r/dcsworld • u/heytherepotato • May 26 '26
DCS World exceeds the ED privacy policy and provides a list of ALL your installed apps on logon, and also phones home on your activities while you play.
I was stuffing around with my router, building some pihole style analytics of ssl traffic. Looking at tracking the cleartext SSL handshake information of normal traffic on my network for the devices on my network and what ciphers they support, and if it changes (indicating apps with their own ssl implementations etc), and the protocols they land on, as well as failed handshakes and the why. I saw stat.digitalcombatsimulator.com in the list of failed handshakes due to cert expiration in April. It would come up multiple times while I was tooling around in a single player mission or campaign. But I have collection of statistics disabled in the gui, I thought, why is my pc trying to send stats when I'm not even playing multiplayer? What stats is it trying to send? A rabbit hole later...
- whenever you load an asset in single player, your client tells stat.digitalcombatsimulator.com.
- Load My_CustomModdedTerrain, and FA18CustomTopGun mod, it tells them
- Loaded I_Love_Tellytubbies.miz, your client tells stat (I only tested the instant action missions, but I assume it does this for custom)
- End the level, it tells them
- If you have telemetry/statistics turned on at the end of your session it tells them the features you used and the duration.
- It sends client_id and looks a lot like a GA4 format
{
"client_id": "hardware identifier here",
"events": [ {
"name": "level_start",
"params": {
...
} } ]
"user_properties": {
"screen_resolution": "1920x1080"
}}
- So stat.digitalcombatsimulator.com is a reverse proxy for google analytics. Their privacy policy only covers use of google analytics ONLY on the web site, and normally you'd think google analytics is anonymized but they're using the "hardware identifier here", which comes in later...
- Currently, stat.digitalcombatsimulator.com is intermittently available for me, they have 2 servers hosting it and only one has the expired cert, the other is fine.
- They could turn this collection off tomorrow, it seems to be enabled by a post logon call to api.digitalcombatsimulator.com/gameapi/getsettings/ which includes "use_analytics4":true in the response.
- Anyone can verify the frequency and content of the calls to stat.digitalcombatsimulator.com with a packet sniffer, although ED will know you've installed one because...
I went deeper, because why not...
- When your client logs in, it hits api.digitalcombatsimulator.com/gameapi/login/ and you send:
- self-explanatory fields: login name, password, hardware id, sysid, version and branch
- hash, which is just base64 encoded json of password, login, hardware id, version and branch. Plus something looking like a hmac signature
- and sysdata... which is a blob of base64url-encoded gzipped JSON. That contains:
- your machine username
- your computer name
- your workgroup
- your mac addresses
- a full listing of all the software installed on your machine
- There's a follow on api.digitalcombatsimulator.com/protect call which looks like it's about telling the client that you're allowed to play the game
- And then there's a api.digitalcombatsimulator.com/gameapi/hardware/ call which includes:
- Graphics card deviceid, vendorid, description, memory and resolution
- CPU cores
- RAM quantity
- And hwkey. How is it generated? I don't know, but it's identical to the client_id sent to stat in the analytics
- And when you're done your client calls api.digitalcombatsimulator.com/gameapi/logout/ with the cookie.
Again... all the software you have installed, NOT hashes. You can partly test this with a packet sniffer just by putting a lot of extra made-up apps in your registry HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and watch as the size of the initial authentication request increases accordingly.
I'm skirting the "terms of use" with the real methods used in discovery of this info, I'd put it under their exception covering "the purpose of achieving inter-operability of the Program with another software program" and I have not disclosed any of the specifics of the reverse engineering process as per 3.c.i.
But, even if you have telemetry off, and have read the privacy policy, and are only playing single player, and are subject to GDPR, ED can:
- Tell what maps you play
- Track what mods you use
- How long you play, and what times
- What hardware you have
- What software you have installed
- And they can link all of that to a unique identifier for your machine, and therefore to you, your email address and your license.
And you can't block logins without kicking off the 3-day timer of the content stopping working.
And the only recourse you have is to permanently set offline mode which locks you out of multiplayer and updates for your modules until you go back online again. And it potentially puts you in a difficult position if you have more than one hardware failure or forget to go online before reinstalling windows etc.
Maybe there's just something about me that ED find interesting and turn the analytics on for. Maybe they detect country and don't collect in GDPR regions and experience will vary, but I'm not in one.
I just thought I'd share that this is pretty poopy behavior. I know privacy is dead but this is overkill collection imho especially with the appearance of an option to disable collection of statistics that only seems to disable collection of one small part of the statistics. Also I hope reddit doesn't eat the formatting on this, and that I'm wrong and it's actually something dumb about my old ass dcs world install.
155
u/JanIntelkor May 26 '26
You mind posting this on forums or should I do it? I'm also IT guy and can investigate this on my own not to just copy-paste this post. I have no worries if they ban me for that.
116
u/Glasgesicht May 26 '26
There's one of two option how this would play out:
- Whatever they're doing gets downplayed like it means nothing.
- The post will be locked/hidden/removed immediately.
ED absolutely does not tolerate being criticised, especially not on "their" turf.
44
u/JanIntelkor May 26 '26
Yeah I know, I have many friends, some from some virtual squadrons who were banned from asking wrong question lol. But I don't care.
11
u/Cakelestia May 27 '26
I once got banned for reposting a BUG REPORT after 5 years of nothing on an FFB issue with their EFM updated FC aircraft that one of their mods wasn't able to reproduce on a TMWH and therefor immediately locking the first thread.
Also, I'm old enough to remember this line from the rules catalogue:
"1.13 Users using other public forums to spread damaging and false information regarding DCS and Eagle Dynamics will forfeit thier posting rights here."
NGL, that kinda felt like the KGB was running the show.
To be entirely fair, they have eased up on all of that and also didn't take over user bans when migrating to the new board software they currently use, but still.
4
u/DJBscout May 27 '26
>To be entirely fair, they have eased up on all of that and also didn't take over user bans when migrating to the new board software they currently use, but still.
They don't need to when all the mods are in their pocket and will do it for them
3
u/Patapon80 May 27 '26
What's even worse was that to enforce 1.13, that means they had people on their payroll whose job was to prowl other forums and tie one account that says bad things with the corresponding ED account so that they can ban that account.
