Slashdot Mirror
Valve Updates On Half-Life 2 Code Leak
Thanks to ShackNews for their updated report from Valve boss Gabe Newell regarding Thursday's leak of the Half-Life 2 source code. He says: "We're still finding machines internally that have been compromised" in relation to the "infiltration of our network" that led to the code leak, and warns that other developers may also be in danger: "There's anecdotal evidence that other game developers have been targeted by whoever attacked us." But he ends with a hopeful appeal to those who've been helping Valve hunt down the culprits online: "I've been fielding calls from the mainstream non-games, non-technical press all day. Hopefully they will get to report shortly what a mistake it is to piss off a whole bunch of gamers and get them hunting you around the Internet."
I hope that the folks at Valve now know that they need two machines on every desk, and two networks. If they had such an arrangement (with one of the networks COMPLETELY disconnected from the Internet) this would never have happened. A company with the money that Valve has can afford this level of redundancy. I hope Valve implements something like this now (and pretty much ANY gaming or large software facility) to prevent problems like this in the future.
The person was probably talking about bits of the Havok engine, which is used in HL2. (Although the Havok engine is actually released under the LGPL, not the GPL.) Now, before anyone starts shooting his mouth off about "stolen GPL'd code" in Half-Life 2, Valve purchased a commercial license for the Havok engine, so there's no foul play here.
From what I've read, there was apparently an initial knee-jerk reaction by some Slashdot dorks claiming that there was GPLed code in there, but a followup post by someone who wasn't retarded pointed out that the code in question was licensed under the LGPL, which allows for such uses.
You know, I really hate to say it, but I'm sorry to see the source go down (Valve says that they're asking websites to take it down -- not sure if that translates to asking or sending legal threats). I'm skimming through a copy of it that I downloaded with some interest. It's not often that you get such insight into game development (post-mortems are interesting as well, but source hasn't been neatly edited). While I doubt a commercial gaming company would ever swipe code from Valve (too much potential damage -- if there's even a 10% risk of exposure, they're better off just licensing it.) Cheating will obviously be a problem...if I were Valve, I think I'd consider significant protocol revisions.
Some people have said that Valve has included GPLed code in the Half Life 2 code. Dunno as to whether this is true, but I'd like to point out that while this is technically not kosher, I suspect that a lot of places do it -- as long as it's out by release time, I very much doubt that anyone will complain. (On the other hand, if it *isn't* out...)
This is a good example of why internal security is very important. I don't use any computers at work that don't talk to each other through encrypted connections. I maintain a single trust relationship (pubkey based, not IP based), from a machine that has a superset of the information on a second machine, so there's little point in exploiting trust relationships (plus, if superset machine A were compromised, a keygrabber could easily allow compromise of machine B anyway). I don't use Windows filesharing. These are all very easy to overlook, especially during crunch time, but as Valve has discovered, while the chances of things going sour may be low, the potential damages are enormous. I would urge folks who are working with *any* kind of important IP to do the same -- do *not* rely on Windows filesharing, do *not* use trust relationships, and do not use unencrypted connections, even on your local network. SFTP exists and there are free clients all over -- you do not have a good excuse for using FTP.
This is also another example of why it may be worthwhile to have a network admin that does regular security audits. It takes additional time, and the vast majority of time that cost is overhead, but Valve is certainly regretting not doing so at the moment. (We have irregular security audits, which is better than nothing, but obviously not ideal.)
Finally, I'd like to say "chin up" to the folks at Valve. This sort of thing can be very frusterating, and I'm sure it hasn't helped morale at Valve much, but it's not a game-killer, even if it necessitates changes in the protocol or game engine, and a release delay. Good luck -- I probably won't buy your game, since it's unlikely that there'll be a Linux client, but I expect you'll have healthy sales.
As for other folks -- remember crack.com, remember Valve -- secure your damn networks already.
May we never see th
Two machines on every desk!
They're developing a game with multiplayer internet capabilities and internet-based content delivery. How are they supposed to not connect their development machines to the internet? If they aren't to ship with networking, sure.
The code should be locked up!
Every programmer, licensee - and presumably a few hardware developers (such as ATI) - would have the code. It would be sitting in a source control database somewhere, plus probably daily backups would be taken of that database. Employees might also be allowed to take their work home with them. For example, I'm a programmer (no, not at Valve) and can connect to my work LAN using a VPN and get direct access to the SourceSafe databases for our various projects.
