the txt file that (almost) ruined valve's trading economy (several times)

[@f4micom]

Special thanks to Displate for sponsoring the video! Discount code: SAVEWALLSFROMSADNESS Discount link: displate.com/f4mi This is a different video from my usual ones, a bit shorter, and it's a story I wanted to cover for a while. Hope you enjoy it! EDIT: small correction, when i say the txt was introduced with the sniper vs spy update talking about the keys i mean that USING IT FOR RANDOM ITEMS and not just weapons was introduced there, it was a small mistake on the script sorry for that, just want to make everything clear :)

[@Kat21]

yay

[@saltedmutton7269]

thank you f4mine that was a good video i liked it

[@KroboProductions]

evil sponsor :(

[@lain611]

No thanks

[@littlejack59]

The video is cool and all but now im more focused on this banger song 10:15 what's the song?

[@aTaryum]

Thank god Valve learned from their mistakes, surely they won't almost sink the economy again by, I don't know, pushing a bugged update that makes unusuals' drop rate 100%. That's never going to happen.

[@nikeovsky]

🚬

[@andy-gamer]

Foreshadowing

[@luk4323]

That would be bad

[@GL33T]

reminds me of crowdstrike

[@polocatfan]

what they should have done is only let people keep the first unusual they got during that period and refund any other keys spent.

[@itchylol742]

i was fully expecting the person who didn't get the reward to turn evil and start using tf2 item exploits to get money

[@Zuudo]

itchylol spotted

[@itchylol742]

@@Zuudo zudo spotted

[@ramdises]

Me spotted

[@Joseph-s]

Ditto, anybody would turn evil after something like that

[@jmvr]

And you, the reader, spotted

[@MegaKosan]

I love that this video is 4:3.

[@Vextrove]

I love 4:3 🥰

[@shortcat]

It's so dramatic I thought it's 5:4 until checking.

[@littlejack59]

Next video has to be ultimate 21:9 to compensate

[@SASTSimon]

Same. Im on a 4:3 screen so its great

[@DJKr15py]

Anyone watching it on a 4:3 crt as intended?

[@Meepysauce]

I remember when Gamemaster reached out to my friend at the time to ask what the method was, after the hats were given. At the time we knew that some properties used for some items could still be applied to other items i.e. the "unlimited" tag for the birthday noisemaker worked for any other noisemaker, making them unlimited too. We'd tampered with name tags and description tags and realised there was some interoperability but called it quits once we realised giftapults opened the crates. I felt at the time it was defeating the purpose of reporting the exploit to valve directly, to let someone else take comprehensive notes, and, later try to use it as a gold rush for further hats. We did let Valve know the potential for further exploits was present between other items that shared an item class in the initial report. Gamemaster's post felt like a mis-representation of him figuring it out by himself (he didn't credit my friend once, Errur was either the beams gibus or lament owner) but also went against the grain of reporting it to Valve to keep it secret and avoid these things getting into the wild. This will be entirely hearsay as I have no proof or receipts this many years later, but I do remember from DMs my friend shared that gamemasters attitude was generally that of someone frustrated and entitled, as he'd apparently been trying to figure out what could be done in the schema and we got there first, almost as if stolen valour. He was pretty adamant on trying to get the hat he felt he deserved and harboured an attitue of envy. My friend and I only figured it out because I presumed if the hosts file block + the custom items.txt with a file path redirect could be used to restore colour to photo badges (discovered by others), there was likely no server side authentication for certain values before any interaction was done with the server and certain properties were available against certain items even if hidden (the path property wasnt in the default schema iirc). I shared the theory with my friend and a few hours of us tinkering later he landed an 'oh shit' in chat when the giftapult with the key item class actually worked. In our report we did not ask for any items. We were asked by valve. Gamemaster's post felt like a bit of a tantrum, if you read it he hypothetically asks how someone with such an understanding of the schema hasn't been rewarded with his own hat but it is crammed with corrections because a lot of his information is regurgitated is from third parties rather than self discovery. He's a storyteller who is angry he didn't get the hero's ending and I don't feel anything he did was altruistic but more out of scorn. I can only imagine that if his approach was to say to valve "here's my exploit, please give me this hat" then it comes as no surprise that he is empty handed after it all. Publicly releasing the information was the nail in the coffin regardless.