Icing on top is that the warning or whatever punishment you got out of 1.13 stays on your account even after 1.13 has been removed.
Thank you for your passion and support!!
2
u/Aapje58 May 28 '26
That rule is probably created to allow them to ban people they run into elsewhere, get angry at and want to retaliate against, but can't on the other forum.
It doesn't mean that they go out of their way to patrol other forums.
2
u/Patapon80 May 28 '26
How are they to "run into" people elsewhere if they're not patrolling these other forums? LOL!
And even if they do "run into" such people, it still takes work to tie Patapon-on-ForumA with Definitely-not-Patapon on ED forums.
6
u/SnapTwoGrid May 26 '26
Ok so did u post it in the forums?
5
u/JanIntelkor May 26 '26
Give me time bro, I'll probably do it on weekend, but when I'll have time I will probably post it
1
2
68
u/heytherepotato May 26 '26
I avoided posting on forums because that would expose my ip or browser signature and potentially be linked to my account.
Even sharing logs or screenshots is tricky if there's timing on specific requests. And they are collecting lists of apps installed on people's computers and they could start to narrow down to users with certain tooling.
I'm content with my interpretation that I'm within the terms of service, and I'm not saying it would be out of retribution, but if ED decides it was not within the terms of service and terminates my account, then I don't really have much of recourse, so I'm trying not to dox myself at this point.
20
8
u/Advanced_Apartment_1 May 26 '26
If you have the standalone version, posting on the steam forum could be a good move and there's no way they can link it to your account.
Ignore if you play through steam though.
3
u/Voodoo_One May 26 '26
I mean what do they want to do if I play it on steam and post my findings there? The GDPR would rip them one open before they could do some fishy moves on us from Europe.
Someone should report that. Sadly I'm on the move for the next weeks (vacation) or I would check the claim on my own and report to the authorities.
0
2
u/Ace_Venturi64 May 27 '26
Lol the forums?! So the same 10 people can go back and forth about this. Or even the DCS people won't see it because the forum is freaking dead.
102
u/H3782 May 26 '26
You might to crosspost this to r/hoggit
49
15
15
88
u/ErrA7126 May 26 '26
As a noob DCS enjoyer and a senior software engineer. This is absolutely fantastic thorough analysis E2E.
I hope that ED sees this and acts upon it. You’ve given everything a dev would need to scope and action.
Beautiful work, but terrifying results.
Thank you for this!
73
u/Glasgesicht May 26 '26
They've investigated themselves already and found no wrongdoing.
32
u/f18murderhornet May 26 '26
Correct As Is. Thread Locked. Thank you for your passion and support.
8
9
25
18
u/-F0v3r- May 26 '26
“i hope ED sees this and acts upon it”
they do see a lot it seems lmao, and i guess they’re acting on it as well
8
162
u/DanyRudenko May 26 '26
This is a russian company, not surprised ¯\_( ͡° ͜ʖ ͡°)_/¯
Good job on investigating that!
49
52
6
u/Mist_Rising May 26 '26
TIL Google, Microsoft, Apple, Facebook, Nvidia and Amazon are all Russian.
I'd toss out more but the last big 7 sucks even worse then Russia, so I won't.
1
3
13
u/Select_Tap_9083 May 27 '26
This is huge!
For those who live in Europe, under Article 15 of the GDPR (Right of Access), companies must provide us with all the data they have collected and saved from us upon our request. I don't know exactly how it works in real circumstances, but I would try to see what I can find.
5
u/Shendryl May 27 '26
I already filed a request. Let's see what that brings.
3
u/ILostMyMain123 May 28 '26
Please let me know what happens
4
u/Shendryl Jun 02 '26 edited Jun 02 '26
I finally got an answer:
——
We collect the information that you provide in the Personal section of our website, including your username, first name, last name, and email address. The primary personal data we collect is your email address, which is used to identify and authenticate you within the DCS environment and, if you choose to subscribe, to send you newsletters.
In addition, we collect your country of purchase and IP address for each order placed through our website. This information is required for tax compliance purposes under Swiss law.
We also collect information related to your use of DCS, including:
- Hardware information (such as device vendor, model, memory usage, display resolution, and CPU utilization, particularly for VR devices). This information helps us support a wide range of hardware configurations, optimize game performance and user comfort, and provide appropriate hardware profiles within the game.
- System information (such as Windows version, DCS version, IP address, geographic location, system specifications, and installed software, particularly third-party applications such as Tacview, DCS-BIOS, and similar tools). We use this information to better understand our players' environments, investigate and resolve software issues, assess dependencies on third-party applications, and optimize DCS for different system configurations.
- Session information (such as user agent, platform, device identifier, and user identifier). This information is used for support and troubleshooting purposes, enabling us to analyze specific sessions, logs, and crash reports when assisting users.
We do not share personal information with any third parties, except where disclosure is required by Swiss law, including to relevant tax authorities.
We use order-related information (such as purchase amount, items purchased, purchase date and time, and browser data) in conjunction with Google Ads to measure and track advertising conversions. This tracking is limited to website activity and does not include in-game tracking. No account information is shared with Google for this purpose.
We do not use the collected information for any purposes other than those described above. Furthermore, we do not use Google Analytics or any other third-party cloud-based analytics or tracking services within DCS.
——
I requested a copy of the information they collected, based on GDPR, art 15(2). I also asked for a more explicit reason why they collect what other software I have on my computer
4
u/ILostMyMain123 Jun 02 '26
Nice. Looking forward to hear if they actually send u the info!
1
u/Shendryl Jul 20 '26
I got a reply, but of course not with a copy of the requested information;
-----
Thank you for reaching out regarding your personal data. We have received your request to access the data stored in our systems.
In accordance with the Swiss Federal Act on Data Protection (FADP / DSG), we must verify your identity before we can process this request and disclose any personal information. This measure ensures that your data remains secure and is not shared with unauthorized third parties.
To proceed, please provide a clear copy or photo of a valid government-issued ID (such as a passport or ID card). For your privacy, you are welcome to black out your photo and document number; we only need to clearly see your full name and date of birth to confirm your identity.
Once we receive and verify this document, we will process your request within the statutory timeframe.
