zlacker

People should always consider the "abusive friend" scenario with regards to privacy.

Even marriages can be extremely abusive...

The assumption that people on your friend's lists, Steam or anywhere (even just people in the same household) should be able to see your personal information, such as computer use, is a bananas assumption. It is an assumption that I'm pleased to say has failed privacy reviews at at least one company larger than Steam.

>>explod+(OP)
I think it's a quite small demographic that have abusive friends on Steam that they can't simply unfriend for whatever reason, and it's not a reasonable expectation on Steam to design for that case. It'd be like a pencil company trying to prevent people from writing hurtful messages.

>>snowmo+o3
What about people who have their online friends on Steam just to play together with someone else? Worst case, this could leak a child’s daily schedule to a predator.

>>snowmo+o3
By that logic, we should remove all friend-level privacy settings entirely. I don't think that would go over well with most of the userbase.

>>snowmo+o3
I'd think it's quite common to have "abusive friends" on Steam. It's not uncommon to get invites from people you've never met offline and were just in a game you played together.

In that setting I don't think there's much "trust" happening. Certainly an average user would not think they are sharing this information with that type of person and certainly the average user believes that setting themselves to be invisible means nobody can see when they're online or any of their activity.

Besides, why would it matter if it is common? At any given point in time Steam has 20m-45m active users. 0.01% is still 2k-4.5k people. Take every single person you know by name, this is probably 10x that. This is 10x-20x the number of friends the median facebook user has. It's a very small percentage but a very large number.

We work in computing... scaling means small percentages are still big numbers.

>>explod+(OP)
People should also remember that scaling means very small percentages are still very big numbers. 0.01% of active steam users is still several thousand people. Which may seem small but it is probably 10x more people than you're friends with and more than every person you know. We get so used to seeing big numbers that we think they're small.

>>ycombi+98
No, that is obviously not logical. A feature can be nice-to-have for most people, while still not needing to be perfectly secure against all sorts of far-fetched scenarios.

If you want to guess how most of the userbase would react, just imagine how much the average user would care when you told them about this "vulnerability".

>>godels+VD
> It's not uncommon to get invites from people you've never met offline and were just in a game you played together.

What? Why does this imply that they're "abusive" or that they'd want to spend effort trying to find my "sleep schedule"?

Note that I'm not saying the bug shouldn't be fixed, but the original author clearly is just getting up in arms about it because he wants the bug bounty. Why others are being so alarmist I cannot understand, but I see this behavior a lot among the younger generation.

> We work in computing... scaling means small percentages are still big numbers

While I've also fallen into the trap of thinking "I'm so special because I work in computing" before, I can assure you we're not even close to the only industry that deals with scaling. The pencil manufacturer I mentioned before has a lot more scaling and also a lot more real-world consequences if they do something wrong.

>>snowmo+DY

  > Why does this imply that they're "abusive"

It doesn't. You read wrong.

  > While I've also fallen into the trap of thinking "I'm so special because I work in computing" before

I'm not saying scaling is unique to CS, you did.

You said that the demographic is so small that Steam shouldn't care about the abuse. That it is an acceptable level.

I said it is a mistake to think that a small percentage is a small number and to focus on the actual number. Instead of asking yourself if 0.01% is an acceptable level of abuse, ask yourself if 3k people is an acceptable number of people being abused.