifact. We (the STS members) had no access to new strings, then came Underlords, the new client... Only TF2 translations are crowdsourced to this day. The rest are done by their external teams.
Allegations of unpaid labor are for crowdsourced translations and have nothing to do with Valve as a workplace.
This controversy is known and there are a few translators on Steam/Valve that came from the community, but nowadays it is mostly outsourced, and they do a terrible job (they replaced gamers with people who can't even bother to download the game to check the context a string is applied to).
> They also take an absurd cut of developer income
30%-20% is by no means "absurd", given the incredible value that Steam provides to developers: content delivery, payment processing, cloud saves, ratings, game tags, social integration, wishlisting and sale notification, search indexing, game discovery, a bunch of incredibly useful APIs including networking and input, Linux compatibility, and many, many other things.
In fact, 30% of revenue is well under what it would cost me to implement all of the features that I want from Steam as a developer, unless I somehow won the jackpot and ended up selling millions of copies (in which case I would end up only paying 20% of revenue anyway).
> and saddle devs with costs that they don't always want. (Selling on Steam? Valve takes 30%
Which you already mentioned, while somehow conveniently omitting the fact that the cut decreases to 20% if your revenue is high enough.
> and forces you to moderate the forums on your listing page that you cannot opt out of
This is the single possibly objectionable thing here.
> They also have an internal culture that's been fairly regularly criticized as being pretty uncomfortable for women and minorities.
~~Allegations~~ mean nothing. Are there successful lawsuits?
> Valve has done some cool stuff, but let's not lionize them too much.
Valve is incomparably better than every other major game distribution platform, which is the comparison that we're making. You are very intentionally making manipulative and dishonest points to try to paint Valve as worst than it is. Which makes sense, because you're a throwaway account.
I appreciate what you've posted here. Valve fanboyism is widespread (I'm guilty of it too) and while they are shoulders above the alternatives, it's a good reminder that no one's perfect and I'll be sure to take a closer look at the company in the future.
> They also have an internal culture that's been fairly regularly criticized as being pretty uncomfortable for women and minorities.
If they don't like the culture, then they should work elsewhere.
I hear Google is hiring.
Nothing worse than joining a company you contributed zero to building from the ground up, then unilaterally deciding the culture needs to change according to your whims, right now.
You might feel uncomfortable working in a black barber shop. Or a cat cafe with pet allergies. You've contributed nothing to their business, they shouldn't have to change for you.
What nonsense. A decision about workplace should be a combination of factors -- workplace culture, products you can work on, compensation, skill fit, alignment with your interests, etc.
You should feel empowered to have a voice in the products of your labor. And you should feel empowered to have a voice in the culture that produces those products.
I think employees are actually entitled to some of those things, like not being made uncomfortable purely because they are a minority or a female. I would find the opposite position to be an exceptionally strange take: that it is entitled to not want to work at a place that puts you in uncomfortable positions for your sex or your race.
I don't have an opinion on Valve or allegations Valve is doing that. I just find it very strange to say it's entitled for a black to want to be treated as equally as a white.
Being uncomfortable has no equivalence to racism, which you are trying to assert.
Assume a white guy voluntarily takes a job working in a wig shop that only sells black women's hair care products. He's going to be uncomfortable at some point. Does he have a right to not be uncomfortable? Should the company culture change, should they stop selling wigs and ditch their customers until he becomes comfortable?
No. The easiest solution is he should work elsewhere. He took the job knowing exactly what was involved. So no, you are not entitled to not be culturally uncomfortable.
What kind of "uncomfortable for women and minorities" if not racism or sexism?
Also wait does this mean Valve is white males-oriented culture and that minorities/women should expect to be made uncomfortable by lieu of being hired there? I think that's an even weirder take!
> What kind of "uncomfortable for women and minorities" if not racism or sexism?
Women generally have different interests than men, and different cultures generally have different interests and expectations than others. This is extremely well documented, as is the fact that people have a harder time being comfortable and fitting in around others who are unlike them or don't share their interests.
> wait does this mean Valve is white males-oriented culture
If Valve mostly hires white males, then either you're expecting the employees to not socialize at all (leading to no culture), which is sociopathic, or yes, that's exactly what you would expect.
You're objecting to reality and truth because it offends you, for some reason? There's literally nothing objectionable with any of the above. Being uncomfortable implies zero moral wrongdoing. You should do some reflection and/or research.
It's kinda wild how part of the modern zeitgeist is entitlement to be comfortable, and how irrationally people will defend that entitlement, including to the point of being literally racist and sexist.
You seem to be misunderstanding how language works? Can you please explain why you think the literal word entitled had to be said by you here?