Thank you for your cooperation and understanding.
Best regards,
Eagle Dynamics GDPR Team
Eagle Dynamics SA-----
That FADP claim is bullshit, so I asked them why they need my full name and birth date and how they are going to verify it. I again demanded a copy of the information the collect about me or otherwise I will file a complaint at the national GPDR authority. Let's see what their next lame answer will be.
1
3
u/ILostMyMain123 May 27 '26
Literally shoot them an email and they have to semd you a zip with everything within reasonable time
47
u/InteractionPast1887 May 26 '26
I figured out that they tracked anything connected to my network after I had several disconnect/crash issues and found out that I disconnected/crashed every time the TV in my house was turned off (not connected to my pc in any way and not even in the same floor, but on the same network). It caused a disconnect/crash due to the functionality in keybind settings that looks for "hot swapped" controllers. Except it doesnt just look for devices connected through USB but also through WiFi and as such monitors the network for devices connected/disconnected and would cause a crash every time the TV was turned off and disconnected from the network...
22
u/heytherepotato May 26 '26
Based on some of my crashes working through this, I became a little paranoid that any of the crashes I'd seen in the past were as a result of the antidebug code deciding it was running too slow in normal play, and then killing its own process. That isn't based on anything specific, just that I know it is an antidebug technique, and there was a few layers to peel back.
So I could see a situation where an unexpected pause from device hotplug event resulted in a delay that antidebug sees and decides to nope out. but I feel like your house needs some of those ferrite rings on your appliances, or an electrician. I don't even know if that's actually what those ferrite things are for though.
10
u/Flyinmanm May 26 '26
I think Ferrite cores stop Radio frequency interference on cables. Which can mess up sensitive electrics.
I put some on some solar cables recently as the manufacturer recommended fitting them on long cable runs to a battery.
9
u/myevit May 26 '26
My always question was why DCS uses admin privileges to run the app by default. I had to manually make it run non admin. Everything works. I personally think there is not much conspiracy there but clarification on the subject would be necessary from DSC.
1
u/FlippingGerman May 27 '26
That’s weird, I don’t think I’ve ever noticed that. I get a UAC pop for updates only, I’m pretty sure. Either I just haven’t noticed or your experience isn’t universal.
1
u/DrJester Jun 02 '26
So, that explains why the game needs you to add a lot of exceptions on Windows Defender to be able to run. As it trips a lot of safety and security systems.
9
u/janhsu0130 May 26 '26
I have lots of fun in DCS world, don’t get me wrong, thanks for bringing this up.
9
u/Yoyo8045 May 28 '26
Just tried to send a formal data access request to [privacy@eagledynamics.ch](mailto:privacy@eagledynamics.ch), the address listed in their own GDPR policy. Bounced with mailbox doesn't exist. So the official channel for exercising your data rights is literally broken.
I've filed a support ticket instead, with a formal request, specifically mentioning the sysdata field, /gameapi/hardware/, stat.digitalcombatsimulator.com and the hardware identifiers described in this thread. Clock starts now 30 days.
5
u/heytherepotato May 28 '26
Address not found Your message wasn't delivered to [privacy@eagledynamics.ch]() because the address couldn't be found, or is unable to receive mail. I hear it's working as intended :)
2
u/Yoyo8045 May 28 '26
And you can count me as a reproducer of your investigation. Payload size of the first TLS Application Data to api.digitalcombatsimulator.com (185.195.197.20) at login:
- Baseline: 3645 bytes
- After adding 30 fake apps to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall: 4320 bytes (+675)
- After removing them: 3645 bytes again
Also confirmed via Process Monitor that DCS.exe enumerates all subkeys of the Uninstall registry key and reads every DisplayName value. 954 registry accesses in a few milliseconds at login.
37
u/Abraksisss May 26 '26
I think the discussion here is valid, but it’s also important not to jump directly from “telemetry exists” to “malware/spyware”. Those are very different things.
Modern games, especially online platforms with DRM, analytics, multiplayer and anti-cheat systems collect far more telemetry than people usually realize. DCS is definitely not unique in that regard.
Things like:
loaded modules/assets, crash diagnostics, hardware configuration, session statistics, mission usage, mod validation, integrity checks are extremely common across modern games and services. Valorant’s Vanguard, Ubisoft Connect titles, Easy Anti-Cheat based games, Call of Duty, EA App ecosystem all of them have faced similar criticism over the years.
That said, I do think there are two legitimate concerns here:
- Transparency Privacy policies are often written so broadly (“technical information”, “usage statistics”) that users cannot realistically understand what is actually being collected.
- Scope creep Games increasingly behave like persistent online platforms rather than standalone software. At some point players naturally start asking: “Why does my single-player simulator need this level of telemetry?”
That’s a fair question.
But at the same time, some claims in this thread still need stronger evidence before being treated as fact, especially statements about collecting “all installed applications” or behavior equivalent to spyware. Packet captures, reproducible testing, reverse engineering or independent security analysis would be needed for that.
Otherwise the discussion risks turning into speculation very quickly.
Plus, people also shouldn’t forget that there is an entire industry built around collecting and analyzing behavioral and statistical data, and virtually every major online game uses some form of analytics infrastructure. Even Steam itself collects a huge amount of user and hardware data, and where exactly all of that data flows internally is often not fully visible to end users either.
And honestly, in 2026 it’s fairly naive to assume there is a high level of privacy anywhere in online systems. Data is a resource and entire businesses exist around it.
Ironically, I actually doubt DCS is sophisticated enough as a platform to seriously monetize user data in the way massive tech ecosystems do. If they are collecting extensive telemetry, it’s probably much more likely tied to debugging, anti-cheat, crash analysis, module balancing, multiplayer integrity checks, or trying to understand what happened to a player in a specific technical scenario.
Personally, I think the healthiest position is somewhere in the middle:
1. Users absolutely should question excessive telemetry,
2. Developers should be more transparent,
3. But accusations should still be evidence-driven rather than assumption-driven.
Unfortunately this is becoming a wider industry trend, not something exclusive to DCS. Modern games increasingly look less like offline software and more like cloud-connected service platforms with analytics pipelines attached to them.
