More likely is nobody at Valve cares enough to actually monitor or respond. There's plenty here about their bizarre corporate structure which really falls flat at critical times.

I would go with this assumption. Best to assume neglect over mal intent.

This behavior was seen before too with the devs behind the new Gmod in Source 2 (Alyx engine). They spent months trying to get in touch with access and it came down to an employee who ended up getting fired for neglecting responsibilities. Now everything seems to be working out and open tooling is being developed.

Does it really make a difference, with respect to whether they should be kicked off HackerOne? Incompetence and disorganization is no excuse for what is essentially (if not literally) wage theft.

My experience with valve on HackerOne was when I discovered an easy way to lag, and if exploited crash, a dota 2 server. It was nothing technically fancy, but something that made it easy for griefers to ruin the game for everyone. I think even spectators to the match could trigger the functionality.

They turned me down for any reward - I don't remember the exact wording in their policy but I think it was a generic exclusion of DOS and DDOS vectors. I thought I should've still been eligible as my exploit was simple and only required a low input frequency. The bureaucratic process of the whole thing scared me from doing anything more and I was happy enough that they would fix the vulnerability and I could get back to enjoying the game.

I think it's five years later and the problem still exists, and regularly reduces the quality of my games.

It would be awful if after 5 years someone independently rediscovered this vulnerability and tweeted reproduction steps.

At some point it is more responsible to make the exploit public and spark public pressure for a fix, than to let Valve ignore exploits while each day is a roll of the dice on a bad actor discovering them.

If they don't feel the pain, again and again for things like this then there will never be any impetus to change.

This isn't your responsibility of course. I'm just saying that disclosure at this point would be anything but irresponsible. Maybe not in the middle of a big tournament, I suppose.

No experience with Valve but are not alone in being cheap:

I submitted the bug where you I proved you could make predictions about a password in Microsoft just by using ctrl + arrow keys.

It wouldn't have been much anyway but I wouldn't have been surprised if they sent me some swag or something - instead I was surprised about how short the thank you mail was ;-)

(They said it wasn't a security issue but at least it was fixed in the next release :-P)

Edit: I later found a reliable way to run the encryption tools the correct way with the tooling in Azure Information Protection that still leaves the files unencrypted (so simple it can happen by accident, that's how I found it, useful for data exfiltration with plausible deniability) and besides the integration of information protection in Sharepoint is so extremely broken that depending on how you log in, SharePoint will easily serve you the files unprotected.

Between not finding the correct way the report it and the very "meh" feeling on my first find I only tried to report those onve or twice and then gave up.

If you check their hacktivity you'll see that the previous negative press spurred them into action:

https://hackerone.com/valve/hacktivity?type=team

These researchers could have earned plenty from making cheats instead. Would make sense for Valve to pay these types to fix their software instead of breaking it.

They pay, eventually. They're particularly slow for game client exploits. Much quicker for server-side issues.

Yeah, it is certainly a wide spectrum. Server-side fixed in days to months, but these game client bugs have been sitting for years.

I had one server bug in HackerOne’s “mediation” for over a month, after 4-6mo of no reply, which did nothing until mentioning it to a Valve employee on another report they had actually responded to.

Disappointing for a program that has paid $1m+ in its lifetime.

I like Valve's approach. Who is the real bad guy here?

Why should they prioritize people who break their hard work and coerce them into paying for protection?

I might be biased; always wanted to work @ Valve Software since HL1.

> Why should they prioritize people who break their hard work and coerce them into paying for protection?

Because they voluntarily joined responsible disclosure programs and promised rewards?

Their hard work wasn't good enough to survive in the extremely hostile world out there. The fact is online gaming is a form of distributed computing and so people are exposed to network attacks. By failing to prioritize security they are putting their customers at risk. They can either start taking this seriously or watch people make money off of the vulnerabilities in their hard work.

> I like Valve's approach. Who is the real bad guy here?

Valve are, leaving millions of users at risk, despite having been informed of an issue.

Because that's what they signed up for?

See it from Valve's perspective.

They've had pre-launch source codes leaked by hackers, gameplay ruined by hackers; they probably don't like hackers.

I wouldn't be surprised if they signed up purely out of spite to tarpit and frustrate hackers.

That is such a bizzare take.

Valve's stance on hackers won't change the fact they exist and are out there doing their thing. Valve's stance can now be the deciding factor between exploits being disclosed to them for a reward, or sold on black markets as cheats.

If you don't want people "breaking your hard work", don't release software. However, being on hackerone can help alleviate the negatives.

Sounds like a great idea, now instead of them getting issues fixed they get sold and not reported.

> they probably don't like hackers

Many of their breadwinners were made by 'hackers'.