You listed a bunch of things which should be, an opinion, he says your not entitled to those things, a probable fact relevant to the likelihood of attaining your professed desires, and he then offers a solution if you are unhappy with not having the things you professed 'should' be afforded.
I made no demands and I made no assertions about entitlements. That reply to me was a strawman.
I made two statements:
1) I suggested people have multiple criteria for selecting a workplace, not just culture.
2) I suggested people should have the ability to voice their input over their work. (Note, that's a weaker claim than "people should have input over their work". Just that they should feel like they are able to voice their input.)
Neither of those two things are demands nor entitlements, and the latter I would assume would be pretty non-controversial unless you believe that bosses should have absolute and complete control over every facet of a worker's job. (I guess I work in tech, where it's pretty widely accepted that people have autonomy to make some decisions on their own about how and what work is achieved.)
I was thinking I know a few people over 65 who are being radicalised, might be an idea to ban it for them too.
The serious answer is that banning "social media" is a bit silly. We should concentrate on controlling the addictive aspects of it, and ensuring the algorithms are fair and governed by the people.
Even if you're half-joking, there's a very real point to this. It's really not solving the problem. It's moving it very so slightly down the line.
I'm not entirely sure how I'd want to word it, but it would be something like: It is prohibited to profit from engagement generated by triggering negative emotions in the public.
You should be free to run a rage-bait forum, but you cannot profit from it, as that would potentially generate a perverse incentive to undermine trust in society. You can do it for free, to ensure that people can voice their dissatisfaction with the government, working conditions, billionaires, the HOA and so on. I'd carve out a slight exception for unions being allowed to spend membership fees to run such forums.
Also politicians should be banned from social media. They can run their own websites.
In principle, certainly. In practice, Congress can't be trusted to craft more or less any law these days. I'm not necessarily sure that the law will be able to help us here, but I also think it's not helpful to take the broadest possible definition of social media to try to shutdown discussion. (I'm not suggesting that you are doing that)
Australia's soon-to-take-effect ban affects nine platforms, including Instagram and Facebook, but not HN. These bans often operate on the amount of users a platform has, so HN is unlikely to make the cut. Nobody cares about this site.
I'd gladly give up HN if it means Instagram and Facebook are eradicated. Yes, yes, "those that would trade liberty for security...", but we were better off without any form of social media at all.
I often wonder if posts like this, along with the people who want to ban all cars, etc are just rage bait. Fortunately most of the population disagrees with your preferences. I give “general social media ban” around a 1% chance of success.
The problem is not social media, it's the few people controlling it. There is no inherent problem in social media, there's an inherent problem of people caring about only their money and power and not giving a jack shit about anything else.
> Oh - and 1.3 billion unique passwords, 625 million of which we'd never seen before either.
It's not just email addresses. It's address + password combos.
But also, how did 2 billion email addresses get exposed? Assuming I give an email address to a company (and only that company) if someone gets access to that email addresss they either got it from me or that company. Knowing the company has sold, lost, or poorly protected my email address tells me they are maybe not worth working with in the future.
> But also, how did 2 billion email addresses get exposed?
The list contains emails which have been part of some other breaches. In my domain I have 2 emails that were exposed that weren't my normal email address. One of them was a typo that I used sign up for one service which was later breached. The other one was something someone used to register to service that I have never used & that service was later breached. Those emails have never been used for anything else as far as I'm aware.
Of course judging from what posted there are likely some other services as well which were breached but wasn't noticed/published until now.
Yea a combo is more problemtic, I could see why thats an issue. Most important stuff in my life has 2FA with my phone thankfully. My banking password got breached like 3 years ago and i still didnt change it... nothing ever happened. I am guessing tech companies that could have huge negative influence on your life should have additional security measures in place, like not allowing a login from a different country unless some kinda mobile code is provided or stuff like that. I'm pretty naive with all that tbh.
The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned.
I understand they gotta make a buck, but I find it interesting this is the first real negative to running a unique email address per company/site I work with.
The domain search feature on haveibeenpwned is/was free. I registered my domain on haveibeenpwned back in 2017 and I got two emails about breaches, one in 2020 and another in 2022. I did not pay.
It tells you that an address in your domain has been included in a breach. It doesn't tell you which address was included. That's what the OP and I are opining about.
It does. I just checked mine today. I can see exactly which individual email addresses in my domain where exposed and in which data leak. I have never paid for it.
Interesting. I'd love to see where you're seeing that. I'll go poke at the site a little more.
Edit: When I try to do a domain search I get told:
> Domain search restricted: You don't have an active subscription so you're limited to searching domains with up to 10 breached addresses (excluding addresses in spam lists).
Yep, if you have the good fortune of having many breaches while using companname@example.org, the service requires that either you pay up or you have to guess and check.