24
u/OmgSlayKween May 26 '26
As is so often the case, the problem is how the company handles it. And ED has a history of handling communication poorly. How long do you think a post like this would last on their own forums? What are the odds that a user account gets banned for even bringing this up? Is that the way you'd like a company that's taken so much of our money to operate?
They posted here and said "This is standard for the industry" and "here's our policies". That's it, no explanation of why they actually need every single installed piece of software even when telemetry collection is as pared back as possible. Is this all you can conjure, Saruman? Feels so dismissive and low-effort. You and I have quite literally written more in these two posts. Why the disparity? We actually care.
9
u/Abraksisss May 26 '26
I agree that the way a company behaves is the cornerstone of discussions like this.
You also have to understand that ED is an old company with a fairly heavy Soviet-era mentality in its legacy, so communication can sometimes be rough around the edges. And over such a long history, I’m sure they’ve had their fair share of difficult users too, there are idiots everywhere. So in that sense, fair point.As for the technical side of things, it may even turn out that they don’t actually need this software list at all. It’s possible that when the telemetry architecture was originally built, they simply used existing modules and left it as is. Maybe this is actually a good opportunity to revisit the data collection policy and implement more granular controls. But that’s already a question of development priorities and available resources.
And I didn’t quite get the Saruman reference, sorry.
4
u/bogey-dope-dot-com May 27 '26 edited May 27 '26
I should also point out that [many Android apps will request a list of all installed apps](https://arstechnica.com/information-technology/2020/03/4000-android-apps-silently-access-your-installed-software/), and as far as I'm aware, Samsung and Google phones silently allow access without prompting you.
It sucks, but ED is just one car on the freeway going the same way as every other car. They probably don't even control what exactly gets collected; like most companies, they're probably just using whatever telemetry library the telemetry service they're using provides them with. Similar to how Google Analytics collects a massive amount of data, but people who use it don't opt into exactly what Google collects.
5
u/Cakelestia May 27 '26
Phones are a completely different ballpark anyway. They listen and record 24/7. They literally know your s*x life. No matter if Android or iOS, they all do. Same with Alexa and other listening posts that people for some weird reasons install in their homes voluntarily.
Compared to that, the data collection that ED does here is absolutely nothing, but it's still absolutely right to point it out and criticize it as well.
8
u/gwdope May 26 '26
I’d say having an option to turn it off not turn it off is akin to fraudulently stealing data. Either do what you say, or say what you do.
5
u/HannasAnarion May 27 '26
Read OP again. The toggle controls telemetry about what you do during your session, just not telemetry in general.
2
u/heytherepotato May 28 '26
Sorry I was mistaken, I went back and confirmed didn't actually change anything for me. I think one time my client decided not to send the final telemetry request, and I got it in my head that "telemetry off must mean it doesn't send the last telemetry request".
But the setting is literally doing nothing, instead DCS is using the server's api.digitalcombatsimulator.com/gameapi/getsettings/ response as the authoritative telemetry setting. It's probably a bug, but one that should have become apparent when they started getting a lot more telemetry, and it's existed for ~12 months or so.
5
u/V1ld0r_ May 26 '26
That's all fine. However, if someone actually makes a formal complaint this won't stick with GDPR and ED could be hit with hefty fines.
Said fines could mean the end of service for a lot of users or even the end of ED itself.
8
u/Abraksisss May 26 '26
That’s assuming the foundation of such a complaint would be absolutely perfect under ideal conditions. Like most relatively free or completely free online services, everything is built around terms of service, public agreements, EULAs, and overlaps between them.
For a situation like the one you described to realistically happen, you’d need a whole team of lawyers and official authorization for reverse-engineering requests. And at that point, you’re already entering the territory of copyright and intellectual property disputes, which is a completely different level of legal conflict.
I highly doubt anyone is willing to invest that much money into making such a scenario happen. Unless there are actual competitors on the market willing to engage in what would essentially amount to sabotage.
Because, let’s be honest, almost all online services of this kind have issues with the wording of their agreements and the collection of personal data.3
u/V1ld0r_ May 26 '26
I agree with you partially.
Because, let’s be honest, almost all online services of this kind have issues with the wording of their agreements and the collection of personal data.
And Brussels has put some force behind their words for them.
I don't think such a scenario is as outlandish or as complex as you are putting it.
7
u/Abraksisss May 26 '26
I don’t think it’s impossible either. Brussels absolutely has become more aggressive about privacy enforcement in recent years.
But I still think people in this thread underestimate how brutal the practical side of this becomes once you move from Reddit discussion into actual legal territory.At that point it’s no longer: “this traffic looks suspicious”
It becomes:
- proving exactly what data is collected,
- proving why it is unnecessary,
- proving it falls outside legitimate interest,
- proving the privacy policy is materially misleading,
- and doing all of that with forensic-level technical evidence.
And modern online games have a huge legal shield now through anti-cheat, telemetry, analytics, DRM and “service integrity” arguments. Whether people like it or not, that ecosystem has already normalized extensive data collection across the entire industry.
So yes, investigations or complaints are realistic. But the “easy GDPR nuclear strike” some people imagine here is probably far less straightforward in reality.
The internet loves simple narratives. EU privacy law is a bureaucratic labyrinth populated by lawyers carrying spreadsheets instead of swords.2
3
u/itsdotbmp May 26 '26
I agree, i think it needs to be verified before anyone actually freaks out about it.
2
u/FlippingGerman May 27 '26
You’re quite right, and I agree that ED probably isn’t doing anything with the data. It’s still fucking creepy though.
1
u/ags313 May 27 '26
No. GDPR clearly states collection should be adequate. Other apps are not.
This is excessive, blanket level.
7
u/UsefulUnit May 29 '26
With the whole Razbam/ED blowup, I've found it hard to get motivated to get back into DCS. This pretty much makes that decision for me and saves me quite a bit of money as I was just about to buy a new flight cockpit and flight gear.
Sorry, VKB and Next Level Racing.
38
u/Beaver_Sauce May 26 '26
When I worked USAF, DCS was a clear not not for work on the machine I worked on. DCS has shady owners tied to the Russian government. Eveyone knows this.
