• Epic Games Store Is Shit - But It's Not Spyware
    59 replies, posted
Let's start of with this, I think the Epic Games Store client is shit, it is slow, it lacks many many many features compared to it's competitors, and the exclusivity deals do feel like a kick in the balls. However there is a disproportionate amount of claims being spread that the Epic Games Store client is outright spyware, this is complete nonsense. My post is a technical analysis of the Epic Games Store client and claims made by other people, I don't like narratives being led by untrue shit so here goes. The /r/PhoenixPoint Reddit Post Let's start with this specific Reddit post, it is linked to in just about every thread regarding Epic however; the guy who writes it self describes himself as an amateur, and rightly so almost everything in his post is him failing to understand how software works. (List is reworded from lotaSherbet with a few more points from me on how this is how Fiddler and DLLs work) EGS likes to enumerate running processes on your computer This isn't EGS enumerating processes, this is literally how tools like Procmon and Fiddler work, they have injected themselves into the running process. why is it trying to access DLLs in the directories of some of my applications? This is how shared libraries work on Windows, and once again in this example he is showing Fiddler which is something he has injected into EGS, nothing here. it really likes reading about your root certificates Like, a lot It is a launcher based around a web browser, this is how HTTPS works, of course it has to check your available certificate authorities - every other Electron application including Discord and Steam do this. if there are any non-amateur people out there who would be able to explain why it's poking at keys that are apparently associated with internet explorer, I'd appreciate it. It seems to like my IE cookies, too. Once again, it is a launcher based around essentially being an internet browser, any application that does that reads these registry values, because it's how internet browsing works. In my totally professional opinion, the EGS client appears to have a severe mental disorder, as it loves talking to itself. A demonstration of him showing how little he knows about what he's saying, this is literally how software works by communicating with itself on private TCP ports and pipes, especially modern web applications. This one might even be Fiddler's internal proxy server. I'm sure that this hardware survey information it's apparently storing in the registry won't be used for anything nefarious or identifiable at all. What is being stored in the registry is simply a flag stating if you've taken the hardware survey test, which he didn't even bother looking into. Automated hardware surveys are also a thing in basically every other launcher and software suite such as Origin, Uplay, Adobe, Autodesk, Windows, etc... it is useful anonymous information that helps developers better understand their target hardware. The big concern that everyone has is tracking, right? Well, Epic does that in SPADES. Look at all those requests. Look at the delicious "tracking.js". Mmm, I'm sure Xi Jinping is going to love it. Here's a copy of that script, I couldn't make heads or tails of it, but I'm also unfamiliar with JS. It looks less readable than PERL, though. He has discovered what analytics and minified javascript is, the script is a minified Javascript analytics tracker - every single website you go on, including Steam has this, everywhere. This is nothing new, nothing dodgy, they just want to know how many users are viewing product pages and their retention etc.. The localconfig.vdf The only worrying part of the Reddit Post is the localconfig.vdf file the launcher copies, however there is again a huge amount of misinformation with this too. There are huge concerns over the sheer amount of information the file contains, just to name a few things: * Steam accounts you've logged in to on this PC * Your entire friends list * Your steam groups * Your games and settings for those games There is a lot more in the file, all unencrypted (the file includes login tokens also which means the file REALLY should be