[@Simon-xi7lb]

Greece is probably the worst place to be minister of finance, lmaoo

[@f4micom]

HARD MODE

[@aarvlo]

yanis went into the position explicitly to refinance the debt, somehow managed to cancel a bunch of it without compromise and then immediately resigned lol

[@alessiobaruzzo1679]

​@@aarvlo Smart move

[@Simon-xi7lb]

@@aarvlo main character vibes

[@zbelios1623]

@@aarvlo gigachad

[@livingfray2340]

I am baffled that they apparently rely on client side checks for this. If I worked at valve and learnt people were modifying a txt file to unlock items I wouldn't try and lock down the file with checksums or redownloading on launch, I'd move those checks to the server where the players have no hope of modifying them. Any client side checks can be eventually bypassed since the players have control over the environment the client is running in.

[@XxZeldaxXXxLinkxX]

But that would prevent the player from launching the game in an offline state to play with bots or whatever. So...

[@livingfray2340]

@@XxZeldaxXXxLinkxX why would it do that? The check only needs to occur when crafting an item, which already requires being online. They can still have the file stored locally for offline play/client side prediction/etc, it just wouldn't be the authority on how items behave whenever a server is involved

[@apurpledragon]

@@XxZeldaxXXxLinkxX That's 100% NOT how it works. If a server is client sided and that .txt file is modified you have access to those said weapons/items. For example, if I were to modify the .txt file to include the Romevision cosmetics for the robots and I load up into my very own server I'd be able to equip those ON MY OWN SERVER. Same with the exclusive robot weapons like the Giant Heavy's Deflector which is it's own seperate mini-gun. But once I go into an online server that .txt file won't work, it'll check and communicate to you that it's a public server. It's how certain commands only work on your own local server with or without plugins modifying your game.

[@WackoMcGoose]

I honestly figured that _making the txt file read-only_ would be enough to prevent overwriting. But yeah, never trust the client at face value, seriously.

[@lexikiq]

the issue with client-side hash checks is you can never trust the client! for example: hacked clients. would be easy to just mod out the item file checks. the only longterm solution is server-side patches which i assume is how they were actually fixing the bulk of the exploits. definitely justice for gamemaster and er, probably all of them because an untradeable cosmetic is not really fair compensation for what is essentially a bug bounty report

[@GrzesiekJedenastka]

Indeed.

[@Inurian59]

Fun fact, game master was also a driving force behind people in comp realizing how fucked up some of the stuff engie can do is

[@genericdevtexture3661]

Source?? Not that I'm doubting you but I want to see what he did

[@Inurian59]

@@genericdevtexture3661 kzbin.info/www/bejne/oHvNkJycr5uCqas Video from the man himself of a UGC grand finals match! I've known him for over a decade lmao

[@Inurian59]

@@genericdevtexture3661 Err, I think links in comments might be automatically eaten by this channel so look up " UGC Grand Finals: John Madden vs Squirtle Squad Excerpt Commentary" Here on YT, you'll get a video from the man himself showcasing it! I've known him for over a decade, which is how I know (personal experience playing against his shenanigans) but this is actual video!

