Loophole Exposed in Steam Review Process by Unauthorized Release of Joke Game

Valve Corporation
Valve Corporation

In a post to Medium, a self-identified online prankster detailed how he managed to get the 45-second long “game” Watch Paint Dry released on Steam by way of some clever technical loopholes.

User “Ruby” had been trying to report this particular glitch in the system to Valve for “months,” and having received no response, decided to publicly demonstrate the full extent of the problem with the way Steam handles indie releases.

This is no more than a prank and was merely to test something I’ve been trying to report to Valve for the past few months — the ability to get any game you want on Steam, without Valve ever even having a look at it.

After gaining access to the Steamworks developer platform — through means the poster has categorically refused to disclose, for unknown reasons — Ruby got to work on the “game” he would use for the stunt. He even came up with silly trading cards to accompany it.

By identifying the manner in which a game goes from Steam’s pre-release review process to the “released” state, Ruby accomplished his joke release with surprising simplicity. While he intended for the game to be listed as “Coming April 1st” for the purpose of his prank, the game immediately shot to the top of the “New Release” list of games, prematurely springing his prank upon the hitherto unsuspecting Steam.

Ruby has taken on very specific lesson from the experience:

Something I’ve definitely learned from doing this is when working with user-generated content that first needs to be approved, do not have “Review Ready” and “Reviewed” as two states of existence for the content. Instead, maybe take an approach where the review of the item has an audit trail by giving each piece of content a “review ticket” or something similar and not allowing the content to switch to the Released state until there is a review ticket for the content. Or just don’t allow users to set the item to “Released”.

Valve has since fixed the loophole, so apparently this hands-on approach to bug reporting was considerably more effective in this case than the security e-mail Valve provides for these issues. And if you’re heartbroken at already having missed out on the brief availability of the not-to-be indie blockbuster Watch Paint Dry, you may continue your pining over a cache of perhaps the silliest Steam store page ever seen on the platform.

Follow Nate Church @Get2Church on Twitter for the latest news in gaming and technology, and snarky opinions on both.

COMMENTS

Please let us know if you're having issues with commenting.