Have I been pwned will tell me if the associated password for that site leaked. I create unique passwords per site, but lets say my mastercard login gets pwned -- that'd be one I want to change the password for right away.
I might not get an email if someone gets that account info.
In practice, anything that high-profile will be plastered all over every tech news site, twitter, reddit, probably even the news. It would be difficult for MasterCard/Visa to have dataleaks, even just email/pass, fly under the radar (I imagine...)
Oracle tried to cover up a data leak, and it didn't go great. Oracle touches nowhere near as many every-day people as MasterCard does
I'm in the same boat. I track all of the unique addresses I use (via my password manager) so I guess I could just check them all against HiBP's database. Kind of a pain in the ass, though.
Me too. It used to work for whole domains. Then I guess the limit was added as part of some kind of monetization push. I don't derive enough value to pay for a monthly subscription any time it occurs to me to check, nor figure out how to check addresses one-by-one programatically. So the site is basically dead to me now. It's a shame because there were a few breached lists where people were speculating on where exactly they came from, and I was able to add to the discussion based on which of my tagged addresses were in the list.
I've had that experience re: my personalized addresses being used to more closely identify the source and time of a breach. When I start getting spam to one of my personalized addresses I'll usually reach out to the party for whom the address was created to let them know. Usually I get treated like a crank but occasionally I get somebody who understands and appreciates the help.
I use Bitwarden with a Vaultwarden server so I have some familiarity. Bitwarden checks new passwords against HiBP. I'm not aware of functionality where it can retroactively check old email addresses or passwords to see if they're included in a breach.
Ahh, okay. I assume that's a part of the Bitwarden offering, presumably happening server-side. I'm just using their official client w/ a Vaultwarden server.
It's not the email address itself that I care about, and that's not the service that the site provides. It tells you for which email addresses a related password has been pwned.
I don't understand... The password is the secret, right? If your mastercard login ends up in some breach, your password is protecting. You without or without vanish urls, if you have strong passwords you'll be fine.
Harvesting potential targets is one part of it i.e. establishing someone was using an email address is the entry point. There's a lot of emails, so associating them to any particular website is right near the start. Establishing that they're active increases their value further.
The people responding to Troy here for example are technically doing that: they clearly monitor the email or still use it, so addresses which respond to up in value.
The problem with catch-all inbox is when you have to reply to an email. Then you have to create the email address to be able to send emails from it. Or are there other solutions?
There's no solution to a non-problem. Precisely 3 of the hundreds of the generated email addresses I've given out over the past ~12 years have needed replies. When this happens, I simply reply from an address that actually does exist, while CCing the original generated address and setting it as the reply-to address.
If I ever have to give a generated address out to an actual person, then I'll let them know replies will come from a different address. So far I'd guess 99.999% of the emails I received are transactional emails and/or sent from noreply@...
Far more annoying are a few websites I use that only support magic links for login--my password manager doesn't auto fill them, and some of them I now have a number of accounts at due to inconsistent spelling/formatting.
True, I simplify it a bit based on the capacity of my mail provider. I have like 4 or 5 generic addresses that I give out and use for sending. Sometimes I mix up when sending, but my mail provider (zoho) is pretty decent at keeping track of the addresses anyways.
In a way if I reply, the other party gets upgraded to one of my 5 addresses, so if they send an email to ContosoCoffeeShop@myname.com I might reply from whatever flavour I'm using nowadays or is more appropriate like hello@myname.com
It's like a 3 layer security system, the least privileged get access to one very specific address, if they send me an email which makes sense and I reply, they get upgraded to a bucket. I might sign up directly with a bucket email and skip the most paranoid layer, that's fine.
In general I try to take more care of the newest alias and become more liberal with my older more ruined addresses, alias1@ has like 8 years of signups, while alias5@ has just 1 if any. And I'm sure the list will grow.
Downside is that if there's a leak it's harder to attribute exactly, but at least I can check the recipient to get some kind of hint.
It's more like art than it is a water-tight security protocol. You paint the world with your wacky addresses and occasionally surprise the observant employee with the inverted expectations (usually the name comes before the at)
I have those things? Did you miss the part where I have multiple vanity URLs and hundreds of email addresses? Of course I have a paid mail provider and catch all. The problem is the cost of haveibeenpwned is too much for me as an individual.
I meant that you are already paying for those, so being charged by providers to support our hacky email addresses is not a novelty introduced by Troy's service
I have the more typical one email used with hundreds of passwords on many websites. haveibeenpwned is also useless for me, it will tell me that my email was compromised but not which sites or passwords. I guess I could check each password individually, hope each password is globally unique to me, and then try to match it back to the website where I used it so I can change the password.
Reread the parent post more closely. It does not tell them: A) which site nor B) which password.