[@TextualDeviant]

I second Generic

[@Jameskii]

I never realized how far does this lore go with just a single text file, great video

[@Thispersonisreal]

holy shit its the real jameskii

[@EliaszekEN]

holy shit its the fake jameskii

[@SleepyVesties]

That's just a fan account DW about it ​@@Thispersonisreal

[@whos_creative]

holy shit its the real jameskii

[@joemkdd]

ai comment

[@unconcernedsalad2]

the double fake out at 11:18 is so funny. genuinely a smart and hilarious editing bit, full praise

[@brunoheredia3244]

wtf TWO long format f4mi videos in the same month already??? goated month for the f4mi fan base ╭( ͡°͡° ͜ʖ ͡°͡°)╮

[@SoggyCatFanNo.1]

f4mi-sisters stay winning

[@bingus5488]

we are feasting this month

[@Harlow.]

TWO POSTS ONE MONTH F4MI PASS ME THE BLUNT /ref

[@rami-23hrhoife]

Definitely not famished

[@krazykatz97_1]

@@rami-23hrhoife f4mished

[@voorhees__]

f4mi is just blessing us with these uploads, and i’m not complaining

[@MrNifto]

holy crap bringus cameo!

[@isaiahmatthews5434]

i started actually jumping when i heard jons smooth sexy voice

[@trog871]

I was like, can it be, then he said the thing and I was like, YES IT IS

[@akosv96]

My boy bringus ❤❤❤❤

[@LdrXJagXMan]

JUSTICE FOR GAMEMASTER! GIVE HIM HIS BUGFIX HAT!

[@titanic_monarch796]

seems like he didn't actually find it, though?

[@JosiePS]

having attemped to recreate the tf2 item system in gmod on multiple occasions finally having someone talk about it feels like a breath of fresh air

[@RazQ]

This was a throwback because I used the block the IPs with hosts method back in the day so I could wear two unusual items for Pyro: Burning Flames Flamboyant Flamenco + Hellfire Burning Bandana. These both are in hat item class. Bandana even would get hidden inside the flamenco really nicely. I had no idea you could use it for all these other things you mentioned in the video.

[@MannFace51]

great video, very interesting community lore. I would however, suggest balancing the music to be more inline with the audio levels of your other segments. Like at 17:37 I literally jumped when the outro started playing lol.

[@f4micom]

hey! thank you! yes, for some reason normalizing hasn’t worked as planned for some audio tracks this time around, i will make sure that won’t happen again in the future

[@SianaGearz]

@@f4micom Nah let it happen, keep viewers on edge a little.

[@EliaszekEN]

​@@SianaGearz make them shiver

[@Sizzyl]

Funny part is that price you highlighted isn't the price it will cost you. It's what it cost you in the past when someone last verified their sale. The guy on th left actually wants $220 or so instead, not $176.

[@Sizzyl]

Realized i shouldve included a timestamp, its 5:36

[@dirtkiller23]

The file that is still used to this day in both S2 Dota and CS2 (tho they probably have internal item editors to add new items to it), and likely Deadlock too

[@DavitTheCore]

Yaaay f4mi did another Valve vid. Love the Bringus voice

[@spookykitty2327]

the real moral of the story here is that, if you try to do a good thing, even a "good" company like Valve will give you nothing in return, or even screw you over. so if you find an exploit that is against a corporation, USE IT

[@erdiego5074]

4:52 That explains a lot

[@moth.monster]

I'm still lowkey sad they didn't give out a re-issue of the Cheater's Lament for people who didn't try to exploit the "crate depression" bug. I was too asleep to bother, but still. (If they were to actually change anything, they should make it so Tux is available whenever you are logged in on Linux. I think it would be fun.)

[@kris_0520]

GLORIOUS 4:3

[@leighfogg-liedel7839]

I was just thinking bringus and f4mi should collab it'd be perfect

[@MrCed122]

You would think that after two incidents, they would actually do something to protect the file, but noooo, you can't expect a massive company like Valve, who owns Steam, to do the minimum, like do a cheksum at every boot, or simply making the file read-only and refusing to boot if it was modified (which is easy to see in the medatada).

[@The_D_ray]

Spectacular video. I knew there were inventory exploits back in the day, but holy shit I didn't know the cause was ALWAYS THE SAME. The Source Spaghetti never ceases to impress me.

