That log line actually comes from the native Linux Steam client libraries, not Proton itself. We just gather everything that gets output on stdout/stderr, which happens to include that line. The right thing would be to stop the Steam client libraries from printing that. Else we'd have to scan every line that gets logged in Proton's log file, which I don't think we want to do.
(TBH I'm not convinced it's really an interesting security problem.)
your steam username and id etc are not private information
@arrowgent The issue being discussed is this more easily enables linking Github identities to Steam identities.
That log line actually comes from the native Linux Steam client libraries, not Proton itself. We just gather everything that gets output on stdout/stderr, which happens to include that line.
Ok. Then it's probably out-of-scope for Proton as a project to fix this.
About this being an interesting security problem: I'd agree that this is not a huge security problem in the sense that it doesn't enable a direct attack on your users or anything like that.
But I believe that most people would be quite surprised about the fact that they identify themselves by submitting a proton-logfile. My assumption about a diagnostic logfile that is intended to be publicly shared would always be that it protects my anonymity on the service that generates it.
For me personally this isn't a problem, I don't even have a public profile on Steam. But other people might have a very different identity on github and other forums than they do on Steam, and this somewhat unexpected behaviour could be a problem for some. And since the users steam id is probably (?) not even useful for diagnostic purposes this could be avoided quite easily.
But you can close the issue, if this is not something you can fix easily. I'd appreciate it though if you would send this to someone at Valve who might take a look at this in terms of privacy and user expectations.
Anyway, thanks for all the work you do on Wine and Proton! Awesome stuff!
I agree with @name-changer
Hi,
I noticed that proton logs that are created with the launcher option
PROTON_LOG=1contain the steam user id. This is the case for Proton 5.0, 5.13, 6.3.8. I didn't check older versions.All the logs have this line:
Steam_SetMinidumpSteamID: Caching Steam ID: [17_DIGIT_STEAM_USER_ID] [API loaded no]which contains the actual users id, so it's trivial to find the profile behind the report by visiting https://steamcommunity.com/profiles/[17_DIGIT_STEAM_USER_ID].
This connects the users id to their system information, hardware, kernel, etc, which is listed in the proton.log. It also connects steam accounts to github profiles (and every other forum profile where people post these logs).
Many people won't care about this, but for some this is probably an unexpected side effect of sharing a proton-logfile.
This also opens a way for scammers, acting as developers who were notified by Valve that the user had a problem with Proton. If the user has no idea that the proton.log they posted 'anonymously' actually contains their steam id and identifies them, a story like this might sound plausible. How should the 'developers' know otherwise?
I get that adding the users id might be useful for minidumps that are send to developers without ever being posted in a public space. That's fine. But for the logs that are shared here on github? Please correct me if I'm wrong, but I can't imagine it's really necessary to add the users steam id to the proton.logs. All the actually relevant and useful information about the users system should be already logged into it.
So, unless it's really useful, maybe you could just remove the user_steam_ids from the logs? Or at least make it more obvious that these logs contain the user information?
Thanks!