Valve Updates On Half-Life 2 Code Leak 119
Thanks to ShackNews for their updated report from Valve boss Gabe Newell regarding Thursday's leak of the Half-Life 2 source code. He says: "We're still finding machines internally that have been compromised" in relation to the "infiltration of our network" that led to the code leak, and warns that other developers may also be in danger: "There's anecdotal evidence that other game developers have been targeted by whoever attacked us." But he ends with a hopeful appeal to those who've been helping Valve hunt down the culprits online: "I've been fielding calls from the mainstream non-games, non-technical press all day. Hopefully they will get to report shortly what a mistake it is to piss off a whole bunch of gamers and get them hunting you around the Internet."
Two machines on every desktop (Score:3, Insightful)
Re:Two machines on every desktop (Score:1)
Okay, not the most popular view in the world, but many companies would do a lot better without the distraction of the internet. e-mail can always be put through a heavily firewalled and filtered system, but why in the world should everything else be enabled?
I hate to say this, but if I were to run a company like this, I would have a computer room where employees can chill, drink coffee or whiskey (hey, creativity comes from the strangest plac
Re:Two machines on every desktop (Score:1)
Because, generally, workers are more productive, happier and less stressed if you trust them, cut them some slack to organise themselves and don't isolate them from friends. In several situations I have encountered where the "internet only via one machine during your one 10 minute break a day" policy introduced productivity has gone down, workers have spent more time off ill and morale as a whole dropped through the floor.
Re:Two machines on every desktop (Score:3, Informative)
It all goes back to the same old crap - employers expect total, slavish obedience and loyalty but aren't willing (as a general rule) to give anything back for that. Just being able to bl
Re:Two machines on every desktop (Score:1)
This is why the parent post suggested two machines on each desk: one for email, IM, web documentation and all that, and one without internet access, but with access to internal source code and other IP. Each not accessible from the other.
E
Re:Two machines on every desktop (Score:3, Interesting)
Also, as a developer who worked for 6 months at a company without net access... it sucks. No access to online developer resources. We wrote enterprise-level backup software that ran on NT, Linux, UNIX (Solaris, Irix, HP-UX, *BSD, SCO, AIX, and a bunch of others I can't remember), Novell, OS/2, and a host of others I can't remember. Getting info from various online publications was a chore. Whenever we downloaded a
Re:Two machines on every desktop (Score:2)
I believe the poster is suggesting something like a laptop on the desk for the internet/email/public network, then having a separate development network with the huge-ass workstation for the development. Makes sense to me.
Where did it say it came because of trojans? (Score:1)
There's not enough information available externally to blame any attack vector.
yep, I do this at work - 2 separate machines (Score:1)
A mini 2-computer KVM, and I don't have to worry about compromising one network by any actions in the other.
And one a Mac (Score:2)
Some thought it was an odd idea originally but that was before the iPod and the iTunes Music Store existed. Opinions changed and the setup is popular now.
I'd agree to a point that a Linux box could also be used in a similar manner but that argument is not as strong as it used to be. Newer Macs are pretty damn nice Uni
Re:And one a Mac (Score:1)
5 years ago Pentium II 450mhz were top of the line. Those are still pretty decent machines.
Re:And one a Mac (Score:2)
The point of the Mac is that the various Windows, Outlook, and Explorer vulnerabilities are irrelevant. Apologies for my assumption that this would be obvious. Additionally, did you miss my point that you could do the same with a Linux box? I merely said we found Macs more convenient.
Re:And one a Mac (Score:1)
Re:And one a Mac (Score:2)
That's a pretty weak troll, please try harder next time. It's obvious to anyone with half a brain that if I were a Mac zealot I would not have relegated the Mac to merely email and web and referred to only the Windows box for development. A Mac zealot would have gone on at length about developing the game on a Mac for a Mac. A Mac zealot would then suggest that when the publisher pulls out a gun and forces you to do a Windows version
Re:Two machines on every desktop (Score:2)
Hardware costs nothing now. The real issue is system and network administration time.
