Slashdot Mirror


Half-Life 2 Delayed Following Code Leak

jhol writes "CNN is reporting that Half-Life 2 is delayed "by at least four months, that is to April 2004.", due to the code leak. VU Games has already suffered a 29% fall in revenue and an operating loss of $61.36 million this year. A Christmas release of Half-Life 2 would probably have been most welcomed." Update: 10/07 20:38 GMT by S : CNN Money are now reporting there's a newly public leak, allegedly involving a partially playable, Beta pre-release of the game.

750 comments

  1. Thanks by Anonymous Coward · · Score: 0

    Thanks very much to the person(s) who leaked the code. No Half-Life 2 for Christmas.

    1. Re:Thanks by allantan · · Score: 1

      musta been the grinch

    2. Re:Thanks by Gibble · · Score: 1

      They Killed Half-Life II. ...Those Bastards!

      (yeah yeah, it's a southpark reference)

      Seriously though, this sucks. I was looking forward to this game, it has allready had a delay and now it'll be even longer.

      Damn hackers don't even wait for the game to be released before they start ruining it for the honest folks.

      --
      Gibble: Descriptive of an emotional state in which one's mind is scrabbling for some purchase on reality
    3. Re:Thanks by Empty_One · · Score: 1

      Actually, I'm glad it's going to be delayed. It gives me more time to save up some money to upgrade my machine. It sure as hell won't play on the dinosaur of a machine I have now.

  2. Still haven't learned their lessons by Alcimedes · · Score: 3, Insightful

    I have to wonder how long until people start to realize that for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

    It would be a pain in the ass only being able to code on one machine, but even something as simple as a KVM switch would make it tolerable.

    No internet, and none of this stuff is a problem. Not to mention you can keep working while various worms/viruses make their rounds.

    The 'net is just too insecure these days, especially if you're running some version of Windows.

    1. Re:Still haven't learned their lessons by javatips · · Score: 2, Informative

      One can use VMWare to do that. All VMs can have a virtual networks which will not be accessible from the host. No need for many computers and/or physical connection.

      The folks at the NSA use VMWare for this purpose (they do have a special version with additional security features)

      I bet that they will try to enforce that kind of separation (virtual or physical) anyway. By missing the Holiday season, they will loose a bundle on sales.

    2. Re:Still haven't learned their lessons by aliens · · Score: 1

      I would think though at this stage of the game when they're testing code against Steam which is on the internet it might have been hard not to be connected to the internet for testing purposes.

      Why they were running Outlook on these machines is beyond me though. You want to check mail? Have a cheapo seperate box setup. For a company the size of Valve I can't believe they couldn't afford a couple of extra $500 Dell PC's to do this with.

      --
      -- taking over the world, we are.
    3. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Ok, so you run everything in a VM... what if the machine you are running VMWare on gets "hacked"? Or would you still be running without a network?

    4. Re:Still haven't learned their lessons by TrippTDF · · Score: 1

      If not stuck coding on one machine, at least a closed network, with no internet access. How hard can it be to have a closed network for all coding purposes? Sure, it's a pain when it comes to email and other internet needs, but in a situation like this, I think it makes sense to keep all code off-line.

      However, I am not a security expert.

    5. Re:Still haven't learned their lessons by dillon_rinker · · Score: 1, Insightful

      Ummm....why would you have SOURCE CODE on the machines you're using to test BINARIES?

    6. Re:Still haven't learned their lessons by Fnkmaster · · Score: 1
      As best as I can tell, somebody either emailed themselves a few source code files or something similar, and that's how they got compromised. There's no accounting for users being lax with system security - I just don't see how you can completely prevent stuff like this in a software development shop.


      Do you propose making software developers do their work without access to the internet? From my experience the loss in productivity would be substantial. Or maybe make them run into a "clean room" whenever they want to look something up or send an email. Jeez, sounds a bit extreme to me.


      Good security practices and user training are key, especially if you are working on high value software that you really, really don't want anybody to see the inner workings of.

    7. Re:Still haven't learned their lessons by BWJones · · Score: 1, Insightful

      I have to wonder how long until people start to realize that for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

      I have to wonder how long until people start to realize that for truly critical work, they are still using Windows?

      Seriously, the Internet is what makes many folks productive especially if they need to collaborate with others. our servers have proven invaluable for collaboration with folks from around the world so that they can write manuscripts with us or see data that we have processed for them.

      Get a Mac. One that runs OS X.

      --
      Visit Jonesblog and say hello.
    8. Re:Still haven't learned their lessons by Darren+Winsper · · Score: 1

      Eh? I highly doubt that somebody e-mailed themselves 100MB of source code.

    9. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Riiight, let's code a Windows game on a Mac. REAL smart, moron.

    10. Re:Still haven't learned their lessons by javatips · · Score: 3, Interesting
      This should not be a big problem as the VM is isolated from the host (it would take far more serious hacking, that what was done to get HL2 code, to get inside VMWare internals). One could always snif the physical ethernet card for packed, but having the VM connect through VPN to the "DEV" network would solve the problem. The host could be a barebone linux Install without any open ports. That would limit the risk of having the Host being hacked. Now you have a closed down host with two VM. One on a "private" network, and the other on "public" network.


      Having a seperate machine on a seperate physical network would be more secure, but would cost much more than the VMWare approach.

    11. Re:Still haven't learned their lessons by BrookHarty · · Score: 1

      I have to wonder how long until people start to realize that for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

      And how is this different than the developers of OpenBSD, Apache, Samba and other developers? The network might be firewalled off, but they still use Outlook, which was how these machines where cracked.

      Blame the part that failed, Microsoft Outlook. Not 1 news story stated that Microsoft Outlook just caused millions of dollars of delays? That hackers took over game developers(s) networks with microsoft outlook security holes. (Valve stated that other developers are also compromised...)

      If this was a car, and the engines exploded killing the drive, you can bet your ass that the automaker's name would be on the news.

    12. Re:Still haven't learned their lessons by javatips · · Score: 1

      Why not! One can code on one machine and test on another one!

    13. Re:Still haven't learned their lessons by Xzzy · · Score: 2, Informative

      > How hard can it be to have a closed network for all coding purposes?

      Oddly enough, as obvious as this seems, people are actually quite resistant to it. I've worked at two software development houses, and while that's not a terribly accurate representation of the entire industry, they both had the exact same attitude: "No, we don't need the dev machines on a private network, we're fine like it is.".

      At one of them, I suggested it as a solution in response to a similar situation; source got into the wrong hands. Even then they said they didn't want to do it, they preferred to rely on employee training and discipline.

      Whether it's indifference or ignorance, who knows. Common sense isn't, I guess. :p

    14. Re:Still haven't learned their lessons by Acidic_Diarrhea · · Score: 0, Troll

      Do you fail to see the difference between someone dying and a nerd not having a computer game in time for Christmas?

      --
      I hate liberals. If you are a liberal, do not reply.
    15. Re:Still haven't learned their lessons by anthony_dipierro · · Score: 1

      I have to wonder how long until people start to realize that for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

      About the same time they realize that you're best off not relying on obscurity for your security.

    16. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 1, Informative

      Bullcrap. The hacker would just have to copy out the file that is the VMWare "drive". No sweat. I'm glad you're not my security consultant...

    17. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Strange... I seem to have missed that "Compile For Windows" target in Project Builder. Can you get any dumber, or is this it?

    18. Re:Still haven't learned their lessons by Digital11 · · Score: 1

      Actually you're 100% wrong. Gabe Newell himself stated that apparently someone had trojanned his machine and stole the source code. It wasn't an inside job.

      --
      I am a leaf on the wind. Watch how I soar.
    19. Re:Still haven't learned their lessons by hoggoth · · Score: 1

      > Do you propose making software developers do their work without access to the internet? From my experience the loss in productivity would be substantial. Or maybe make them run into a "clean room" whenever they want to look something up or send an email. Jeez, sounds a bit extreme to me.

      No, how about giving your developers a second cheap email and web only desktop sitting right next to their development machine?

      Hmmm millions of dollars of software compromised vs. $500 2nd computer?

      --
      - For the complete works of Shakespeare: cat /dev/random (may take some time)
    20. Re:Still haven't learned their lessons by PainKilleR-CE · · Score: 2, Informative

      The initial interviews with Gabe Newell stated that someone had hacked their systems, installed key loggers, and so on, then had accessed the source repository from off-site, using the login information gathered from the key loggers to checkout the source tree.

      No one had to email source code anywhere. Besides, with source that size (or even smaller), it's far easier to just burn a CD and take it with you, or log in remotely and download only what you need.

      --
      -PainKilleR-[CE]
    21. Re:Still haven't learned their lessons by javatips · · Score: 1
      I don't think you a rich enough to pay for a full analysis on how to use VMWare to implement the above solution in secure way.


      While you are getting richer you can always encrypt the Virtual Disk file(s) using an encrypted file system! Now if you want to know how, just google it up or search past slashdot articles.

    22. Re:Still haven't learned their lessons by hoggoth · · Score: 1

      > And how is this different than the developers of OpenBSD, Apache, Samba and other developers? The network might be firewalled off, but they still use Outlook, which was how these machines where cracked.

      Ummm maybe it's different because every example you gave FREELY DISTRIBUTES THEIR SOURCE CODE after they are done coding it?

      --
      - For the complete works of Shakespeare: cat /dev/random (may take some time)
    23. Re:Still haven't learned their lessons by CyberGarp · · Score: 2, Interesting

      The folks at the NSA use VMWare for this purpose (they do have a special version with additional security features).

      How do you know this?

      It's known that the NSA uses VMWare, but they're very tight lipped about how. Also if a VMWare image is sitting on a disk, that's on an OS that's on the network. Doesn't that make the image just as vunerable? I guess one could encrypt it, but still I think the original idea of a KVM is far more secure. If it's not on the net, or a completely private net with no outside connection, then it can only be pilfered by sneaker net.

      --

      I used to wonder what was so holy about a silent night, now I have a child.
    24. Re:Still haven't learned their lessons by BWJones · · Score: 1

      Riiight, let's code a Windows game on a Mac. REAL smart, moron.

      And why not? I realize I should expect this sort of post from an AC, but if you did any coding at all, you might realize that core coding itself has no platform preference. Yeah sure, there are specific system calls, but much coding can be accomplished for different platforms on many other platforms. After all, algorithms and math do not care if they are running on Windows or not.

      In fact, I was sitting on a plane last year next to a guy coding for a Wintel system that was performing all of his coding in VirtualPC on a Mac. Why? I asked. His response was that virtual environments were easy to simply throw away if your root coding did something stupid. You dont have to go fishing around to try and fix problems. All you have to do is grab a fresh copy of your Wintel PC and start working again.

      --
      Visit Jonesblog and say hello.
    25. Re:Still haven't learned their lessons by PainKilleR-CE · · Score: 1

      If this was a car, and the engines exploded killing the drive, you can bet your ass that the automaker's name would be on the news.

      And if it had happened several times and the flaw had been well publicized and people still hadn't taken their cars in to get fixed?

      Yeah, it's not like this problem with Outlook is new or anything. In fact, it doesn't even exist on the current or previous (2003 & XP) versions of Outlook.

      --
      -PainKilleR-[CE]
    26. Re:Still haven't learned their lessons by javatips · · Score: 1

      This past slashdot article has some information on this.

      The KVM Approach is more secure but requires a seperate computer AND physical network connection (unless you use a switch or a hub so both computer can share the same ethernet cable on different VLAN) and cost much more than the VMWare solution.

    27. Re:Still haven't learned their lessons by badasscat · · Score: 4, Insightful

      I have to wonder how long until people start to realize that for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

      It would be a pain in the ass only being able to code on one machine, but even something as simple as a KVM switch would make it tolerable.


      Pain in the ass?? Try impossible. How do you think game programming works, anyway? One guy sitting there plugging away on his work machine from 9-5? Bzzzzt. Sorry, try again. I say this as someone who works in the industry for a fairly large publisher who will remain nameless.

      HL2 is a large, big-budget game with a lot of code, a lot of staff, and a tight production schedule. Some people seem to live in this fantasy-land where PC games are still coded by individual hackers locked away in their basement. Well, welcome to the real world, where dozens of people need to work on the same code in near real-time, and where work continues even while coders are out of the office or in fact out of the country.

      I don't know that all of this code needed to be on one machine that was net accessible. There's probably something that could have been done to segment it among separate machines on separate VPN's, which then could have been combined to compile and run whenever a build was needed. So yes, Valve could have probably taken better precautions. But the answer is not to put all of the code on a single, closed machine - that simply doesn't work in real life. The code - at least some of it at a time - needs to be net accessible for a company in the business of making games to function these days.

      It was revealed today that a third of the code was stolen, so maybe Valve actually was taking some sorts of precautions - maybe it was separated into three segments on three different machines. But that probably was not enough.

      You can look at Valve's security as a whole, and maybe you will find holes that should have been plugged, but simply saying "the code should not have been net accessible!" is just not realistic.

    28. Re:Still haven't learned their lessons by Bios_Hakr · · Score: 2, Insightful

      A KVM is a recipe for screw-ups. Take a hint from the military. Have one open network and one closed network. The closed networks have no CD-R/RW, floppy, or other removable media. The closed network is clearly marked as closed. The closed boxen are then physicaly seperated from the public network.

      Having a KVM would only be acceptable if the login script set your desktop background to a bright orange/red bitmap and a one-minute screensaver. You never know when some tool will forget what machine he is on. Having seperate monitors and keyboards can be a pain, but it's well worth it to prevent code leaks.

      --
      I'd rather you do it wrong, than for me to have to do it at all.
    29. Re:Still haven't learned their lessons by Oddly_Drac · · Score: 1

      "And how is this different than the developers of OpenBSD, Apache, Samba and other developers?"

      They're open source, and it's not considered the end of the world if you see theirs.

      Valve's implementations of engines, physics, etc would be the selling points 'behind the scenes' so to speak. That is if the leaked source is usable and not around simply for bragging rights.

      I think 2003/2004 will be remembered as the years that the gaming industry went 'dirty' though....

      Doom 3 and Half Life 2 do seem to be going head to head at the moment...hmm.

      --
      Oddly Draconis
      Too cynical to live, too stubborn to die.
    30. Re:Still haven't learned their lessons by Kpau · · Score: 2, Insightful

      The last 2 places I've worked, every developer had TWO machines. The "development" machine was on a physically isolated network and the "office box" was the one with Internet access, email, etc. It didn't stop sneaker-net issues, but it sure stopped those little port buzzes and tickles from outside. ...and woe unto the developer that ever mixed the two. I used to do Cold War era work in the 80s... the procedures to keep delicate things isolated did not require any rocket science (outside of the frequency-isolating chickenwire that enveloped the work area). I will say as a consultant, I'm never too amazed at the LACK of prudent and simple precautions taken for critical operations at many businesses.

    31. Re:Still haven't learned their lessons by Compenguin · · Score: 1

      Even better check mail on a Unix machine. All the professers at my school do that and even the developers of _Win_amp do thier mail from a unix box.

    32. Re:Still haven't learned their lessons by Oddly_Drac · · Score: 1

      "Having a KVM would only be acceptable if the login script set your desktop background to a bright orange/red bitmap and a one-minute screensaver."

      A variation on the same idea is something I use for Putty sessions; local servers use orange on purple.

      Try forgetting which server you're on for that colour combination...

      --
      Oddly Draconis
      Too cynical to live, too stubborn to die.
    33. Re:Still haven't learned their lessons by RabidOverYou · · Score: 2, Insightful

      Funny how you use "100% wrong" and "apparently" in the same sentence. Gabe has no clue how he got owned. Outlook buffer overflow - pfah! Could have been the creepy-looking new hire.

    34. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      not saying it's not a good idea or anything...

      but saying just $500 for a computer without looking at all the costs is ridiculous..

      let's say you can get a computer for $500 from some major computer vendor (since businesses want the "service", "support", and warranty)...take that times the number of employees, figure in a higher electric bill, wages/time wasted setting up the second computers and wiring them to a network, oh and if you go the closed network route for the dev machines figure in costs for routers and whatever other equipment you need.....your net profits go from millions to maybe just thousands..

      again, not a bad idea but not as cost effective vs. good training/IT guys that know thier stuff and can setup a decent firewall/keep shit patched....hey newell download the patch for OE for christ's sake!

    35. Re:Still haven't learned their lessons by sqlrob · · Score: 3, Insightful

      And VMWare doesn't emulate 3D hardware worth crap. How is a cutting edge 3D game supposed to be developed with that?

    36. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      I have to wonder how long until people start to realize that for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

      Or for starters, get a good firewall, antivirus and don't use outlook. Yes, an outlook vulnerability played a role in this.

    37. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Actually, it's pretty standard to have the source code and a full development environment on most of your test machines. That way, if a tester trips a hard to reproduce bug, a developer can sit down and check out the problem at their station. Some problems are just impossible to track down unless you can poke around the memory of the crashed program. You can include symbols in the build to see the names, but that doesn't help when you're trying to trace through the logic back from the fault. It's just really nice to have the code on hand.

    38. Re:Still haven't learned their lessons by AxelTorvalds · · Score: 1

      Proxy firewall? Anyone?

    39. Re:Still haven't learned their lessons by xanadu-xtroot.com · · Score: 1

      No internet, and none of this stuff is a problem.

      Really? Are you suggesting NO ONE in the company might want to play it at home and either
      A) Want to let some friends check it out
      B) Get his/her computer "hacked"

      Most of network problems come from the inside, not the outside. (not saying that you shouldn't protect yourself from the internet, but...)

      --
      I'm not a prophet or a stone-age man,
      I'm just a mortal with potential of a super man.
    40. Re:Still haven't learned their lessons by LurkerXXX · · Score: 1

      So, if one machine has IE, Outlook, and other general use stuff, and the other computer has your nice programming IDE and all your source code, how exactly is the source code going to jump across to the other machine through the KVM? Silly. At worst you'd type in a username/password on the wrong machine inadvertently and some keylogger on the internet box would grab it. As long as the Source-code machines are on a private network not connected to the internet, you are fine.

    41. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      So it's fine that Valve was compromised just because they have "a lot of code, a lot of staff, and a tight production schedule"? I now know why you don't work anywhere close to a security related position. Yes this could have been prevented. No matter what the requirements of developers mock networks and dynamic security measurements could have avoided this "hack" no matter what platform they happen to be running on. First of all, nobody that has any security in mind should think of securing their work at the operating system level on an M$ platform. It is just plain too easy to get administrator privledges. What you need to do in a situation as critical as this is make everyone blatently responsible down to the switch port they were connected to down to the minute. It's relatively trivial today with protocols such as 802.1x, AAA, VLAN's and the like. If everyone is accountable for "everything" then user awareness of the value of the product they are working with goes up. If user "joeblow" snags code off the network and it's leaked to the 'net then "joeblow" is responsible for the millions of dollar in loss. Although I doubt at Valve the leak was on purpose (as only the developers are going to take a loss in a situation like this) then whomever implemented their network, at every layer, did a horrible job. A hardened network is not an unusable network. It's just usable for only what it needs to be.

    42. Re:Still haven't learned their lessons by rikkards · · Score: 2, Interesting

      Actually I believe the author of X-Plane does all of his development work on a mac and prefers it to a PC. I think that would be a good example of being able to do it successfully.

    43. Re:Still haven't learned their lessons by mark_lybarger · · Score: 1

      the point is that software manufacturers should be held accountable for defects in their product the same as any other industry. even the serivce industy gets their arse sued when they fsck up. imagine a doctor giving you a release form that says he's not responsible for any accidents which may happen during surgery? imagine a lawyer saying he's not responsible for any of his actions their representation. currently, only those with "malicious intent" are liable in the software industry and that means crackers.

      though the shoe would have to fit the other foot too. i wonder who's going to be accountable for defects in the linux kernel? how about sendmail ;)?

    44. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      All of what you said above has absoltuely no relivance to what the parent said. Development machines should be seperate from ones accessing the internet. That does not mean that they cannot be networked, nor does it mean there cannot be a VPN gateway. The two are not mutualy exclusive.

      No one expects them to be like the CIA. But the fact of the matter is that Valve cut corners on security and they are paying for cutting corners.

    45. Re:Still haven't learned their lessons by crucini · · Score: 1

      Good point. However, I don't think the weird colors will remedy the security problem. Couldn't an attacker break into the net-connected machine and give it the same weird colors?

    46. Re:Still haven't learned their lessons by lpp · · Score: 1

      Trollin', trollin', trollin'.
      Keep them posters trollin'.
      Trollin', trollin', trollin'!
      Troll Hide!

      Okay, I'll bite. How about Metrowerks? Allows you to cross compile to your choice of targets including OS X and Windows. Granted, their media libraries might not be cross platform, but then again, maybe they are? BioWare was able to use cross platform libraries for a Win/Lin/OSX (say it out loud and it sounds like a cheer) multi platform release.

      Project Builder isn't the only option on OS X.

    47. Re:Still haven't learned their lessons by gorfie · · Score: 4, Insightful

      I agree that Valve should not be blamed for allowing the code to reside on a machine connected to the Net. Having the code reside on a local machine (or local network of machines) that does not have Internet access is an impractical idea.

      However, I think Valve shares some of the responsibility on other aspects. The unpatched Outlook (perhaps even the use of Outlook) is definitely a problem area for such a high profile organization. If they neglected to patch Outlook, what other basic security issues were neglected by Valve? Perhaps it was something as simple as Gabe using his home computer which he left unpatched, but that's something that network admins should be aware of IMO.

      I also think Valve's staff is vulnerable to social engineering. Take a quick peek at myg0t.com (skip the intro and turn off the music) and read about the various chats that were had with Valve personnel. Really simple stuff that worked.

      My point: Valve should be aware that they are high profile and they should have at least taken measures to make themselves secure against basic hacking methods.

    48. Re:Still haven't learned their lessons by GooRoo · · Score: 3, Insightful

      Ummm... I don't think he was suggesting that you take the machines off a network, just the internet. You could quite easily have an internal network with machines/servers/other devices for development of the game by a multitude of people and a external network for machines that have internet access.

      I setup all my test networks that way, Valve could certainly do the same. Sure it can be a pain, but it's the only way to go when you *really* want something secure.

    49. Re:Still haven't learned their lessons by Mysticalfruit · · Score: 1

      It's really simple. You setup a completely isolated development network on it's own non internet connected lan. Even put a mail server on your little internet so people can email one another.

      Yeah, it'll cost a few bucks to setup, but weighted against what your losses might be through a loss of IP, it's trivial.

      Have your little italy have everything. Connect everything via gigE, put a couple nice fast build servers out there.

      Then, when you're ready to mint a copy of the game, you do a final build and burn a CD with only binaries on it.

      Say some third party buys a copy of the code. Burn them a DVD and put the thing in the mail!

      --
      Yes Francis, the world has gone crazy.
    50. Re:Still haven't learned their lessons by aeoo · · Score: 1

      Then someone brings a laptop or VPNs into the network with an infected machine...

      As we discussed recently, firewalls are nice, but they're not all that (unless you can whitelist the allowed nic IDs, that might work against casual users).

    51. Re:Still haven't learned their lessons by BrookHarty · · Score: 1

      And how is this different than the developers of OpenBSD, Apache, Samba and other developers? The network might be firewalled off, but they still use Outlook, which was how these machines where cracked.

      Ok, how about Oracle, Informix, Nortel, Ericsson, Lucent, ATT, IBM. You think developers sit in little bubbles with laptops without email? How many do you think run some sort of MS Exchange server with outlook clients? Look how many get viruses/trojans before the anti-virus companies have new definition files, happens ALL THE TIME.

      So, point again. Outlook was the way they got into the machines, the hackers didn't touch machines directly because of a firewall.

      AND BTW, opensource software cvs sites have been compromised too. Craclers could alter a makefile to put a backdoor in, cvs commit it... oh wait, its already happened to opensource projects.

    52. Re:Still haven't learned their lessons by WalletBoy · · Score: 1
      It was revealed today that a third of the code was stolen, so maybe Valve actually was taking some sorts of precautions - maybe it was separated into three segments on three different machines.

      The three machines contained the Source Code of Power, the Source Code of Wisdom, and the Source Code of Courage respectively.

    53. Re:Still haven't learned their lessons by gukin · · Score: 1

      It IS possible, think about Los Alamos, Livermore or any site. You have a completely separate LAN that your secure stuff lives on and you have a LAN that connects to the Internet. It's really not that damn hard, if you have to move stuff over, you use removable media or do it across VERY special equipment.

      There are LOTS of examples of places which have reasonable security (think about the recipe for froot loops, you won't find THAT on the Internet.)

      It sucks that Valve's code got hoarked, it sucks that we'll have to wait for the game, it sucks that they didn't take proper precautions; now it's a lesson to the rest of the industry.

    54. Re:Still haven't learned their lessons by Acidic_Diarrhea · · Score: 1
      I realize the point of the post. My point was that comparing theft to the death of a person is trite and a foolish way to go about proving the point that software manufacturers should be held accountable.

      Now, the theft was due to a vulnerability in Outlook that Microsoft has since released a patch for. How do you want MS held responsible? If you expect and demand that all software that is released to be completely secure, you will bring about the end of commercial software.

      --
      I hate liberals. If you are a liberal, do not reply.
    55. Re:Still haven't learned their lessons by mrwonka · · Score: 1

      The Code 'not being accessible' is very realistic. There are many places that have offline networks for coding and separate insecure locations to browse the web. Some even go as far as to not allow you to bring in storage devices or storage media into the secure networked areas.

    56. Re:Still haven't learned their lessons by BrookHarty · · Score: 1

      My point is, its not the hack, ITS THE METHOD...

      MS Outlook is how they got cracked, the same could happen to Opensource developers, passwords stolen to put trojans in the CVS trees. And btw, makefile and other backdoors have already made it into linux distros, bsd distros, and major server applications.

      Unplugging the computer isnt the solution, people need to communicate. Fix the METHOD that people are getting hacked.

      99% of most developers are on the net, or have some sort of net access...

    57. Re:Still haven't learned their lessons by LiquidCoooled · · Score: 1

      I dont mind them developing on beefy desktop machines connected on the standard office LAN - makes everybodies lives easier.

      What I dont understand is:

      How the fuck they can run an unpatched outlook - possibly on more than one machine.

      Christ, these are tech folks at the sharp end of the wedge, designing software thats uncheatable.