[@MrPowerGamerBR]

Maybe I'm stupid, but wouldn't the BEST way to fix this issue is by actually implementing server side checks? I don't know how TF2 works, but why did Valve insist on trying to add checks on the client side instead of just doing the right thing and fixing the issue on the server side? Considering that items are already stored on the server, and as far as I know the server that decides which item you'll get when opening a crate, then why the key validation is not done on the server too? Because if they just added a signature on the client side, couldn't someone bypass the signature check and keep abusing the bug? But I guess now, 10 years later, Valve (hopefully) has already implemented server side checks for the items...

[@unconcernedsalad2]

with my half of a CS degree this sounds correct but i would like someone smarter to confirm or deny this. replying to boost visibility because i am genuinely curious

[@kneesnap1041]

You are absolutely 10,000% correct, as someone who both writes and hacks multiplayer games (responsibly, I'm not enabling cheaters usually). If there's one thing I take away it's that Valve's games are immensely breakable and that they will not fix it even when told. It's legitimately insane that they shipped code which had so many checks missing.

[@bb010g]

yeah. first rule of networked systems is that you don't trust the client (or up to any of your peers, really). you want stuff done right, you use cryptography and methods that are correct by construction.

[@notpumkin]

Honestly it feels like some intern designed some of these systems considering how basic these mistakes were.

[@SianaGearz]

@@notpumkin It must have been clear that the system is not proper, but at first it worked, and then engineers moved on, and sometimes nothing is more permanent than the temporary. Prototypes done for testing ideas, where actual effort is not called for, often do leak into release implementation.

[@iNostalgia0]

the one thing i wouldn’t expect from a f4mi video is a bringus studios collab, and we still got it🔥🗣️

[@gregorymorse8423]

Nice video, here from ThePrimeTime. CS has basically everything from TF2 sometimes with different names. Loot boxes, keys, trade up contracts, stat trak weapons and transfer tool, etc. Probably suffers from the same issue. Their modification check of the txt can be patched around, id be shocked if they dont have full server side checks by now.

[@AlfaWAR]

In Portal 2, at the beginning, there was a way to complete the level in 0 seconds and then get your name on the leaderboards. I found out how they did it (it was some console command that enabled saving, and then you'd just reload the save and it would restart the timer, while keeping your position), reported it to ValvE, they fixed it within a week.. and I got nothing too. Well, I got a "thank you for reporting the problem".. that was it.

[@galic6068]

2:41 ad skip

[@m.f.3347]

i knew it before this video, but even then the fact that Yanis Varoufakis worked for Valve to manage the TF2 economy sounds fake. It's like if Slavoj Zizek got hired to write Runescape quests

[@Eale_]

IS THAT BRINGUS STUDIO AT 8:11???

[@gergoantal1066]

IT'S HIM

[@DavitTheCore]

Yep, it is.

[@EliaszekEN]

no way

[@Blin240]

No

[@MrMegaManFan]

I can't think of anything LESS secure than a TXT file. Sure you could add a checksum, or force a persistent internet connection to validate it, or even hide it in a zipped folder that's encrypted, but it's still a bloody TXT file. Anyone can open it on anything anywhere WITH anything!

[@piecaruso97]

there are thousand of ways to handle this information properly and safe from the user, but valve decided to just use a stupid txt file

[@somerandomguyintheinternet]

Justice for Gamemaster :0

[@youtubehandlesux]

16:38 I wonder how they are doing the checks, and if they are using MD5, there might be a way to modify it using MD5 collision if the file is usable when there are some junk data in it

[@PledgeBass]

Here from ThePrimeagen. Amazing editing! Subbed!

[@TRDiscordian]

I love the cheeky implication that "The Orange Box" was the literal beginning, especially because it was my first exposure to Valve's games.