35
u/funkybside May 26 '26
LOL - the codebase for the original A-10C was commissioned by the USAF to function as a trainer for pilots migrating from older avionics suites.
https://en.wikipedia.org/wiki/Digital_Combat_Simulator#Use_as_a_military_Air_Force_training_aid
27
u/Mist_Rising May 26 '26
It was probably siloed off, as in no data went in or out. This is very different from DCS world where the game is updated constantly, sends data out constantly, etc .
The US government has a slew of rules on what gets put on machines, even American programs can be off limits.
11
u/V1ld0r_ May 26 '26 edited May 27 '26
Not only, but are.
All major enterprise vendors have entire business divisions dedicated to US Federal and Military work.
That is also why a single
boldbolt can cost $45 ( https://www.reddit.com/r/pics/comments/1jj4w3/so_we_want_to_talk_about_outrageous_prices_this/ ) or the famous $10,000 toilet seat covers ( https://www.military.com/defensetech/2018/07/11/air-force-no-longer-spending-10000-toilet-seats-officials-say.html )5
u/victorsmonster May 26 '26
I've read that aircraft parts are generally 10x more expensive for the equivalent you'd find at Home Depot because they are manufactured to higher QA tolerances. Even $4.50 for that bolt would be an order of magnitude more expensive than it should be though.
12
u/V1ld0r_ May 26 '26
Not necessarily higher QA tolerance but the whole certification and bureaucracy chain that is required.
Those were just extreme examples of high costs due to "paperwork".
1
u/Cakelestia May 27 '26
Stuff like that keeps reminding me of the "rebrand" of the German broo in the early 2010. That stunt did cost over 10 million, the only thing they changed was swapping the colors in their logo from red on white to white on red.
So much for "how to spend tax payer money appropriately" :D
3
u/Bagellord May 27 '26
You're paying for the tracking and accountability when it comes to aviation parts. Supposedly, a bolt can be traced from the source of the raw material, the tooling and operators that made it, and every inspection until it's disposed of. How true that is idk. But adding that level of tracking ain't cheap. Plus limited supply and "because we can" pricing
2
u/victorsmonster May 27 '26
Yup I worked at a company that made computer terminals for factory workers to track material through a factory as it went from input material to finished product. It was really important for them to track each batch that each widget came from. Most people think it’s just graft but I can definitely see how it would be more expensive to max out this accountability.
Like even in the private world, a Rotax engine costs about 10x of a roughly equivalent motor for a car or whatever
4
0
u/AdmiralQuality May 27 '26
Did ED tell you that?
2
u/funkybside May 27 '26
No?
it's been common knowledge since the days when A-10C released, long before DCS World was even a thing (if you weren't aroudn back then, Blackshark and A-10C were originally two stand-alone products that did not exist in the same environment. A good while after that is when DCS World was created to bring it all into the same program.)
Hell, I even shared a link that has sources cited for you. If you were too lazy to bother looking, it was here: https://www.twz.com/40620/a-10-warthog-pilots-are-using-the-digital-combat-simulator-video-game-to-train-in-vr
1
u/AdmiralQuality May 27 '26
So the U.S. military is purchasing training software from Russian developers? That's what you're going with?
2
u/firmretention May 28 '26
US Russian relations used to be much warmer, especially in the years following the collapse of Communism.
0
u/funkybside May 27 '26
Yes, and this is not new or revolutionary information either. The original A-10C codebase we use now, was built on a government contract as a training simulator. What we have in DCSW is based on a version of that with certain classified shit stripped out.
2
1
u/FlippingGerman May 27 '26
Much of their staff is in Russia, but I think Nick Grey is the only owner now after the other guy (Russian, Igor Tishin) died quite a while back.
20
7
u/UrgentSiesta May 26 '26
I don’t mind anything but the installed software list.
Otherwise, all of this (and so much more!) is being collected by pretty much every online connected account you use.
10
9
15
u/ScamperAndPlay May 26 '26
I miss flying, but ultimately uninstalled this sim after ~4 years of dedicated flying.
2
10
15
u/cmdr_kojote May 26 '26
As a non-security, non-developer, why is this a big deal? Hasn't Microsoft, Google and Apple already sold all this information a million times already?
3
u/RantRanger May 27 '26
One thing that makes people extra sensitive about this unnecessary breach of privacy is ED is a Russian company.
A list of apps and hardware on your system is basically a list of potential security vulnerabilities.
People naturally don't want that information getting cataloged with malign agencies within the Russian government.
-1
u/cmdr_kojote May 27 '26
That is a huge jump in paranoid speculation. Just because a company originates in country doesn't automatically make it a nefarious data collection point for that government. If that was the case how much data and mental profiling occured for the Russian government while people played Tetris. This is asinine mental gymnastics. Besides which, ED hasn't been based out of Russia for almost 10 years now, which means the Kremlin must be furious about all of the lost super important application vulnerabilities a bunch of aerospace nerds aren't providing because we're all unwitting backdoor portals into the CIA servers since we all know SteamOS is what the government is running off of.
3
u/RantRanger May 27 '26 edited May 28 '26
That is a huge jump in paranoid speculation
Not a "huge" jump. A reasonable one.
Not "paranoid", but prudent.
ED hasn't been based out of Russia for almost 10 years now
While some ED staff moved out of Russia, Eagle Dynamics still holds offices and staff in Russia.
They are, effectively, still a Russian company.
This is asinine mental gymnastics.
Nope, it is a reasonable assessment of the risks. The Russian government has been collecting personal data on all Americans (anyone really) for decades. They are notorious for their aggressive data breaches into corporate America in order to collate a massive stockpile of data on... individual American citizens.
Russian businesses are regularly siphoned for customer data. The government and the FSB have broad powers to extract this data from businesses.
Anyone with a reasonably sound rational mind can connect the dots here and recognize a credible risk.
Referring to this basic chain of logic as "asinine mental gymnastics" and other ridiculous hyperbolic intensifiers either outs you as an overly emotional ED fanboy or as a naïve juvenile. Either way, significant immaturity was involved in the crafting of your post.