encrypted). And whilst the file does contain huge amounts of information, there is no evidence that Epic Games Store client uses anything other then the bare minimum in their import friends feature. https://files.facepunch.com/forum/upload/828/10e5a308-4b9b-48cc-9e81-0d2dc470c6e2/image.png This is one of the usages of the file, listing your Steam accounts from the PC. The secondary usage is then generating hashed copies of your Steam's friend ids, not even full versions, they're making HASHES, this is because they can't collect SteamIDs, names or avatars from people who have not agreed to their privacy policy, this is because they operate within the law. The file being copied isn't an ideal solution either, however it is required to be done at installer time so that the client itself does not require administrative privileges. A look at what is actually collected I decided to open Fiddler and see exactly what data was being collected and sent to Epic and to no surprise it's exactly what they say is collected. https://files.facepunch.com/forum/upload/828/db90021b-28fc-4816-a0d9-bc1bb54fc731/image.png This is my Fiddler from when I launched the client right through to using the Steam import friends feature and some after that. In the top right of the picture you can see exactly what data they use and send to their servers: my steam account id, a hash of my steam account id, my steam persona name, my steam avatar hash, and a hash of my Steam friends. Which is exactly what they say they send. Additionally I logged the following requests for an idea of the telemetry / hardware survey they're doing: {"Events":[{"EventName":"SessionStart","DateOffset":"+00:01:00.397","AppMode":"Default","Platform":"Windows"},{"EventName":"Usage.CommandLineArguments","DateOffset":"+00:01:00.158","AppMode":"Default","Args":"\"C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Binaries\\Win32\\..\\..\\..\\Portal\\Binaries\\Win64\\EpicGamesLauncher.exe\" -SaveToUserDir -Messaging -enablehighdpi"},{"EventName":"Network.Ping","DateOffset":"+00:00:59.995","AppMode":"Default","TargetAddress":"qos2.ol.epicgames.com","Status":"Success","ResolvedAddress":"173.199.67.137","ReplyFrom":"173.199.67.137","Time":"0.064"},{"EventName":"Usage.PortalStateSnapshot","DateOffset":"+00:00:59.993","AppMode":"Default","TotalRunTime":"0","AppVersion":"9.11.1","AppState":"Initializing","AppFocus":"SystemTray","CurrentLocation":"","ActiveDownloads":"0","OpenApplications":"0","RunningApplications":"","CPUTimePct":"0.0","MemoryAllocator":"binned2","AvailablePhysicalMiB":"19712","AvailableVirtualMiB":"134212642","UsedPhysicalMiB":"224","PeakUsedPhysicalMiB":"224","UsedVirtualMiB":"292","PeakUsedVirtualMiB":"292","PrimaryDisplayHeight":"1440","PrimaryDisplayWidth":"3440","MainWindowHeight":"1120","MainWindowWidth":"1194","MainWindowDpiScalingFactor":"1","MainWindowIsMaximised":"false","MainWindowIsMinimized":"false"},{"EventName":"Usage.Navigated","DateOffset":"+00:00:59.907","AppMode":"Default","PreviousLocation":"","CurrentLocation":"/waiting-room"},{"EventName":"Performance.InitialStartupComplete","DateOffset":"+00:00:59.859","AppMode":"Default","Timespan":"+00:00:01.207","Milliseconds":"1207"},{"EventName":"Launcher.Install.Start","DateOffset":"+00:00:58.721","AppMode":"Default","AppName":"EpicGamesLauncherContent","BuildLabel":"Live-Carbide-Windows","AppInstalledVersion":"++Portal+Main+prod-CL-5684328-Windows","AppPatchVersion":"++Portal+Main+prod-CL-5684328-Windows","InstallSessionId":"SESSIONID","InstallMode":"EInstallMode::NonDestructiveInstall","ItemId":"","Namespace":"","DeveloperName":"","Categories":""},{"EventName":"Launcher.Install.Stats","DateOffset":"+00:00:58.546","AppMode":"Default","AppName":"EpicGamesLauncherContent","BuildLabel":"Live-Carbide-Windows","AppInstalledVersion":"++Portal+Main+prod-CL-5684328-Windows","AppPatchVersion":"++Portal+Main+prod-CL-5684328-Windows","TotalDownloadedData":"0","AverageDownloadSpeed":"0","InitializeTime":"0.057013","ConstructTime":"0.000001","MoveFromStageTime":"0.003901","FileAttributesTime":"0.03163","VerifyTime":"0.025306","CleanUpTime":"0.000499","PrereqTime":"0","ProcessPausedTime":"0","ProcessActiveTime":"0.179484","ProcessExecuteTime":"0.179484","ProcessSuccess":"true","FailureType":"EBuildPatchInstallError::NoError","NumInstallRetries":"0","InstallRetryTypes":"","InstallRetryCodes":"","ErrorCode":"OK","FinalProgress":"99.999985","FinalDownloadSpeed":"0","InstallSessionId":"SESSIONID","PeakDownloadSpeed":"0","NumFilesConstructed":"0","TotalReadData":"7320679","AverageDiskReadSpeed":"628999960.703155","PeakDiskReadSpeed":"628999960.703155","TotalWrittenData":"0","AverageDiskWriteSpeed":"0","PeakDiskWriteSpeed":"0","AverageMemoryStoreUse":"0","PeakMemoryStoreUse":"0","AverageMemoryStoreRetained":"0","PeakMemoryStoreRetained":"0","MemoryStoreSize":"336","InstallMode":"EInstallMode::NonDestructiveInstall","DownloadConnectionScalingEnabled":"false","NumFailedDownloads":"0","PrimaryCDN":"https://epicgames-download1.akamaized.net","ItemId":"","Namespace":"","DeveloperName":"","Categories":""},{"EventName":"Usage.Navigated","DateOffset":"+00:00:58.086","AppMode":"Default","PreviousLocation":"/waiting-room","CurrentLocation":"/epic-login"},{"EventName":"Launcher.User.Login","DateOffset":"+00:00:57.287","AppMode":"Default","Success":"TRUE","REASON":"","AccountID":"MYACCOUNTID","OldAccountID":"MYACCOUNTID","SuccessfullyUpdatedAccoundID":"1"},{"EventName":"Performance.SignInComplete","DateOffset":"+00:00:56.606","AppMode":"Default","Timespan":"+00:00:01.877","IsUsingRefreshToken":"true","IsAnonymous":"false","Milliseconds":"1877"},{"EventName":"Usage.Navigated","DateOffset":"+00:00:56.603","AppMode":"Default","PreviousLocation":"","CurrentLocation":"/null"},{"EventName":"Usage.Navigated","DateOffset":"+00:00:55.001","AppMode":"Default","PreviousLocation":"","CurrentLocation":"/store/en-GB/home"}]} Basic information of application usage: {"Events":[{"EventName":"Usage.PortalStateSnapshot","DateOffset":"+00:01:00.002","AppMode":"Default","TotalRunTime":"25","AppVersion":"9.11.1","AppState":"MainWindow","AppFocus":"Unfocused","CurrentLocation":"/store/en-GB/home","ActiveDownloads":"0","OpenApplications":"0","RunningApplications":"","CPUTimePct":"0.367325","MemoryAllocator":"binned2","AvailablePhysicalMiB":"19375","AvailableVirtualMiB":"134212298","UsedPhysicalMiB":"236","PeakUsedPhysicalMiB":"322","UsedVirtualMiB":"266","PeakUsedVirtualMiB":"384","PrimaryDisplayHeight":"1440","PrimaryDisplayWidth":"3440","MainWindowHeight":"1120","MainWindowWidth":"1194","MainWindowDpiScalingFactor":"1","MainWindowIsMaximised":"false","MainWindowIsMinimized":"false"}]} When you navigate around their launcher, information is sent regarding what pages I'm going to: {"Events":[{"EventName":"Usage.Navigated","DateOffset":"+00:00:00.017","AppMode":"Default","PreviousLocation":"","CurrentLocation":"/null"},{"EventName":"Usage.Navigated","DateOffset":"+00:00:00.016","AppMode":"Default","PreviousLocation":"","CurrentLocation":"/null"},{"EventName":"SessionEnd","DateOffset":"+00:00:00.000","AppMode":"Default"}]} For shits and giggles I launched a bunch of Steam apps, but nothing was ever sent back to Epic Servers re that. I've wasted a lot of my time writing up this post, so please give it an actual read through before blindly hitting that box icon below. I'm in no way denying that there are lots of valid criticisms to hold Epic to, but I don't think it's right for people to keep spreading false truths just to further push the narrative they want. All I want is for people to be able to discuss actual issues without the same people spewing that Epic Games Store is spyware for the chinese goverment. Also wasn't sure which section to dump this in, if it's wrong feel free to move it mods.
The same guy who made the Reddit post probably also made that godawful infographic that was circulating on 4chan. Well-done analysis. You should repost this on Reddit if you haven't already. The audience you'll get here is rather small and won't change the public consensus unfortunately.
I suspect it'd just get immediately down voted on Reddit, someone can repost this there if they want however. I don't really like discussions there since anybody with a minority opinion gets down voted and unseen, it's not really a discussion and more of a literal circle jerk. At least with traditional forums like Facepunch you're able to see opinions on both sides of the argument.