      They should operate using *COMMON SENSE* and follow logical advice, heck its the same advice we tell our Aunts n Parents:

      *UPDATE YOUR SYSTEM*

      --
      liqbase :: faster than paper
    58. Re:Still haven't learned their lessons by Dark+Lord+Seth · · Score: 0, Flamebait
      Blah blah big-budget yadda yadda tight production schedule bleh bleh real-time blah blah VPN's

      Let me guess, you work at Electronic Arts? That's the only place where they will let someone from marketing touch a PC with actual code on it...

    59. Re:Still haven't learned their lessons by redog · · Score: 1

      I think the code should not have been INTERNET accessable.

      Can you say 61.36 million?!
      Thats alot even to a company the size of M$.
      29% fall in revenue!!
      How many coders can they keep now?

      Im sure the first to get cut will be those "out of the office or in fact out of the country."

      I think for code as valuable as HL2's a development network not accessable to the internet makes alot of sence. If you have more then one development team, build more then one development network.

      Colaboration times could be scheduled and internet conectivity could be introduced at the drop of a dime.
      No need to leave it accessable for hackers to bang on it for months at a time.

      Simply put poor security model.(Thank M$ & Valves proud SysAdmin, I bet he gets the cut too).

    60. Re:Still haven't learned their lessons by Digital11 · · Score: 1

      Funny how you use "the same sentence" to denote two phrases seperated by a period. You have no clue how to read. Correct grammatical useage - pfah! Could you please go back to 5th grade?

      --
      I am a leaf on the wind. Watch how I soar.
    61. Re:Still haven't learned their lessons by bman08 · · Score: 2, Insightful

      Could you use VMWare for outlook and the internet while the "real" os is only connected internally?

    62. Re:Still haven't learned their lessons by Phil+Wilkins · · Score: 1

      *cough* BULLSHIT *cough*

      Someone has no fucking clue how teams develop code.

    63. Re:Still haven't learned their lessons by ComputerSlicer23 · · Score: 2, Insightful
      Run the network enabled system under the VM? The VM can't access the underlying system (or shouldn't be able to). You want to search the web looking for the best AI algorithm for capture the flag, do it under the VM. You want to build and test the software? Do it under the real machine.

      Kirby

    64. Re:Still haven't learned their lessons by Fnkmaster · · Score: 1

      Sorry, that's what CNN reported. Don't blame me if the CNN writers are talking out of their asses.

    65. Re:Still haven't learned their lessons by Fnkmaster · · Score: 1
      Hey, I never claimed to have any magical inside information - I just read the CNN article, which was pretty frigging vague. In any case, the point still stands that the grandparent post's suggestion that software developers should do without email/internet access and write code in a sterile cleanroom environment seems somewhat misguided.


      Obviously there are top secret, high sensitivity government projects that justify extreme level of secrecy and protection for the code involved (and the massive expense and effort that goes along with it), but I don't know of any normal software development shop that would do a basic cost/benefit on this and determine that isolation is the solution to the problem.

    66. Re:Still haven't learned their lessons by RollingThunder · · Score: 2, Insightful

      You know, it is possible to have a network not connected to the Internet.

      Now, if you want to allow the programmers to work from home, etc, then you do end up re-opening the system, but there's no driving business reason that it must be that way - especially since the result of a screwup can be this drastic!

      I'm a closed beta tester for a game that shall remain anonymous. I was discussing the Valve situation with one of the devs in the test server, and he explained their strict "no source on net-accessible machines". Any access from the dev boxes out goes through application level proxies, such that no system ever talks direct to the outside world. It's always dev box to proxy, then proxy to the outside world.

      Now, I can see a couple ways around that. If they can proxy through to the web, so can my keylogger/malware installer, for starters... but at least the intention is there.

    67. Re:Still haven't learned their lessons by blincoln · · Score: 1

      I seriously doubt that a game developer would be willing to put up with the massive performance loss of using VMWare. We've got it here where I work (for app development, not gaming), and it's incredibly slow.

      --
      "...always new atoms but always doing the same dance, remembering what the dance was yesterday." -Richard Feynman
    68. Re:Still haven't learned their lessons by mark_lybarger · · Score: 1

      in the same way the the Ford motor company "should have known" that the tires it used on the SUVs were known to have major defects and cause the vehicles to crash, Microsoft should have known that such an exploit were available in its software. the software industry needs QA practices that identifies these type of exploits. and yes, software companies that "should have known" and exploit existed when it released a product should be held accountable. patches are not the answer anymore, and does no better job than a recall (good day to use that word ;) ).

    69. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0
      Hmm, I like VMWare's non-persistant disk feature a bit better than that. Set it to ask on shutdown, and you can commit the changelog if you wish, but most often I just discard the changelog as all the save files are not on the VM. The actual state of Windows and applications needn't change from session to session.

      VMWare is also a good deal faster than VirtualPC. So really it would seem to make more sense to use a Linux machine with Windows VMs if you wanted to go that route.

    70. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      What do you do for a living?

    71. Re:Still haven't learned their lessons by Syncdata · · Score: 1

      If this was a car, and the engines exploded killing the drive, you can bet your ass that the automaker's name would be on the news.
      If, however, a product recall (patch) were instituted buy the car company to replace the engine part, and the person simply did not take his car to the dealership, the auto company would not be liable for damages.
      Outlook is not the only piece of software, nor the only email client with security holes. Valve played fast and loose with their own security, and they got hit by it.
      It's not the car companys fault if sudden deceleration causes you to explode through the windshield, because you were not wearing the seatbelt.

      --
      "Inattention makes clowns of us all" -Bean
    72. Re:Still haven't learned their lessons by Slime-dogg · · Score: 1

      heh heh. That's funny.

      --
      You need to restart your computer. Hold down the Power button for several seconds or press the Restart button.
    73. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      its just laziness. why the fuck should the developer have 2 machines at his desk and have 2x the number of admins for the developers boxen ?

    74. Re:Still haven't learned their lessons by lp_bugman · · Score: 1

      In my opinion the safest solution is to have a private network. conected to the internet with a very restricted firewall. ej (only allow Web Cache "squid").

      Allow email but remove ANY attachmens comming IN or OUT (this in case a smart boy find's cool to mail something from inside the building)

      Giving google access to developers is good because It let's them check news and consult global resources.

      --
      BSD licensed software can't be stolen....
    75. Re:Still haven't learned their lessons by Jeff+DeMaagd · · Score: 1

      It really depends on whether they need to allow off-site access.

      What the US Navy does is keeps two separate networks on its ships. One network has the non-critical stuff and has internet access, the other network is supposed to be secure and does not have internet access. Some desktops have two computers on it to keep this sort of separation so that sensitive systems are less likely to be hacked.

      Another problem is that it sounds like they used Outlook and without fixing its security settings. Outlook can be set to not execute code on reading a message.

    76. Re:Still haven't learned their lessons by Le+Marteau · · Score: 1

      Ummm....why would you have SOURCE CODE on the machines you're using to test BINARIES?

      Ummm.... because in order to use a debugger and view program execution (e.g. 'step through' the program), you need the source code?

      --
      Mod down people who tell people how to mod in their sigs
    77. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      I doubt most OpenBSD, Apache, or Samba developers use Outlook, simply because most of the programming effort probably happens on Unixish systems, and *ta-dum* Outlook doesn't run on Unix. And considering what compromise-phobes the OpenBSD folks are, they probably ban any of their main developers from using Outlook, period.

      Of course, you do have to consider the point that if an open source developer gets compromised, we're not exactly talking about the theft of millions of dollars worth of source code (think about it). Furthermore, the possibility that anyone would be able to slip in malicious code that would be undetected in the long term would be remote (as it would be for a commercial development scheme, provided they keep adequate backups for comparison purposes and do an adequate source review after the intrusion is detected).

    78. Re:Still haven't learned their lessons by FiloEleven · · Score: 1

      trojanned his machine and stole the source code.

      Ah, methinks you mean pirated.

      =)

    79. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      It does make it rather hard to quickly Google for an algorithm or code sample or something, though.

    80. Re:Still haven't learned their lessons by thisisjoex · · Score: 1

      Wow, I wish I had mod points to slam you down. Talk about going off without thinking. I understood what the poster was trying to say (of course, I've worked at more "secure" facilities) and you seemed to miss the point entirely going off on your "nobody understands game development" rant. You need two networks -- physically and completely seperate. Put your development machines on a seperate net along with the source control servers and content servers. The only problem this generates is for artists to bring source material from internet sources onto the game production network. However you can easily create some pipeline to do the work, e.g. have the artist burn the images to cd and then hand carry them over and installed via a special machine (which does a good job of virus checking on the material). If the artist is only using the material for drawing reference then it doesn't even need to be transferred over to the secure network.

      If the code/art isn't connected to an external network it can't be stolen...

      This also means no working remotely, however, for a large chunk of us in this industry we can't anyway (you need your consoles devkits to develop and you don't have those at home).

      If you must allow remote development then you can have a much less secure solution using good vpn security (with physical devices -- e.g. RSA's SecureID solution), and no other network aware stuff on the secure network (i.e. no email, no file transfer -- just a tight firewall that only allows the VPN and only through one gateway machine with tight access control). This isn't a good solution because then your code and content is on a lot of external uncontrollable machines... At that point you might want to not use the VPN and go for laptops that you make unable to hook to any network but yours (how you do that, I leave as an exercise to the reader).

      make sense now?

    81. Re:Still haven't learned their lessons by Sinistar2k · · Score: 2, Informative

      VMware might be great for general coding work. But what if you want to actually test something you've written? Good luck getting VMware to run your advanced 3D engine that requires a hardware accelerator (hint: it won't).

    82. Re:Still haven't learned their lessons by racermd · · Score: 3, Insightful

      Good point. The developers can, to a certain extent, make demands regarding their development environment. However, network security is totally in the hands of their IS/IT department, if they even have one. It's the responsibility of the IS/IT staff to maintain the computing environment everyone works in. That applies to developers, the CEO, marketing, even the secretary. The head of IS/IT must set balanced policies regarding access and security. Access should be granted on an as-needed basis, not on an as-wanted-by-CEO basis (like some companies I've worked for). [RANT]I've never understood the reasoning behind the CEO or other major department heads getting unrestricted access to everything. The people that are most visible in the company, and thus the biggest targets, are these department heads. Often, these are the same people that don't even understand the technology they've been given access to, which makes them just that more dangerous to the security and integrity of the network. I try to point out that they should have just as much access as they need to do their job, and that usually means less than their own secretary.[/RANT]

      If it were me, I would have mandated a separate firewalled subnet for the developers systems and done away with Exchange/Outlook company-wide in favor of a more stable mail server. It wouldn't be completely out of the question to maintain a second mail server just for the developers inside their subnet. An enterprise-grade network-enabled virus scanning package would have been installed at the primary switch on both networks. Accessibility from the outside, including from the other subnet used by the general office staff, would be restricted to what would be absolutly required. These connections, once enabled, would be monitored and restricted to certain times of day. I'd even go so far as to implement a one-time password system with rotating keys.

      With just these simple policies in place, connectivity to the outside from within is maintained, virii and trojans are dealt with (mitigated to reasonable extent, anyway), and the biggest external threats are those with the "absolutly required" access to the developer subnet from outside. It wouldn't have been totally secured against outside traffic, obviously, but the traffic that would come through should be easier to manage and detect. If it were an inside job, as some have speculated on due to lack of faith in the accounting of events Gabe provided, this would have been easier to detect, as well. Covering one's tracks is much more difficult to do if everything is separated and monitored more closely than the general traffic. Sneakernet is the only method that I have not addressed, and I can't see any reason to do anything about it. The developers would be the only staff that have regular physical access to the project's systems, so "outsiders" accessibility would be almost out of the question, assuming that the building has adequate access controls (i.e. card keys active for only certain times of day). And securing it any further would be tipping the balance of security/accessibility too far.

      Also note that I'm not saying that what happened at Valve could have been prevented. A determined individual could still bypass the security measures outlined above with enough time and resources, but it would be much harder to do so. As an IS/IT manager, the focus is more on balancing security with accessibility. If the code were completely secured to outside access, development time and costs increase to the point where, possibly, it would make no business sense to even develop the game.

      --
      My sources are unreliable, but their information is fascinating. -- Ashleigh Brilliant
    83. Re:Still haven't learned their lessons by tantlerur · · Score: 1

      Perhaps this poster did not know that Doom and Quake where originally written on a NeXT workstation. Indeed, I actually played Doom on my old NeXT *before* I played it on my Windows PC.

    84. Re:Still haven't learned their lessons by helmutjd · · Score: 2, Informative

      Why is this modded up? You do realize that VMware images can be copied to another machine running another copy of VMware, and booted without further effort, right? So all it would take is for someone to compromise the host machine. A thief wouldn't need to compromise the virtual machine or sniff packets; he could just download the VM's disk image from the host machine and boot it at his leisure on his own machine.

    85. Re:Still haven't learned their lessons by pdp10 · · Score: 1

      I run a small IT company, even for a $150 project we do not connect the dev boxes to the boxes connect to the Internet. This is easy business decision that does not affect production in any way. Can't really believe that Value let this happen, sounds more like this gives them a good excuse for ATI to delay release.

    86. Re:Still haven't learned their lessons by danila · · Score: 1

      That's irrelevant. Although the journalists and Valve claim that the code was "stolen", that's fucking nonsense. It was copied. I don't see the reason why they have to delay and this article doesn't tell about that either.

      A third of the source code was stolen... it forces us to delay the launch of the game by at least four months ... Just the time to rewrite parts of the game.

      What a load of claptrap! It's not like the hacker phisically stole the lines of code from the server and they are no longer there. :) My guess would be that Valve still has the code (they make backups, don't they) and the reasons to delay the game are completely unrelated to the incident.

      Yeah, sure, the security is important, but I still haven't heard a strong argument why this code leak is bad for Valve (other than a slightly higher cheating risk due to code exposure).

      --
      Future Wiki -- If you don't think about the future, you cannot have one.
    87. Re:Still haven't learned their lessons by Avatar889 · · Score: 1

      You still haven't learned your lesson...

      Haven't you read Mitnick's book? Hacking into computers is too time consuming and risky. All $75.13 that I have in my bank account says that the code was leaked by somebody who works there. Or somebody who had access to media laying around the office (i.e. cleaning people, guards) I'm sure Valve has adequate protection from Internet hackers, and I would highly doubt they are dumb enough to have source code on a machine that is directly hooked up to the Internet, with no firewall, and folders shared. Catch my drift?

      Such a large majority of "hacking" and "pirating" (see MPAA on wanting to crack down on 'screeners') happens from the inside and just takes a little grunt work and connections.

      --
      Nullum magnum ingenium sine mixtura dementia (There is no great genius without a mixture of madness) - Aristotle
    88. Re:Still haven't learned their lessons by fredrik70 · · Score: 1

      sorry, how would having the code residing on a computer without internet access been impractical?

      --
      if (!signature) { throw std::runtime_error("No sig!"); }
    89. Re:Still haven't learned their lessons by rodgster · · Score: 1

      Ah....
      I believe the guy meant that the coding/testing/gaming machines should be on a physically separate network. One that is NOT connected to the internet. My understanding is that the defense agencies use this approach. IT'S CALLED PHYSICAL ISOLATION!

      It is a pain, but depending on your situation, worth the trouble.

      --
      Who will guard the guards?
    90. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      "Giving google access to developers is good because It let's them check news and consult global resources."

      Actually I find it distracts me :) But then, I can't possible be working 10 hours straight...

    91. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Hey look! Another moron who hasn't read *either* article..

    92. Re:Still haven't learned their lessons by Mysticalfruit · · Score: 1

      But see, that would be the case. There wouldn't be any casual users.

      You'd still have your corporate network and all that good stuff. But you then have a seperate isolated DEV net and you'd have someone in charge of white listing all the hardware that gets attached to it.

      I understand that the measures are strict and might cramp the styles of some programmers. Oh well. Getting a pink slip because they checked out the whole tree onto their laptop, went home, connected their unpatched laptop to their cable modem, only to have it rooted and all the code stolen will seriously cramp their style!

      --
      Yes Francis, the world has gone crazy.
    93. Re:Still haven't learned their lessons by onelin · · Score: 1

      Right. I fault the coders for using that damn preview pane in Outlook. EVERYONE doing any kind of coding should be savvy enough to know about that...best to avoid it all together, as I do now with Mozilla.

    94. Re:Still haven't learned their lessons by Cecil · · Score: 1

      It would be a pain in the ass only being able to code on one machine, but even something as simple as a KVM switch would make it tolerable.

      That's stupid. Try working in a world with real deadlines and real programmers. Idealism has its place, but that place does not involve shouting down others because they don't practice things in the "proper" way, and that is the cause of all their ills, despite the fact that it would cause massive outlay of cash and prevents only very unlikely problems in the first place (how many game developers are there? how many have had their entire source tree compromised by an outsider and stolen? insider attacks don't really count for the purposes of this discussion)

      Perhaps they should consider replacing Outlook, on the other hand. It's banned on our company network, for good reason. Our firewall protects us from most outside attacks. The only thing that can get in without someone having to go out and download it intentionally is e-mail.

    95. Re:Still haven't learned their lessons by DAldredge · · Score: 1

      Forget? Damn, I would be blind in about 3.2 seconds. :->

    96. Re:Still haven't learned their lessons by Erwos · · Score: 1

      Actually, there are very valid possible reasons:

      First one: they stole the code which validates the keys. Once they figure out the valid keyspace (rwhich equires maybe 10 real CD keys), they can crank out keys all day with a keygen. Valve has to recall all boxes and rewrite the key algorithm. Theoretically, this could take a while.

      That's one theory, anyways. Not sure why it would delay the game by 4 months.

      The other theory is that their network protocol was using some sort of "security through obscurity" trick, and now needs to be totally rewritten. But, even that doesn't strike me as needing 4 months. Weird.

      -Erwos

      --
      Plausible conjecture should not be misrepresented as proof positive.
    97. Re:Still haven't learned their lessons by BrookHarty · · Score: 1

      If, however, a product recall (patch) were instituted buy the car company to replace the engine part, and the person simply did not take his car to the dealership, the auto company would not be liable for damages.
      Outlook is not the only piece of software, nor the only email client with security holes. Valve played fast and loose with their own security, and they got hit by it.


      There someone goes again, saying Valve played fast and loose with their own security. Nobody said they didn't have the basic precautions with their PC's, anti-virus, windows update, firewall. The software they used, Microsoft Outlook wasn't patched.

      It's not the car companys fault if sudden deceleration causes you to explode through the windshield, because you were not wearing the seatbelt.

      How protected does a company need? Do you need to lock everything down to keycard access, DMZ'ed computers, DNA access codes, congress permission to turn on a computer...

      They took basic Microsoft updates, anti-virus and a firewall. The patch might of been out, but somehow it didn't make it to the PCs in question. It would be completely different, IF they just put their pc's on a DSL line sitting on the Internet, without any protection, bare to the world. This wasnt the case.

      While valve could of used more security, they didnt leave the door unlocked. Stop blaming the victim, Not everyone knows kung-fu and owns an ak-47.

    98. Re:Still haven't learned their lessons by damiam · · Score: 1

      In order to access the Internet, VMWare would have to go through the "real" os, which would have to have internet connectivity. It would be about as secure as running something in a chroot jail or under user-mode Linux - better than usual, but not perfect.

      --
      It's hard to be religious when certain people are never incinerated by bolts of lightning.
    99. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      I LOVE YOU

      --
      !!!!RKZ!!!!

    100. Re:Still haven't learned their lessons by DredPirateRoberts · · Score: 1

      HL2 is a large, big-budget game with a lot of code, a lot of staff, and a tight production schedule.

      I agree with your comment except for the "tight production schedule" bit.

      --
      "All animals are created equal, but some animals are more equal than others." - George Orwell
    101. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      You fuckwit. A computer costs $400-4000. This is a tiny amount for a large scale software development.

    102. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      While valve could of used more security, they didnt leave the door unlocked. Stop blaming the victim, Not everyone knows kung-fu and owns an ak-47.
      I don't expect everyone to know IT kung fu. I do expect the IT department to. I also expect the management to place such an important project for their company under a Manhattan project style security profile. If outlook was installed on the machines holding source code at all, let alone missing patches, people weren't doing their jobs.
      What this situation all boils down to is an very important software release was compromised because security allowed intrusion.
      You say "They were following reasonable security policy"
      I say, obviously they weren't. If they had, they wouldn't have their product floating around in the wild.

    103. Re:Still haven't learned their lessons by gte910h · · Score: 1

      But the answer is not to put all of the code on a single, closed machine - that simply doesn't work in real life.

      However, it could EASILY be put on a closed network that's phsyically disconnected from the internet. The US government does this all the time, as do its contractors who handle sensitive data. Then put a few internet accessble terminals in the office not attached to the lan, and you have quite a workable system, one that I've worked in time after time.

      The software industry as a whole doesn't take IP security very seriously. This is another instance of that lax attiude. It is COMPLETELY realistic to say "the code should not have been net accessible!"

      --Michael


      http://www.itworld.com/AppDev/1310/ITW0202nsa/

      --
      Want to see every step I took to start my company? http://www.rowdylabs.com/blogs/pitchtothegods
    104. Re:Still haven't learned their lessons by Martin+Blank · · Score: 2, Insightful

      I've seen this in developers at four different companies. Just because they can write code doesn't mean they keep up to date on their patches. A lot of developers barely know how to power on their systems, let alone when to go looking for patches. It's low priority.

      --
      You can never go home again... but I guess you can shop there.
    105. Re:Still haven't learned their lessons by Ian+Wolf · · Score: 1

      You are completely correct, but I will add one wrinkle. In many software companies, development is a profit maker and IT is a cost center. As a result, what the developers want they get and the IT guys are told to go pound sand.

      --
      "The words of the prophets are written on the Slashdot walls."
    106. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      > Do you propose making software developers do their work without access to the internet? From my experience the loss in productivity would be substantial.

      Really? what experience would that be? Where I currently work, the majority of development is done inside classified development environments. Somehow they manage to develop multi-million dollar applications without net access.

    107. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Weeeeeeaaaak.

    108. Re:Still haven't learned their lessons by Fnkmaster · · Score: 1
      See my other comment in this thread. I realize this is possible, but it does reduce productivity, and it does cost more money to develop software this way. Which is fine for classified government projects, but doesn't fly in most parts of the business world. Specifically, most projects are done on a tight budget as it is, and more importantly, are done with insanely short development timelines.


      If you go out and drop on an existing development team that they will have to give up the net access they've become so used to for looking up API documentation, posting questions to message boards, email around the office or with others outside the office (or for after working-hours conversations about work related topics), or make them go through extraordinary steps to get to the same information, productivity will drop substantially.


      My experience here comes from managing teams ranging from 2 to 20 people in size working on projects with budgets ranging from tens of thousands to several million dollars, just FYI - and specifically, remembering back to several occasions where our internet access went down unexpectedly for a day or two, and seeing productivity drop massively as people floundered around trying to get work done.

    109. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Dude, your statement was torn to shreds, and you reply by pointing out a grammatical error. What a cop-out. Welcome to my foes list.

    110. Re:Still haven't learned their lessons by ball-lightning · · Score: 1

      Lets say someone picks the lock on my front door and steals one million dollars out of my house (hey, its hypothetical here). Who's fault is it? The tires on the Ford SUVs caused the SUVs to crash, it was an actual defect. In a perfect world, unpatched Outlook works just fine. If Aunt Mildred, for example; e-mails me a cookie recipe or something, my computer is not automatically compromised. Outlook is not secure, but the fact remains that someone did this to Valve, on purpose. This wasn't an accident, it was a planned, deliberate attack. Sure the software could (should) have been better, but that doesn't mean the people who did this shouldn't be the ones whom the blame is placed upon.

    111. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Even Armored cars get robbed by professionals.

    112. Re:Still haven't learned their lessons by Michael+Spencer+Jr. · · Score: 1

      Why is THIS modded up?

      How do you compromise the host machine if you can only interact with one of the two virtual machines? The host machine wouldn't even bother to act on the IP datagrams inside ethernet packets going to or from either VM -- it would just forward the raw ethernet frames. Unless you know of some way to compromise a host when the host is ignoring your packets...

    113. Re:Still haven't learned their lessons by Goldberg's+Pants · · Score: 1

      Any company worth a dime in software development should NOT UNDER ANY CIRCUMSTANCES be running that KNOWN security risk we call Outlook. I mean really, running Outlook on a machine with sensitive data on is the equivalent of leaving a gun laying on the counter in a bank. Sooner or later, somebody will pick the gun up and use it. It's not IF, it's WHEN. There is *NO EXCUSE WHATSOEVER* for running Outlook other than it's the lazy thing to do. Why the fuck weren't they using Pegasus Mail? Or Eudora? Because they were stupid.

      They got 0wn3d. They deserved it for their stupidity.

    114. Re:Still haven't learned their lessons by Digital11 · · Score: 1

      Hey, use some common sense. Lets think about this for a second. Hmm, if I'm going to own a computer that I have physical access to, I'd probably just write a custom trojan and execute it. Someone who works at Valve would probably not have too terribly hard of a time getting access to the source w/o infecting Gabe's machine. Why the heck would someone bother going through the trouble of exploiting a vulnerability in a mail client on someone else's computer? Short answer: They wouldn't. And my reply was not a cop-out. I was responding to a stupid rebuttal of my previous statement that was both grammatically incorrect and made no sense. Since when does saying someone is 100% wrong and apparently in the same sentence contradict?

      apparent adj.
      Readily seen; visible.
      Readily understood; clear or obvious.

      My statement was not torn to shreds, it wasn't even properly rebutted.
      Gabe DOES have a clue how he got owned, he knows it was by a trojan specifically targetted at Valve, most likely custom written. They know that a keystroke recorder was installed on several machines, apparently a customized version of RemoteAnywhere. Thats another issue, if it was an inside job there'd be no reason whatsoever to install a remote control software.

      I'm glad to be on your foes list, someone with your lack of intelligence (or guts obviously since you're posting as an AC mr. OwnedByTwoCats) who is so quick to open your mouth so as to prove your foolishness is not someone I would want to be friends with. Good day.

      --
      I am a leaf on the wind. Watch how I soar.
    115. Re:Still haven't learned their lessons by aliens · · Score: 1

      Was the exploit using a known hole in outlook? Or is this a new unpatched hole that they learned of themselves?