The parent can log in because they have a map of site<->password. But without either the site or the password, the notification that an email address is compromised is useless.
As someone who became vegetarian after reading a Glenn Greenwald article I found on HN about how the pork industry does awful things and gets the government to prosecute people trying to expose it, the key I've found is to look to world cuisine.
Many cultures around the world have awesome food that's easily convertible to vegetarian or is vegetarian already, where meat might be a luxury.
Central America and the Caribbean have tons of dishes with rice, beans, plantains, and flavorful sauces with flatbreads. Or a million ways to prepare corn. West Africa has peanut stew that's amazing. Across the rest of the continent jollof rice and githeri are good solid bases for a meal. Misir wot is a spicy hearty lentil stew. North Africa has a rich vegetarian tradition of soups, stews, and rice dishes. In the middle east there's falafel, hummus, mujadara, shakshuka and about a million ways to combine spices, onions, tomatoes, flatbreads, etc. South Asia obviously has a massive vegetarian cultural tradition, as does Southeast and East Asia.
When I started, I found it hard. I kept thinking "beans and rice... I guess?" Once I started going, "ok, I'm going to pick a small region of the world and see what they eat there and try it" I had WAY more success. The first time I made tteok-bokki or sushi or vareniki I suddenly realized just how much of the world is really already preparing vegetarian meals for many of their meals.
> FBI agents are devoting substantial resources to a multistate hunt for two baby piglets that the bureau believes are named Lucy and Ethel. The two piglets were removed over the summer from the Circle Four Farm in Utah by animal rights activists who had entered the Smithfield Foods-owned factory farm to film the brutal, torturous conditions in which the pigs are bred in order to be slaughtered.
> Rather than leave the two piglets at Circle Four Farm to wait for an imminent and painful death, the DxE activists decided to rescue them. They carried them out of the pens where they had been suffering and took them to an animal sanctuary to be treated and nursed back to health.
ICE is currently shooting peaceful protestors and is gearing up for war with Venezuela; a couple of pigs chasing a couple of pigs is the least of my concerns viz-a-viz tax dollars
Sorta. The animal welfare laws say that getting images out of food production facilities are terrorism. Which suggests that an authoritarian regime could/would deploy a lot more of the state power against them.
And I think "understanding your food sources is terrorism" has impacts too people should be worried about. (To be clear, they ARE less acute than ICE concerns, of course).
Thanks for your response. But I think you've misunderstood.
I'm pretty well aware of the deep well of cuisines offered by various cultures, but my issue is not finding recipes -- it's the time I and effort spend cooking.
My current job takes a lot of time and energy out of me, by the time I get home I'm pretty exhausted. I don't really get any time to cook throughout the week. (Which kinda sucks, I did enjoy cooking)
I rely a lot on quick meals from Trader Joe's or something I can just toss in the microwave. And while Trader Joe's does have some vegan/vegetarian selections like that, it's kinda limited.
I don't know Trader Joe and what they offer but here's some quick preps I found convenient:
- cereals and lentils/beans semolina. Mix with oil, spices and hot water. Cover and wait 5 minutes.
- Cans of beans, lentils, chickpeas mixed with pre-made tabbouleh or another carb. Oil/spice and eat.
- Various marinated tofu: they're delicious own they own and don't need prep: open and bite.
- Instant mashed lentils/slip peas/quinoa (flakes). Oil/spice/water and eat.
- Tempeh: microwave and dip in sauce.
- bread and houmous.
- bread and nuts.
- Vegetable that can be eaten raw: rince and eat. Dip in sauces if you like. Carrots, cauliflower, cucumber, radishes, chicory, small iceberg salads...
- Fruits. rince and eat.
The trick is to have a few different oils and spices, those add taste and nutrients. Also you can add to anything a spoon of brewer's yeast if you're into that (cheese/fermented taste) or of silken tofu for more creamyness.
I don't understand your comment. Is it an attempt at humor? Don't be a dick.
I don't object to eating animals, I object to torturing animals in the process of raising them. You can raise pork without forcing mother pigs to indefinitely share a space with a pile of their rotting children's carcasses.
Ask yourself why it warrants a terrorism charge to smuggle out photos of animal mistreatment.
Sure, but spinach, kale, mustard greens, chard, and arugula are all pretty wildly different. With different textures, flavors, and other things going on.
They also take an absurd cut of developer income and saddle devs with costs that they don't always want. (Selling on Steam? Valve takes 30% and forces you to moderate the forums on your listing page that you cannot opt out of.)
They also have an internal culture that's been fairly regularly criticized as being pretty uncomfortable for women and minorities.
Valve has done some cool stuff, but let's not lionize them too much. They are probably better than an average company, for sure, but it's important to remember that they are also sketchy in some very gross ways as well.