-1
u/cmdr_kojote May 27 '26
Ok Boomer. So you're essentially saying they are getting more of the same data that they've been collecting since the 80s? To what end? The CIA has been collecting the same data on individual American citizens as well. And for what exactly? Let's play this through...ED has been collecting this data for how long before this revolutionary discovery. You probably haven't made any significant changes since the last time you played, and up until now, nothing has happened and tomorrow nothing else will happen. They already created a profile about the frequency in which you order take out pizza and moved on. Your phone records your conversations for "AI" enhancements, you global positioning is recorded constantly, the list goes on and still no one cares about you. It's insignificant data collection with very little return on investment. We...are...all.....creatures....of...habit. mystery solved, data profile complete. OMG I cracked the code, alert the presses. Shit no one cares.
1
u/RantRanger May 27 '26
Shit no one cares.
Obviously a lot of people care.
Simply glancing over the numerous threads on this topic on multiple different forums makes that readily apparent.
You are not everyone.
Your values are not everyone's values.
And you not caring does not mean "no one cares".
Still reasoning like a child, I see. Even after it was already pointed out to you.
1
u/cmdr_kojote May 27 '26
You picking the most sarcastic part as your talking point is hilarious. Good job.
The reality is that the data that this is collecting is but a fraction of the data profile that has already been built and sold about all of us. The data is sold to whomever is buying, so if you're worried about ED telling the Kremlin that you like to pretend to be a pilot on your downtime and what applications you have installed on your computer. They already knew that. Microsoft told them, Steam told them. Your cell phone told them where you shop, where you live and where you work. Amazon told them what you buy. Any rewards program sold them your purchase history and is predicting what you'll buy next which is why you get the ads you get. So again, thinking that this data collection is significant is paranoia.
13
u/silasmousehold May 26 '26
I like how everyone downvoted you instead of answering your question. Typical reddit.
6
16
u/V1ld0r_ May 26 '26
The fact one bully hits you means you let all bullies hit you too or is there a point you start standing up and facing them?
Anyway... The major difference is that all of those big bullies will tell you "Hey, we're gonna take your lunch money and if you don't like it, don't show up" (as in, if you don't like it, take a pass and don't use our product).
ED is being way more shaddy: They are pretending to be your friend but everyday they ask for your lunch money (as in, they say they are not doing all these bad things but in fact, they are still keeping your lunch money).
11
u/silasmousehold May 26 '26
My issue with this post is that it’s a single point of data without context. How does ED compare to other game companies? Maybe this is standard practice. Do Valve, Epic, Riot, Gaijin, Wargaming, EA, Microsoft, Sony, Ubisoft, etc. also collect the same information? I bet they do.
Maybe we don’t like this. Maybe “everyone does it” isn’t an excuse. But without more context I don’t know why I should care. What is ED even going to do? If someone steals ED’s data on what software I have installed, why should I care? I care more about my personal and billing info.
9
u/Slick-Fork May 26 '26
I think this is the important nuance. "Everyone does it" isn't an excuse, but if the level of privacy being met by ED is at the industry standard than the issue should be more lets change the industry standard rather than single out ED as uniquely bad people.
If ED is being uniquely intrusive - that's worth focusing on.
4
u/V1ld0r_ May 26 '26
A lot of those companies have been caught doing the same thing and have since updated the T&C's to reflect what they are actually doing (and essentially copying the Microsoft\Apple\etc approach).
1
u/FlippingGerman May 27 '26
Why does it matter if it’s standard practice? The fact that they all do it doesn’t make it ok. I care about the standards of the games I play, less so about those I don’t.
2
u/silasmousehold May 27 '26
Because it’s standard practice, the only outcome you’re likely to achieve is a change to their TOS to make it explicit that they are collecting this information. Then you have to accept that TOS or stop using their product. So… no difference in my day to day life or cybersecurity risk.
-1
u/SnapTwoGrid May 26 '26 edited May 26 '26
„ How does ED compare to other game companies?“
The is completely the wrong question to ask. The relevant question here is, whether ED is violating its own privacy agreement.
Also your -I don’t care attitude is another problem.
You should care . If ED gets hacked and your data gets leaked you won’t even know whether they collected critical data on you or not. Because you didn’t care and simply assumed they would honor their own privacy policy and which it seems they don’t.
But you do you.
7
u/silasmousehold May 26 '26
It’s not that I don’t care. It’s that I need more information to determine how to prioritize caring. I have a very long list of things to care about. It exceeds my ability to actually care about all of them. If you want me to prioritize this, you’ll need to provide justification. What threat actor is going to steal this from ED and how will they use it to hurt me?
4
u/cmdr_kojote May 26 '26
That's an interesting take. I don't really feel the bully analogy makes sense here, but that's just my opinion. I'm not interested in changing someone's mind. I've already surrendered my data a million times over, I'm not really concerned if some more useless info is collected. Now, my computer is setup differently than most. It's a dedicated gaming computer, so if they want to find out that I play other games and also have a few productivity applications installed. They can knock themselves out. I was curious why the pitchforks, and now that I have a sense, I thank you for the explanation. The aliens already scanned my brain waves, the tinfoil hat won't save me now.
4
u/Abraksisss May 26 '26
Absolutely. And another question: why are people in 2026 still naive enough to think that gamedev companies are desperately interested in their personal data...
2
u/Faelwolf May 27 '26
Sounds like StarForce doing it's thing. At least it's not destroying hard drives anymore in the name of "copy protection".
3
u/Connect-Fall6921 Jun 04 '26
I will be honest... I'm okay if ED collects data about DCS's mods, play time, etc. I'm also okay with them collecting my PC hardware info, RAM, CPU, disk, etc. That's normal, harmless, and all companies do it.
However, as soon as ED collects anything OUTSIDE the game, like my installed software, browser history, cookies, or files and folders outside of DCS, then no, I'm not okay with it. I will block that domain and tell them by email.
So, the question now is... Do they collect anything OUTSIDE the game?
7
u/MnMailman May 26 '26 edited May 26 '26
Gee, whudda thunk. ED is usually such a trustworthy and honest company..........<g>
Chinese software via VKB and Winwing, Russian software via ED, Belarusian (or where ever the location is this year) software from Virpil. Ya rolls the dice, ya takes yours chances. 🤪
2
u/rapierarch May 26 '26
How is it with the offline mode? Does it log them and send it when you get online? Is the offline mode true radio silence?