Re:I don't see why (Score:1)
Geeze, where do YOU work, the CIA? Maybe in paranoid-spook land you consider commiting your code to memory every night and destroying all copies "common sense." However, most people don't. The assumption is if you're sitting behind your corporate firewall, you're safe. (And if the IT department is doing its job, then you are.)
The truth is, no matter how good security is, it's almost impossible to defend
Re:I don't see why (Score:1, Insightful)
Re:I don't see why (Score:1)
Damn Interweb, too complicated for me !
Re:I don't see why (Score:1)
Re:I don't see why (Score:4, Insightful)
Not sure if this has been mentioned before, but (IT) security firms generally estimate that 80% of (computer) crime come from inside a company (a disgruntled employee, low security passwords, bribes, taking data home from work etc.). Only 20% of all attacks happen from the internet. The numbers may be a bit outdated, but I doubt they have changed significantly.
I totally agree with you. Security can never be 100%, no matter how many gimmicks or firewalls you install.
Hate to say it (Score:5, Interesting)
Some people have said that Valve has included GPLed code in the Half Life 2 code. Dunno as to whether this is true, but I'd like to point out that while this is technically not kosher, I suspect that a lot of places do it -- as long as it's out by release time, I very much doubt that anyone will complain. (On the other hand, if it *isn't* out...)
This is a good example of why internal security is very important. I don't use any computers at work that don't talk to each other through encrypted connections. I maintain a single trust relationship (pubkey based, not IP based), from a machine that has a superset of the information on a second machine, so there's little point in exploiting trust relationships (plus, if superset machine A were compromised, a keygrabber could easily allow compromise of machine B anyway). I don't use Windows filesharing. These are all very easy to overlook, especially during crunch time, but as Valve has discovered, while the chances of things going sour may be low, the potential damages are enormous. I would urge folks who are working with *any* kind of important IP to do the same -- do *not* rely on Windows filesharing, do *not* use trust relationships, and do not use unencrypted connections, even on your local network. SFTP exists and there are free clients all over -- you do not have a good excuse for using FTP.
This is also another example of why it may be worthwhile to have a network admin that does regular security audits. It takes additional time, and the vast majority of time that cost is overhead, but Valve is certainly regretting not doing so at the moment. (We have irregular security audits, which is better than nothing, but obviously not ideal.)
Finally, I'd like to say "chin up" to the folks at Valve. This sort of thing can be very frusterating, and I'm sure it hasn't helped morale at Valve much, but it's not a game-killer, even if it necessitates changes in the protocol or game engine, and a release delay. Good luck -- I probably won't buy your game, since it's unlikely that there'll be a Linux client, but I expect you'll have healthy sales.
As for other folks -- remember crack.com, remember Valve -- secure your damn networks already.
Re:Hate to say it (Score:1)
Re:Hate to say it (Score:2)
Secondly, the game content -- audio, etc, would still be commercial. While I might be willing to spend time porting code of some game to Linux, if I made the extensive kind of time investment involved, I would expect content-creating members of the project to do the same -- to donate their work, so that it may be distributed freely.
Re:Hate to say it (Score:5, Informative)
They're talking about the Havok physics engine. Two things:
1. It's LGPL, not GPL
2. Valve is using the Havok physics engine under a commercial license, so it's legit.
Re:Hate to say it (Score:2)
Re:Hate to say it (Score:1)
Re:Hate to say it (Score:5, Insightful)
Seriously, I considered downloading it since I like to toy with 3d programming, and I'd love to see how the "pros" do it, but then I realized that if I were to be caught, anything I might ever want to release myself could be considered infringement in some skewed sense. So I steered clear of it even though the educational benefits would be amazing. I've looked at the quake source code, but it didn't help me much, and by now it's horribly outdated, so seeing some real, working and current, source code to something like this would be beyond incredible for me to pick apart and analyze.
I wish VALVe could open their engine up, but I definitly understand the possibility for cheating, and their obvious right to make a profit on what so far looks incredible. I won't be buying the game for the same reason as you, no Linux client, but I know for a fact they'll do well. I hope they take the time to rework portions of the code that could allow cheating since that's probably the single worst thing that can happen to a game.