[@Mewoburner]

7:49 bringus jumpscare

[@some_body_else3636]

hunans invented 16:9 for decades at this point but there's still some humans who don't know what it is

[@USERWASBANNED]

16:48 User was "Burpman" Source: I was on ToyFort with him when he did it lol

[@ConeNore]

Nobody expects the Bringus inquisition

[@FlyingSlig]

two uploads in a month? we eatin' good lads

[@iwasinnamuknow]

How does a large company make such colossal and elementary mistakes? Did they just get a 16 year old work experience kid to secure their RCE game? It boggles the mind, these are security 101 issues. How did any of this pass QA? When they found the first issue, how did they not audit and secure the rest of the system? I could've done a better job as a teenager that's for damn sure. There are other RCE games dating back to 2003 that have handled this stuff far better (and with much more expensive items).

[@SianaGearz]

That's not how QA works, it wouldn't have caught it. It needs to be caught in engineering. Sounds like a prototype implementation that was made for testing things out on the quick, then it was suddenly called "release" to everyone's surprise, because QA critical ticket count fell near zero, and then people moved on since they were needed elsewhere, and the project got stuck with an overworked skeleton crew (aka one code janitor) who didn't know their way around the codebase and how everything works and way too many more pressing gremlins to hunt, and the persons who were originally responsible probably soon left the company anyway. The janitors possibly didn't stick around long enough to gain institutional memory of the txt file, since it's not a very desirable job, there was possibly a new janitor every few months, nor did they have direct connection to any oldbies who would have known. At least a hypothesis for you to ponder. You treat the company as one entity, while in reality it's, over years, thousands of individuals who have each very niche, deep rather than broad, and fragmentary product knowledge and individually minimal influence, while likely being fundamentally good at their profession.

[@lolkun1]

4:3 screen giving so nostalgia effect

[@Autistic_Chaos]

Happy to see you getting sponsorships, it's well deserved with this level of quality and editing. I love how niche this channel is

[@ExDementia666]

Dang f4mi is knocking it out of the park with the production on these videos, this is rad

[@boxxie79]

12 second old f4mi video :)

[@boxxie79]

and IS THAT BRINGUS STUDIOS

[@Т1000-м1и]

Him being a future Greek finance minister is hilarious

[@Т1000-м1и]

I did enjoy the story

[@foxo444]

I KNEW Bringus was gonna show up somehow. Love both of your channels

[@pac4games253]

Gotta love every time there's a Cameo on your videos, always great to hear my favorite creators together

[@DrazenX195]

Was driving along listening and then I heard bringus voice pop up. Had to check my phone to see if the video somehow switched on accident but nope. What a nice surprise to hear him in a f4mi video xD

[@zNyVa]

That is cooked send a email to gabe with this video justice for Gamemaster!

[@Ben79k]

Another f4mi masterpiece 🙏 the transitions between chapters are literally art

[@Pepperroni_McRoni]

She got sponsored by Displate

[@kirbles2035]

Not the worst sponsor.

[@KroboProductions]

my favorite youtuber...... sponsored by a common youtube scam sponsorship :(

[@Madkalibyr]

@@KroboProductionshow are they a scam? I’m curious

[@rangeramg]

​@@Madkalibyrunfortunately a lot of ai art garbage flooded the site, the posters themselves are very expensive too

[@jordjordjord]

@@Madkalibyrthe products from displate are cheap quality and aren’t worth the money at all considering other poster options out there

[@timeimp]

I have never heard of f4mi before, but I have now subbed - this editing was insanely great - and from a 10+ year TF2 player!

[@BigRigCreates]

Nothing better than a Bringus appearing out of nowhere.

[@hisashiburi0]

GAWD DAYUM, the editing, the style, the scenery are just astonishing, gal. Have a heart-flaming subscribe and keep doing what ya doing!

[@deviljuanjox129]

This channel being so underrated is criminal. Absolute loved the video, edition and narrative. Props to you!!!