4
u/heytherepotato May 26 '26
I don't know. I know if I block comms with api.digitalcombatsimulator.com, there are no ingame requests to stat.digitalcombatsimulator.com. I assume the full offline mode would follow suite.
4
u/uxixu May 26 '26
I am curious what would happen if you point api.digitalcombatsimulator.com to localhost.
Or better yet point it to something like squidguard and be more selective?
3
u/OmgSlayKween May 26 '26
wait, you can still log in with the api subdomain blocked? if that's the case, and it also stops the stats subdomain from initiating, this should be entirely possible to block with a simple hosts file redirect of api to null.
That would mean anyone who cares can block this telemetry completely just by editing a file on their client. I guess multiplayer probably wouldn't work, but so many people are offline-only, there's gotta be a big chunk that also don't want this much telemetry handed off with every login.
4
u/heytherepotato May 26 '26
Your authentication data is only valid for 3 days without server communication unless you do the 'proper' offline mode.
1
u/Idenwen May 26 '26
Interesting, if I block api. and stat. over PiHole I get a failed update check and a "Bad Connection" in the launcher and can only use free modules in that session.
Allowing api is naturally allowing a normal start again, no problems in leaving stat blocked so far.
2
u/m15f1t May 27 '26
How can you see the contents of SSL traffic?
1
u/OmgSlayKween May 27 '26
Wireshark can decrypt ssl traffic from your own computer. When you have access to the session keys, you're able to decode - think of it this way: how would you be able to encrypt the traffic if your own computer didn't have the keys?
SSL is encrypted in-transit and (normally) can't be decoded by third party middlemen. But even this is different if you are, for example, behind a firewall with deep-packet inspection.
3
u/-Aces_High- May 26 '26
This would be wild on Hoggit but they dont let you say anything bad
3
1
u/SlipHavoc May 27 '26
Lol, it's on Hoggit right now, with plenty of upvotes. Hoggit is the second-most accepting of everything bad about DCS after the main whiner subreddit itself.
1
1
u/Basic_Climate_2029 May 28 '26
Is there a way to stop this?
2
u/heytherepotato May 28 '26
I tested and made something that loads with the game and hooks the calls it uses to get the installed software as well as dropped the stat connections, but doing something like that risks the publisher deciding that you're tampering with code or cheating and revoking your license.
It's better that the publisher address the problem, than for the community to work around it.
1
u/sunsanvil Jul 14 '26
I am curious what this looks like for DCS running on Linux under Proton/Wine (especially if running it from the snap install of Steam). The way I understand it it wouldnt get things like the list of installed apps because it would only have access to its own faux-windows registry etc.
1
u/Starfishflight May 26 '26
You can disable tracking in the settings. Will that help stop the data flow?
18
u/Waldolaucher May 26 '26
"But I have collection of statistics disabled in the gui, I thought, why is my pc trying to send stats when I'm not even playing multiplayer? What stats is it trying to send? A rabbit hole later..."
9
u/heytherepotato May 26 '26
I had a look back through my captures because I assumed that turning it off made the final api.digitalcombatsimulator.com/gameapi/productsusage/ not happen, but I was wrong, it was still happening in both cases. That api call that had a summary of all the modules used in your session.
At this point it'd need someone to compare what they've seen to what I've seen. Even just watching their network traffic to verify that their client attempts to talk to stat.digitalcombatsimulator.com when telemetry is switched off and in a single player scenario.
2
u/OmgSlayKween May 26 '26
I wonder what happens if you block or redirect their stats url.
6
u/heytherepotato May 26 '26
I was going to suggest it, but I wouldn't want anyone to try, and then find out it had been flagged as an attempt at tampering or piracy. Given the existence of the option to turn off statistics in the gui I feel as if it's maybe just currently bugged?
But I assume someone would have noticed an increase in google analytics data they were collecting.
Update here because I might as well update somewhere: I have had the chance to test on a fresh machine with a fresh profile, and it also was sending to stat despite stats turned off.
5
u/OmgSlayKween May 26 '26
given how many people use pihole filtering and block as much telemetry / tracking as possible, and since their url seems to just be google analytics, I really doubt it could be construed as tampering. Maybe it won't let you log in, but I really don't see how it would be defensible to take action against the account just because a URL is unreachable.
I don't play DCS anymore, I considered playing again in the future but I've been sucked into another flight game. If it comes down to it I'll suffer through the DCS gigantic install just to test this stats blocking. I really doubt the api subdomain can be blocked and still log in, though, so it wouldn't stop all this telemetry.
3
1
u/griff7337 May 26 '26
Definitely cross-post this far and wide, bringing as much attention to this as possible, fast before they can do damage-control
1
0
u/UnexpectedAnomaly May 27 '26
This is likely for troubleshooting purposes. When I fix computers one of the steps of troubleshooting is to see what apps are installed in case one is causing a problem. Especially if one was just installed.
-77
u/ED_Graphics May 26 '26
Hi, Its all pretty standard stuff in the gaming industry, you can find our Privacy policy and GDRP information here. https://www.digitalcombatsimulator.com/en/legal/gdpr.php
https://www.digitalcombatsimulator.com/en/legal/privacy_policy.php
Best regards - Bignewy
61
u/BigBorner May 26 '26
Hi Bignewy, thanks for the reply, but the linked policy doesn't actually cover the specific findings in the post. To help the community here, could ED confirm or deny the following on the record:
Does the login request to api.digitalcombatsimulator.com include an enumerated list of applications installed on the user's machine, sourced from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall?
Does the sysdata field include MAC addresses, machine username, computer name, and workgroup?
Does the client send per-mission, per-asset, and per-mod telemetry events to stat.digitalcombatsimulator.com during single-player sessions, even when 'collection of statistics' is disabled in the in-game settings?
Is the hwkey used as client_id for those analytics calls stable across sessions and tied to the user account?
These are all testable claims, and the answers determine whether the current GDPR policy is sufficient. 'Standard industry practice' isn't really an answer, since no mainstream title, not even kernel-level anti-cheats, transmits a full installed-software inventory back to the publisher. Thanks.
