Gabe Newell addresses concern over Valve Anti-Cheat system

Gabe Newell has taken the unusual step of addressing concern over VAC - Valve's anti-cheat system.

Newell took to Reddit after a thread on the Counter-Strike: Global Offensive sub-Reddit claimed VAC had recently changed the way it worked so that it read all the domains players visited and sent the information back to Valve's servers hashed.

In short, players were concerned Valve was spying on Steam users' internet use.

Newell, in a post on Reddit of his own, moved to calm those fears by explaining exactly what VAC had done.

"Cheat developers have a problem in getting cheaters to actually pay them for all the obvious reasons, so they start creating DRM and anti-cheat code for their cheats," Newell explained. "These cheats phone home to a DRM server that confirms that a cheater has actually paid to use the cheat.

"VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache.

"If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result."

Newell went on to say the specific VAC test that sparked the initial concern was effective for 13 days and is no longer active because cheat providers have already worked around it. Valve's goal, Newell said, "is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain."

Newell also highlighted the "social engineering" element to cheat creation, saying if the idea that "Valve is evil - look they are tracking all of the websites you visit" gets traction cheaters and cheat creators benefit. Indeed it is this aspect to the recent situation, and threads on Reddit, that caused Newell to step in.

"VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky. For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light.

"Our response is to make it clear what we were actually doing and why with enough transparency that people can make their own judgements as to whether or not we are trustworthy."

To sum up, Newell denied VAC sends your browsing history to Valve. "Do we care what porn sites you visit?" he asked. "Oh, dear god, no. My brain just melted."

And finally, is Valve using its market success to go evil? "I don't think so, but you have to make the call if we are trustworthy. We try really hard to earn and keep your trust."