Honestly though, I'm really interested in what this will do to their overall release date, since it was already delayed for reasons unknown. Or maybe the reasons are known now, since the dates were around when it was supposed to go gold...hmmmm, makes you think.
Good luck to VALVe, take this opportunity to tighten your code and fix steam, I'm tired of hearing my Windows friends complaining about it :).
Re:Hate to say it (Score:2)
True, and the act of downloading such software infringes their copyrights. However, there would be very little benefit to Valve in attempting to pursue the thousands of people that obtained the code through Slashdot alone, much less through secondary and alternate distribution. They're trying to keep websites from posting the code, but obviously it will never be eliminated.
Seriously, I considered downloading it since I like to toy with 3d pro
some stupid comments here already (Score:4, Insightful)
They're developing a game with multiplayer internet capabilities and internet-based content delivery. How are they supposed to not connect their development machines to the internet? If they aren't to ship with networking, sure.
The code should be locked up!
Every programmer, licensee - and presumably a few hardware developers (such as ATI) - would have the code. It would be sitting in a source control database somewhere, plus probably daily backups would be taken of that database. Employees might also be allowed to take their work home with them. For example, I'm a programmer (no, not at Valve) and can connect to my work LAN using a VPN and get direct access to the SourceSafe databases for our various projects.
They're using GPL source code they've not released!
Um... newsflash: HalfLife 2 isn't out yet. Way to start bitching about something that's not happened yet. Even if it did include GPL'd code - by the GPL terms they only have to release that code when the product is for sale. If they have included such code, I'd imagine it's LGPL - and they wouldn't have to release code they've used provided they didn't change it.
Anyway... Microsoft security = some very scary shit. I thought they'd solved the autorunning-virus-in-your-email thing, but I guess not. I patched the crap out of my Windows installation today, stopped using Outlook Express, went back to Pine for email and started using Mozilla Firebird. If I could work out why KDE 3.1 keeps hanging on me under FreeBSD 5.1, I'd move in that direction.
Re:some stupid comments here already (Score:2)
That's what I thought, initially, but the GPL states you need to be willing to provide the source code upon distribution of the derivated work. Distribution does not equal the game's release, actually, since they also distribute copies of the game bef
Re:some stupid comments here already (Score:2)
What is this GPLed code everybody speaks of? Quake? If so, it's probably covered by the license they had to Quake before id GPL'd it.
Re:some stupid comments here already (Score:1)
Simple - you have one lot of machines on a private LAN with no connections at all to machines directly or indirectly connected to the internet. When you build a binary that needs testing across the internet, you put the binary, data files and everything except the bleedin sourcecode on a CD, carry it across to an internet cap
Re:some stupid comments here already (Score:2)
If you're going to be that paranoid about security, but still want to keep from increasing your development time by a factor of 10 by allowing your developers access to communications, consider having a private lan with all internal machines firewalled off from internet accesss, and then either have virtual OSes in virtual machines connecting, or have an app server (Citrix or similiar) with internet connectivity.
And even that is a massive
Re:some stupid comments here already (Score:1)
What does it matter whether you are connecting to a machine across a few routers in your building (maybe one is simulating internet latency) instead of a few routers across the country? Why can't you test internet code on a LAN? It's just TCP/IP... works the same on a little network as a big one for the most part.
And the bits of the internet you can't simulate locally (not sure what that would be).. you can test later on with a binary.
Re:some stupid comments here already (Score:2)
You are suggesting a level of security and inconvience not practaced in the world except for military level government top secret agencies. Remember, they are a gaming company. Their program will require a patch in the first 1-3 months.
If you went thorugh all of this pain just to protect a potential leak in one part of your product you might as well have a secure shreeder for your print outs and remove all floppy drives/burners from all machines.
Re:some stupid comments here already (Score:1)
Re:some stupid comments here already (Score:2)
For testing, you can set up a *private* routed internet (not the Internet, an internet) that the development machines are connected to, and separate boxes for non-code activity (documentation that isn't local, down
Re:some stupid comments here already (Score:2)
Its more important that their product is stable, fun and on time rather than have a thick manual of security and procedures.