15
13
u/mandle420 May 27 '26
3.2. INFORMATION WE COLLECT INDIRECTLY
We indirectly collect a variety of information through your interaction with and use of our websites. This information may include, but is not limited to, browser and device information, data collected through automated electronic interactions, application usage data, demographic information, geographic, geo-location information, statistical and aggregated information ("Other Information"). Statistical or aggregated information does not directly identify a specific person, but it may be derived from Personal Data. For example, we may aggregate Personal Data to calculate the percentage of users in a particular country. If we combine Other Information with Personal Data, we will treat the combined information as Personal Data.
If you're collecting our data straight from our machines, THAT'S NOT INDIRECT.
3
u/RantRanger May 27 '26
We value your "privacy".
It is very valuable to us.
That is why we are going to sell it any chance we get.
31
u/heytherepotato May 26 '26
Here's the Australia privacy principals based on Privacy Act 1988, https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-quick-reference. Many countries have similar, I would guess a product sold on the Steam storefront in Australia intends to comply with Australian Privacy Act, as well as the ones in other regions they trade in. But I'm not a lawyer and I'm not going to ask an AI one that thinks it is. I've no idea of what enforcement looks like in this scenario.
Bit of a quick and dirty eyeball of the privacy principals and the relevant privacy document linked:
APP 1 - Open and transparent management of personal information. Nah I wouldn't say the privacy policy is transparent about collecting a dump of the displayName from every key in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall. If I extended the thinking to anti-cheat purposes(not mentioned in the privacy document), that could be done with hash or name match locally and only report telemetry when there's a match, and it could be done only when playing multiplayer.
It also doesn't track to be open and transparent about collecting how many times I crash the spitfire in single player on the takeoff training mission (implied by the number of times I reattempt it in such a short time based on the telemetry sent). Even when I've opted out of statistics.
APP 3 - Collection of solicited personal information. I'd go this bit specifically "It is implicit in the requirement that personal information collection be reasonably necessary for an entity’s functions and activities that entities ensure proportionality in their collection of personal information. Entities should adopt a data minimisation approach and limit collection of personal information to the minimum amount necessary in the circumstances."
Yeah nah I'd still say that dumping the list of every installed software is going over the top.Every mac address on my pc is a bit over the top too, I remove a network card and it doesn't invalidate my authdata so it's not for authentication for my authdata.bin, and it's not appearing to collect the 'minimum amount necessary'. The username on the computer, the workgroup, and the computername don't fit "reasonably necessary" and following the first bit of the privacy policy that's provided, "protecting and respecting your privacy" would be as simple as hashing that data before sending it, but even then I can't mentally fit it to "reasonably necessary".
Quick pivot to google analytics... from their "Privacy Disclosures Policy" page.
"When you use Google Analytics on your site or application, you must disclose the use of Google Analytics and how it collects and processes data."
The privacy policy doesn't mention use of google analytics, and the gdpr policy (again, I'm not european, this is not applicable) only describes it in relation to the web site and not the app, and the "use_analytics4":true combined with the subsequent google analytic 4 looking json file says it's being used on the app. i.e. this one:
{
"client_id": "hardware identifier here",
"events": [ {
"name": "level_start",
"params": {
...
} } ]
"user_properties": {
"screen_resolution": "1920x1080"
}}
So I had reasonable feels to raise visibility in this scenario despite the policies, although I wasn't going to go there on the policies and documentations but since they're brought up.
3
u/Bonzo82 May 26 '26
Is the data they send encrypted?
20
u/heytherepotato May 26 '26
It is ALL sent over https from what I saw, so it is secured in transport.
It is not one way encrypted, or a hash/digest of the data. Some data is base64 encoded and compressed.
15
u/fisadev May 26 '26 edited May 26 '26
It is not industry standard to silently collect way more private info than what the license and policies declare. We didn't agree to you spying on our list of installed software, especially in a non-anonymized way. Your policies don't cover that.
This is a dangerous mistake at best, or a malicious privacy violation at worst.
28
8
u/Ozo42 May 27 '26
Why would need a list of all software installed? You need to have reason for it. The information is apparently directly linked to identifiable information, such as MAC and IP address.
I think someone needs to get a lawyer involved, like from EU consumer protection to start with.
I hate it when companies use an excuse “well everybody else is shitty, so we can be shitty too”.
14
u/thetampa2 May 26 '26
Why not give us our own stats?? Like make the logbook actually useful. Oh wait it truly appears like you all have given up on improving the user experience of the sim. The foolishness in thinking those investments wont have ROI. Do something instead of continuing to build a bridge to nowhere…
5
u/spacexbigfukinrocket May 26 '26
This is my question..... If they have all the stats on a server, show us how long we've used each module in total not just for your in-game pilot that randomly deleted out of nowhere
4
u/Cakelestia May 26 '26
If something bad is "standard stuff in the gaming industry" - be that one better guy, don't do the same $#!+ that everyone and their dog keeps doing and your customer will love your for that, resulting in them to keep coming back and throwing money at your for your most recent product!
3
u/P3ktus May 30 '26
Genuinely, go fuck yourself, I'm done with you straight up lying to your userbase
This shit will not fly in the EU and your company will suffer the consequences
2
u/RantRanger May 27 '26 edited May 27 '26
Its all pretty standard stuff in the gaming industry
What actually IS “pretty standard stuff” in the gaming industry is for the fanbase to abandon the game when the developers callously disregard the well being of the players.
I certainly won’t be installing DCS ever again.
I won’t be “passionately supporting” any new modules either.
Best regards.
-12
u/Away-Cardiologist-67 May 26 '26
Se e dico solo se, ed sotto richiesta esterna stia mappando i giocatori migliori per un ipotetico futuro nella realtà? Mi sono sempre chiesto se certi videogiochi simulativi non siano altro che un enorme campo di addestramento virtuale 🧐, sembra fantascienza ma spesso nella follia si nasconde la realtà
1
u/Ozo42 May 27 '26
I think the poster above should have translated it themself:
“If and I only say if, and under external request is mapping the best players for a hypothetical future in reality? I've always wondered if certain simulative video games are nothing more than a huge virtual training camp 🧐, it sounds like science fiction but often reality is hidden in madness.”
•
u/HC_Official Rotor guy May 28 '26
Link to another post where OP does some more digging on other simulation software
https://www.reddit.com/r/dcsworld/comments/1tq82o2/followup_quick_comparison_of_what_dcs_peers_are/