We Stopped Policing the Platforms We Trust Most

Steam’s five most-played games right now are all between five and fourteen years old. No new title has broken into that top tier in years. Meanwhile, security researchers recently found over 10,000 repositories on GitHub distributing Trojans, hiding in plain sight among millions of legitimate projects.

These two facts look unrelated. They describe the same structural problem.

Players reinforce what already won

When millions of players invest thousands of hours into a game, they build social networks, muscle memory, and sunk-cost loyalty around it. New games compete against all of that accumulated weight. Players don’t just prefer the old titles; they actively maintain the conditions that keep newcomers out. Every hour in Counter-Strike 2 or Dota 2 is an hour that raises the switching cost for the entire community.

The result: nobody displaces a decade-old game because the players themselves have made displacement prohibitively expensive.

Operators lose visibility when platforms grow

GitHub hosts hundreds of millions of repositories. At that volume, platform operators cannot manually verify what each repo contains. Attackers exploit this by naming malicious repositories after popular tools, mimicking legitimate structure, and relying on the sheer mass of content to avoid detection. The platform’s moderators face an asymmetry: every new repo is trivial to create but expensive to inspect.

Over 10,000 Trojan-distributing repos survived long enough to matter because the people responsible for policing the platform physically cannot keep pace with its growth.

Trust debt accumulates when nobody audits

Here’s the shared pattern: users and operators in both ecosystems stopped verifying their assumptions about safety. Steam players trust that the top-played list reflects quality and momentum. Developers trust that a popular-looking GitHub repo is legitimate. In both cases, people made a reasonable bet years ago and never revisited it.

Every day without re-verification adds a small increment of risk. Engineers call a similar concept “technical debt” (deferred maintenance that compounds over time). Trust debt works the same way: the longer people go without checking, the larger the gap between assumed safety and actual conditions.

Why this matters now

Platform incumbents have crossed a threshold where their own scale undermines the trust people place in them. The people running these systems face a genuine dilemma: the features that made them dominant (network density, repository volume, historical momentum) are the same features that make oversight harder.

If you build on, play on, or depend on a platform that has dominated for a decade, the uncomfortable question is simple: when did you last verify that your trust is still earned?