[@cis_eraser_420]

*extremely* inspired music choice with sam & dave there. yet another f4mi banger

[@meowlimit]

shoutout to both f4mi and red bard for being better economics teachers than my school could ever have

[@ryangraham9623]

the music in here is cool f4mi! im liking the new editing style too

[@gigitrix]

Amazing how much they are seemingly committed to just not making things server side, but then I guess the cost to them of not fixing these holistically is minting out a new unusual as a bug bounty sooo

[@damantioworks]

The 3D animations are pure eye candy and add a lot to the production value

[@Fejszi]

Absolutely love the 4:3 aspect ratio, it fits perfectly on my monitor

[@arthurwilnow9795]

Everything peripheral to primary game mechanic is side quest for enough to break it...

[@littlejack59]

So like... did you just get tired of making the hdDVD video after a while and started working on this one? Because this is a dam quick turnaround.

[@Guest_WD]

What one day of developing a TF2 map in the Hammer Editor does to a valve employee

[@arnox4554]

I used the Hammer Editor once to quickly port The Beginner's Guide maps to GMod... Never again. Even UnrealEd ONE was better than that shit.

[@NGGJamieNyan]

former minister of finance for Greece isn't exactly the seal of approval I look for in my economists.

[@NessExplains]

What the f- it's been one week I died and went to heaven

[@freeuploads4290]

2 videos in the same month? Hell yeah!

[@Nega-Tim]

You're legit me favorite KZbinr now. Excellent work, just make sure you don't get any burnout.

[@thedylansang]

"You could only use stock weapons" GOOD. "There were no hats" GOOD.

[@HoldenVontz]

JUSTICE FOR GAMEMASTER

[@EnoughInsects]

Jeffiot AND f4mi upload? Blessed

[@alex73630]

This video was the last one I'd had expected to hear about Yanis Varoufakis and it's not even about Greece economy

[@FederalPandas]

Beautifully edited. Fantastic video, keep it up!

[@Chubby_Bub]

never played TF2 but this was a very interesting video, looking forward to the sequel of an 18-minute video about an md file

[@patodeweloperka]

Music 10:10 if someone is looking for a song name and signer it's Petula Clark ~ Downtown (1964)

[@JQSHl]

Babe wake up new F4mi upload

[@SweHam]

Ayyy, I'm so hyped hearing Bringus in this video. Always happy to see that my niche YT creators overlap 🥰

[@Zephyr_07216]

i didn’t expect a bringus studios crossover in the video tbh 😂

[@milymilo]

a f4mi episode? this soon? Must be early christmas...

[@Skynetic917]

0:10 hellboy put it best when he said "uh, that word.. 'fockused', yeah with your accent.. i wouldn't use it"

[@cabbot_]

i missed out on the crate depression simply because i couldnt buy keys at the time, i still havent gotten over it

[@snowy2419]

I finally found the tech channel that was designed for me specifically

[@anuaanua5285]

2 Videos from the Legend in such a short time? Daammnn dat shits goood!

[@raulbotelho8038]

This channel deserves more views.

[@FailureOfAName]

Gasp, a "surprise MF" video from f4mi? I knew i liked you for a reason

[@GabrielMPereira]

Yanis Varoufakis being a Valve ex-employee got me completely unprepared lmao

[@ViketAnnYuumi]

girls with a time machine: im you grandma! boys with a time machine drops exploit to valve office ONE UNUSUAL MAX PLEASE!

[@LiEnby]

Surely no one would ever patch out the signature check on the txt file right ?

[@FarmerSlideJoeBob]

Wow just wow :O A new video and also an interesting topic :D Well done :) And I like the 4:3 aspect ratio.

[@appleofdoom]

Wow I wasn't expecting another video so soon!

[@themerchantmagikarp]

BRINGUS STUDIOS JUMPSCARE???

[@wesleycoder]

Love the blue hair, keep it up, the research must have been hard, great work

[@XRatedPoetry]

"Minister of Finance for Greece" uhohhhhh