The spyware stuff seems like the lower end of the shit scale for them, now it's all mainly anti-consumer practices and that EGS pales in comparison to the features that steam has ATM, atleast imo
For sure they're doing a lot wrong, however I think it's important for people to focus on those specific things rather then throwing around this false spyware argument I see on every page of every thread regarding anything to do with Epic Games. People are getting irrationally angry over a platform you buy video games off of? It's actually crazy.
It is the literal definition of spyware. https://files.facepunch.com/forum/upload/204712/0c3bbec3-b015-4af8-81f0-82bb0af9c90e/epic games store.png You can argue that it isn't bad spyware, but it's spyware.
Shouldn't be that surprising as they have encroached on a territory of games PC gamers didn't think they'd ever have to inherit from consoles. Goddamn PC exclusives now? It's not like I have to buy an EPIC games dongle or little device to play BH3 on PC. It's kind of crazy to think about that dynamic.
Which part are you refering to is spyware? The telemetry you agree to in their privacy policy? There is nothing covert about telemetry you agree to in a privacy policy, every piece of software including Discord, Origin, UPlay and Steam do this.
would like to use this thread to point out that despite constantly defending epics launcher i still think their practice of buying exclusives is still shady af and their storefront really needs a lot of work, but at least its a step forward in competition for game stores
@.matt So I have to ask, what reason would they have to still store a full copy of the file? I'm aware they did not send all this data but at each launch they still copied the data and stored it a folder. It appears they have at least stopped doing that, the files are now gone, I still have "unencrypted" (some simple XOR cipher iirc) copies of those files, I'm just curious how you would rate that behavior from a technical standpoint. Like is it just lazy programming to not delete the data after processing, do you think they could have been stored for further processing at a later date? With them having that removed there is sadly no real way of telling what they actually did with that. Not that I say your analysis is wrong but I wonder if they might have sent more before and not sending more then the friendslist was also part of the fix that removed those SocialBackup files.
Epic Game Store still has a long way to go to become good, and exclusivity deals are not giving them positive PR. I don't want to use it mainly because I see exclusivity deals anti-consumer practice. I agree it's not a spyware though. It doesn't send data forward for them, but the way they obtain Steam friends data is too fishy to be comfortable for me. They could just use Steam API for it instead of copying files. At least that way they could respect privacy settings I am using on Steam community.
I could be wrong on this one, but I think the most obvious reason from a programming perspective is you wouldn't be able to read it without administrative privileges, so upon installation they make a duplicate somewhere they can easily read it. It seems they've changed how it works now to no longer make a copy of the file. But you're right my analysis can only account for behaviour they're doing now, they could of been doing terrible things before hand but we have no evidence of anything.
From the outset there's already two things I don't believe: > EGS is a spyware (well uh, what am I suppose to do if I'm an UE4 dev?) > Epic is influenced by Tencent who works for Chinese government (so what? Authorities in China HATES video games) Combine this two together and you've got unproven conspiracy theory. Please do not bring these up if you are trying to convince anybody.
I am uninformed about this, but more and more I keep hearing about Epic's "involvement" with Tencent - and I don't quite understand the issue. Could someone who is more in the know elaborate on why Tencent is such a boogeyman?
I'm less aware of the inner workings of Tencent then others, but they are a Chinese company and are very likely influenced by China. They own investments in just about every technology sector however including Reddit and Discord which many many people here use. What I keep hearing repeated is how people seem to think Epic Games is controlled by Tencent when they only own 40% of shares and as such would only have a smaller amount of board members to allocate then the majority shareholder, Tim Sweeny who owns 50% of the company. The board members allocated by Tim Sweeny get final say over any decisions made by the company from majority rule, Tencent have an opinion on the board and can vote for stuff, but they have no majority, at the end of the day it's down to Tim Sweeny.
This is coming well after they were caught for it and curtailed it. This is post-clean-up.
They were "caught" doing what exactly? This is what I don't get? How can you be caught if there is no evidence? I have seen no evidence on literally none of these crazy conspiracy theories people have been saying.
When the data scraping was first brought up they admitted to it, denied a lot of it, then said they were going to immediately scale back what they were doing. You can go to the thread in SH about it, pretty sure Tim Sweeney even brought it up on his Twitter
https://files.facepunch.com/forum/upload/828/4957a9b8-a5e3-4e2f-94e3-2b2fd848bbe3/image.png This is the only thing I've seem them admit to, and it's exactly what they're still doing exactly as I've described in my OP. If they have admitted to more then this then please do share a link.
