This is a pretty cool exploit, and of course reinforces one of the most important rules of writing software. Don't trust users.
The center of what this kid pulled off to get his game on the front page with no Valve oversight basically amounted to fiddling around with an HTML form data and feeding the back end illegal state information.
The fact that the back end's business logic layer didn't verify and authorize the request is hugely troubling from a big service like steam. What other dragons are lurking in there to exploit? Could I take ownership of someone else's game on the store? Get myself some free games by generating reviewer steam keys? All sorts of interesting activity is possible.
The center of what this kid pulled off to get his game on the front page with no Valve oversight basically amounted to fiddling around with an HTML form data and feeding the back end illegal state information.
The fact that the back end's business logic layer didn't verify and authorize the request is hugely troubling from a big service like steam. What other dragons are lurking in there to exploit? Could I take ownership of someone else's game on the store? Get myself some free games by generating reviewer steam keys? All sorts of interesting activity is possible.