They're using GPL source code they've not released!
Um... newsflash: HalfLife 2 isn't out yet. Way to start bitching about something that's not happened yet. Even if it did include GPL'd code - by the GPL terms they only have to release that code when the product is for sale. If they have included such code, I'd imagine it's LGPL - and they wouldn't have to release code they've used provided they didn't change it.
Anyway... Microsoft security = some very scary shit. I thought they'd solved the autorunning-virus-in-your-email thing, but I guess not. I patched the crap out of my Windows installation today, stopped using Outlook Express, went back to Pine for email and started using Mozilla Firebird. If I could work out why KDE 3.1 keeps hanging on me under FreeBSD 5.1, I'd move in that direction.
It seems like quite a few game companies are rather lacking when it comes to security. If the code is so important then why is he reading email, with Outlook no less, on a machine with access to the code? Frankly, it sounds like Valve didn't have any kind of security policy in place and they got bit by it. Hopefully they've learned their lesson.
Looking through the code there is a directory called linux, full of makefiles and also #ifdef _LINUX switches through the code (especially in the parts using inline assembly). Whether this is just for the server or not I can't tell.
The linux makefiles work to an extent, but only after you rework some of the code. I've got to a point where there's some calculations done in asm that I can't get to compile.
If anyone has got further than that (I can compile up to studiorender/cstudiorender.cpp ) I would love to hear about it.
it's almost impossible to defend against an inside job
Not sure if this has been mentioned before, but (IT) security firms generally estimate that 80% of (computer) crime come from inside a company (a disgruntled employee, low security passwords, bribes, taking data home from work etc.). Only 20% of all attacks happen from the internet. The numbers may be a bit outdated, but I doubt they have changed significantly.
I totally agree with you. Security can never be 100%, no matter how many gimmicks or firewalls you install.
My cats ate my karma. They also wrote this comment.
These guys are smart enough to completely own Valve's computers but they're not smart enough to realize that you have to get the art, sounds, levels, and such too if you want to play Half-Life 2.
Tim
Omnia vestra castrorum habetur nobis.
I would really like to see a Linux port, is anyone working on it yet? :)
Sticking feathers up your butt does not make you a chicken - Tyler Durden
I noticed you worded your post very carefully, so I can't say anything to you directly. However, people like the ones you have described (be it you, or not) make me sick. They are stealing thousands of man hours from people who have poured their lives into this. Whether it be HL2, a movie, or MP3s. Yes, I used to download MP3s when I was a freshman in college, but I don't do it anymore because I've realized the ramifications of it. RIAA be damned, you're still taking money away from the people you claim to support.
/end rant
As for movies and games, I realize that many people download them as "demos" before going out and actually buying/watching the final product. This is no excuse. That's what demos and movie trailers are for. If that isn't enough for you, wait for reviews. You've waited four odd years already, another month won't kill you. I just find it heartbreaking that people will outright steal the blood, sweat, and tears of other human beings just to save a buck. I guess that's just one of the cons of the capitalist system. (And no, I'm not a communist, so please refrain from "In Soviet Russia, cons have capitalist system!")
Please, just think before you download stuff.
--------
This isn't the sig you're looking for. Move along.
If you'd been looking forward for most of the year to the release of one of the most hyped games ever, and then someone leaked the source code, making it pretty likely that the game's release will be pushed back several months - wouldn't you be, oh, mildly irritated?
Crackers are happy. A lot of legit hackers and coders are happy as well, because you don't get to see this sort of code every day. But gamers? Gamers don't want source code, they want the damn finished product!
Some people are acting like this is a gift from god that will force Valve to Open Source. Some are saying that it's payback for not making a Linux version. Do you guys actually believe this stuff?
Oh, as for the comments on licensing, it how much of the engine source you get depends on the licensing contract. A blanket statement like "You get it all." is erroneous.
They named the company Valve, they should expect leaks!
"There's anecdotal evidence that other game developers have been targeted by whoever attacked us."
Bad news for 3D Realms today - Duke Nukem Forever source liberated. Sadly, there wasn't that much to liberate.
Here it is, contents of dukeforever.c:
main()
{
printf("Duke Nukem Forever\n");
}