      I don't think the release was entirely clear.

      --
      -- taking over the world, we are.
    116. Re:Still haven't learned their lessons by LiquidCoooled · · Score: 2, Informative

      He said they speculate that it was done via a buffer overflow in Outlook's preview pane. .

      At least a couple of years old if I remember correctly.

      --
      liqbase :: faster than paper
    117. Re:Still haven't learned their lessons by LiquidCoooled · · Score: 1

      Yes I agree, they expect their machines to simply work.

      Either way, its a damn shame the release date has been wound back.
      Sounds more like final tweaking turned up more than a little hiccup ;)

      --
      liqbase :: faster than paper
    118. Re:Still haven't learned their lessons by duffbeer703 · · Score: 1

      Oh yeah, it's nonsense...

      Who knows what tidbits were left in the code. I imagine Valve will be spending many hours auditing that code for trojans or backdoors.

      Only someone living in Slashdot fantasy land would think for a second that a compromised development project in a wide open network is NOT a bad thing.

      Would you now trust any code that came from Valve?

      --
      Conformity is the jailer of freedom and enemy of growth. -JFK
    119. Re:Still haven't learned their lessons by markz · · Score: 1

      I disagree. Not completely, but come on! Why the hell are you reading email on a machine that has the source? If you can't completely isolate the dev network, you can at least make sure it doesn't have dual(+) functionality to add to the exploitable possibilities.

    120. Re:Still haven't learned their lessons by Assembler · · Score: 1

      I think what you meant to say (at least I *hope* you meant to say) is that you could do your internet browsing inside the virtual machine.

      Remember: the virtual machine client has little/no access to the host computer. The host computer has full access to the virtual machine.

      Regardless, if you're really into security, you know that VMWare has had its share of holes too. (That's why I said 'little/no access')

    121. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      The funds within armored cars are insured. Half life 2 is a total loss.

    122. Re:Still haven't learned their lessons by Diag · · Score: 1

      Yeah, my initial thought when this news broke was "Who would do this? Who would have the most to gain from it?" (other than bragging rights).

      Valve's competition maybe.

      --
      Serving Suggestion: Defrost
    123. Re:Still haven't learned their lessons by EpsCylonB · · Score: 1

      I think it was gabe newell's laptop that was running outlook, we don't know what mail client is used internally.

    124. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      Typical, you forgot 3) Appearing as such but not necessarily so; seeming. Try not to create illusions in the future. You're fucking flat wrong, still. Also your fucking logic that it wasn't an insider job because an insider would mostlikely already have source access is flawed. Like you, maybe the perp inside did all of this so eyes are shifted elsewhere, creating the illusion that it was this or that from the outside.

    125. Re:Still haven't learned their lessons by Anonymous Coward · · Score: 0

      I LOVE to TYPE in ALL CAPS to get my POINT across TOO. I thought I was the ONLY one!

    126. Re:Still haven't learned their lessons by aeoo · · Score: 1

      Yea, I agree, as long as they don't share their network with the rest of the company. I think most companies are too lazy and lack the inhouse experience to set this up, even if they aren't too lazy. And game companies are really no exception.

      If a game company should set this up to protect their IP, shouldn't then almost any company that develops source code? Yes, right? It should be the same for all companies that have IP to protect.

      Yet this is not happening, and Valve, is really, just another, boring, unsexy company. It's not special in any way, other than it makes a game that many people happen to like. But so what. I'm sure once you got inside Valve (or whatever parent entity that controls it) you'd be facing same old corp BS (even if they aren't incorporated), same attitudes, same general atmosphere.

      So, maybe Valve is going to learn its lesson and create just such a network (I doubt it). Here is five bucks saying that other game companies seeing this will do nothing (and never mind non-game companies).

      Hindsight is always 20/20 right?

    127. Re:Still haven't learned their lessons by WNight · · Score: 1

      The code that verifies CD-keys has two parts. There's in in-game stuff which is pretty simple. Correct number of digits, totals to an even multiple of 31337, or something. Just enough to catch people who incorrectly enter the key. Then, the real check happens on their keyservers. You try to log into a game and your client sends your encrypted key to the keyserver, which decrypts the key, checks it, and tells the server to let you play, or to kick you out.

      The keyserver doesn't use a fancy algorithm, it simply looks up the key in a list of every key they've shipped. No fancy math, nothing. But, almost impossible to hack because you need to guess a real key, not simply fool an algorithm you can watch with a debugger.

    128. Re:Still haven't learned their lessons by WNight · · Score: 1

      It's not often you can cut and paste working code from googling on the net, at best it'll use different variable names. You pretty much need to rewrite everything anyways, so not being able to paste from the net isn't much of a pain. (And anything larger than a few lines that you download is probably a library you'll want to have added to the main project.)

    129. Re:Still haven't learned their lessons by Goldberg's+Pants · · Score: 1

      You're NOT!

      It's called adding emphasis. Look it up.

    130. Re:Still haven't learned their lessons by j-turkey · · Score: 1
      ...I've never understood the reasoning behind the CEO or other major department heads getting unrestricted access to everything.

      I completely agree with your analysis of how it should be. However, when the President, CEO, COO, or CFO wants something from an employee (or a group in their organization) -- you'd better believe that they're going to get it. These are the folks that hired you and/or your boss -- they sign your paychecks, and they can really easily fire your ass and hire someone else who will comply with their requests. You can write all the policy you want, but there's not all that much that they have to do to trump that.

      That being said, I'm not sure that the default policy for most companies is to give senior managers total access. Now, in a smaller business environment, it makes complete sense to give higher levels of access to senior/executive level managers because they need to be more hands-on -- and most small tech startups seem to have executives with backgrounds that are more tech-oriented than management (completely subjective obersvation). How large of an operation is Valve? (I really don't know -- that wasn't rhetorical). I'm guessing that they can't be more than 30 or so people. It might make sense for them to grant access rights to their CEO.

      I don't really know -- but the point is that each orginazation is different, and I'm not sure that there is "the way". Just different ideas on how to balance security with usability. I guess that the folks at Valve will need to re-evaluate this.

      Now will someone tell me why a code leak sets them back 4 months? Why do they have to re-code that? It's not like their CVS tree was corrupted. I've gotta be missing something obvious here.

      --turkey
      --

      -Turkey

    131. Re:Still haven't learned their lessons by racermd · · Score: 1

      Yeah, I know. That's not always how things are done, but it can be reasonably pointed out (even to a non-techie) that an additional point of access to a system is less secure than just not letting them have access to it in the first place. Obviously, compromises can be made regarding times of day, certain directories/files, etc., but in no way should senior management automatically be entitled to unrestricted access just because they're "the boss(es)". The IS/IT security policies apply to everyone, not just the lowest people on the corporate org-chart. If there's a reason for access to be granted, then by all means make it so. A hole is a hole is a hole, boss or otherwise, and holes should be kept to a minimum. Not that I'm ranting or anything... Any reasonable boss should agree when you put it in terms of cost of convenience. They're always dealing with how much things cost to the company and should understand your point when rationalized as a "cost".

      As for how the stolen code set Valve back 4 months, I'm not completely sure. I can make a few edjumakated guesses, though:
      1: They're going through a code-review looking for any changes made by the suspect.
      2: They're cleaning out any trace of the trojans/worms/backdoors that the suspect put onto any systems that are used for development and/or testing, possibly leading to #1, as well. With development systems down prior to the code being completed/tweaked, additional time is required for systems/services to be restored so that coding work may continue as before. Test systems are probably cloned (think Norton Ghost or Virtual PC) so as to test new builds on fresh systems without having to deal with the full install process, and would be easy to restore to pre-breach configurations. Certainly not 4 months worth of work.

      I'm sure there are more possibilities, and I may be nowhere on target. We're on their schedule for release no matter what the circumstances, and I'm sure we'll get a detailed report after any sort of investigation has been completed (possibly another cause of the delay). All I know for sure is that I'm really looking forward to the release date, whenever that might be.

      --
      My sources are unreliable, but their information is fascinating. -- Ashleigh Brilliant
  3. Delayed anyways? by kneecarrot · · Score: 5, Interesting

    I just have to wonder if a serious delay was in the works anyway and the code theft gave Valve a publicly acceptable reason.

    --

    I always save my last mod point to mod up a good troll. You people are too serious.

    1. Re:Delayed anyways? by dotwaffle · · Score: 1

      Publically acceptable reason? WHAT? Explain that one to me! "We've been compromised, so we're going to wait and see what happens, and let our software get old."

    2. Re:Delayed anyways? by kneecarrot · · Score: 1

      Publicly acceptable because it was somewhat beyond their capacity to prevent (yes yes, poor security, but still) and not a result of bad project management.

      --

      I always save my last mod point to mod up a good troll. You people are too serious.

    3. Re:Delayed anyways? by vierja · · Score: 0
      I certainly agree... 4 months looks much more than the time they have lost trying to find and patch the hole(s) that let the hacker(s) in.

      Unless, of course, they need this time to close the bugs that would have let cheats work...

    4. Re:Delayed anyways? by Tebriel · · Score: 1

      Yup. About sums it up.

      --
      The Blaster Master Fighting for Truth, Justice, and Evil Pie since 1979
    5. Re:Delayed anyways? by gl4ss · · Score: 1

      probably.

      the code leak shouldn't affect the consumer experience in too many ways(hell, maybe just bad online play) anyways, since it's (for me) a primarily a single player experience. and as it was 'supposed' to be in stores by now i take it as a ~6 month delay more like, which makes you wonder what the f were they thinking 2 months ago thinking they could release it by now? now there is going to be doom3 around before them by the looks of it, heck, if they pull it again then to migrate to doom3 engine they could be just in the same limbo with hl2 they've always been. but as long as you can get community to enhance your earlier products to sell enough of the old, old products you don't need a new product, right?

      (and any copyprotection on it would have been cracked anyways, source or no source)

      --
      world was created 5 seconds before this post as it is.
    6. Re:Delayed anyways? by Anthracks · · Score: 1
      Why do you assume they're just going to be sitting around? From the article:
      "It's serious because it forces us to delay the launch of the game by at least four months, that is to April 2004. Just the time to rewrite parts of the game."
      They're probably scrambling to change how various multiplayer features work so their game isn't absolutely unplayable due to hacks and cheats on release.
      --
      Rock over London, Rock on Chicago. Wheaties: Breakfast of Champions.
    7. Re:Delayed anyways? by shird · · Score: 5, Interesting

      Yes I think this is the case. I have taken a look at the code, and I can say there is a hell of a lot of 'TODO:/BUG:' stuff in there. I'm no expert, but I would say it seemed a long way off being complete. Not to mention all the artwork, levels, scripts etc that may or may not exist in very complete form.

      As for ease for creating keygens, take a look at the code - it makes an external reference to a 'cdkeycheck()' function (cdkey.obj) in which there is even comments to the effect that they (valve) don't have the source code. In other words, they have outsourced the key verification algorithm, so it doesn't exist in the source tree. (either is the cdkey.obj file).

      --
      I.O.U One Sig.
    8. Re:Delayed anyways? by TaliesinWI · · Score: 1

      Took the words out of my mouth, my man.

    9. Re:Delayed anyways? by Anonymous Coward · · Score: 0

      I have been wondering the same thing, but I don't think it's too likely.

      When the code was leaked to the entire world, I assumed the craxxors did it partly out of frustration at the announcement of a delay of unspecified length. But I kinda doubt Valve was really planning to miss Christmas 2003 before this leak came out. Their announcement definitely left the possibility open, but you'd think they'd release before the end of 2003 if they possibly could (without making the game suck).

      The people who leaked the code are probably feeling mighty stupid right about now. But who knows how someone like that thinks.

    10. Re:Delayed anyways? by EinarH · · Score: 1
      Well, the scheduled 31. September release was of course way to early. Medium November was far more likely as release date.

      Valve is known for not managing to meet the deadlines. All of the Counterstrike versions from 1.3 came 2-6 months later than the official schedule. (dig around at csnation for proof)

      So Half-Life 2 with a real release date somewhere between 30. November and 30. March was (IMO) far more likely.

      --

      Melius mori in libertate quam vivere in servitute.

    11. Re:Delayed anyways? by gl4ss · · Score: 1

      newsflash, they're telling this to keep the community from jumping on to other vendors and not feeling screwed over how they got lied the game was almost ready, first they delay it and tell it's because they want to polish it up and 'add extra something maybe to mp' and then they delay it _extra_ 4 months? it's not like they've had hype up their ass and then backed out quietly before(remember steam, the original steam, announcements?)

      seriously, i can't see any reason why they would need to rewrite the parts _totally_ again(and fuck, they're professionals, they've done the design and concepts already once it's not such a big deal to actually rewrite the code, but you end up with the same concepts being done again so if there is something fundamentally wrong with it they've been actually screwed from day 1) to prevent some aimbots that intercept the engines internal messages or some other totally crazy cheats, that could get invented anyways, obscurity is not a way into securing your online game if you want it to be secure. heck, if you want it to be really what it is you do everything you can on the server side and have it so that no matter what info comes the client it can be trusted as good playing(ok, this approach closes out some genres being feasible with todays tech though).

      moreover, IT'S A SINGLE PLAYER GAME mainly. and fuck, some id's games can be played pretty decently still on public servers when the source has been out for years.

      --
      world was created 5 seconds before this post as it is.
    12. Re:Delayed anyways? by cK-Gunslinger · · Score: 2, Insightful

      Makes sense. There is really no reason to release the game as early as last month or even December. They really have no competition (next-gen FPS) other than Doom3, which won't show up until late next year. On top of that, they are just slightly too advanced for the current hardware out there. I mean, it appears that top-of-line hardware is required to even play the game at an acceptable rate. $400 dollars vid cards should never be *required* for a game. And don't think nVidia isn't heavily involved, either.

      This is all marketing. The truth is, HL2 will have a better market 6 months down the road than in December. There will be more hype and more people woul can afford the HW to play it.

    13. Re:Delayed anyways? by Anonymous Coward · · Score: 0

      You might be right. Other screenshots in that directory. They are apparently from the subsequently leaked beta of the game.

      My personal opinion: this sucks. I don't see how anyone can doubt that this kind of criminal intrusion rates a jail sentence of 1-2 years plus a heavy fine.

      The act was deliberate, quite clearly illegal, and had a real cost of millions of dollars, plus inconvenience to millions of people.

    14. Re:Delayed anyways? by Anonymous Coward · · Score: 0

      That is what I was thinking. Now they can blame it on someone other than themselves. Who knows, maybe the leak was staged as well ;)

    15. Re:Delayed anyways? by subgeek · · Score: 2, Insightful

      maybe online play doesn't matter to you, but i'd say that online play matters a LOT to most gamers. if not "most" it is certainly safe to classify it as "millions."

      they've been working on this for 5 years. it's easy to say how long YOU think it should take them to rewrite parts that were stolen. you don't have to rewrite it. you don't even know what it is they have to re-implement.

      anyway, we still haven't heard from valve. before we re-invent all of their intentions, why don't we read what valve has to say about this?

      --
      you probably shouldn't have read this.
    16. Re:Delayed anyways? by Ender77 · · Score: 1

      On the Code part, it was mentioned that the code that was stolen was a earlier version that was kept on the machine and was not the current one they were working on.

    17. Re:Delayed anyways? by PainKilleR-CE · · Score: 3, Insightful

      moreover, IT'S A SINGLE PLAYER GAME mainly. and fuck, some id's games can be played pretty decently still on public servers when the source has been out for years

      No one would still be playing Half-Life if it was selling for single player only (that being said, it's sold about 140x as many copies as there have been people playing it online).

      As for id's games, Quake was completely pointless to play after the source was released. It may be significantly better now, after people have spent years working on anti-cheat software for the game, but for the year after release you couldn't join a game without at least one person using a blatantly hacked client, and who knows how many others using more subtle cheats. I didn't even bother trying Quake 2 after the source release, as I was already playing TFC (and by that time dealing with cheaters there, too).

      That being said, I can only see the source release being a fairly minor delay, depending on how heavily Steam and the CD key verification need to be rewritten. For the rest of their code, they just need to be extra careful in reviewing their code for exploits, as now they have plenty of other eyes looking for anything that might be missed in the final code, and probably at least a dozen little utilities being developed to scan the HL2 binaries for anything found in that code.

      --
      -PainKilleR-[CE]
    18. Re:Delayed anyways? by arivanov · · Score: 0, Troll

      In other words it is delayed because the entire world has understood how halfbaked it is.

      With the code out there any reviewer can do a quick search for the TODO/BUGS and reproduce the condition.

      As a result if they release it without fixing them they will get slaughtered.

      So IMO:

      1. The leak may be deliberate as a publicity stunt which gives them a chance to delay it despite investor pressure.

      2. They intended to do as some other game companies have done in the past and ship utter bogus buggy crap.

      Dunno which of these is the case. But it is either.

      --
      Baker's Law: Misery no longer loves company. Nowadays it insists on it
      http://www.sigsegv.cx/
    19. Re:Delayed anyways? by DarkSarin · · Score: 1

      yah, but I don't believe they needed a reason. Blizzard, by comparison, is NEVER on time with their releases, and no one can reasonably claim that they do poorly. It is just as easy to argue that the anticipation factor actually increases sales (aka Star Wars). What people do with the game after purchase is totally different though.

      --
      "We don't know what we are doing, but we are doing it very carefully,..." Wherry, R.J. Personnel Psychology (1995)
    20. Re:Delayed anyways? by Anonymous Coward · · Score: 0

      If there really was a theft, wouldn't they tell it to the FBI. Don't you think?

    21. Re:Delayed anyways? by Anonymous Coward · · Score: 0

      You're funny. You talk like almost every software product on the planet isn't in a similar state.

      WinXP was shipped with over 65,000 bugs, and it probably stopped there because that's the max number of lines Excel will support.

      Every version of linux, even small version number increases, have very long changelogs full of bug fixes.

      That's the nature of the beast.

    22. Re:Delayed anyways? by xanadu-xtroot.com · · Score: 1

      I just have to wonder if a serious delay was in the works anyway

      Doom3 is due out about the same time, right? Hmmm...

      --
      I'm not a prophet or a stone-age man,
      I'm just a mortal with potential of a super man.
    23. Re:Delayed anyways? by Overly+Critical+Guy · · Score: 1

      newsflash, they're telling this to keep the community from jumping on to other vendors and not feeling screwed over how they got lied the game was almost ready, first they delay it and tell it's because they want to polish it up and 'add extra something maybe to mp' and then they delay it _extra_ 4 months? it's not like they've had hype up their ass and then backed out quietly before(remember steam, the original steam, announcements?)

      First off, learn to write English correctly.

      Second, the hack happened on the 11th. The delay was announced later that month.

      You do the math.

      --
      "Sufferin' succotash."
    24. Re:Delayed anyways? by Jugalator · · Score: 2, Insightful

      You are apparently not a programmer.

      *Most* released software has known bugs in it, but is released when the software is in a good enough state.

      Quake 1's QuakeC API code had lots of TODO's and even comments like "Oooh really ugly hack coming up!" in the code. Yet, Quake 1 *was* released and *was* a huge success. And even the unpatched version was very playable and of release-quality.

      The same goes for Doom's later released source code, etc, etc...

      So, once again, pretty much all released software has bugs. Nothing wrong with that. The problem is if the software has obvious glaring bugs, but a simple TODO/BUG entry won't tell you that.

      --
      Beware: In C++, your friends can see your privates!
    25. Re:Delayed anyways? by gl4ss · · Score: 1

      they would've have gotten it done years ago weren't it for the continuing sales of hl1 through counter strike. now, online play matters only if it exists or there is some serious good game in it, hl1's online play by itself wasn't that special and tf-c didn't get that many followers either, but counter strike struck it big and could just as easily be happened to be made for quake2 in which case valve would have been out of zillions of hl1 cdkeys sold(ok the point being here that hl1 online play did hardly matter to anyone, useless online play in a single player game doesn't matter that much since there are other games out there that cater that deparment pretty well, however killer online play could keep them in money for years and maybe that's what they are hoping for, but then they are stupid in attempting to marry the two games together).

      what i(and many others) are saying is that it doesn't matter all that much that the code is compromised. if the online game is seriously good then the players will govern the servers themselfs to somewhat acceptable levels of play(kicking cheaters or people they don't trust and act fishy) and the cd check for single play or whatever system they had in place for that would have been compromised 24hours after the groups got hold of the binary. most cheat writers use disassemblers anyways.

      --
      world was created 5 seconds before this post as it is.
    26. Re:Delayed anyways? by Anonymous Coward · · Score: 0
      I mean, it appears that top-of-line hardware is required to even play the game at an acceptable rate. $400 dollars vid cards should never be *required* for a game.

      I'm tired of this argument about a game needing top-of-the-line hardware to run well. Using that logic, everyone should drive a Geo because there are people who can't afford a Viper. I'm sorry, but it doesn't work like that. It basically comes down to this:

      - Games are not a necessity
      - If you don't have the hardware to play a game, then don't buy it
      - Do like anything else you can't afford right away and save the money to upgrade

      Yes, everyone would like for their current hardware to run the latest games at the best possible framerates. However, in order for developers to truly break out of the bonds of hardware limitations, you have to set some baseline.

      You remember folks bitching about Quake 2 requiring hardware acceleration to get the images seen on the box? You're not going to get that with a software renderer. The only good software renderer I've ever seen was in the original Unreal, but even then you had to sacrifice something for decent performance.

      Upgrading to play a game with good image quality and decent speed should not be held with such contempt. The economy is in the toilet right now, and I know it's difficult to find the rationalization to spend money on entertainment products. But if you can't afford it, don't complain about it. It's not like this is price-gouging on something critical, like water.
    27. Re:Delayed anyways? by billo · · Score: 1

      Yeah, this is a big joke. There's no legitimate reason why release of source code would cause a slip in schedule or necessitate rewriting anything. The only exception would be small sections of code needed for obfuscation/securing/anti-piracy stuff, and that would be trivially easy to alter assuming there was a halfway decent architecture in place to begin with.

      I'm totally bummed out, I was really looking forward to HL2.

      Duke Nukem Forever, anyone? :-(

    28. Re:Delayed anyways? by gl4ss · · Score: 1

      **No one would still be playing Half-Life if it was selling for single player only (that being said, it's sold about 140x as many copies as there have been people playing it online)**

      well, i haven't known anybody to play half-life online too much, ever. they play counter strike which (conviently for valve, and very luckily for them as well) happened to born as an addon for half-life(well, i never knew too many people who played tfc when compared to the hordes that play cs, and kept half-life selling for years after the usual shelf life of a pc game).

      anyways, it would be stupid(bad business) for them to not release the game if it's ready for the xmas sales, if they're really planning on releasing it in april. in my book it just goes back to the same category with dn-forever now, someday if ever(they like the dnf crew have had enough time to do the thing totally from scratch couple of times already between their periodical hyping up of the press).
      -

      --
      world was created 5 seconds before this post as it is.
    29. Re:Delayed anyways? by buddha42 · · Score: 1
      there is a hell of a lot of 'TODO:/BUG:' stuff in there. I'm no expert, but I would say it seemed a long way off being complete.

      Y'ever played counterstrike, or for that matter dealt with Steam?

    30. Re:Delayed anyways? by stuartkahler · · Score: 1

      HL1 is still on the shelves after about 5 years. I think they want to get HL2 to market ASAP so they can ride it's sales as long as possible. Today's top-of-the-line is simply mid-range in 6 months. It's really nice for people to have a great new game to pick up when they're blowing $1200 on a new computer.

    31. Re:Delayed anyways? by Goyuix · · Score: 1

      To add in a dash of consipiracy theory... Why couldn't it be somehow tied back to nVidia (perhaps a friend of an employee) who did the hacking - Really nVidia stands to benefit more from this delay that anyone else - it totally hoses the launch deal with ATI (which will be renegotiated, but still hurts) as well as gives them time to get the next gen hardware out as well as the Det 50's nicely polished.

    32. Re:Delayed anyways? by devnull17 · · Score: 1

      I'd guess it serves a second purpose. Gabe Newell has previously asked for help from the community in helping to track down the people responsible for the leak. If you believe that the break-in caused a four month delay, then the perpetrator has hurt not only Valve but the millions of people eagerly awaiting the game. My guess is that they hope the desire for retribution will encourage people to perhaps be more forthcoming with information about the cracker.

      As for security in the network portion of the code, if it were well-designed to begin with, its security would be dependent upon a key and not the secrecy of the encryption algorithm. I highly doubt that's the cause of a four-month delay, and I doubt even more that a publisher would see that as justification for missing the holiday shopping season.

    33. Re:Delayed anyways? by ManoMarks · · Score: 1

      The hacker didn't get in through the security hole in Half-Life 2, but rather through a hole in Outlook. Patching that hole is like patching a sieve, but is also besides the point. The problem is that if a hacker could get in and take the code, that person could also modify the code to put in backdoors. If you have to review the entire 1/3 of the code that was stolen, and also try to figure out if the rest of the code was compromised, then I say take all the time you need. I've seen the movies of HL2 and I'll tell you it's well worth the wait. I'd say Valve is doing the responsible thing. Go Valve! _____

      --

      That's gotta fit into your schema somewhere

    34. Re:Delayed anyways? by wshwe · · Score: 1

      Valve compounds a bad situation by delaying HL2 by 4 long months. I can sympathize a little with their stolen code plight, but have absolutely no sympathy for the crappy 4 month delay. Valve demonstrates their ineptitude again.

    35. Re:Delayed anyways? by sklib · · Score: 1

      You're not right about top-of-the-line hardware being required. They have shader code for several tiers of programmable hardware, from geforce3-equivalent cards all the way up to today's radeons.

      --
      -S
    36. Re:Delayed anyways? by startled · · Score: 1

      "Yes I think this is the case. I have taken a look at the code, and I can say there is a hell of a lot of 'TODO:/BUG:' stuff in there. I'm no expert"

      Software is never released when there are still TODOs, FIXMEs, HACKs, and BUGs in the comments. Oh, no. We look at every line and make sure it's absolutely perfect in the leisurely months of free time leading up to release.

    37. Re:Delayed anyways? by startled · · Score: 1

      "I just have to wonder if a serious delay was in the works anyway and the code theft gave Valve a publicly acceptable reason."

      Right. They could say "the game has been delayed". Or they could involve the FBI in a fabricated code theft story, and hope they don't get thrown in federal themselves.

