Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When you download the client it does not weigh too much, and seems to do very little. Inside the app bundle there is a script that—upon inspecting the environment and deciding you're not running Linux—launches the client, which downloads the full support environment and resources. For this to happen (all of this is saved inside the bundle, the app bundle gets updated in this process) Steam wants Universal Access for Assistive Devices, and your password.

Cacheable resources, preferences (like keyboard shortcuts), support files (like game hardware requirement lookup tables) live inside the bundle, not in ~/Library/{Application Support|Preferences|Cache}; games' data get dumped into ~/Documents/Steam Content.

I'd describe myself as a bit OCD (which really says a lot), and I wouldn't care that much still. I'd go comb this hairy mess and find out where stuff is, when and if I need to, even if it's in an unfamiliar place; that does not actually tick me off. Well, a little bit.

What makes me concerned is the way Steam needs both Access for Assistive Devices, and my password to run for the first time. The former gives it the ability to talk very intimately with running apps and the underlying system; while the latter (admin account) could very well give it and it's publishers unrestricted access to all my software, hardware and data. With publishers like Rockstar using scene NOCD cracks to publish their games on Steam, I'm not so sure I'm OK with this.

I'd like more games made available for the MacOS X and all the pretty machines that run it, but this arrangement does not seem very Mac-like to me. It looks like Valve is going around system security measures and best practices, foregoing sandboxing, code signing, relatively sane structured organization; all the things that would appeal to someone who's no fun at parties at all, and will die alone, in his long dead mother's basement… wait. Right. Anyway.

Can we get some input on Steam for Mac security at the end-user machine, from someone who understands how Accessibility API works, whether games distributed on Steam can read and write outside the user homefolder, collect data from other running apps, or similar?

share|improve this question
2  
I seriously doubt Steam would seek this post out and reply to it here. You'd probably get better luck on the Steam forums... Edit: here, i posted it there for you. forums.steampowered.com/forums/… –  RCIX May 17 '10 at 3:53
    
I did not think they could answer that in a way that isn't costing them some PR points, so I asked here, where people that know stuff happen to hang. –  godDLL Jun 29 '10 at 13:23
add comment

4 Answers

up vote 9 down vote accepted

Answer from the devs themselves (Robert Barris, in this case):

Activating Universal Access is not a requirement for Steam or for games on Steam. However if you want to use the Steam Overlay then it is needed - UA provides the mechanism by which the Overlay can intercept keys from the game even when the game is front most.

No, Steam games are not running as superuser :/

share|improve this answer
add comment

There are thousands of installers that need your admin password to write to protected areas of the filesystem, including Apple's. If you want to know what user a process is running as then use ps or Activity Monitor.

Enabling assistive device access is a common workaround used when a non-scriptable application needs to be automated through a series of simulated clicks on windows and menus. It is far more likely that the people working on this product simply know nothing about the Mac platform than it is that they're interested in telling your mom where your naughty folders are.

http://www.macosxautomation.com/applescript/uiscripting/index.html

share|improve this answer
    
Apple's I trust, Steam's publishers – I do not. As far as I can see all the files Steam has on my system are 755 me:me. And you didn't answer my question. –  godDLL May 13 '10 at 19:43
4  
Actually, he told you exactly how to answer your own question: "If you want to know what user a process is running as then use ps or Activity Monitor" –  EvanK May 13 '10 at 19:49
    
I did not want to know that, I already did. And my question is above – "Can we get some input on Steam for Mac security at the end-user machine, from someone who understands how Accessibility API works, whether games distributed on Steam can read and write outside the user homefolder, collect data from other running apps, or similar?". –  godDLL May 13 '10 at 19:59
8  
The Accessibility API is used by many products for many reasons. None of them are security threats. Your only problem is that you have been exposed to a very small amount of information you have no hope of understanding, and that you think Steam developers are going to respond to you on a public forum. –  Hasaan Chop May 13 '10 at 20:26
1  
It's not really my fault if your six paragraph question contained so little data. Or would you contend that your "mother's basement" rant was evidence of superior intelligence? –  Hasaan Chop May 13 '10 at 22:36
show 2 more comments

Steam is not running as root. It simply needs your credentials to install.The fact that is uses Assistive Devices isn't a big deal. Many apps do.In fact, most games do.

I have steam running and I'm not worried about this.

But if you are, then get something like Little Snitch. It monitors ALL in and out going traffic from your mac. It's a must app for every mac user. Some use it to replace the firewall. And you tell it what apps/processes too allow access to the net. That way, if Steam runs a process that you aren't familiar with you will be notified. And you can decide to grant (or not) access.

You should be running Little Snitch anyway. But frankly, I think you are worried too much about Steam.

share|improve this answer
add comment

My partner installed Steam on one of our Macs, and her own account isn't in the 'admin' group - /var/log/secure.log shows she only had to use an admin account for Finder to copy it to "Applications".

Access for Assistive Devices was already enabled on that Mac. A process listing confirms that nothing running for Steam is running as root (but it is running as your user. It can do anything you can, just like almost any other bit of software on a standard Unix, including reading or erasing all your files.)

If you're very paranoid, install and run your games in a separate user account.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.