Re:some stupid comments here already (Score:2)
Well for one thing I doubt they were using Outlook Express, if they were using MS email they'd have been using Outlook, a different product, and a lot more secure out of the box (at least 2000 SP3, or 2002 versions are anyway).
Putting aside the pros and cons of MS email clients, I'm
Re:some stupid comments here already (Score:2)
Re:some stupid comments here already (Score:1)
Basically, they'd have to be using an unpatched Outlook 2000 or older to have gotten hit through that method, unless there's some big preview pane exploit no one knows about.
Anyway, it's not like Valve's ever jumped to early conclusions before, and I'd take their current explanation ('we dont know') over their previous explanation ('Outlook did it') any day.
Re:some stupid comments here already (Score:2)
I still use O2K from time to time but the distro it came from was already SR1
Re:some stupid comments here already (Score:2)
The game doesn't have to see the real live internet prior to alpha or beta testing. An internal TCP/IP LAN with generated lag and randomly dropped packets can do nicely. It's damn near required to simulate various conditions anyway.
Re:some stupid comments here already (Score:2)
Linux port (Score:5, Interesting)
The linux makefiles work to an extent, but only after you rework some of the code. I've got to a point where there's some calculations done in asm that I can't get to compile.
If anyone has got further than that (I can compile up to studiorender/cstudiorender.cpp ) I would love to hear about it.
Re:Linux port (Score:1, Informative)
Re:Linux port (Score:4, Interesting)
It took some effort, but I coaxed it into compiling and I got about 8 libraries and an executable. I had to go back and do some fixing, but after that it ran. It exited immediately after running. I stopped hacking on it after that. Anyway, it is just the server. However, it looks like the whole engine and helper libraries compile for use by the server. I'm waiting on a hint from valve as to whether they're going to get nasty about people messing with the code. I hope they take the attitude that you can't turn cheese back into milk, and adopt a noble policy wrt people messing around for curiosity's sake. If I see that I'll go further. I'd love to see just how far away a linux client is.
BTW, I'm not bragging about being 1337 or anything. It's code, I'm a programmer, I was curious. That's why I'm not posting anonymously. Don't even ask for the results, they are not available. Maybe if Valve does something cool, like releases under the Sun CL, or even the GPL (yeah right).
I've never been a Valve fan. I'm a linux user, and only a linux user. One of the priviliged few that get to use linux exclusively at home and work. That means that Valve allows me to further their cause by running a server but denies me the pleasure of playing their game. It's like they're throwing a party in my house and won't let me come.
Gabe, what do you say? Can I come to your party? I'll help out.
Matthew
Re:Linux port (Score:1)
Anybody who looks at the code is TAINTED. Any programer may claim they wont look at the code, but this code is.. well tainted to look at exectp for licensees and the developers.
I can understand kiddies looking at it, but any seasoned programmer would lose something.
Re:Linux port (Score:1)
Re:Linux port (Score:1)
There is a missing (what a suprise) resource file (cpp) needed by the material system. If you just make and empty file in its place, however, it will continue to compile happily.
After this I can compile everything except the engine and cs. (cs being dependent on the engine)
There is a missing engine header file which seems to contain a large number of the functions used in the engine.
I don't think it can be compiled much further without t
Re:Linux port (Score:2)
dont get it (Score:2)
Re:dont get it (Score:3, Informative)
Crackers are happy. A lot of legit hackers and coders are happy as well, because you don't get to see this sort of code every day. But gamers? Gamers don't want source code, they want the damn finished product!
Re:dont get it (Score:1)
Cheats possible (Score:1, Redundant)
1: Cheats become widely available. Cheat programs are made to stop them eg. punkbuster. This = good. I don't mind the supposed "bandwidth hogging" programs on cable.
2: Cheats are made but not let out for free use. This would be a small problem due to only a few l33t hax0rz having cheats. I prefer to just kill them with my handhack(tm).
3: A combination of 1 & 2.
4: Valve delays hl2 to make changes to the code. I hate to say it but I'd rather 1,2 or
Re:Cheats possible (Score:2)
So WTF (Score:3, Funny)
Tim
Re:So WTF (Score:2)
Re:So WTF (Score:2)
This is very bad news for the existing hl community. The hlds code that can run hl1 games is there for example. They can hack that to cheat.