      I haven't seen this many ridiculous conspiracy theories since the JFK assassination convention was in town.

    38. Re:Delayed anyways? by palp · · Score: 1

      I wish I had mod points for you, cause this is a damn good point. If in fact the hacker had access to 'live' code at any point, they could have planeted backdoors into the code, and this is something that could take them months to find.

      --
      -palp
    39. Re:Delayed anyways? by kneecarrot · · Score: 1

      Read what I said carefully. I never made the claim that Valve fabricated anything. I merely pointed out that the code theft provided a convenience to them.

      --

      I always save my last mod point to mod up a good troll. You people are too serious.

    40. Re:Delayed anyways? by Natchswing · · Score: 1
      Maybe this time they'll use some sort of copy protection that won't fail for most people who buy the game.

      Isn't the original Half Life famous for being unable to detect the original CD in *most* computers, thus requiring a patch the day you buy the game before you can ever play it?

    41. Re:Delayed anyways? by PainKilleR-CE · · Score: 1

      well, i haven't known anybody to play half-life online too much, ever. they play counter strike which (conviently for valve, and very luckily for them as well) happened to born as an addon for half-life

      It doesn't matter which mod they're playing, it's still Half-Life. CS regularly has some 50-60K users online (or at least last time I looked), but the game itself sold about 7 million copies in the US.

      (well, i never knew too many people who played tfc when compared to the hordes that play cs, and kept half-life selling for years after the usual shelf life of a pc game).

      To each their own, I only play CS at LAN parties, and haven't been to one of those in about 2 years. Of course it keeps the game selling much longer, though, even if people are only buying a replacement copy for the extra CD Key or to keep from having to download the patches.

      It is bad for the game not to ship in time for XMas, but there are many cases where games missed the date and still did very well. It would be significantly worse in terms of mod development and long-term sales if the multiplayer portion was easily hacked and cheaters ran rampant. The original Half-Life was remarkably resistant to this problem for quite a while, despite having the largest multiplayer FPS fan-base (even before CS).

      --
      -PainKilleR-[CE]
    42. Re:Delayed anyways? by startled · · Score: 1

      Oops, sorry. Been reading too much brain-damaged 1337 on IRC; lost ability to comprehend normal english.

    43. Re:Delayed anyways? by Baikala · · Score: 1
      No, that was UT2003.

      I have the original edition of Half-Life, an out-of-the-box installation has run perfectly ok on a mirriad of cd-roms/dvd roms/writers and SO conbinations for several years so far.

      Now, I had an LG DVD-ROM/CDWriter combo and I wasn't able to play UT2K3 with out a nocd crack, and that sucked big because after every patch I was left out of online games until the new nocd crack was out. Anyway, both games ended up not requiring the cd to be on the drive to play. Thank you very much for leting me play with my original game!

      --
      16,777,216 comments ought to be enough for any forum!
    44. Re:Delayed anyways? by cK-Gunslinger · · Score: 1

      Supported, yes. Playable at 30+ FPS? No?

    45. Re:Delayed anyways? by dnoyeb · · Score: 1

      I agree. Though its likely the parts they did not finish were security related and hacked together temporarily. And we all know what happens to hacks right? They usually get released. So they were all set to release with 'functioning' hacks. but now with the flaws exposed, they must actually do the code up front.

      So I feel that it is possibel that the break in did delay the release, but only because they were already cheating so to speak.

      It always happens when you cut corners, you end up with the short stick.

    46. Re:Delayed anyways? by Anonymous Coward · · Score: 0

      Yeah, let's just ignore the punctuation on that post of mine...

    47. Re:Delayed anyways? by cK-Gunslinger · · Score: 1

      Bah, I'm not complaining that "my system can't play HL2 well, poor me" or proposing some socialistic attitude, I'm pointing out that it's not economically sound to release software that only a small portion of the market can utilize.

      Game companies could easily make a game today that uses 2.8 Million polygons per model and renders each pixel at 128-bit color with 27 passes-per-pixel, but it would be suicide to release it today when hardware won't support it.

      Yes, games should push the envelope and demand better hardware - to a certain extent. If they go too far too fast (which I believe HL2 has), then they can outpace the market and lose some of it. There's always a "sweet spot" for new games, and I think HL2's is a few months down the road, not today.

    48. Re:Delayed anyways? by F34nor · · Score: 1

      I agree, and anyway I had fun playing Wolfenstien with the screen turned down to the postage stamp size. I even had fun playing Q1 at 320x240. Granted I now play Jedi at 1600x1200 but it makes little difference to gameplay for anything but sniper work.

    49. Re:Delayed anyways? by F34nor · · Score: 1

      I have bought HL 3 times after roomate lost or stole my key and rendered it unplayable. The 3rd time was just so I could play Natural Selection. So you are wrong in not uncretain terms. HL is still viable only becasue of multiplayer. I loved HL single player and played it through again when I bought it again but none the less I bought it again only for NS multiplayer. Your distinction between HL & CS is totally meaningless.

      Yes they should release a singleplayer only for X-mas but they wouldn't be able to do it becasue I would want the multiplayer and due to logistics and fraud they would never re-issue to the people who wanted multi later. I NO WAY IN HELL I AM USING STEAM. If I had HL would have cost me $600 so far.

  4. My HL2 Conspiracy Theory by Numeric · · Score: 1

    Here's my theory on the HL2 delay. Since VU is operating at a substantial lost, they are prime to be saved by Bill Gate's wallet. Since Half Life2 and Xbox2 are both optimized to run on ATI's hardware, I can see the Richmond's Borg needing their killer app for XBOX2. Gates says "Hmmmm, Half Life2 sounds good. Buy them out boys!"

    --
    -- ladies and gentlemen we are floating in space!
    1. Re:My HL2 Conspiracy Theory by Anonymous Coward · · Score: 0

      I think it's way too late in the production cycle for HL2 to be released for the X-Box 2 only... especially since the hardware isn't even ANNOUNCED yet.

    2. Re:My HL2 Conspiracy Theory by sebi · · Score: 1

      Even though it does not sound quite as catchy I would guess that the XBOX2 (quite a stupid name in itself) will get the third game in the Half-Life series. The second console is still much further off than the second game. They might have delayed it to get the PC and XBOX versions out at the same time, though, which would be fine with me. I don't have a PC, after all, but I have a XBOX.

    3. Re:My HL2 Conspiracy Theory by dilvie · · Score: 1

      The problem with this being they're already owned by Vivendi-Universal -- a HUGE media conglomerate that owns Universal Studios, Universal Pictures, MP3.com, and many, many other holdings all over the world.

    4. Re:My HL2 Conspiracy Theory by stevesliva · · Score: 1

      Uhh, hate to ruin your theory, but GE/NBC already has dibs on VUE. They're being saved by Jeff Immelt's wallet, not Steve Ballmer's.

      --
      Who do you get to be an expert to tell you something's not obvious? The least insightful person you can find? -J Roberts
    5. Re:My HL2 Conspiracy Theory by PainKilleR-CE · · Score: 3, Informative

      Since VU is operating at a substantial lost, they are prime to be saved by Bill Gate's wallet. Since Half Life2 [neoseeker.com] and Xbox2 [arstechnica.com] are both optimized to run on ATI's hardware, I can see the Richmond's Borg needing their killer app for XBOX2. Gates says "Hmmmm, Half Life2 sounds good. Buy them out boys!"

      One big problem:
      VU doesn't own Valve. VU owns Sierra, and Sierra is the publisher for Half-Life (and currently for HL2), but Valve owns Half-Life 2 and is self-funded. Gabe Newell formed Valve with his own money (gotten from being a well-payed Microsoft employee) and funded Half-Life without Sierra's (or VU) help. This is why Valve was able to delay Half-Life for a year in the first place. This is why Valve can push back HL2 without VU forcing it out when VU is operating at a loss. VU has no say in when the game is released unless their own QA finds problems with the final code and sends it back to Valve for more work (in other words, Sierra can delay HL2, but they can't force it to be released early).

      Microsoft could probably buy Valve if they wanted HL2 bad enough, but I think it would be more than it's worth, since Valve is privately owned, self-funded, and making money hand over fist off the best-selling FPS of all time.

      --
      -PainKilleR-[CE]
  5. This is stupid by Anonymous Coward · · Score: 1, Interesting

    This is just another stupid excuse not to release their product on time (even though that's been set back several times). They probably planned this because it wasn't even close to being ready. You suck valve.

    1. Re:This is stupid by cookiej · · Score: 1

      This guy is an obvious moron.

      The biggest issue with HL and all the mods is CHEATS. If they come out with a version that already has the hacks and cheats ready, they will suffer major revenue hits.

      I stopped playing CS for this very reason. I won't buy HL2 if they don't address the cheats.

      My guess is that this guy is one of those hack-kiddies who couldn't play worth crap without an auto-aimer or see-through walls.

    2. Re:This is stupid by coolgeek · · Score: 5, Funny

      You know the Duke Nukem developers are kicking themselves, saying "Why didn't we think of that."

      --

      cat /dev/null >sig
    3. Re:This is stupid by siriuskao · · Score: 0

      Just find a server with good admin and become a regular.

      Cheaters are easy to spot.

    4. Re:This is stupid by Anonymous Coward · · Score: 3, Funny

      Because they'd need actual source to leak? :-)

    5. Re:This is stupid by gid-goo · · Score: 1
      My guess is that this guy is one of those hack-kiddies who couldn't play worth crap without an auto-aimer or see-through walls.

      Man, those hack-kiddies really have to suck. If you can't play worth crap with an auto aimer, there's no hope.
    6. Re:This is stupid by cookiej · · Score: 1

      I did that and some continued to sneak in. And truly, you get tired of playing the same guys all the time.

      I really love CS. Probably the single most entertaing game I've played in the last 10 years. When they added the voice-chat component, it just racheted up a beyond anything else out there. Shows how successful things can be when the company writes a quality core and supports mod efforts.

      But the gameplay is/was second to none. The first game where real tactics could outclass those trying to take advantage of some weirdness in the game implementation. How many multiplay games do you know where there isn't at least one (usually many more) tactic that is considered "cheese" that leverages a weakness in the implementation. CounterStrike just rules.

      And having the audio cut out when you drop was truly cool. It actually made it a priority to report movement and numbers before you started trying to pick off the enemy--even retreating and calling in support when facing an overwhelming force. When I was working with a team that was clicking, I lured many a CT to their destruction by telling teammates where to set up an ambush.

      Hm. Just typing about this gets the juices flowing. Maybe I'll go play a round or two...

    7. Re:This is stupid by skyrytow · · Score: 1

      I don't think that they would push the delay past a christmas release unless they deamed it absolutly nessessary.

      Loosing those christmas sales will hurt them big-time.

      Besides I would rather them delay the release of HL2 if it means that it is going to be a better product.

      --
      Rasputiin
    8. Re:This is stupid by Anonymous Coward · · Score: 0

      maybe he meant that they shoul have stolen the source code...then they might have an actual product!! Who knows, take the HL 2 code, add in some strippers...voila! DNF!

  6. B.S. by Anonymous Coward · · Score: 2, Insightful

    This is complete B.S. Why would having their code leaked force them to rewrite the game. Some people may say that it's due to cheat prevention... but c'mon. Security through obscurity is no security at all, if that's what they were relying on.

    This is nothing more than them using this as an excuse for delaying the game - something that would have happened anyway. Also, by saying this, if they find the people that hacked their systems, they can sue for large monetary damages.

    1. Re:B.S. by hhnerkopfabbeisser · · Score: 1

      Of course there is no security by obscurity, but the war against cheaters is not one you can actually win.
      It's a constant arms race, and obscurity at least gives you a head start.

    2. Re:B.S. by Anonymous Coward · · Score: 0

      So, if something you've worked on for years gets totally trounced:

      - you wouldn't bat an eye
      - your performance wouldn't be effected
      - you could participate in an investigation which wouldn't take time away from your development

      You're obviously better than anyone at Valve...

    3. Re:B.S. by Anonymous Coward · · Score: 2, Insightful

      Some people may say that it's due to cheat prevention... but c'mon. Security through obscurity is no security at all

      The game industry is quite different in that regard. It is not mathematically possible to secure the client-server model of multiplayer gaming against cheating. You do not have control over the client, no matter what you do, so some form of cheating will always be possible.

      The effects of cheating my a minority of players on a multiplayer game can be disasterous. If a cutomer's experience is an unpleasant one due to a small number of cheaters, it's only a short matter of time before they stop playing that game. Revenue from subsequent "mission packs" or monthly online subscription fees will be lost.

      In the multiplayer game industry, putting the work into minimizing cheats - either in the amount of time before protocols and game internals are reverse engineered or in reducing the effects that cheating has on the gameplay of non-cheaters - pays off in additional revenue. The cheat/revenue correlation is obvious to game companies by now. This is not a theoretical thing.

      Executive summary: Game security is nothing like computer security or network security. Any security is better than no security, and it's measurable in dollars.

    4. Re:B.S. by Anonymous Coward · · Score: 2, Insightful

      It is a MYTH that security through obscurity is not "security." Infact, it is the ONLY security you will ever get. I'm sure you are talking about source code being viewable by anyone (open source). The fact is, open source is just as insecure as closed source. That theory that open source allows many to view it which means all bugs are apparent just does not hold up. Take for example an old version of bind. Before you KNEW that there was some security issue (bug) you felt "secure." You were NEVER secure. The only hint of security came from the obscurity of the bug itself. Once the issue was widely known, it was not a security problem. Open source advocates would then jump at the chance to point out how well open source fixes security problems. This is putting the cart before the horse, so-to-speak.

      The same is true for game networking code. The more obscure it is, the less likely there will be cheaters. This is NOT to say there will be NO cheaters. This says there will be MINIMAL cheaters. Right now, someone, somewhere knows of an exploit for some open source software that NOONE knows about. If that person keeps quiet, he will probably be the only one who can use the exploit. If on the other hand he posts the bug to bugtraq (or perhaps makes a famous cheat for a game.. such as OGC for Quake3) then the security issue can be resolved. This applies equally for proprietary as it does open source. The benefit of open source is that many people have the opportunity to fix the bugs once they are known. The problem with open source and gaming is that the cheaters have access to the algorithm of gameplay and can more easily figure out how to cheat.

      Gaming is significantly different from your typical network security. When a player joins a game, he MUST be a trusted client. Your typical network exploits almost ALWAYS exploit a flaw from the OUTSIDE. In other words, the exploit works from the view-point of a non-trusted entity. Gaming exploits (cheats) work from the view-point of a trusted entity. Significantly different. Back in the day there used to be something known as hijacking a network connection. When this occured, the non-trusted exploit was transformed into the trusted client. Once an exploit was "trusted" by the server software, it could do damn near anything it pleased. Almost all exploitation revolves around the communication between trusted client and hosting server. Packet sniffing, IP spoofing, etc. etc. The only reason TCP/IP is "secure" is because at any given point in time it has obscure data that a 3rd party has trouble guessing. It used to be easy to spoof connections. Today it is somewhat harder.

    5. Re:B.S. by Anonymous Coward · · Score: 0

      Other than obscurity name one method that is even theoretically possible on an untrusted client.

      A link or reference to the mathematical proof would be nice.

    6. Re:B.S. by anthony_dipierro · · Score: 1

      The game industry is quite different in that regard. It is not mathematically possible to secure the client-server model of multiplayer gaming against cheating.

      That's certainly an overstatement. A well designed game, built with the internet in mind from the ground up, will not suffer from this problem. Well, sort of. All games suffer from the problem of collusion between players, but hiding the client code doesn't do very much to stop that.

      For example, consider online poker. A well designed multiplayer poker game cannot be cheated except through collusion of players. So maybe your statement is correct with regard to half-life, but that's a flaw in the game itself, not a flaw in the concept of multiplayer gaming.

    7. Re:B.S. by f0rtytw0 · · Score: 1

      I'm sure you would be glad to buy the trojaned early release of Half Life 2. I on the other hand will wait until the code has been reviewed.

      --
      this is the most important sig ever! In your face 446154!
    8. Re:B.S. by James+Lewis · · Score: 1

      Consider this: It has been reported by halflife2.net that a pre-release version of the game has been leaked. In other words, a fully functioning version of the game is out there, that was most likely taken at the same time as the source. Valve may want to take the next 6 months to make the game worth buying even to those with a pre-release version, by adding more content.

    9. Re:B.S. by sqlrob · · Score: 1

      Now add the requirements of real time, scalable to many players, and playable on existing hardware.

      Not so simple a problem as poker now, is it?

    10. Re:B.S. by xnickmx · · Score: 1

      Changing a small to moderate amount of code may not take six months but testing that changed code could require quite a bit of testing. What if it was necessary to change some of their code to prevent cheating? Writing the code seems like it might only be an insignifigant part of of the process. First they would need to figure out what to change, then write the code and then do another whole round of testing to make sure that nothing was broken. The testing alone could take months even for small to moderate code changes.

    11. Re:B.S. by LurkerXXX · · Score: 1

      Your joking right? People who are running a pirated pre-release are the most likely ones to run a pirated version of the release... i.e., Valve won't be getting any money from them anyhow, so there's no point spending 6 months writing 'special' stuff for the thieves.

    12. Re:B.S. by anthony_dipierro · · Score: 1

      Now add the requirements of real time, scalable to many players, and playable on existing hardware.

      Not so simple a problem as poker now, is it?

      Huh? Online poker is all these things.

    13. Re:B.S. by bigpat · · Score: 1

      Most people reading this probably know a bit about the give and take of software development or at least understand the complex uncertainties of any new creative process. Timelines and estimates are rarely more than half good when trying to do a new complicated software project like this.

      This is a really flimsy excuse for a delay like this. And the timing is strange since they just started putting out rumors about a possible delay in the weeks before this "leak" happened. I wonder what the delay would have been without this code "leak", my guess would be that it realistically adds at most a couple weeks to the schedule.

      This makes me wonder if the stated reasons behind this delay are a symptom of an internal breakdown in communication which has resulted in a convenient lie being told to take advantage of an excuse that people might believe, other than the truth that development is just very time consuming and took them longer than they thought. Or maybe this is just external marketing bunk. Either way it is simply not believable that this code leak all of a sudden caused this entire delay. They should have been substantially done by now to meet their original deadline.

      of course, I am not an investor, so I don't give a rat's ass about the internal politics and marketing. Just hope the game is good and that it comes out sometime soon.

    14. Re:B.S. by Chester+K · · Score: 1

      Some people may say that it's due to cheat prevention... but c'mon. Security through obscurity is no security at all, if that's what they were relying on.

      You have to rely on security through obscurity to some extent in an FPS, because the network latency is too high to constantly be relying on the server for every piece of data that the client might need at any given moment. More data than is absolutely needed must be sent so that if the player turns around suddenly, they don't have a quarter-second delay (or more) before they see who's standing behind them.

      --

      NO CARRIER
    15. Re:B.S. by Politburo · · Score: 1

      A well designed multiplayer poker game cannot be cheated except through collusion of players.

      A well designed poker game cannot be cheated except through server-side hacks. Teamplay, while not accepted at almost any table, is technically not cheating.

    16. Re:B.S. by vadim_t · · Score: 1

      Bugs always happen.

      However, there's such a thing as real security, which doesn't rely on obscurity. Take encryption for example. Right now, you can google a bit and find the full source code of Blowfish. You can take this code, lots of plain text and its encrypted versions and study it. And you will still be unable to decrypt a message without knowing the key. THAT is security.

      Or, take the Unix security. The basic ideas (/etc/passwd, /etc/shadow) are known. The encryption/hash algorhitm is known. However, if you take an old /etc/passwd with the passwords in it, and try to use that information to log in, your only possibility is a brute force attack against the hashed passwords. THAT is also security.

      A system that relies on that its method of operation is kept secret and becomes instantly exploitable as soon as somebody figures out how it works is simply CRAP.

    17. Re:B.S. by sqlrob · · Score: 1

      No, it's not. Poker is transactional. If there is a second or two delay from bid or revealing of the cards as the server does validation, people won't notice. A second or two delay as to whether or not the server validates you actually have and can fire that weapon you're carrying and doing the same as you empty the clip of 200 is rather detrimental.

    18. Re:B.S. by anthony_dipierro · · Score: 1

      Teamplay, while not accepted at almost any table, is technically not cheating.

      Where are you getting that from? Teamplay is most certainly cheating. Haven't you ever watched Rounders? Take a look here:

      Poker players are always aware of the possibility of collusion. Collusion is when two or more players on the same table work together as a team, unfairly knowing each other's cards, and betting with this knowledge in order to maximize their team's profits. Collusion destroys the integrity of any poker game. Any player that attempts to collude at ParadisePoker.com will be permanently banned from our games.
    19. Re:B.S. by anthony_dipierro · · Score: 1

      If there is a second or two delay from bid or revealing of the cards as the server does validation, people won't notice.

      Well, that's certainly untrue. A second or two delay will certainly be noticed. It's one of the few tells in online poker.

      A second or two delay as to whether or not the server validates you actually have and can fire that weapon you're carrying and doing the same as you empty the clip of 200 is rather detrimental.

      OK, but what does this have to do with whether or not you have source code?

    20. Re:B.S. by sqlrob · · Score: 1

      OK, but what does this have to do with whether or not you have source code?

      Nothing. It has to do with this statement:

      It is not mathematically possible to secure the client-server model of multiplayer gaming against cheating. You do not have control over the client, no matter what you do, so some form of cheating will always be possible.

    21. Re:B.S. by Anonymous Coward · · Score: 0
      You can take this code, lots of plain text and its encrypted versions and study it. And you will still be unable to decrypt a message without knowing the key. THAT is security.
      No, that is the definition of obscurity. I don't know the key, therefore the key IS obscure. The key is simply source code that the encryption "compiler" transforms into an "encrypted" format along with the message. Likewise for *ix security methods.
      A system that relies on that its method of operation is kept secret and becomes instantly exploitable as soon as somebody figures out how it works is simply CRAP.
      Not necessarily. The key here is: how long and how hard would a person have to work to obtain such knowledge? My guess would be just as long, if not longer, to break "open algorithm" methods, such as blowfish, etc. If you completely ignore bugs and the possiblity of someone writing a "dumb" security algorithm (rot13 anyone?), then it would be just as hard to break into a system using the unknown method as it would be for someone to break into a system using an open algorithm.

      The "security through openness" people assume, as you did, that the proprietary methods are inherently WEAK. As if a complete moron just sat down one day and wrote an XOR algorithm as their encryption. I'm sure this has happened (in fact, I KNOW it has). If someone were to sit down and write an algorithm more advanced than the latest RSA algorithm, but made it obscure, it would be as secure as any open method. Probably moreso, now that few know how it works. The only thing an open method has is that many can see how the algorithm works and can be sure of its reliability. But this is just theory at that. Just because the algorithm is open does not mean that that many people know how it works and how to test if it's not working. Just as with open source. Everyone has the source code. Very few know how it works for any given open source program. Therefore, bugs and problems will almost always get found during use and not because of the open nature of the source code or security method. Think about that. Not many people post bug reports to open source mailing lists saying "I've found a bug in line such and such." Or if they do, they have learned what the source code does and figured out how to fix it. More likely they will post a description of a problem they are having, with debugging messages and so on. Even with the source code the methods are still OBSCURE to some people. I know quite a few programming languages, but what is currently going on in my X server or Linux kernel I haven't the slightest clue. It would literally take me days, weeks, and months to even slightly comprehend what is going on in the source code. Even if I knew all the math involved in some "secure" algorithm, it would take me just as long to figure out what is going on mathematically. Now put all that math into source code. It is that much harder to understand. Now take that source code and run it through an advanced optimizing compiler. It is even MORE secure. I now need to know what is going on at the binary level, the compiler level, the source level, AND the mathematical level.
    22. Re:B.S. by Anonymous Coward · · Score: 0

      Nothing about online poker solves the problem of "bots".

      (And if bots don't help much in poker, too bad because some people would rather play FPSs than poker.)

    23. Re:B.S. by vadim_t · · Score: 2, Insightful

      Okay, first, you're confusing two things here. The password is simply unknown information. We're talking about the security of algorhitms here, not passwords.

      Yes, if you know the password of course you can decrypt a blowfish encrypted message. However, you can't decrypt ALL of them. That's the difference between a compromised password and an insecure algorhitm.

      Second, while indeed writing a secret algorhitm that is secure is indeed possible, it doesn't mean that just because you can't break it nobody can. Given two insecure algorhitms, one open and another closed it is possible that the open one will be broken in a month after it's announced by some security expert. The second one might be just as broken, but remain in use for years, at which point somebody will find a flaw and compromise much more information.

      Also, open algorhitms like Blowfish and AES have been tested and reviewed by real security experts over all the world. To me, the words of Bruce Schneier have much more weight that somebody who came out of nowhere and announced their unbreakable algorhitm. If you want a concrete example, Meganet's VME "unbreakable" and non-public algorhitm has been successfully reverse-engineered, and proved to be AWFULLY broken. So broken in fact that any message can be decoded within minutes.

      If you rely on obscurity, prepare for a nasty surprise. Sooner or later, some smart guy with free time will decide to debug, decompile and reverse-engineer your application. Perhaps in a week or two the algorhitm will be posted on the USENET, or a closed source exploit will appear.

      You don't want a situation like above. This smart guy might very well decide to do the same as you're doing, keeping the rest of the people in the obscurity and finding a way of getting a profit from that.

    24. Re:B.S. by Anonymous Coward · · Score: 0

      It is completely possible to find a flaw in an open encryption that many "experts" claim could not be done. I'm not saying it is likely, just that it is not impossible.

      Also, I'm not the one confusing the issues. It was the original poster who implied that Half-Life could be made "secure" via open source. It is a common thing to see... open source advocates throwing around that "security through obscurity" nonsense. The security issues surrounding online gaming are COMPLETELY different from that of securing information from a 3rd (non-trusted) party. Infact, the only areas that I can think of where that phrase works is for the information hiding/access restriction aspect of security. And this is only because that aspect can be completely automated (in other words, the actual communication is generated at run-time and demonstrates psuedo-emergent behavior). Nowhere else at all can that phrase be used! Yet people group ALL security issues together and believe they can magically be resolved through openness. And typically they are talking about source code--not algorithms. In any given large application there will be at least one bug. Having source code does not prove that these bugs disappear. Even having HL open source and having a magical network communication protocol that solves all the security issues involved (there are countless issues here. really.), there will still be cheats via exploited bugs. But there will never be that magical protocol which solves all gaming issues (not until the entire game is server-hosted, but even then a player has local video access). Hence, "security through obscurity" does infact work better here. Not PERFECT. But BETTER.