That is what they admitted to yes, but admitting doesn't mean much when they've been caught lying routinely and deceiving. Further, I recall from the SH thread here that the encryption on the file was virtually nonexistent and basically would take nothing to get around.
Nobody was playing detective in the first place, that's the issue. The one reddit post everyone keeps quoting is complete bullshit, this is what my entire post is about is proving with evidence that all his points are wrong. All of his points can't even be countered with "oh they could've changed it after" because all his points were him just misunderstanding how software works and presenting it in a terrible way. I can come out right now and say Discord is sending all your chat messages and logs to China, I have absolutely zero proof of this and if you were to look into it and found nothing, I could say you showed up late to the party so Discord were doing it? Idk
Most of what you're saying is "Well, it's probably something." At least give a link to someone giving actual evidence they were doing anything bad with the data they scraped, or even a post in the SH thread you're mentioning so people who weren't there initially can see what you're talking about.
I went to get the older thread on this to look through. Epic Games Launcher appears to collect your steam friends & play.. Hah, hey wait matt, I thought you were familiar: Epic Games Launcher appears to collect your steam friends & play.. Epic Games Launcher appears to collect your steam friends & play.. Epic Games Launcher appears to collect your steam friends & play.. You changed your name, cute. Valve shows off Steam library overhaul, new Events features Valve shows off Steam library overhaul, new Events features Valve shows off Steam library overhaul, new Events features All of your posts on the matter, up until just today, have been like this. There was another thread or two and posts about it in a couple of other threads at the time, so I'll be searching for those to bring up later. You weren't shitposting in those threads though.
what's your point to me shit posting? first thread is entirely based around the Reddit post that's full of shit. last 3 links are irrelevent to Epic Games entirely. is there anything that's not been covered yet?
Your posts in the borderlands thread stuck out as shitposty, and now I see why and that makes your other posts on the same matter suspect.
sorry I edited my post as you quoted it, my previous hostile tone wasn't appropriate for constructive discussion but arguing anything other then epic = bad I was sure to be met with a hostile response so I instantly went on the defensive with shitposting my tone was bad sure, but this changes nothing in our current discussion nor supportive of you claiming they were doing much more then they were
We're two steps away from devolving to calling eachother shills at this point, folks. This isn't the point of the thread, but the problem I have with all this isn't necessarily the fact that Epic's buying exclusivity or whatever, it's all the smug shit-eating-grin-wearing fucks going "Welp, guess that's another game I'm pirating :^)" I mean, come on. Bragging that you're going to pirate a game? What an amazing high horse to sit on.
So... One link from an article that links back to the reddit thread mentioned in the OP which was more or less debunked, and 6 (actually 5, one is a duplicate) that relate to some shitty posts this guy made? Ok... Again, do you have any actual evidence that Epic was doing anything other than what they said?
The bigger problem handsome matt here is that you have a history of not using that smart brain of yours and consistently go free Willy and troll/fuck with people. It's only when caught YOU double down or assert why. It's also inly then do people continue to shit on you for past grievances to which I don't blame them. I'm surprised it took this many warnings and bans to get it in your head that you shouldn't shit post or be hostile. You're only going to get shit back and some of it has been twice as hard. Don't forget I've yet to critique any of your information but I am going to thank you for making things more clear and starting a discussion. I'm going to advise all of you post cleanly and collectively and stop becoming the typical poster where they get upset because someone is arguing their own opinion. May this be a lesson that it is unwise to build your character around being a shit poster, creep and a troll if you want people to listen to your smart brain and opinion later on. As for EGS. Yep still a shit client. Thanks for disproving that it's spyware. My opinion won't change. It's still a shit client but at least it's not phoning home or to Tencent as much as the majority of people thought.
For real, all this shit with Epic is awful and they need to fuck off. But don't fucking pirate the game you goobers. You're just going to make life harder in the future for actual customers. When a publisher sees piracy they don't take it as "we fucked up", they take it as "those are sales, they clearly want the game after all" and look for ways to make piracy harder instead. You're not helping. Just don't play the fucking video game you nerds. I'm sure you can wait it out.
Sorry, you need to Log In to post a reply to this thread.