The CD Key verification code is there. I dont think I need to comment on why that's bad.
The anti-proxy/aimbot obfuscation code is there. Most of this code could be legacy hl1 code or share common patches. This IS VERY BAD.
This isnt just bad for HL2 delay, thi
Re:So WTF (Score:2)
I think the reasoning there is, those can be extracted from a legitimate CD on release.
They can, however, now remove copy protection, generate valid CD-keys, and so on.
Not to mention, unfortunately, build some WICKED cheat programs....
Re:So WTF (Score:1)
Re:So WTF (Score:2)
This isn't a pirating attack. Pirates wouldn't bother. This is someone who for whatever reason wanted to get his hands on the code. Could be nothing more then bragging rights. Certainly the fact that the code was released immidialtly suggessts this. After all if someone had wanted to steal the code for making th
Re:So WTF (Score:1)
Linux port? (Score:3)
I would really like to see a Linux port, is anyone working on it yet? :)
Re:Linux port? (Score:1)
Not going to happen.
There might be going to be a Linux server, but I doubt you'll enjoy the gameplay on it much. The likelihood of the game itself being ported to Linux is roughly on a par with the Pope converting to Islam.
Your best bet for a Linux version is to donate vast sums of money to WineX, but frankly it'd be cheaper to grit your teeth and pick up a copy of Windows.
Some of the comments around here astound me. (Score:4, Insightful)
Oh, as for the comments on licensing, it how much of the engine source you get depends on the licensing contract. A blanket statement like "You get it all." is erroneous.
The Linux Way (Score:1, Insightful)
Ahhh yes, there's the Linux Way - If you can't make it yourself, use stolen code from Valve (the hard work of others) against the the very people whom you want on your side and blame Valve for not having perfect security instead of blaming the bastard who attacked them.
Let's see if they even give you the time of day on the next great game th
Re:The Linux Way (Score:1)
Re:The Linux Way (Score:2)
I'll admit though, I do get a kick out of the irony of it all. They chose to make their game operable only on the Windows platform, they p
piss off gamers? So what... (Score:1)
They asked for it... (Score:2, Funny)
Help! (slightly OT but I couldn't resist :) (Score:1)
Other Developers? - Uh-oh (Score:4, Funny)
Bad news for 3D Realms today - Duke Nukem Forever source liberated. Sadly, there wasn't that much to liberate.
Here it is, contents of dukeforever.c:
main()
{
printf("Duke Nukem Forever\n");
}
Too much ado about nothing (Score:2)
Taking source code home (Score:1, Interesting)
If someone stoled it or even the machines at work, all the data is unusable since to mount the dmg image on OS X you need the password. I create 4.7 DMG images to burn on DVD once a month in case of hardware failures.
This is very usefull for me and protects the company.
Re:Taking source code home (Score:1)
Re:GPL found? (Score:2, Informative)
Re:GPL found? (Score:5, Informative)
Re:GPL found? (Score:1)
Re:GPL found? (Score:2)
Re:GPL found? (Score:2)
Actually the code in question most likely was statically linked (as someone reported and as one could imagine that a 3D-game's physics system must be) and the LGPL only permits dynamic linking. So that would not save them.
But the trail leads to the Crystal Space engine as previously reported here [slashdot.org].
The code in question seems to be contributed to Crystal Space by someone working at Havok who then of course has all the rights to also license it for use in a proprietary product (Havok). This is an assumptio
Re:Oi! (Score:2, Insightful)
Re:Perhaps Valve would consider Open Source now? (Score:2)
Re:Perhaps Valve would consider Open Source now? (Score:2)
So Valve Open Source/GPL it, someone builds a game with just textures/maps/ai (which is not OpenSourced/GPL and it doesn't have to be) and then sells it with no license required from Valve.
Re:Hate to say it..... (Score:1)
Oh dear. .
As soon as the gold disc has been sent to the cd plant, it'll appear all over the net.. including your precious kazaa
Re:Hate to say it..... (Score:2, Insightful)
Re:Hate to say it..... (Score:2)