    25. Re:B.S. by anthony_dipierro · · Score: 1

      So you've shown that one particular game cannot be secured in one particular way. That's not the same as it not being "mathematically possible to secure the client-server model of multiplayer gaming against cheating."

    26. Re:B.S. by anthony_dipierro · · Score: 1

      If it could be done by a bot, it's not a very interesting game.

  7. Why the delay by Oliver+Wendell+Jones · · Score: 1, Insightful

    Why exactly should this delay the game? If it was close to being ready, and according to their release date(s) they should have been pretty close, why are we expected to believe a delay until April?

    --
    A computer once beat me at chess, but it was no match for me at kick boxing -- Emo Phillips
    1. Re:Why the delay by thefluxster · · Score: 1

      Probably to change the aim code and other things that would allow people to build bots/hacks for the game.

      --

      Ever notice how fast Windows runs? Neither did I.

    2. Re:Why the delay by Merk · · Score: 1
      1. To prevent people who have the copied source from being able to cheat when the final game comes out, thanks to knowing its internal workings well
      2. Because of all the bug reports, RFEs, patches and stuff that have come in since it went "open-source" ;)
    3. Re:Why the delay by foobario · · Score: 1

      Because they need to rewrite large sections of the code, since their secrets are out in the open, and the black hats don't even need to bother reverse-engineering protocols when they have the source code. It would probably be A Bad Thing to release the game minus online bits now, and release the rest later. And if Steam code was released, their security is hosed...

      It's not a direct comparison, but remember when Quake I was released, with the supposedly unbreakable infrastructure encrypting the entire Id line on the CD? On the day of the release the crack was available before the stores even opened on the west coast of the US... most people had the crack before they had the CD.

      Valve has brought us good games in the past, I don't see a problem in giving them a few months to try to recover from this. This is the sort of thing some companies don't *ever* recover from.

    4. Re:Why the delay by Anonymous Coward · · Score: 0

      And yet, Quake I was still very successfull... despite the crack.

    5. Re:Why the delay by edwdig · · Score: 1

      Their network got hacked. Badly. The code that got leaked was something like 23 megs compressed. And supposedly it's not even the complete code.

      They have to verify the code to make sure nothing got inserted into it by whoever compromise their network. That'll take a while.

      They also have to evaluate the code that got leaked, and see if that requires changing anything. They don't want their copy protection cracked, and they also don't want lots of cheats to be out as soon as the game is released.

      Also, keep in mind that before this happened, they were hoping to have it out before the holidays, but totally confident they could do it. Add in a slight delay, and that makes a January release. The beginning of the year is terrible for game sales, as everyone spent all their game money on the big holiday releases. So businesswise, April is a much better release date than January or February. So releasing then will give more time to fix bugs and also result in better sales. Oh, and it'll give more time for current graphics cards to drop in price, resulting in more people being able to play the game.

  8. code-leak by Anonymous Coward · · Score: 0

    are you loving bittorrent and filesharing now?

    1. Re:code-leak by frodo+from+middle+ea · · Score: 1

      It was not bittorrent or filesharing that caused the code to be stolen.
      Filesharing or no filesharing, hackers will always try these kind of things regardless. It is upto the concerning business to have a proper security mechanism in place.
      How foolish can you be when your code worth potentially millions of $s is kept on a machine accessible from public internet.
      Ever heard of things like Firewalls, intrusion detection, etc ?

      --
      for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
  9. SSL by tlovie · · Score: 1

    Wouldn't wrapping all the network communications in SSL be sufficient to thwart many hack attempts? or do some type of aimbots do some dynamic patching of the executable?

    1. Re:SSL by Anonymous Coward · · Score: 0

      The vulnerabilities which I saw in the HL2 source code (yes, I took a look) were mostly of the buffer overflow kind possibly allowing remote code execution. Even saw a little something which could have allowed rooting of the Steam servers although I'm sure they are smart enough to use StackGuard or other similar patches in their production kernels there.

      Wrapping it in SSL will do nothing useful since it's the CONTENT that will be improperly parsed and that is what most of the holes are about.

      One thing I remember was that it had a fixed-size (16 chars) data field for the md5sum of the Steam executable. Suppose their API specs say that the client is supposed to pass this checksum to the server in a packet with the first two bytes set to "A" and "A" (0x41, 0x41) for example. So the client sends "AA" + 16_chars_of_md5_checksum. Should the client send "AA" + more_than_16_chars, you have an instant buffer overflow and voila - go figure out a root exploit for the server ;)

    2. Re:SSL by Delphix · · Score: 2, Informative

      Generally HL hacks intercept the DLL calls. SSL on the network connection wouldn't help at all.

    3. Re:SSL by Tom7 · · Score: 1

      SSL's main vulnerability is to man-in-the-middle attacks, which is precisely what aimbots usually do. It's especially vulnerable if you are *deliberately* trying to connect through a proxy, in fact, it's trivial.

    4. Re:SSL by cryptor3 · · Score: 1

      The reason this won't work is the same reason that Digital Rights Management won't be completely secure. The endpoints are still open. That is, you could change the data before it gets encrypted, since you have direct access to the machine.

    5. Re:SSL by PainKilleR-CE · · Score: 1

      or do some type of aimbots do some dynamic patching of the executable?

      Many aimbots use DirectX to 'scrape' the screen and send spoofed mouse + keyboard inputs to the executable. There's also the possibility of finding holes in the code, or wrapping game DLLs (or DirectX DLLs as above, though many HL bots and hacks use OpenGL wrappers).

      Yes, dynamic patching is also an option, used especially for things like radar hacks and others. Also used against anti-cheat software.

      --
      -PainKilleR-[CE]
  10. In other news... by jhughes · · Score: 1, Funny

    In other news a new startup company (founded last week) has announced the release of a revolutionary new game: Full Life: The Adventures of Frodan Greeman."

    (I got nuttin)

  11. Well.. by sonoluminescence · · Score: 3, Funny

    ...maybe the Valve version has been delayed.

    --
    Karma: Bad. Calmer, good.
  12. Confused by M.C.+Hampster · · Score: 2, Insightful

    Was the code that was stolen then deleted by the thief? Why would this cause any sort of delay? This sounds like a fairly lame excuse for shipping late.

    It only makes sense that code that would generate millions of dollars in revenue for Valve would be backed up quite reguarly offsite.

    --
    Forget the whales - save the babies.
    1. Re:Confused by Rufus211 · · Score: 1

      The delay makes perfect sense. First of all if the hackers got to the code and were able to check it out, they probably also were able to change some code. Who wants to be the first to run HL2 special BackOrifice edition? Also released with the code was the code to their new Stream DRM system. It's been noted that in the past month (even before the code was released online, but after it was stolen) there have been a half dozen Stream updates. Finally they probably are going to do their best to make sure the source as it is released now has as little do to as possible and is as incompatable as possible with the shipping game.

    2. Re:Confused by paul99se · · Score: 1

      With access to the source, the thief could then design exploits and cheats quite easily.

      It's not the theft that's the problem: it's the fact that every kiddie in the land possesses the game engine now.

    3. Re:Confused by PunchSix · · Score: 3, Funny
      Was the code that was stolen then deleted by the thief?

      That would be awful! The stolen code would be distributed to millions and Valve would have no way of getting that widely distributed code back!!!

    4. Re:Confused by Broodje · · Score: 1

      I don't think its a question of losing code as much as it is the inadvertant release of algorithms that helped keep cheating at bay.
      The one thing that has not been hacked is the half-life cd-key - you need this to play online. Now you might get some guy pumping out valid cd-keys and mucking up the whole distribution system.
      I do think that the whole thing was gonna be late anyways, it just needed a good excuse. Where is my tinfoil hat?

    5. Re:Confused by tabby · · Score: 1

      I imagine there would be a lot of know exploits in the code that they didn't intend to have fixed on release but rather in the first patches long before anyone could work them out. Now since the source is in the wild they must fix them before release.

      --
      I've experiments to run, there is research to be done on the people who are still alive.
    6. Re:Confused by vistic · · Score: 1

      hah (-:

    7. Re:Confused by Auckerman · · Score: 4, Insightful

      "Why would this cause any sort of delay?"

      One possible explaination is that the network code will need to be made incompatible to prevent cheaters. APIs may need to me moved around and renamed to prevent see though wall cheaters. Stuff in the code may need to be hidden to make it harder for cheaters to mod the dlls.

      Just a guess....

      --

      Burn Hollywood Burn
    8. Re:Confused by Tim+C · · Score: 1

      Valve would have no way of getting that widely distributed code back!!!

      More to the point, if they had lost their only copy, they'd probably have no way of verifying that the code they retrieved hadn't been altered.

    9. Re:Confused by Stinking+Pig · · Score: 1

      All the functions that were in that code have to be redesigned and rewritten to work differently in order to prevent cheats.

      The point of the theft wasn't to get HL2 early and play it; the point of the theft was to write and sell cheater bots and mods.

      --
      "Nothing was broken, and it's been fixed." -- Jon Carroll
    10. Re:Confused by Anonymous Coward · · Score: 0

      It still seems like its more important to get HL2 out on the shelves in time for Christmas. They can always release a patch later that will kill all the cheat exploits.

    11. Re:Confused by Anonymous Coward · · Score: 0

      Yes, but is it worth it to miss the very valuable Christmas release window?

      Especiallu since cheaters will appear anyway... and they'll have to patch it anyway?

      They could just release and work on a patch.

      I have doubts. I think it was behind schedule and this has been a great excuse (and in every other sense, a total disaster) for Valve.

    12. Re:Confused by Digital11 · · Score: 1

      Umm, there are HL cd-key generators all over the place. Granted, a spoofed cd key won't allow you to play online, but neither would having the source to the official key generator. Valve's WON network knew specifically what keys had been sent out, and you'd be VERY lucky to manage to generate a valid key that also happened to be on the authentication list.

      Not to mention the cdkey thing is going away with the advent of Steam.

      --
      I am a leaf on the wind. Watch how I soar.
    13. Re:Confused by Jagasian · · Score: 1

      Seems like a poor excuse. The original Quake is opensource, and security is maintained through two things: client-side closed source authentication module and intelligent servers that detect cheating, such as players moving too fast, etc...

      There hasn't been any network protocol or engine changes, yet we still have security. I think that Valve is using the leak as an excuse to delay HL2 for almost another year (6 months)... without upsetting fans by admitting that they lied about the release date.

    14. Re:Confused by Slime-dogg · · Score: 1

      I would hand the source back to them (if I had it) only if I had it written in contract that they were not going to prosecute me for retaining possession of the code. That, and I'd make sure that they also had a clause in there saying that they were going to hire me.

      --
      You need to restart your computer. Hold down the Power button for several seconds or press the Restart button.
    15. Re:Confused by Gogo+Dodo · · Score: 1

      They probably are also auditing the entire codebase to make sure no code was inserted. Can you say Trojan Horse?

  13. Saw this coming by BillLeeLee · · Score: 1
    Somehow, I think we all saw this coming. While the code couldn't really do much harm by itself, since there were no art, graphics, levels, sound, etc. files in the source tree, it could've been used to do other things (easier to make hacks and keygens). I guess valve will take the time to rewrite the algorithms and such, but what else would they be doing?

    And waiting another 4 months for Half Life 2? Come on Valve, I'd still buy it if you released it tomorrow.

    --
    www.google.com
    1. Re:Saw this coming by shird · · Score: 1

      They don't even need to recode the cd key verification algo. From the source code: // this function exported by cdkey.obj (we don't have the source code)
      extern int SimpleCDCheck( const char *cdkey );

      All this code was commented out anyway, so were intending on modifying it anyway.

      Although they perhaps might need to recode some of the networking code which sends the md5 of this to servers - this would be easy to sniff and allow people to steal 'keys' (or at least the md5 of them - which is used to auth). They should be using some challenge response instead anyway.

      --
      I.O.U One Sig.
    2. Re:Saw this coming by shird · · Score: 1

      They will not even need to recode the key auth algo. From the source: // this function exported by cdkey.obj (we don't have the source code)
      extern int SimpleCDCheck( const char *cdkey );

      This was all commented out so they intended to change it anyway.

      They might like to change the server auth code though. Currently it sends an md5 of the key to authenticate. Easy to sniff and abuse - they should be using a challenge response system where the key or usable hash isn't sent over the wire. Then again, security obviously isn't something valve is good for.

      --
      I.O.U One Sig.
    3. Re:Saw this coming by timbloid · · Score: 1

      -- they should be using a challenge response system where the key or usable hash isn't sent over the wire

      And you should be using the preview button ;-)

  14. Speculaciones? by Anonymous Coward · · Score: 0

    Maybe it was someone annoyed with the amount of time they're taking to release it? Or maybe some Unix user that was worried they wouldn't do a port for *nix?

    1. Re:Speculaciones? by notanatheist · · Score: 1

      Darn right. I never pay retail for a game if I have to reboot to play it. I will however pay retail for a game that'll run natively on linux. Even if the release wasn't until April there's still going to be bugs and patches. Why not go public beta before then to give gamers an oppurtunity to find the bugs now and patch as many as possible in the next 2 months. It's not like packaging or anything needs to change.

  15. Lame excuse by Quasar1999 · · Score: 0, Flamebait

    There is no way they can re-write the game from scratch in 6 months, so why the hell are they delaying it? It has NOTHING to do with the code leak, they just needed an excuse, one where the gamers would feel sorry for them... Otherwise they'd suffer the Duke Nukem Forever fate...

    --

    ---
    Programming is like sex... Make one mistake and support it the rest of your life.
    1. Re:Lame excuse by Pvt_Waldo · · Score: 1

      I don't think they are rewriting the whole thing.

      Probably rewriting the CD key authentication, the server authentication system, and a number of hooks so it's not so easy for cheaters to break into things.

    2. Re:Lame excuse by fermion · · Score: 2, Interesting
      With an intrusion like this one can never be sure of the extent of the damage. My guess that they will

      Roll back to a known secure codebase
      Allow the programmers add back in code written since that date
      revalidate the codebase
      rewrite protocols to make the new release less vulnerable to the hacks created from the code leak
      Then add in any functionality originally scheduled for this release and validate

      --
      "She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
    3. Re:Lame excuse by svott · · Score: 0
      I don't think the code was stolen, in the sense that Valve no longer has a copy of it. If that were the case, they could hop on the P2P apps and download a copy of their source code just like the rest of us !

      Linus would say the world is just mirroring their code.

  16. Re:Likely a change to stop "pirating". by Blenderkitty · · Score: 5, Insightful

    Are you serious? How much money do you think Valve makes off of the sale of a game? How many MILLIONS?

    Do you HONESTLY think that they would even make 1/10 of that solicting for donations from the good of one's heart?

    How much money do you think cdex + xiph + bittorrent + scorched3d + blender + tons o' other donation-based projects get per year? Answer) A mere fraction of a fraction of a fraction as much as Valve does.

  17. Re:Likely a change to stop "pirating". by Microlith · · Score: 1

    Because the cost in terms of time and money to create all of those combined likely does not compare to the cost associated with creating Half-Life 2.

    I can guarantee you if Half-Life were freely distributed, the money they would make back on donations would come up far short of the costs, much less make Valve a profit (which is the inevitable intention of the whole venture.)

  18. Can you really cover up all the holes exposed? by preric · · Score: 1

    The leaked code contains the frame source to Half Life 2, allowing free reign for cheat coders and (most likely) unlimited cd keys... is six months really enough time to really fix these holes, or will gamers just be screwed of honest gameplay no matter what?

    1. Re:Can you really cover up all the holes exposed? by Viol8 · · Score: 2, Insightful

      "allowing free reign for cheat coders and (most likely) unlimited cd keys... is six months really enoughtime to really fix these holes"

      Err yes! 6 HOURS should be enough to come up with a new key generation algorithm! As for cheat coders, they can disassemble the executable anytime, they
      don't need the source code and in fact it probably wouldn't be much help anyway. As other people have said , this is just BS to cover up more delays.

    2. Re:Can you really cover up all the holes exposed? by davew2040 · · Score: 1

      So wrong.

  19. Oops by SiNBelldandy · · Score: 1

    Sorry guys, I promise the version I compiled on my computer will be ALOT better.

    1. Re:Oops by timbloid · · Score: 1

      With the graphics and levels you drew and made?

      "Arrrgh...the big red and green blob monster has me trapped in the corner of this boxy, textureless room!"

  20. Re:Likely a change to stop "pirating". by dilvie · · Score: 1

    Pay off BIG? I know donations have been made to some projects, but I don't know of anybody who makes LOTS of money on the donation system. Can you give us more specific examples? How much have these projects managed to rake in via donations? I would like to see a major studio game go open-source out of the gate as much as the next guy, but I'm not sure donations are the way to go. Maybe a game with a huge community could make some money selling swag, or going on network party tours (ticket sales)...

  21. I guess now it's... by Anonymous Coward · · Score: 1, Funny

    First-Quarter Life

  22. The real reason for the delay by mr_resident · · Score: 1

    I don't see how the leaked fragment of code would mean they have to delay the release.

    I think it's more likely they're giving themselves time to look over the final version of DOOM III.

  23. If you want anyone to blame by Sir+Haxalot · · Score: 3, Informative

    It was Myg0t that got it, and Hitman, an ex-member of Myg0t, that released it.

    --
    I have over 70 freaks, do you?
    1. Re:If you want anyone to blame by kayen_telva · · Score: 0

      do you have any links or proof of this ?? Id like to read about it.

    2. Re:If you want anyone to blame by ymgve · · Score: 1

      Mod parent down. There is no evidence that supports that any member of myg0t was the hacker. They are just a bunch of assholes that will claim anything to get attention.

      Until the FBI knocks on someone's door, nobody truly knows who the hacker was.

    3. Re:If you want anyone to blame by captainstupid · · Score: 1

      According the NFO file being distributed with the now CONFIRMED "prerelease" or beta version of HL2, "To myg0t: this is too big for you to take credit :p - Anonymous leaker"

      http://www.neowin.net/forum/index.php?showtopic= 10 6246&st=0&#entry1231928

      Again, this new beta or prerelease has been played by many people now (no, not including me). See neowin.net for details.

      --
      "Anyway, long story short... is a phrase whose origins are complicated and rambling...." - Abraham Simpson
    4. Re:If you want anyone to blame by Sir+Haxalot · · Score: 3, Interesting

      Mod parent down. There is no evidence that supports that any member of myg0t was the hacker. They are just a bunch of assholes that will claim anything to get attention.
      Until the FBI knocks on someone's door, nobody truly knows who the hacker was.

      Hitman was in #halflife2 EFNet giving links to the source HOURS before anyone else had it. Enough evidence?

      --
      I have over 70 freaks, do you?
    5. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      Why would we blame them?

      Information wants to be free!

      Copying is a victimless crime!

    6. Re:If you want anyone to blame by ndrw · · Score: 1

      Are you fucking joking? Like the FBI has never made a mistake?

      Remember that old catch phrase, "Innocent until proven guilty?" It's not, "Innocent until fingered by the feds." Or even, "Innocent until questioned by the feds."

    7. Re:If you want anyone to blame by Sir+Haxalot · · Score: 1

      Why would we blame them?
      They made sure the most wanted game ever made was pushed back about at least 3 months and cost one of the best software developers tens, hundereds or thousands, possible even millions of dollars for a start. Software should only be open source if the developers want it to be.

      --
      I have over 70 freaks, do you?
    8. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      Wow, you really think that's the reason Valve delayed HL2 again? Wow.

    9. Re:If you want anyone to blame by Sir+Haxalot · · Score: 1

      Wow, you really think that's the reason Valve delayed HL2 again? Wow.
      Their official statement was that that was the reason, and I don't have any reason to not believe them.

      --
      I have over 70 freaks, do you?
    10. Re:If you want anyone to blame by Sir+Haxalot · · Score: 1
      --
      I have over 70 freaks, do you?
    11. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      There was no such notice in the early version of the source code. If someone stuck in an NFO file, it was done well after the release was in the wild. So there's no reason to believe Mr. "Anonymous Leaker" that wrote that has any idea where it came from.

    12. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      I'm not talking about the source, I'm talking about the beta or whatever it's called, the actual playable game that is now floating around out there. The NFO file was placed in the RAR by whoever got their grubby mitts on the BSP's and textures and all that fun stuff as well. That's why I believe it.

    13. Re:If you want anyone to blame by Overly+Critical+Guy · · Score: 1
      --
      "Sufferin' succotash."
    14. Re:If you want anyone to blame by Polo · · Score: 1

      sounds like you're looking for a scape-g0t..

    15. Re:If you want anyone to blame by Overly+Critical+Guy · · Score: 1

      All alleged betas have been confirmed as hoaxes, often with trojans hidden in them.

      --
      "Sufferin' succotash."
    16. Re:If you want anyone to blame by MachineShedFred · · Score: 1

      Do you have any solid confirmed information that they did this, or is it just speculation fueled by some idiot h4x0rz that think they are cool for griefing?

      Instead of saying that these morons caused millions of dollars of problems, get some concrete evidence.

      When the FBI starts using the "Federal Master Key" on doors, then I'll believe it.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
    17. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      You're not keeping up. CHeck the news for just the past few hours, things have changed quite a bit.

    18. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      Exactly! Forward evidence and contact details directly to Valve, so that they can exact their revenge. Post them here too, for mob justice.

    19. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      You sir, are a moron.

    20. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      Do you have any evidence to the contrary? Nope, didn't think so. So apart from believing the people who wrote the game, what myth are you going to believe instead? The general Slashdot bs?

    21. Re:If you want anyone to blame by Anonymous Coward · · Score: 0

      HA! See I was right you half-witted bafoon! You do know how to open your mouth too soon, don't you, twit! I fart in your general direction!

  24. Why the dealy? by DeckerEgo · · Score: 1

    Why have a delay? I don't get it... so code was leaked and people will find some multiplayer hacks - release single player (which is what the game is really designed for) and mop up networking code later.

  25. Can't blame anyone but themselves... by DroopyStonx · · Score: 1

    The "spy" program was sent to the founder's email. He downloaded it and installed it. Come on... how stupid can someone be?

    This is just like the stupid office secretary that thinks, "OOooh someone LOVES MEEEE!!" Then they open the .vbs file and spreads the virus.

    This is also like the millions of people who fail to patch their Windows XP machines and complain once they get a virus.

    Come on, people. It should be implanted into your HEADS to not do dumb crap like this.

    --
    We have secretly replaced these Slashdot mods' sense of humor with a rusty nail. Let's see if they notice!!
    1. Re:Can't blame anyone but themselves... by Karhgath · · Score: 5, Interesting

      He wasn't that stupid. The email used a old buffer overflow bug in the preview pane of Outlook to install the program, Gabe just had to click(not even open) the email for it to install the trojan.

      However, it's mind-bending that their Outlook weren't patched(it's a very old exploit) and that he uses the preview pane in Outlook, on his work related computer. I know that they are backed by Microsoft, and thus probably gets all the MS toys, but they still forgot to patch them.

      A shame. Still, a custom written trojan made against Valve to target their system and get the code/data of the game isn't something you see everyday. Either this kind of thing doesn't happen often, or it happens often but it's never detected(or acknowledged). Think industrial espionnage. Either way, it's not an easy to spot/cure, not antivirus/firewall can detect it effectivly if it's custom written against you. They probably probed Valve to check what exploits would or wouldn't work, so it's not as easy as to say: they should have patched, because the hacker would probably have tried another way and with a little determination, would have still compromised their systems enough to get some data.

    2. Re:Can't blame anyone but themselves... by Oddly_Drac · · Score: 1

      "A shame. Still, a custom written trojan made against Valve to target their system and get the code/data of the game isn't something you see everyday."

      I've read the accounts and I still can't see the point behind a 'custom' written trojan if they'd managed to install several keyloggers on machines. Not to piddle on Valve's bonfire, but something stinks to high heaven if they don't patch Outlook Express, run heuristic checking and/or have sufficient nous to make sure that they don't connect production servers to the internet.

      While I feel a certain amount of sympathy, the whole thing has the feel of an April fools gag.

      In short, I can't really believe that this happened in the way described.

      "They probably probed Valve to check what exploits would or wouldn't work"

      Unless they're really competent, there's a backtrace to follow, but it comes back to the same thing; why was the development server connected to the internet? I know that most game companies run a VPN between offices, but open internet access? Gabe was using Webmail? WTF?

      --
      Oddly Draconis
      Too cynical to live, too stubborn to die.
    3. Re:Can't blame anyone but themselves... by Compenguin · · Score: 1

      "This is also like the millions of people who fail to patch their Windows XP machines and complain once they get a virus."

      The problem with the holes is i've been hit while updating the system because there is just so much eratta it takes forever to download and yes this was SP1 and yes it was with a broadband connection

    4. Re:Can't blame anyone but themselves... by Karhgath · · Score: 1

      We're not 100% sure it was a development computer. If they installed lots of keyloggers and such on many computers, instead of taking the code right away, it's probable that there was no code on the compromised computer. So, with the keyloggers and remote apps they got access to the LAN or private network and then were able to find the dev computers from there.

      Still, like I said, they should have known better, patching softwares, isolate the dev computers better, close/monitor the network at the first sign of 'weirdness with emails' and such.

      It really comes back to: "Are you paranoid or not? Even if you aren't, it doesn't mean they aren't after you." All in all, better be safe than sorry,but I'd imagine 80% of the people are going to be sorry one day or another, as they'll feel it takes too much time to be safe most of the time.

    5. Re:Can't blame anyone but themselves... by Anonymous Coward · · Score: 0
      However, it's mind-bending that ... he uses the preview pane in Outlook

      I would like to point out that I have been previewing my e-mails for six years now, and I have NEVER been a victim of a virus or worm. Know how? I use an e-mail program that is not a stinking pile of crap.

    6. Re:Can't blame anyone but themselves... by Anonymous Coward · · Score: 0

      He wasn't that stupid. The email used a old buffer overflow bug in the preview pane of Outlook to install the program, Gabe just had to click(not even open) the email for it to install the trojan.

      I know this is going to sound offensive, but if you use Outlook Express then you have to be some combination of stupid, ignorant, and/or lazy. Considering the context, ignorance is not an excuse. So by my logic, you claim that is is very lazy.

