Comment by drnick1
4 hours ago
This underscores a major issue with commercial software like Steam and games obtained therein. You cannot trust that software not to maliciously scan your device for secrets such as crypto wallets or other information. Ideally, you want to run apps like Steam, Discord, Zoom and whatever else does not come from a trusted distribution repo as a separate user. This is not always convenient however, and the compromise I adopted on my gaming PC is to bubblewrap Steam. Do not mount things like /home and devices games should not be using in the sandbox.
In theory you could change the steam command line fpr each game and have them launch in bubblewrap. Though I'm not sure how well that would play with graphics drivers. It might be friendly with AMD, but my experience is that NVIDIA is a pain to have play nice with containers.
I sandbox Steam itself for simplicity. My experience with Nvidia and Wayland has been good. I simply exposed /dev/nvidia*, a few networking-related files in /etc and system binaries like /usr.
This is what my Steam Deck is for. There's no gap like air gap.
Dedicated hardware is definitely the most secure option, but realistically it is even less convenient than a separate user. You can't realistically play graphically intensive games on a Deck, and separate workstations are very unaffordable at the moment.
Android solves this problem by making it impossible for an app to access the storage of another app. No matter how much the Steam app wants to see your crypto wallet's key it is not possible (assuming no Linux exploit).
That's nice, but a cell phone isn't a viable gaming platform for anything but very basic games. And Android, at least in its typical Googled form, has its own set of problems; it's a privacy nightmare.
And despite what you claim it is the most profitable gaming platform. There are lessons you can learn from them.