    7. Re:Can't blame anyone but themselves... by Anonymous Coward · · Score: 0

      You use a different e-mail program in house with a company running MS Exchange server? Wow, what is it?

    8. Re:Can't blame anyone but themselves... by startled · · Score: 1

      Actually, they could blame the person who, you know, illegally accessed the machines and obtained a copy of the source code.

      Just because someone's not terribly computer literate doesn't mean it's fine to fuck over their entire company. If I know a guy who can't fight, I don't go kick his ass on general principle.

    9. Re:Can't blame anyone but themselves... by Anonymous Coward · · Score: 0

      outlook and outlook express are two different products.

    10. Re:Can't blame anyone but themselves... by Tim+C · · Score: 1

      Mozilla's mail client, Netscape's mail client, KMail and Evolution can all access mail on Exchange servers. There are probably others, but those four I have used personally.

      Unfortunately, they're intolerably slow (imho) compared to Outlook, and obviously don't support calendaring. Still, if all you need is mail access, and don't mind it being a little stately, then they work fine.

    11. Re:Can't blame anyone but themselves... by SpamJunkie · · Score: 1

      However, what if that guy who can't fight was a security guard? Maybe he's not armed, or armed with a gun known to jam frequently. Perhaps his bullet proof vest has just been recalled. Sure it's still morally reprehensible to exploit any of his weaknesses but shouldn't he be as well equiped as possible?

      Now, what if instead of a security guard he was a regular employee with all access to sensitive data? And instead of a company, he worked at the Pentagon? Shouldn't he be protected by the best security guards and systems possible?

      This is where Valve is to blame. They did not provide the most current and available security measures to their employees. This is especially gratuitous since the Outlook patches are available free of charge, unlike upgraded vests and weapons!

    12. Re:Can't blame anyone but themselves... by _KiTA_ · · Score: 1

      Yeah, because $szDiety knows that every virus and worm in the Windows world requires you to actively open the file. It couldn't have just been them a bit too slow on the uptake on installing a patch on their server, workstations, etc.

      Nah. It couldn't be a really shitty OS. Has to be the developers being morons. Because $szDiety knows, computer programmers have such a horrible reputation of being clueless computer users.

    13. Re:Can't blame anyone but themselves... by Overly+Critical+Guy · · Score: 1

      How many times does this need to be pointed out? It was Gabe's e-mail that was hacked. The machine containing that source wasn't on the net.

      --
      "Sufferin' succotash."
    14. Re:Can't blame anyone but themselves... by startled · · Score: 1

      Agreed-- so they both fucked up. Valve's getting punished already, which leaves one party yet to be caught.

    15. Re:Can't blame anyone but themselves... by Jace+of+Fuse! · · Score: 1

      I know this is going to sound offensive

      It could be offensive, and it's also ignorant.

      Anybody with any moderate to advanced skills will turn off all of the default stupidity in Outlook. The Preview Pane(Pain) isn't just an exploitable problem, it's also damned irritating.

      I've been using Outlook Express (and before that, MS Mail and News) for a very long time, and I've never been a victim to any such exploit. Of course, my install of Windows has the vast majority of the stupid bloated bullshit turned off, and as such doesn't much resemble a typical Windows machine.

      Typical Users, Typical Installs, and Typical Stupidity result in the Typical Problems that people have with Windows.

      Incidently, the alternative e-mail programs available for Windows blow as much goat cheese as (or in some case more than) Outlook Express for one reason or another. I've used them and I don't like them. It's that simple. It's true that a default install of Outlook is unsafe, but I don't use defaults. I configure my software. Don't you?

      Keep on bashing Outlook Express if you want, but just because you don't have the ability to use Microsoft applications without problems doesn't mean there aren't people out there that operate perfectly fine with those apps.

      Or, to put it another way, just because you can't do it doesn't mean there isn't someone else that very easily can.

      --

      "Everything you know is wrong. (And stupid.)"

      Moderation Totals: Wrong=2, Stupid=3, Total=5.
    16. Re:Can't blame anyone but themselves... by Oddly_Drac · · Score: 1

      "How many times does this need to be pointed out?"

      Many, many more. :oP

      "It was Gabe's e-mail that was hacked. The machine containing that source wasn't on the net."

      Then at first glances he was 'storing' a third of the source code in his webmail folders?

      How about the recent reports that there's a leaked version of the entire game doing the rounds? You'd need access to the source tree to do that, surely?

      --
      Oddly Draconis
      Too cynical to live, too stubborn to die.
  26. Noooooooooo! by Control-Z · · Score: 4, Funny

    Ok, it's not that bad but I'm modarately disappointed. But some of these fanboys I've been reading posts from on USENET might just kill themselves. Maybe someone should set up a crisis counciling center?

    1. Re:Noooooooooo! by LupusUF · · Score: 1

      nah, they can just use the crisis center started for people who actually belived that Duke Nukem forever was going to come out, and Team fortress 2 was really ever in development.

  27. What kind of genius... by Delron+Da+Thugg · · Score: 0

    What kind of genius is emailing around source code? That clown should be flipping burgers...

  28. Someone needs to call them on this. by mbourgon · · Score: 1

    Why, indeed, does the code need to be rewritten? What are people going to do, mod it so they can beat the single-player game more easily? And hadn't they delayed the game before the code leak was announced?

    --
    "Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples
  29. not practical by Anonymous Coward · · Score: 0

    And how do you plan on supporting mulitple developers? Code repositories? Cross-platform development?

    Dificult (nay, impossible) to do any of this without have some kind of network connection. There is a difference between offline and off the internet

    1. Re:not practical by frodo+from+middle+ea · · Score: 1

      When he said OFFLINE, he obviously ment make the machine or the internal network inaccessible to the public internet.

      --
      for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
    2. Re:not practical by Necroman · · Score: 1

      Doing something like this is practical though. He didn't say to have 0 network connection, he said not to be connected to the internet. The employees could still be connected to an intranet to use all the network based apps they need.

      --
      Its not what it is, its something else.
  30. from the sucks-for-the-gamers dept??? by deadlinegrunt · · Score: 1

    Sucks even more for the developers who work extrenuous hours to produce the games for gamers if you ask me. Especially the Valve coders.

    --
    BSD is designed. Linux is grown. C++ libs
  31. I can't wait!!! by Anonymous Coward · · Score: 0

    I hear it will be released along side Halo, Doom III, and Duke Nukem!!! I'm holding my breath right now!!!

  32. Other news: beta leaked, apparently... by Tyreth · · Score: 5, Informative
    There's a buzz at the moment on irc.quakenet.org #hl2-source and other places about the beta being leaked.

    I would submit it as a story, but someone else probably has, and I've never had a story accepted yet :)

    The NFO was on nforce.nl for a short time, but has since been removed. The leak has been confirmed here, and a few claim to have it (but they could be lying).

    I've also seen a screenshot of the folders with all the map files in it, and the names look very much like what one would expect the long gameplay demo to be made from.

    Not good news for valve :( I am disappointed that the game had to be delayed - and for all of you who have taken the source or download the beta, I hope you remember your duty to purchase the game when it does come out.

    1. Re:Other news: beta leaked, apparently... by Anonymous Coward · · Score: 0

      they're all fake dude

    2. Re:Other news: beta leaked, apparently... by Leffe · · Score: 1

      Yeah, it's out in the wild too.

      Here are some screenshots I've gathered from #halflife2@irc.efnet.org:

      http://upl.mine.nu/uplfolders/upload8/HL2_icon.J PG
      http://hitmen.fragwhore.com/HL2/hl2-1.jpg
      http: //hitmen.fragwhore.com/HL2/hl2-2.jpg
      http://hitme n.fragwhore.com/HL2/hl2-3.jpg
      http://hitmen.fragw hore.com/HL2/hl2-4.jpg
      http://hitmen.fragwhore.co m/HL2/hl2-5.jpg
      http://hitmen.fragwhore.com/HL2/h l2-6.jpg
      http://www.uploadit.org/files/071003-ith inkitsnotf ake.JPG
      http://upl.mine.nu/uplfolders/upload8/tag ged1.JPG
      http://gtwy.hl2arena.com/images/hl2-real .jpg
      http://upl.mine.nu/uplfolders/upload8/tagged 3.JPG
      http://www.uploadit.org/files/071003-hl1_mo nster.j pg
      http://upl.mine.nu/uplfolders/upload8/tagged4. JPG
      http://www.knake.info/knakezooi/_images/bikin i/Ima ge1.jpg
      http://www.knake.info/knakezooi/_images/b ikini/Ima ge2.jpg
      http://upl.mine.nu/uplfolders/upload8/map s.jpg
      http://upl.mine.nu/uplfolders/upload8/files .jpg
      http://upl.mine.nu/uplfolders/upload8/tagged 8.JPG
      http://upl.mine.nu/uplfolders/upload8/tagge d10.JPG
      http://upl.mine.nu/uplfolders/upload8/tagged9.JP G
      http://upl.mine.nu/uplfolders/upload8/tagged12. JPG
      http://www.neowin.net/staff/creamhackered/halfli fe 2/shot5.jpg
      http://www.unreal.dk/hl2/hl2img4.jpg
      http://www.deejay-fuzion.net.nz/hl2-WORKING.png
      http://www.deejay-fuzion.net.nz/hl2-version.png

      NOTE: Not all might work, I got them a couple hours ago, and all of them might not actually be beta screenshots.

      Check them out anyway, oh and sorry for not linking :)

    3. Re:Other news: beta leaked, apparently... by Austerity+Empowers · · Score: 1

      I don't like half life, or FPS's in general so I'm not going to buy it regardless, quake 2 pretty much was the pinnacle of that genre in my mind (up until everyone and his mom was cheating, so I understand the delay).

      However, having and being able to examine this code is the best thing that has happened to me in what has been a pretty shitty year. This is about as close to working in the game industry as I'm going to get (wrt having the source to a professional game engine) without having to put up with the low salaries and slave driver esque atmosphere associated with working in the game industry. It's hard just by reading texts and trade magazines to understand how people REALLY work. This source seems badly organized to me, but it is still fascinating.

      I'm not justifying the morality of the thief, what he did is clearly wrong/immoral and worthy of jail time. I should and will delete this (as soon as I'm done with it), but every cloud has a silver lining.

    4. Re:Other news: beta leaked, apparently... by Jugalator · · Score: 1
      At one of the links you provided:

      "It's not a beta as such, it's the source compiled with resources, put together by people who had both the resources and the know-how. I called it a pre-release for a reason, instead of labeling it an alpha or beta."


      If that's true, there might have been more leaked than we first knew. Perhaps the hacker rushed the source out because that was likely to cause a lot of attention on its own. (hackers like attention) But he had grabbed the entire hl2 tree with resources and all, and that might now have been leaked.

      Or perhaps Valve messed up once again, and allowed another hacker to once again grab stuff from their computers. Sounds unlikely though...
      --
      Beware: In C++, your friends can see your privates!
  33. I hope who ever did this... by Anonymous Coward · · Score: 0

    Goes to Black Mesa [pound-me-in-the-ass]Prison, if only there were such a place...

  34. Security through obscurity, yet again by bconway · · Score: 1

    People seeing your code requires it to be rewritten? There something seriously wrong there, Valve.

    --
    Interested in open source engine management for your Subaru?
    1. Re:Security through obscurity, yet again by Anonymous Coward · · Score: 0

      Alright, smart guy. What's the best way to prevent cheating so that the game is still playable, and so that it's secure?

    2. Re:Security through obscurity, yet again by sqlrob · · Score: 1

      How do you know there weren't any modifications?

    3. Re:Security through obscurity, yet again by bconway · · Score: 1

      Not code like a half-assed monkey? What's the best way to prevent exploitation so that a network service is still useable, and so that it's secure?

      --
      Interested in open source engine management for your Subaru?
  35. This proves that Eric Raymond is wrong by surstrmming · · Score: 1, Funny

    This proves that Eric Raymond was wrong in the Cathedral and the Bazar when he wrote ``Given enough eyeballs, all bugs are shallow.''. It's just wrong.

    If ESR had been correct, surely the source code leaking out to thousands of open source developers would have increased the speed of development, rather than slowing it down.

    1. Re:This proves that Eric Raymond is wrong by Anonymous Coward · · Score: 0

      I assume you're joking and not just an idiot.

    2. Re:This proves that Eric Raymond is wrong by dbavirt · · Score: 1

      The speed of development would be increased if Valve were taking patches from the community. I'm sure if I were to submit a patch, they would be sending a "welcoming commitee" for me.

  36. time to rewrite the code? by karb · · Score: 1, Funny
    That's a good one. I'll have to remember that next time I'm about to miss a deadline.

    "Yeah, boss, sorry the code is late, but it was leaked : therefore, it must be rewritten."

    --

    Jack Valenti and the MPAA are to technology as the Boston strangler is to the woman home alone

  37. ATI paid 6 mil to miss Christmas by Anonymous Coward · · Score: 0

    A Christmas release of Half-Life 2 would probably have been most welcomed.

    ATI must be pissed. It's rumored they paid $6 mil to get the half-life bundle. I'm sure they paid to get Christmas sales pumped. Guess Christmas is now Ground Hog Day.

  38. The story so far... by augustz · · Score: 1

    Valve spends years developing Half-Life 2. What seem at least like countless delays.

    Finally, they demo it. After hearing the critics rave, Valve decides to DELAY the game again and REWRITE portions of it. They cite the release of a small portion of the source code, rather than any bugs or incompleteness in the game itself.

    While some companies would keep or accelerate a release if they were worried about piracy, valve has deceided to take the opposite approach. Delay yet again.

    And the story continues...

  39. Bastards deserve it! by Microsift · · Score: 0, Insightful

    No Mac version of Half-Life....'nuff said

    --
    My other sig is extremely clever...
    1. Re:Bastards deserve it! by Anonymous Coward · · Score: 0

      Heh heh ever notice that the most successful and clever companies will make Mac versions of their software? This company lost their source code through an Outlook virus, so they are hardly clever. And they are losing money like crazy, so they are hardly successful. So I'm not surprised there is no Mac version.

    2. Re:Bastards deserve it! by McBeer · · Score: 0, Flamebait

      If you use a Mac as your primary machine and expect that people should cater to your idiocy and waste time and money writing games fo you, I hope you choke. Valve doesn't owe you shit, and there is no excuse for somebody stealing thier hard work. I work in the game industry and know just how hard it is to accomplish what they have done. If they want to delay release for any reason whatsoever thats thier decision. They don't owe you shit as I said before.

      --
      Hikery.net - The best hiking site ever. Made by yours truly.
    3. Re:Bastards deserve it! by TwistedGreen · · Score: 1

      I'm sure someone will manage to port it now :)

    4. Re:Bastards deserve it! by idsofmarch · · Score: 1

      I hope you swallow. The original post was stupid sure, but to say "[to]use a mac as your primary machine...and waste time and money writing games for you.." is just piss and bile. I'd appreciate it if more companies like Valve would more titles for the mac. However, no one should hack a system and steal source code, no matter how easy or difficult to obtain. I would say that using Outlook seems like a bad idea for a company so invested in protecting their data.

      --
      Anyone who whines about being modded down should be.
  40. Source's source changed? by GeneralCern · · Score: 1

    Isn't it possible that the code was not just leaked? (Assumimg the crackers had full access to the production box.) What if there was subtle addition of mal-ware? Can you imagine what would happen if Half Life 2 installed a Trojan? I can easily see them spending a good amount of time just trying to make sure this doesn't happen.

    1. Re:Source's source changed? by mstamat · · Score: 1

      Have you ever heard of versioning systems (e.g. cvs)? Assuming that their programmers check-in their code at the end of each day, Valve can detect&remove any mal-ware added in a few minutes without losing more than a day's work

    2. Re:Source's source changed? by Anonymous Coward · · Score: 0

      If the time of the first intrusion can be definitely established, it may be easier to audit cvs updates since that time, rather than an entire audit of the code tree. But either way -- major, major headache.

    3. Re:Source's source changed? by sqlrob · · Score: 1

      Assuming of course, that the cvs (or SourceSafe) server itself wasn't compromised as well.

    4. Re:Source's source changed? by GeneralCern · · Score: 1

      Hmmm. Sorry, I didn't realize there was a 'DETECT MALWARE INSERTED DURING INTRUSION' function in CVS or Sourcesafe. Is it a checkbox or do you need to press a button?

      Seriously, assuming that Valve has a fair amount of programmers, and those said programmers were in crunch mode fixing bugs, optimizing code, etc., and further assuming the crackers were clever enough to name the mal-ware something slightly non-obvious, don't you think comparing the delta's in the source code would yield a larger amount of information than that which could be processed 'in a day's work'?

      You are also assuming that Valve can pinpoint exactly when the intrusion took place. The delta's grow significantly the farther back in time you go. If the CVS system itself is compromised, then all bets are off (as a previous poster already noted).

      When you also take into consideration the amount of time spent doing damage control to find/plug the leak, change the key-gen code, and test the changes, I can see how a 4 month delay would start to become realistic. Especially since I am sure Valve is in 'caution mode' now having been burned once already.

  41. Re:Likely a change to stop "pirating". by Anonymous Coward · · Score: 5, Insightful

    Yeah, or they could consider free copying of the games as promotion for their concerts, where they make the real money.

    When will Slashdot users grow up?

    Games, movies, and even songs from the Backstreet Boys cost huge amounts of money to produce. You will be charged for copies, one way or another.

    If people can't figure out how to slow down this ridiculous level of IP theft pretty damn soon, I guarantee you that we will have DRM shoved down our throats. In this case already, the delay of several months is probably to put in place with is effectively DRM, in order to cut down on multiplayer cheats.

  42. Sounds fishy by Fnkmaster · · Score: 2, Insightful
    I'm assuming the only reason the lifting of some portion of source code would lead to a delay is if it contained their copy protection code. Otherwise, so what if somebody obtained 1/3rd of the source code? What would they do with that, other than perhaps guide them a bit in disassembling the finished executable, assuming they could figure out what was what. If their copy protection system was sufficiently robust, they should be able to get around a compromise of that with a few changes - it shouldn't require months. But then again, if you assume even a moderate number of changes need to be made, the re-testing and repeat QA work required could take a fair amount of time.


    Still, it sounds more like this is a convenient excuse for late delivery to me. I'm sure this guys email really was compromised, and hey, it sounds good to the uninitiated - "our code was 'stolen', we have to go rewrite a lot of it, we'll be delayed by a few months".

    1. Re:Sounds fishy by Overly+Critical+Guy · · Score: 1

      I'm assuming the only reason the lifting of some portion of source code would lead to a delay is if it contained their copy protection code.

      Then your assumption is completely wrong. The Steam code was leaked. Also, people will be writing tons of hacks and cheats now that they are exposed to the source code.

      Still, it sounds more like this is a convenient excuse for late delivery to me. I'm sure this guys email really was compromised, and hey, it sounds good to the uninitiated - "our code was 'stolen', we have to go rewrite a lot of it, we'll be delayed by a few months".

      The Slashbot mindset--every corporate action is a conspiracy.

      --
      "Sufferin' succotash."
    2. Re:Sounds fishy by Anonymous Coward · · Score: 0

      and hey, it sounds good to the uninitiated

      And to the initiated, as they actually have an idea on what has to be done.

      a: the Steam code leak
      b: The API change to prevent hacks based on the leaked source code.
      c: check over the existing code or roll back to a before hack version of the code then re-apply all the changes since then.
      d: all the things that I'm missing here

      All of this is going to take time. The only people who don't realize this are the ones who think they've got a clue, and seem to be so vocal with that clue.

    3. Re:Sounds fishy by hughk · · Score: 1
      I agree, here is a hypothetical situation:

      You have your product 95% done. Yes, we all know about the other 5%.

      Your VC is breathing down your neck for a release, threatening to sell the company from underneath you.

      Now your source code is out, it would be hard to sell the company, as the trade secrets are compromised the resale value is low. It could also give a springboard for the people leaving the company because any purchaser would know the state of the code and be able to do a rapid "Due Dilligence" and decide they need the original coders to be quick to market.

      This is a dreadful hypothesis but an interesting strategy for dealing with excessive pressure from a bad VC company. I don't think that VALVE is doing this, but there remains a very slight possibility.

      --
      See my journal, I write things there
  43. Re:Likely a change to stop "pirating". by 110010001000 · · Score: 1, Insightful

    Good idea. They could ask for $15 million or so and setup a Paypal link.

    Better idea: they could setup a seperate paypal link for each employees paycheck!

    Its obvious though that since the code was stolen, they need to completely change their business plan. That is obvious. There is no way that anyone else could possibly sell software now. Microsoft should give up selling software too, someone might steal the sourcecode to Wordpad.

  44. No need to wait by Anonymous Coward · · Score: 0

    No worries. There is a working "beta" floating around. Source isn't all that was taken.

    Believe nothing you read and half of what you see.

  45. How will this affect the ATI bundle? by FuzzyGuru · · Score: 1

    Ati is supposed to be bundling Half-Life 2 in with their new 9600XR and 9800XT graphics cards.

    So, will we all just get a coupon?

    How will this this affect Dell? They are the other partner involved. more info here

    --
    OK - who stole my duct tape?
    1. Re:How will this affect the ATI bundle? by My+name+isn't+Tim · · Score: 1

      It is a voucher in the box and yes you will have to wait for the official release to redeem it you have a choice between download or CD (4-6 weeks delivery though)

  46. Parts that will need rewriting by Builder · · Score: 2, Informative

    There are a lot of posts asking why the delay and why does it need rewriting. I would guess that the majority of the game WON'T need to be recoded, but certain things like CD key auth code will, certain networking code, etc.

  47. Why? by Anonymous Coward · · Score: 0

    Did they say why they were delaying it?

  48. Being "poor sports"? by neuro.slug · · Score: 1

    Valve just sounds like a bunch of whiny babies now, somehow punishing everyone for one person's wrongdoing. I'm not sure what they hope to accomplish by doing this.

    3. Act stupid
    4. !Profit

    I guess Doom 3 will be ruling the shelves this winter

  49. Half Life 2 Beta Just Got Released by dr+ttol · · Score: 0, Redundant
    Okay, no lies, the half life 2 beta just got released.

    Check out here for screenshots.

    Before, it was just the blueprints that got released. Now the whole house with wallpapers and furnishings as well was released.

    I did a exe size comparison and guess what? They match the sizes you get from compiling from the source.

    Feel free to mod me up as I'm sure you all will ;)

  50. Not true according to this by Overly+Critical+Guy · · Score: 1

    This says otherwise. In fact, Gabe Newell says only a small portion of source was taken.

    --
    "Sufferin' succotash."
    1. Re:Not true according to this by nolife · · Score: 1

      Yeah but look what Skynet was able to acomplish with only a piece of a CPU.

      --
      Bad boys rape our young girls but Violet gives willingly.
  51. 4 months to do what, exactly? by Ndr_Amigo · · Score: 2, Interesting

    Four months to rewrite what exactly? Apart from possible Steam issues, for which I can't see four months solving any more than two weeks, there is (allegedly) nothing in the actual game source worth changing. Let's outline what will probably be done, to what should really NEED to be done:

    * A week or so to fiddle with Steam and break compatibility enough to prevent the leaked source being of any use. Although, as it is supposibly a secure content distribution system, I do not see how the source floating around would hurt it. But then again, HL2's "Source" engine was supposed to be all new, but in reality it's (allegedly) still based off of Quake1/the original HL1 codebase.

    * A few days to change some APIs to prevent engines compiled against the leaked code from running the release game DLLs. Again, this shouldn't really be needed - the server should be anti-cheat enough to catch abnormal physics behavior (eg, no walk/shoot-through walls, Neo style flying blah blah), and optimised enough not to send entitiy data for players/objects not REALLY in the players view (eg, no see-through-walls cheat)

    * Another few days to similarly break the network protocol. This is easy enough to do ACCIDENTLY when coding engines, so... :)

    In reality, nothing SHOULD need to change... and the only things worth changing should only take a short amount of time and only be in the form of obscurification and not be subject to the need for extensive re-testing.

    Ah well.

    1. Re:4 months to do what, exactly? by Kpau · · Score: 1

      Obviously very few people on Slashdot have ever been involved in COMMERCIAL software development. You change the APIs, change the interfaces, move the data... guess what? ALL your validation and verification testing is SHOT. Any software project leader with any sense would hve zero confidence in the codebase. Every piece of code changed triggers a retest and re-integration of all systems that have any connection to it. They're going to have to do the entire test suite over and possibly even drop back to alpha level. I am of course, assuming, that Valve follows some sort of software methodology and not the "infinite keypounding monkeys" method -- in which case their customers are fucked in the way "Pools of Radiance 2" or "Shadowbane" fucked the community.

    2. Re:4 months to do what, exactly? by Thornkin · · Score: 1

      I agree, all of these should be simple fixes and not take too long. However, you have to remember testing time. Any time you are changing all of the API's and protocols, you now need a lot of time to make sure that the changes all play nicely together.

      That said, I have no idea why they think they need to make all of these changes. The game should be built to be immune to this sort of thing. After the game is released, someone is bound to figure this stuff out either through code leaks or through reverse engineering. The game should be robust enough to withstand a source code leak.

    3. Re:4 months to do what, exactly? by Anonymous Coward · · Score: 0

      Ah, but you must have forgotten the algorithm for *actual* development time:

      Double the number and increment the time period.
      Your estimates total to about 2 weeks, right. That comes to about 4 months.

    4. Re:4 months to do what, exactly? by Anonymous Coward · · Score: 0

      Why even ask this question? Are Valve answerable to you sir? No sir, they are not.

      Their code has been compromised. They even have the right to pull the plug on the whole project completely, should they wish to e.g. if this leak has cost them too much money. Do they answer to you? No. Will they reply to your misinformed speculations? Probably not.

      The last thing they probably want is smart alecs giving their opinions on what they should or should not be doing after this catastrophy.

    5. Re:4 months to do what, exactly? by Ndr_Amigo · · Score: 1

      That's true, but the API and protocol changes need only be compatibility-breaking and superficial. It really only needs to affect the renderer and network portions of the game (the SDK will almost certainly be opened up for modding, so that API - being the major and most tricky one - shouldn't need any real changes). Even with a month of hard-core testing afterwards, the timeframe really just doesn't add up.

    6. Re:4 months to do what, exactly? by Ndr_Amigo · · Score: 1

      I have, and I also have been deeply involved in the Quake codebases and reverse-engineering of Half-Life itself... So I am WELL aware of exactly how all the API hooks interact and the possible testing procedures they could use. I still hold true that any of the potential changes they should (from the result of the source-leak, assuming thats the SOLE reason for the delay) want to make are not those that should affect the majority of the engine or interaction between the core components. Eg, localised testing of the changes.

    7. Re:4 months to do what, exactly? by Kpau · · Score: 1

      Admittedly, (after all this is Slashdot), we're speculating somewhat and I definitely plead guilty to not having scanned the leaked base to critique the modularity. So lets be massively conservative and figure it takes six weeks (a couple of weeks of brainstorming analysis to make sure nothing "down the road" is impacted, a couple of weeks of unit changes and tests, and at least 2 weeks of inhouse system level retesting). A lot of that time is spent twiddling from impacts due to the network overhaul the suits ordered (rather than just clipping the wires). They'll miss the Yuletide season (distribution clogs and the pain of a mid-December release). January and February are kind of murder on new release sales so their marketroids are probably saying March is the next best release date. But then, I get my revelations from dust motes.... Here's a question: how automated are the test suites for a typical game development project? Do they have autobot mice that search terrain geometry for holes? (anyone remember that hole in the map in Tribes ice station map?). Do they automate user creation decision trees? OT: I worked with an inhouse compiler once... if the code compiled, the return code was: "None of the errors were detected." Here's hoping HL2 doesn't pull a Tribes 2 or Pools of Radiance on release because of this.

  52. Re:Likely a change to stop "pirating". by l810c · · Score: 1
    It's a risk, but the donation model can pay off big.

    Please define 'big'

    A) Big as in cover the cost of the webpage, the weekly caffeine and *maybe* a little computer hardware.

    -or-

    B) Big as in the #1 computer game release of the year. More revenue than most Hollywood productions. Hundreds of millions big.

  53. Don't Delay by sh0gun · · Score: 1

    Even though the source code was leaked, can we still classify this as vaporware?

    But seriously folks. I would think if anything they would want to push the release of the game and get it out as soon as possible. With the source code being leaked another company might be trying to use the stolen source.

  54. What's the reason again? by lawpoop · · Score: 1

    Why exactly does a source code leak push the project back 4 months? Are they trying to punish the gaming community? Did they need to push back the release, and this is a good excuse?

    --
    Computers are useless. They can only give you answers.
    -- Pablo Picasso
  55. A great example.... by Junta · · Score: 1

    This is a great example of how important a highly competent IT staff is to a business. The end of year figures for their finances is going to look horrible, probably in part because they viewed 'cheap guy that happens to have a MCSE' as suitable IT versus seasoned, yet experienced IT experts.

    In the face of this, the 15-20k a year extra per IT staffer can be seen as a reasonable insurance rate when this much is at stake. What kind of infrastructure do they have there? Obvious that the development workstations are Windows, the use of Outlook makes me suspect they likely use Exchange and therefore likely a Windows-centric infrastructure through and through, including net-facing systems running open services.

    I can understand in Windows game development that Windows workstation is a requirement, but I will kick and scream and point out this incident among many others as examples of why not to use MS products to handle mission critical or sensitive information. You just don't have the control and flexibility required to really adequately secure a MS box.

    --
    XML is like violence. If it doesn't solve the problem, use more.
    1. Re:A great example.... by Anonymous Coward · · Score: 0

      Of course you're right, but in America the cry is "cut costs and screw everything else".

  56. Re:B.S. -Welcome to the real world by Anonymous Coward · · Score: 0

    There are not infitinite budgets, your products WILL HAVE SECURITY FLAWS.

    Since we are talking video games and not Nuclear Secrets,....Security though obscurity is "STILL SECURITY".

    They could throw another N million at the issue to hopefully eliminate all issues but:

    -This costs money
    -This delays release

    And they'd be in the same boat they are now.

  57. Cry me a river by Henry+V+.009 · · Score: 1

    I am dubious of this claim. The loss of the HL2 code was not actually as damaging as they claim. The cheats will be out there no matter what.

    What game companies should be doing -- only they do not have the smarts to understand why it would be a good idea -- is pursuing open-source development right from the sort. Let any fan who wants to see the status of the completed project log-in and see the code at any time. Hell, let them send in their own code and save you the work.

    What would a company lose? Will other game companies steal their code? Yeah right -- like they'd risk it. Valve's grandest dream is for id to steal even one line of HL2 code. They would morph into the SCO of the gaming world in about 5 seconds.

    Would they lose out because "techniques" were stolen? Yeah right. Most game programming is the insertion of completely obvious techniques into a huge mess of a game. It is organization that is the hard part, and that cannot be stolen without lifting code wholesale.

    So until some company wises up, we are going to hear a lot of whining from game companies about this sort of thing: "We are working so hard for the community, why are they so ungrateful as to do this to us poor programmers, now we'll delay the game." Cry me a river.

  58. Oh yeah. by Ndr_Amigo · · Score: 1

    Also, I hear the leaked code compiles fine - so I'm not sure where this 1/3rd figure comes from. Gamecode I guess...

  59. Upgrade by DJCouchyCouch · · Score: 1

    I think they're just waiting until I upgrade my 700mhz Duron. Thanks for thinking of me, Valve! DJCC

  60. DRM Rewrite? by onyxruby · · Score: 1

    DRM Rewrite? The code that was copied was the game's engine. Not the levels or graphics files. Nothing would be spoiled by this, because the player interaction part wasn't copied. A delay of a little while would make sense just to make sure the game itself wasn't trojaned, but an additional four months? I don't buy it.

    This has to be DRM vulernability concerns. They will lose millions from not selling over the holidays, and nothing with the engine itself would justify this.

    After all the engine is fairly easy to detect if someone ever decides to try and make an unathorized copy or derivative, and this would be suicide to commercially exploit. Are they sincerely that worried about a driver exploit based on insider knowledge of the engine, enough to deliberately lose millions in holiday sales - especially with Doom 3 already pushed past the holiday season which they would have owned, I don't think so.

    They are bringing this delay on themselves, causing their own problems, and deserve no sympathy for any lost sales.

  61. 61MILLION dollars in a YEAR ? by selderrr · · Score: 1, Interesting

    omfg... even if they work with 600 programmers, that's still a whopping $100.000 per programmer in one single year

    HL2 better be damd good for such an insane amount of cash. Considering that they've been working on it for what, 5 years ? They've drained a staggering $300.000.000 or so. At 40$ per copy, they'd need to sell 7.5million copies of the game to get break even. And that's not counting money spent on advertising, distribution, and the cost of setting up a central network server that can handle 7.5 million players connecting to play online.

    1. Re:61MILLION dollars in a YEAR ? by OAB · · Score: 1

      VU Games is Vivendi Universal, not Valve. It's still a stupidly large amount of money to loose tho'

    2. Re:61MILLION dollars in a YEAR ? by standard+method · · Score: 1

      Companies like this don't lose money based on what it costs to make things. Oddly enough. They lose money because of investors pulling out, selling shares, reducing the value of the company as a whole.

      That's how they "lost" all that money, probably.

      ---

      --
      "I'll be a killer whale, when I grow up"
      -Wintersleep
    3. Re:61MILLION dollars in a YEAR ? by stuartkahler · · Score: 1

      That loss is for the whole company, which has many more titles that it's working on. I'd be surprised if any software companies stay in the black all year, considering how massive sales are during November and December. Most retailers barely break even the first 10 months of every year, and make all their profits in the last 60 days.

      I think a big part of the HL2 profit strategy will be to sell the game engine to other game developers. If you can license the thing to 15 game makers at a million apiece, you've made some serious coin. Once HL2 comes out, people are going to expect the features it has, and games in the pipe right now can move to the HL2 engine for alot less money than coding their own.

      I think the real reason for game manufacturers losing money is that the consoles are getting old (massive back-inventory of titles for $10-20), and PC game makers have been mostly releasing shit for the past two years. And the shit has been slow to arrive as well. I've hardly had anything to look forward to for the last 2 years, and starting a month ago, it's been raining good games in the PC market.

    4. Re:61MILLION dollars in a YEAR ? by Zak3056 · · Score: 1

      omfg... even if they work with 600 programmers, that's still a whopping $100.000 per programmer in one single year

      VU is Valve's parent company, not Valve itself.

      --
      What part of "shall not be infringed" is so hard to understand?
    5. Re:61MILLION dollars in a YEAR ? by BattleTroll · · Score: 1

      omfg... even if they work with 600 programmers, that's still a whopping $100.000 per programmer in one single year Considering that benefits can account for up 50% of the total cost of employment, I suspect these devs are making significantly less then $100k/year.

  62. nvidia shaders by Adolphus · · Score: 1

    It is my understanding that the game was to be delayed for some time because the game runs unplayably slow on most (even the newest) nvidia hardware. I think this is partially because the shaders are written in DX9, and DX9 does not take full advantage of the GeforceFX features; in fact it rather favors the ATI cards.

    1. Re:nvidia shaders by GoSpeedRacerGo · · Score: 1
      That is rediculous. Do you think ATI (who paid $6M for exclusive marketing rights) would tolerate HL2 being delayed for NVIDIA's benefit?

      And as for the generic DX9 favoring ATI cards inference. While it is true that the DX9 minimum spec is more aligned with ATI's hardware rather than the higher precision NVIDIA hardware, the source code has exposed a good deal of the custom, ATI-written shader code that is in HL2.

      Your understanding was paid for by $6M and in cases like these it was money well spent.

    2. Re:nvidia shaders by Slack3r78 · · Score: 1

      There's plenty of code scattered throughout there written by an ATI coder, true. But it's written to DX9 spec. The way I see it, nVidia's hardware just plain isn't up to snuff right now. They love to play the precision card as an excuse, but the cards are still running slow even at their 16bit setting, which is below DX9 spec. What good is 32bit precision if the card is unusably slow? The 'ATI-specific' code is nothing more than regular DX9 code - it's nVidia who needs their own, special codepath.

      I should add the disclaimer that this doesn't make me happy as I've always liked nVidia cards and owned nothing but nVidia from the TNT2 up to this past month... when I bought a Radeon 9600 Pro. When the FX cards first came out, I was skeptical about ATI's lead, but the past 2 months have convinced me that nVidia is, and will be, behind until at least the next generation of GPUs. The GF FX is just plain inadequate for DX9 level shaders.

    3. Re:nvidia shaders by SynKKnyS · · Score: 1

      (Note: I own at least 5 NVidia cards and only one ATI card.)

      While it is true that the DX9 minimum spec is more aligned with ATI's hardware rather than the higher precision NVIDIA hardware, the source code has exposed a good deal of the custom, ATI-written shader code that is in HL2.

      It is also revealed there is a lot of NVidia specific code in there, too. They are optimizations just like the ATI specific shader code. Unfortunately, NVidia hardware is to blame for slow DX9 performance. The GeForce FX may have higher precision, but only 1/4th of its shader units are DirectX 9 shader units. The rest are DirectX 8 class only. It is amazing that Valve has squeezed as much performance as they have out of the GeForce FX. Carmack countered this in Doom III by switching on half precision shaders where precision was not neccessary. Being different beasts, Source may require high precision shaders in more places, but may have tried to use half precision shaders where they could.

      This issue has been brought up over and over again; NVidia just needs to release newer hardware.

  63. Release dates by gsparrow · · Score: 1

    I don't even know why they try to set release dates based on marketing efforts. They should be based around the build of the application

  64. Bullshit story. by nlinecomputers · · Score: 1

    This whole story smells IMHO. If the game was to be released to market for X-Mas then it would be going to the printers now if not already being shipped to warehouses to be on the shelves by Thanksgiving day. A code leak while anoying is no worse then the program appearing on Kazza and 500,000 warez sites within hours of it hitting the shelves.

    I would think that game makers would be targets of hacker/cracker all the time so one would think that they would have pretty good security. I've read comments about Outlook preview pane buffer overruns and blaming the lastest IE hole on this leak. Makes a great story and alot of M$ bashers will believe it but I have my doubts.

    Also this line In a statement today, the games publisher said that Half Life 2, an expected blockbuster, will now contribute to 2004 results. shows the real reason. They want to delay the profits onto the 2004 books. It's all a bunch of Marketing bullshit. I wouldn't be suprised that the code was LEAKed. After all they didn't get all the code if I heard correctly. They managed to get breached yet DIDN'T get the whole code? Yeah right...

    --
    Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
  65. Uninformed by Overly+Critical+Guy · · Score: 1

    I have to wonder how long until people start to realize that for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

    Well, before you start blasting Valve, why don't you actually read up on the hack? It was a buffer overflow in the Outlook preview pane that allowed the hacker to install custom versions of RemoteAnywhere. Password sniffers and other keyloggers were installed on various machines to grab passwords and so forth.

    The machine with the code was not connected to the net. It was, however, on the network.

    --
    "Sufferin' succotash."
    1. Re:Uninformed by Anonymous Coward · · Score: 0

      if the machine was getting email then it was in some way connected to the net.

    2. Re:Uninformed by Zan+Zu+from+Eridu · · Score: 1
      What good is installing RemoteAnywhere, password sniffers and keyloggers if the machines are not connected to the internet?

      Yes, the email could have been transported to the machines over a sneakernet, but how do you suppose the code got out?

    3. Re:Uninformed by Oddly_Drac · · Score: 2, Insightful

      "Well, before you start blasting Valve, why don't you actually read up on the hack? It was a buffer overflow in the Outlook preview pane that allowed the hacker to install custom versions of RemoteAnywhere."

      Alledgedly.

      And when was that exploit patched in Outlook Express?

      I think it's perfectly justifiable to have a giggle at Valve because that's the kind of schoolboy error that companies are not supposed to fall victim to, especially software companies.

      --
      Oddly Draconis
      Too cynical to live, too stubborn to die.
    4. Re:Uninformed by Overly+Critical+Guy · · Score: 1

      Alledgedly.

      That's what happened according to Gabe himself.

      --
      "Sufferin' succotash."
    5. Re:Uninformed by bryhhh · · Score: 2, Informative

      I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

      I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

      I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

    6. Re:Uninformed by bensgroi · · Score: 0

      since when do id and Quake 3 have anything to do with Valve, as per your 5th link?

      --
      You'll like being a dude!
    7. Re:Uninformed by Slack3r78 · · Score: 0, Flamebait

      You have to remember though, Valve was formed by former Microsoft employees. They truly believe in MS software as a platform, and this is part of the reason why they're so gungho about DirectX.

    8. Re:Uninformed by Slack3r78 · · Score: 1

      Replied to the wrong post. Sorry. =)

    9. Re:Uninformed by Drachemorder · · Score: 1
      "I love to know why a source code leak cost them four months?"

      One major reason is that they're trying to make it difficult to cheat. Cheating has been a major problem in the original half-life. If the cheaters have the source code, they can likely come up with more efficient or less obvious ways to cheat.

    10. Re:Uninformed by bryhhh · · Score: 1

      Fair enough, but judging by past experience, it will take a matter of days/weeks for cheats to surface no matter what state the final software is realeased in.

      It's frickin annoying for those of use who are only interested in playing the single player mission - It's like we are being punished for Valves own incompetance. Why can't they release a fix 4 months later to stop cheats rather than delay the launch by 4 months? They are guaranteed to release a patch within the first six months no matter what the release date is.

    11. Re:Uninformed by smallfeet · · Score: 1

      Humm... I like this conspiracy angle much better. Valve knows they can not meet their December dead line. 'Yikes', they says, 'if we slip again our stock will really take a hit'. So they fake a break in, claim some code and art was stolen and that now they have to slip four months. Trouble is the stock takes a hit anyway. This theory has merit because: 1) Why slip the release? Makes no sense, just ship it anyway. 2) I am up to post 50 or 60 in this /. article and there has not been a link to the code/game yet. Gentlemen and lady, I rest my case.

    12. Re:Uninformed by Disevidence · · Score: 1

      I always thought Valve was formed from the mod team of the original tf for quake 1. Am i wrong?

      --
      Think nothing is impossible? Try slamming a revolving door.
    13. Re:Uninformed by Slack3r78 · · Score: 1

      I'm not sure about that, but I do know that Gabe Newell and one of the other founders of Valve (who's name escapes me at the moment) were both former MS employees who had literally made millions off of MS stock options before they started Valve. This is why Valve was able to function pretty much as an independent developer before even the original Half-Life was released.

    14. Re:Uninformed by darc · · Score: 1

      Get on kazaa, note that REAL source is available.
      Notice that there were bittorrent links in the original article, and rampant piracy thereof thanks to slashdot.

      Get clue before posting.

      --
      Tired of legitimate data sources? Try UNCYCLOPEDIA
    15. Re:Uninformed by Oddly_Drac · · Score: 1

      "Get on kazaa, note that REAL source is available."

      Is that the one with 'REAL' after it rather than the fifteen other trojans, four 'is fake' text files and the one proclaiming that it's also a 'teen'?

      --
      Oddly Draconis
      Too cynical to live, too stubborn to die.
    16. Re:Uninformed by Oddly_Drac · · Score: 1

      "That's what happened according to Gabe himself."

      Accepted, although I believe part of my incredulity is still this problem of people having a fairly lax approach towards security, particularly in high profile companies.

      --
      Oddly Draconis
      Too cynical to live, too stubborn to die.
    17. Re:Uninformed by WNight · · Score: 1

      If they'd actually code it securely you could hack it but you wouldn't gain extra info because it wouldn't send anything that you weren't supposed to see. (Well, perhaps a packet or two before the person reached the door, but not completely on the other side of a wall or anything.)

      Their lame security via code obscurity and anti-debugger tricks just mean that anyone who uses a debugger for legit reasons gets annoyed when the game won't play, but doesn't actually help security. Even their constant updates (Q3 as an example) doesn't stop the cheats, it only makes them come out with new versions every few weeks. Perhaps they're a bit harder to find for people who haven't mastered google searching, but for anyone willing to spend an hour looking, they're just as easy to find.

  66. This Just in by VEGETA_GT · · Score: 2, Funny

    Doom3 to beat Half-Life 2 to market

    Now isn't this a scary messed up thought

    1. Re:This Just in by Patrik_AKA_RedX · · Score: 3, Funny

      Nah, Duke Nukem Forever to beat Half-Life 2 to market.

      Now that's scary.

  67. You are a dumbfuck by Anonymous Coward · · Score: 0

    You are a dumbfuck.

    Do you not understand why they are delaying the release?

    They need to make sure that licensing still works, dumbfuck. They need to ensure that their intellectual property, worth hundreds of millions of dollars, cannot be compromised. What's the point in releasing a product if people can write key generators for all the licenses?

    A small portion of the code? It was 33% of the code, and contained the engine. You are a dumbfuck.

    Please tell me which companies would accelerate a release if their source code were stolen and released on the internet? Please give me a list of "some of the companies" that would do this? It's stupid.

    Something unexpected and detrimental happens to your one and only product, so you decide to continue with the release date? Why? After 9-11, do you think people kept their deadlines? You DUMBFUCK!

    You sound like a 15-year dumbfuck who doesn't understand how the real world works. Grow up before you post more dumb shit, asshole.

    1. Re:You are a dumbfuck by Anonymous Coward · · Score: 0

      LOL, I too love how these game stories bring out the high school programming and business experts.

    2. Re:You are a dumbfuck by Anonymous Coward · · Score: 0

      Actually, you're the idiot here. Coming up w/ a new algo for keys, changing up the networking and steam code is two-three weeks work, tops. If the delay really winds up being 4 months, I call shenanigans. Also, your comparison of the Valve source code theft to 9-11 gets you A-1 asstard status in my book. HAND.

    3. Re:You are a dumbfuck by Anonymous Coward · · Score: 0

      What's the point in releasing a product if people can write key generators for all the licenses?

      Look at how well Counter Strike sold in stores, and that mod was FREE. Companies vastly overestimate how much piracy actually hurts them, or more to the point, they use it as a convenient excuse as to why their products aren't selling.

      If you have a quality product, you'll still be able to sell if even though people can potentially get it for free somewhere else. Sure you might lose some money, but in my experience, the people that got it for free would have just done without it if they couldn't get it for free.

      I can't believe I actually fell for replying to this post... ugh, I feel dirty.

      -- gid

  68. Whatever by Anonymous Coward · · Score: 0

    This is like getting a headache and calling in sick from work, when in reality you wanted to skip work all along.

    Why can't they just admit they were going to delay anyways and just needed an excuse?

    Probably because vivendi is riding their asses.

  69. This is why there could be a delay by Pvt_Waldo · · Score: 4, Insightful

    It's not because the game leaked, but because the underlying systems that ensure that players can't easily cheat, warez the game, or access the personal information of other players.

    Part of what was compromised was probably the code that handles CD key authentication, user online authentication, etc. So clearly warez and such for this game could be hugely rampant.

    Part of what was compromized was probably the code that handles Valve's anti cheat system. So clearly the cheats that override that system could be hugely rampant.

    Part of what was compromized was probably the code that is the game's engine. So clearly there could be cheat authors easily creating wall hacks, aim bots, and any number of other cheats.

    Part of what was compromized was probably the code that handles purchasing the game over Steam. So clearly there could be some risk of credit card and online commerce fraud, personal information leaks, etc.

    Look at it this way. The blueprints and plans for the bank got stolen. Thieves are studying them now. The bank is going over the blueprints with a fine toothed comb to fix the obvious (and not so obvious) weaknesses which are more clear when you have the plans.

    1. Re:This is why there could be a delay by moshez · · Score: 1

      Why did the bank not do this *before* the thieves got their hands on the plans? Surely, it could anticipate the likelihood and hire the security specialists when they installed the safe. In fact, banks do. This is what we mean by "security by obscurity doesn't work".

    2. Re:This is why there could be a delay by radish · · Score: 2, Insightful

      Yeah, cos no one ever decompiles anything. Please. If your lovely CD key checking system is vulnerable to a source code release, then it's just plain broken.

      --

      ---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"

  70. Delay good and bad by Zed2K · · Score: 1

    Bad because it will make it tight for them financially. Bad because of all the whiners (see posts below mine) and conspiracy theorists who have nothing better to do with their lives except assume that whenever something happens its always the company trying to hide something. Bad because we will all have to keep hearing the whiners complain over and over again about a GAME! Bad for hardware makers because there are tons of people waiting for this game before they upgrade their machines or buy new computers.

    This is good for those of us who are waiting to buy new computers. It gives us even more time to save up and wait. There is always some new video card or cpu just on the horizon. The money I would have spent today will be able to buy something better for the same price in April.

  71. Playable beta data leaked by Fnagaton · · Score: 1

    The playable beta demo with data has been probably been leaked. See here:

    http://www.neowin.net/forum/index.php?showtopic= 10 6246&st=30

    Also "Today the Half Life 2 Beta leaked across the world onto the internet via IRC channels. The release by "anon" shows it's obvious that the hackers who managed to sucessfully steal source code of the game itself also stole the game itself and who knows what else." from http://www.neowin.net/

    --
    Martin Piper
    Owner - ReplicaNet and RNLobby
  72. Wrong by Overly+Critical+Guy · · Score: 2, Interesting

    Ever heard of a little thing called Steam? All mention of CD authentication and so forth aside, Steam was supposed to be the big thing to stop cheating.

    Now it's all exposed. People were going to give their credit card numbers to this thing. Now it's open for all to see and anyone can exploit/spoof it.

    Yes--contrary to the Slashbot idealist mindset--there are cases where security through obscurity is the best method. You have to look at each situation inviduallly and logically (instead of covering everything with a veil of ideology).

    This is nothing more than them using this as an excuse for delaying the game - something that would have happened anyway.

    Yeah, it's "nothing more," oh Valve Software insider. Please. The game was ready to ship for September 30. The hack happened September 11. Guess what was announced not much longer later? That's right, the delay.

    We'd already be playing this game if it wasn't for the source leak. Valve's plans were ruined. I'm hoping for late November.

    --
    "Sufferin' succotash."
    1. Re:Wrong by Synn · · Score: 2, Interesting

      Yes--contrary to the Slashbot idealist mindset--there are cases where security through obscurity is the best method. You have to look at each situation inviduallly and logically (instead of covering everything with a veil of ideology).

      If security through obscurity was the best method here, then what would've happened if the source was leaked after the game had hit the stores?

      They would've been totally screwed.

      That's why security through obscurity is never the best method.

    2. Re:Wrong by Anonymous Coward · · Score: 0

      Which is all well and good, but none of that stuff was in the leaked src tree.

      All that was, was references to binary-only link files. Commented out refs, at that.

      Security through obscurity is never the best method.

      There were delay rumours about HL2 - and stores claiming a December release date - long before September 1st.

      And the new one is April 2004.

    3. Re:Wrong by Overly+Critical+Guy · · Score: 1

      If security through obscurity was the best method here, then what would've happened if the source was leaked after the game had hit the stores?

      They'd be just as fucked as they are now. What's your point?

      --
      "Sufferin' succotash."
    4. Re:Wrong by johnnyb · · Score: 4, Interesting

      "there are cases where security through obscurity is the best method"

      PLEASE don't say this. I understand what you're trying to say, and that is correct, but your wording is completely horrid.

      Obscurity is just that - obscurity. Using obscurity for protection is actually a decent plan in many cases - it's just not the same thing as security. The problem with "security through obscurity" is not that people aren't protected enough, it's that they are _confusing_ security and obscurity - thinking they have security when they only have obscurity. Both offer protection, but with different expectations.

      There is NO SUCH THING as security through obscurity, and those who try show a complete misunderstanding of the issues. The can be _protection_ through obscurity, but security in relation to computers has a certain, specified meaning, and when people start throwing it around in connection with obscurity, it just makes the situation a lot more confusing than it needs to be.

    5. Re:Wrong by Overly+Critical+Guy · · Score: 1

      Which is all well and good, but none of that stuff was in the leaked src tree.

      Yes, it was. The source for Steam was in that tree (along with Hammer, TF2, etc.).

      --
      "Sufferin' succotash."
    6. Re:Wrong by SlightOverdose · · Score: 1

      I use obscurity as a "last tier" defence against hackers. If someone manages an exploit, they end up seeing my custom linux distro built from the ground up. And, literally, the only thing on my standard servers is apache and its immediate dependancys (libc, etc). I dont even have a shell installed.

    7. Re:Wrong by Overly+Critical+Guy · · Score: 1

      In other words, my point was valid, but you just decided to rant for a few paragraphs about semantics for no reason. My "wording."

      --
      "Sufferin' succotash."
    8. Re:Wrong by Durandal64 · · Score: 1
      Ever heard of a little thing called Steam? All mention of CD authentication and so forth aside, Steam was supposed to be the big thing to stop cheating. Now it's all exposed. People were going to give their credit card numbers to this thing. Now it's open for all to see and anyone can exploit/spoof it.
      Ever heard of a little thing called OpenSSL? It's always been exposed, and people still trust their information with it. If the code is well-written and secure, it won't be exploitable, or at least not very easily.
    9. Re:Wrong by Anonymous Coward · · Score: 0

      And, literally, the only thing on my standard servers is apache and its immediate dependancys (libc, etc).

      Yeah, I'll bet this helps you sleep at night, don't it? ;) Well, I seem to remember several cases where a couple widely used libraries were flawed (zlib, glibc, ssl) even tho the servers were ok. Then apache itself suffered attacks from the Scalper worm on FreeBSD systems. And how about all of your cgi, perl scripts, and apache mods, are those really secure?

      My point being, it won't matter how much you've stripped from the system or what obscurities your using, the blackhat can figure it out if he sits on your gateway long enough. Your most important concerns should be: host firewall (control the traffic flowing out of your server and recheck the traffic comng in), network firewall (control the traffic flowing in and recheck the traffic flowing out; you wont need syn packets for port 139, etc.), proxies for your web server (even if its just an internal one), and backing up your system in case it gets comprimised (you'll have copies of the clean logs in case he's in them; and do you really want to rebuild your system from scratch again?)

      Still going to sleep well tonight? :)

    10. Re:Wrong by Maradine · · Score: 1

      There is NO SUCH THING as security through obscurity, and those who try show a complete misunderstanding of the issues. The can be _protection_ through obscurity, but security in relation to computers has a certain, specified meaning, and when people start throwing it around in connection with obscurity, it just makes the situation a lot more confusing than it needs to be.

      You're passionate, and I like that. But I respectfully disagree.

      Security's specified meaning in relation to computers:
      "Measures by which the confidentiality, integrity, and/or availablility of information is preserved." -- NSA INFOSEC Methodology

      If I can't find it, I can't steal it, change it, or make it go away.

      While I, as an Information Security Professional, agree that security through obscurity is a less effective method of preservation than a good, thorough risk assessment and targetted remediation program, obscurity is still a valid preservation tactic, and every bit a provider of security by definition.

      I'd say "that's my two cents", but all I got's a fiver. Got any change?

      M

      --

      trustedworlds.net - gaming, security, and the gunk that lives in between

    11. Re:Wrong by Aapje · · Score: 1

      That's why security through obscurity is never the best method.

      What alternative do you propose? A computer which you don't control can never be trusted. You need to do the bulk of the work locally however (rendering on the server is not an option). The only option is to take away the users freedom: DRM. Security through obscurity is the best you can do without it.

      The picture suddenly looks different, doesn't it? You get to choose between cheaters or losing control over your computer. I'll let the knee-jerkers run in an infinite loop now:

      - Security through obscurity doesn't work, we need DRM.
      - DRM is bad.
      - Security through obscurity doesn't work, we need DRM.
      - DRM is bad.
      - ...

      --

      The Drowned and the Saved - Primo Levi
    12. Re:Wrong by truenoir · · Score: 1

      If we were all going to be playing this game already, why would Software Etc. have recieved a release date of next year before Valve fessed up to the *first* delay? You'd think they'd want to let retailers know when to expect it.

      I heard and believed that HL2 was going to be pushed back to next year. I still can't wait to get my paws on it, though all the stupidity with ATI/nVidia, Steam, and this theft are sorta dampening that.

    13. Re:Wrong by Anonymous Coward · · Score: 0

      i had a print server a long time ago (actually its still running) at a certain large organization where it had to run for several years at least with no updates and no firewall.
      i built it around a 386Dx-40 with an old version of slackware with all the updates installed on a 40 meg hdd. since it was a 40 meg hdd, gcc and other stuff went out the window. basic bare bones install with openssh, apache and the like (lpd, etc).
      sure enough, 3 months later -- rootshell exploit announced in ssh/apache/whatever. then another. then another.
      in total the box has around a dozen root exploits all unpatched. ...some time later...
      a cracker exploits the box. tries to install a rootkit. oopsy -- its a 386. no pentium instructions. tried to compile - no gcc. tried to add libraries -- no space left AND the box had write protected files (need to reboot to un write protect the files). tried to reboot -- no reboot command, to shutdown command (i stripped everything out due to lack of space). finally a print job came in, exhausted the 8 megs of RAM in the box and the cracker was booted off with no space for any shells available.
      the cracker gave up. ..some time later..
      i check the logs and found no less than 20 different crackers, 4 worms (or maybe crackers) -- all trying to r00t the box and failing miserably even with rootshells.
      the box is still operational, works perfectly. still has open root compromisable holes. crackers come in, crack it, give up.
      security thru obscurity works.

    14. Re:Wrong by scot4875 · · Score: 1

      There is NO SUCH THING as security through obscurity

      Sure there is. What principle do you think passwords work on?

      --Jeremy

      --
      Jesus was a liberal
    15. Re:Wrong by yourmom16 · · Score: 1

      DRM uses security through obscurity as well. Everything you need to decrypt the data is in the game(It decrypts it). Therefore if security through obsurity doesnt work, neither will DRM.

      --
      "We have got to make Stan understand the importance of voting, because he'll definitely vote for our guy." - South Park
    16. Re:Wrong by yourmom16 · · Score: 1

      sounds more like security through crappy hardware.

      --
      "We have got to make Stan understand the importance of voting, because he'll definitely vote for our guy." - South Park
    17. Re:Wrong by Anonymous Coward · · Score: 0

      >>There is NO SUCH THING as security through obscurity
      >Sure there is. What principle do you think passwords work on?

      Passwords aren't obscure. Everyone knows that every password is either god, money, or sex. Haven't you watched Hackers?

    18. Re:Wrong by Anonymous Coward · · Score: 0

      No, now they have the chance to fix it, you ignorant monkey. You're quite the rediculous twit, aren't you?

    19. Re:Wrong by duffbeer703 · · Score: 1

      The problem with opening things up is that it takes time to figure out what is going on in the code.

      If your "security through obscurity" rants were close to reality, there would be NO released security bugs in the publically-reviewed Linux, Apache or Samba codebase. Yet that isn't the case.

      The real reason for the delay is likely due to the fact that it will take the Valve programmers signifigant amounts of time to verify that trojans or backdoors are not present in the game.

      How good would the PR be if it turned out that Half Life 2 was allowing hackers to takeover people's computers?

      --
      Conformity is the jailer of freedom and enemy of growth. -JFK
    20. Re:Wrong by Anonymous Coward · · Score: 0

      You're a complete BOOB aren't you? I mean, your opinions are completely worthless and uniformed. You spout off without knowning anything about the topic at hand. YOU ARE D U M, DUM!

    21. Re:Wrong by SlightOverdose · · Score: 1

      True, a decent hacker could get in if he tried. I've been called in to recover about 15 compromised boxes before, and every single one was compromised by a rootkit. Since it's impossible to even get a shell, you pretty much can't run a rootkit.

      most hack attempts are by 15 year olds with the latest 1337 tool. Change the system enough so the tools dont run, and you eliminate most of the threat and are left with the small percentage of experienced hackers who will persist. And even if they find an effective exploit, they can't do anything. The entire filesystem is read only at multiple levels (lids, chattr, mount, hdparm, bios). If they can get past that without a shell or any standard unix commands (keep in mind they can't upload anything, all daemons are running as non privilaged users, and LIDS locks down any chance of suid, kernel modules, and outgoing tcp), then... they are a freaking god.

    22. Re:Wrong by Anonymous Coward · · Score: 0

      Yes, wording is important as it conveys your point.

      Security through obscurity is not a valid form of security and will never be considered a valid form of security by seasoned professionals.

      Anyway, jonnyb's got it pretty much exactly.

      Oh, never mind, just looked at your post history... I've been trolled again. :P

  73. Ah, sweet irony... by CrackerJackz · · Score: 1

    When this code was released there were several people on Slashdot calling for a full code audit of the CVS (since in thoery the person who checked out the tree could have checked in backdoor code) could it be that Valve is doing just such an audit and also changing the keygen and netcode to prevent widespread copying? My god people, this company has dumped *millions* into this games development, "poor gamers"? try "poor programmers", this delay could cost them serious money for missing an Xmas launch date.

  74. hello, outlook by Stinking+Pig · · Score: 5, Informative

    See the story at The Register. They link to Valve's forum, where the general manager details how the code was leaked: in short, his own account information was stolen via Outlook, then several other employees were hit with a Outlook preview-pane virus that installed a keylogger.

    Of course, this is no reason to think that Outlook isn't a perfectly good solution for email. Outlook is great. There's no reason to consider any alternatives. No matter how much money you lose to Outlook virii, simply look at the silly dancing monkey!

    --
    "Nothing was broken, and it's been fixed." -- Jon Carroll
    1. Re:hello, outlook by NetJunkie · · Score: 1

      Old, patched exploit. Want to give your CC number to these guys? Maybe not.

      I bet Slashdot wouldn't be so smug if the attacker had gotten in via the also patched SSH exploits that were out recently.

    2. Re:hello, outlook by Anonymous Coward · · Score: 0

      The plural of "virus" is "viruses."

    3. Re:hello, outlook by Anonymous Coward · · Score: 0

      The exploit is over 2 years old!! How can you possibly blame the client for a 2 year old bug?!?!

    4. Re:hello, outlook by DickBreath · · Score: 4, Insightful

      I bet Slashdot wouldn't be so smug if the attacker had gotten in via the also patched SSH exploits that were out recently.

      Yes we would be.

      It is one thing to have a bug (i.e. buffer overflow) which can be exploited. That can happen to anyone.

      It is a whole different thing to have software that is not designed with security in mind. SSH is designed to be secure. Outlook is not. IIS is not.

      You're comparing a bug (which anyone can have) to a security design problem (which Microsoft seems to have plenty of).

      Running a web server under the System account? Executing strange code merely by receiving e-mail? Showing spammer's links to external graphics by default? A web server that allows dot-dot-slash URL's to serve (or execute) files outside the WWWRoot directory? The people who wrote this were NOT thinking the slightest about security.

      Um, yes we would still be as smug. And rightfully so.

      --

      I'll see your senator, and I'll raise you two judges.
    5. Re:hello, outlook by Stinking+Pig · · Score: 1

      Old bug? Which one? Do a little research and you'll find that SSH bugs are also a lot less frequent than Outlook bugs. I don't know about Slashdot, but I'd be just as smug. Getting in via email and getting in via ssh are two different classes of attack. The first requires one step: the attacker to send a crafted email to an unpatched mail client. The defense modes against that (defanging mail, &c.) are unpopular because of collateral damage and required maintenance. Once the attack is launched, all other activity is passive (keystroke logging) until the shipment of captured data back to th cracker. The cracker then logs in as a regular user and looks like regular traffic, no need to worry about an IDS. the second requires: 1) opening SSH to the Internet on an unpatched box. 2) a local root exploit on that box (just because you got in as the sshd user doesn't mean you have the privileges required to scan and attack other boxes on the LAN). 3) active attacks that don't trip any IDS systems in operation, or the ability to passively sniff user data (very difficult in switched environments, unless of course your evil sniffer is sitting on the general manager's desktop!). I think we can all agree that Valve's sloppy IT practices are to blame here; I'm just saying that Outlook on the desktops is one of the sloppy practices.

      --
      "Nothing was broken, and it's been fixed." -- Jon Carroll
    6. Re:hello, outlook by Politburo · · Score: 0, Troll

      No, you would be smug. Don't lump all of us in with your arrogant ass.

    7. Re:hello, outlook by Anonymous Coward · · Score: 0

      SSH is designed to be secure. Outlook is not. IIS is not

      SSH is designed to be secure and is exploited...
      Doesn't seem like cause for smugness.

    8. Re:hello, outlook by NexusTw1n · · Score: 1
      Our speculation is that these were done via a buffer overflow in Outlook's preview pane.
      So no, Gabe's own account does NOT say it was Outlook what did the infernal deed, just that it MAY have been. They are only guessing.

      I'm curious if anyone knows what exploit he may be talking about. As far as I'm aware all preview exploits were patched by 2000 SP3.

      If Outlook preview pane caused this, then MS need slapping, and slapping hard, but if this was an unpatched box then the ball is back in Valve's court...
      --
      It has become appallingly obvious that our technology has exceeded our humanity. --Albert Einstein
    9. Re:hello, outlook by Anonymous Coward · · Score: 0

      So, lemmie guess, in your world, Ford said yeah, it's a bug in the Firestone tires. Bridgestone says, it's a design flaw with the Explorer. In the end, does it matter? Not to the dudes who rolled their SUV.

      Brings me to my next point, that the software industry is in dire need of regulation, just like the automobile industry is subject to. Whine all you want, but in large part thanks to goverment regulation cars now are much safer than they were 20 years ago. Sure, there are loopholes in the laws, and the companies squirm to get around them, but they sure beat nothing.

      Software needs to be made more secure, period. Microsoft or not. Too many innocent people are getting caught up in the pissing war between *NIX and M$.

    10. Re:hello, outlook by Anonymous Coward · · Score: 0

      Novell and MS, actually!

      The RPC leak was present in NT 3.5 as well.

    11. Re:hello, outlook by DickBreath · · Score: 1

      Let's change the terms.

      Let's not say that slashdot users are smug, when they rightfully point out the weaknesses of Windows. (Some are smug, but let's look at sane rational people.)

      What we're really talking about is not smug slashdot users but Windows apologists. Their attitude is: "don't keep knocking our insecure system! You are so smug.".

      --

      I'll see your senator, and I'll raise you two judges.
  75. hl2 xmas = ouch by kayen_telva · · Score: 0

    this will lose them a shitload of money and make a lot of people really pissed. they NEED to get this out by Dec 1 well, thats what I think anyway I wont even be able to run the damn thing

  76. Release dates by gsparrow · · Score: 1

    I don't even know why they try to set release dates based on marketing efforts. They should be based around the build of the application.

  77. Good!! by FortKnox · · Score: 1

    That's right... GOOD!

    I have two reasons to like this decision:
    1.) Deus Ex 2 will be out next month, and now I have time to just concentrate on that game without feeling 'rushed' to finish quickly so I can get into HL2.
    2.) It will help prevent the cheating that was BOUND to happen with the source being leaked.

    Ultimately, don't blame Valve for this. They were going to release on time and this isn't an "excuse." Your real anger should be aimed at the crackers.

    --
    Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
  78. Please, shut up by brkello · · Score: 4, Insightful

    How many whiny posts do there need to be on: "Why did they have to delay it? This is BS". Well, here is a reason. If your company just got hacked in to and important information was stolen and leaked, instead of working on the product, you have to find what the vulnerability was, how to do damage control, how to re-structure how you do business so it doesn't happen again (i.e. redesign the network and create new security policies), and then have to get back to work on finishing the product while trying to make sure that anything cheaters would have gained from the source is fixed. I would say that is pretty large amount to do in a few months. Don't you think they would love to get it out so they can make money? Just use some freaking common sense here. If you are surprised by these delays, then you didn't think very hard. If you are upset by the delays, join the crowd, hunt the hackers, whatever. Just relax, it's a game, go buy a different one. It's not the end of the world.

    --
    Support a great indie game: http://www.abaddon360.com
    1. Re:Please, shut up by The+One+KEA · · Score: 1

      You're right. The reason why people are upset is because of the Sahafist misinformation campaign that has been raging ever since Vivendi first contradicted VALVe about the Sept 30 release date. I've seen gamers in the halflife2.net and halflifesource.com forums who are very angry about this PR disaster and would forsake the game mainly because of the way the delays and the cracking of VALVe was handled.

      There are a lot of whiners attached to this story. But not everyone is whining for the sake of whining, they're whining because VALVe and Vivendi weren't up front to begin with.

      --
      SCREW THE ADS! http://adblock.mozdev.org/ Proud user of teh Fox of Fire - Registered Linux User #289618
    2. Re:Please, shut up by Nate+Eldredge · · Score: 1

      Um. I rather doubt the people who will be securing the network are the same ones who write the code for the game. The only part of that which I think makes sense is any rewriting they have to do so their security by obscurity remains obscure. And it's conceivable that would take them 4 months, but I doubt the rest would have a significant impact on release date.

    3. Re:Please, shut up by mattgreen · · Score: 1

      You must be new here.

      We don't take kindly to "common sense."

    4. Re:Please, shut up by GFPerez · · Score: 1

      Ok, everybody is just pissed about not getting the game by XMas or whatever, but it seriously shows how the game companies should be careful about secutiry (as it wasn't clear already). Geez, id Software never got hacked and they've developed already 4 games or more. Maybe Gabe's still got friends on MS that asks him to use Outlook? :)

    5. Re:Please, shut up by Cyno · · Score: 1

      ...instead of working on the product, you have to find what the vulnerability was, how to do damage control, how to re-structure how you do business so it doesn't happen again (i.e. redesign the network and create new security policies), and then have to get back to work on finishing the product while trying to make sure that anything cheaters would have gained from the source is fixed.

      Yep. That's because a company is only as intelligent as its CEO. Should pay those guys more money or something.

      Look, if management gave up control most techs would have their networks and systems completely secure. And a good backup plan would keep important information from being "stolen" or deleted. The very concept of information being taken as if it were a tangible object is almost laughable by today's standards.

    6. Re:Please, shut up by brkello · · Score: 1

      Um. Even if they aren't, they can't continue working on it until security problems have been addressed. This disrupts a lot of work. Computers have to be cleaned, maybe even formatted to make sure that all back doors are shut, the network needs to be set up differently, or not at all. A lot of things are going to change, and that causes delays. It really is a big deal as I am sure any network security administrator would tell you. My main point, though, was that everyone needs to relax. People act on here like there is some sort of conspiracy here so that VALVe has to wait 4 more months to get profit. If people don't buy the game because of this, good, they probably are the ones who would whine that I was cheating when I beat them down online;)

      --
      Support a great indie game: http://www.abaddon360.com
    7. Re:Please, shut up by Peldor · · Score: 0

      If the people coding the game are now devoting their efforts to finding network vulnerabilities, they're screwed anyway. They didn't have reasonable protection before (Outlook? AYFKM?) and diverting people who's job ISN'T to secure the network to secure the network is a very weak and temporary patch. On a lighter note, the soap opera may be better than the game.

    8. Re:Please, shut up by brkello · · Score: 1

      Look, if management gave up control most techs would have their networks and systems completely secure.

      I don't know where you work, but my CEO sure as heck doesn't touch the network. Admittedly, they should have had a better firewall or intrusion detection system up to watch for external connections, but from the sounds of it, this was an Outlook exploit that no one even knew about. I find it interesting that it was used to get a game. I would think an exploit like that would be used by hackers to get in to top secret government data. Or maybe it has been and we don't even know about it...scary. But in all reality, if your boxes are patched early and often, it shouldn't be a problem. It is hard for any network admin to defend against a security hole no one knows about.

      --
      Support a great indie game: http://www.abaddon360.com
    9. Re:Please, shut up by Cyno · · Score: 1

      All I can say is I know Outlook is exploitable. If I were in charge of security for that company Outlook would not be allowed on their networks. Nor would any Microsoft products without the latest patch sets, firewalls, anti-virus software and updates. I'm a UNIX admin. There are no excuses.

    10. Re:Please, shut up by brkello · · Score: 1

      I don't know...someone else posting on here said this was an old exploit and the systems weren't patched. If that's the case, then they got what they deserved. I am not an MS fanboy, but I don't think having Outlook is that big of deal. Our government (for the most part) uses Outlook. Most businesses use Outlook. I think they should have had a developer only internal network. Any OS is going to be vulnerable if it isn't patched though, that's just nuts.

      --
      Support a great indie game: http://www.abaddon360.com
    11. Re:Please, shut up by bojan · · Score: 0

      This is slashdot, most posts will be

      - someone claiming to know better than those who are actually doing it

      - whining abuot those doing it and why they aren't doing it the way of the slashdot user, afterall, they know best.

      - posts such as yours, asking for people to stop posting this way

      - posts like mine, pointing out the various posts

      - REPEATED NEWS STORIES

  79. Re:B.S. -Welcome to the real world by Anonymous Coward · · Score: 0

    It seems like missing the Christmas release is going to cost them quite a bit. Is it really worth it to stop cheaters?

  80. There should be an investigation... of Valve. by Lord_Pain · · Score: 2, Interesting

    I admit to being a cynic... but this stituation strikes me as being too much of a coincidence.

    1. Valve is not in a very profitable place.
    2. They promised the world with HL2.
    3. Theft of code...

    My conspiracy riddled mind tells me that they painted themselves into a corner with a brand of paint called Daikatana... and they need money.
    So they arrange the "theft" of their source code. This gives them an excuse to delay release and avoid bad press. Perhaps they can claim insurance for the theft? This way they kill two birds with one stone.

    Of course this is just baseless speculation on my part! Cheers!

    --
    -- What's this '-r *' file doing here? -- Oh well, a simple 'rm' should do the trick.
    1. Re:There should be an investigation... of Valve. by OAB · · Score: 1

      Frankly, if any insurance company wrote that risk they deserve everything they get.

    2. Re:There should be an investigation... of Valve. by Anonymous Coward · · Score: 0

      Exactly what I said in a comment to the original article. But then the flamers came out.

      I agree with you that this looks just a bit too suspicious, especially when very technically smart people use Outlook AND don't patch it. Add in your points and you have to wonder...

    3. Re:There should be an investigation... of Valve. by __aamkky7574 · · Score: 1

      > This gives them an excuse to delay release and > avoid bad press

      Avoid bad press? Google is full of nothing but bad press for them? Newssites that never mention gaming news are full of "famous game stolen" stories. If they had simply announced they had needed a few extra months, a few hardcore gamers would have groaned, but the news would have slipped by most. Sorry, I don't buy this conspiracy nonsense at all.

      P.

  81. New name for the game? by reiggin · · Score: 1

    I think they should rename it: "Half-Life Forever!"

    1. Re:New name for the game? by Lord_Pain · · Score: 1

      Whatchu talkin' about?!?
      It's obvious!
      HalfDaikatanaLife!

      --
      -- What's this '-r *' file doing here? -- Oh well, a simple 'rm' should do the trick.
  82. Ship delay due to firing by Dav3K · · Score: 1

    Come on people, am I the only one who sees this? A 4 month delay is just enough time to complete a successful witch-hunt, fire the source of the leak, hire and train a new worker bee and complete the project, including new 'features' that make the leaked source incompatible with the release. As an upshot, QA gets the extra time to polish up a few extra bugs.

    This isn't so much of a conspiracy theory as an obvious knee jerk reaction by some executives.

  83. Duke Nukem 4 ever source code leaked! by Anonymous Coward · · Score: 0

    *** TOP SECRET DUKE NUKEM 4 EVER CODE ***
    Project: Version - DN4Ever-- DN marketing strategy (MARKET.EXE):

    #define say(x) lie(x)
    #define next_year soon
    #define the_product_is_ready_to_ship another_beta_version
    void main() {
    if (latest_fps_game<one_year_old)
    if (rumours_drop_below_certain_point)
    raise(RUMOURS_ABOUT_NEW_FEATURES);
    while(everyone_chats_about_new_features) {
    make_false_promise(when_its_done); /* Standard Call, in lie.h */
    if (rumours_grow_wilder)
    make_false_promise(real_soon_now);
    if (rumours_grow_even_wilder) {
    market_time=ripe;
    say("It will be ready in one month);
    order(start_brainstorm_about_new_version);
    &nbsp ; order(marketing_permission_to_spread_nonsense);
    vapourware=TRUE;
    break; }
    switch (nasty_questions_of_the_worldpress) {
    case WHEN_WILL_IT_BE_READY:
    say("It will be ready in", today+30_days," we're just testing");
    break;
    case WILL_THIS_BE_A_$GAME_KILLER:
    say("Yes it will be");
    ask(marketing);
    pretend(there_is_no_problem);
    break;
    case WHAT_ARE_MINIMAL_HARDWARE_REQUIREMENTS:
    say("It will run on a 8086 with lightning speed due to the video architecture");
    inform(ATI, "Video card sales sales will rise skyhigh");
    inform(NVIDIA, "Start a new video card plant 'cos all these customers will need a new card");
    break;
    }
    while (vaporware) {
    introduction_date++; /* Delay */
    if (no_one_believes_anymore_there_will_be_a_release) break;
    say("It will be ready in",today+ONE_MONTH);
    }
    laugh_at(everyone, for_having_the_patience_year_after_year_for_anothe r_unfinished_version);
    }

    1. Re:Duke Nukem 4 ever source code leaked! by shawn(at)fsu · · Score: 1

      Looks like this might actually be closes to DN4 than you think
      laugh_at(everyone, for_having_the_patience_year_after_year_for_anothe r_unfinished_version);

      so when they go to compile this code they get:
      ");" expected error notify sales department of 12 month delay.

      --
      500 dollar reward for tip(s) leading to the arrest of the person(s) who stole my sig.
  84. HL2 Not delayed? by slycrel · · Score: 2, Interesting

    Check this out: http://www.halflifesource.com/ These guys sound like they'll have the real scoop one way or the other here shortly.

    1. Re:HL2 Not delayed? by D.A.+Zollinger · · Score: 1

      I wouldn't trust a single thing that comes out of Andy Hodges' mouth. He is extremely well known as a liar in the TFC community. Just visit the catacombs and their forums - enter into the cesspool and ask who Andy Hodges is (well, you could ask in any forum really, but the admins would move your thread to the cesspool forum). Don't believe him when he writes "Our exclusive visit with Gabe Newell and Valve Software" because he lives just about as far away from Seattle as one could in the continental USA. When he used to run area51live.com he would make up stories just to impress the teens who would visit the site on their way to his game servers. A lot of people from the TFC community were drawn in by his lies and were hurt by his actions.

      His new web site, halflifesource is a farce. They have no special connection to Valve, all information they post on their site is either coming from other sites, or pure speculation. This is just about as bad as it can get when the blind lead the blind.

      --
      I haven't lost my mind!
      It is backed up on disk...somewhere...
  85. Are they going to fix Steam? by xTown · · Score: 1

    I hope they use the time to fix Steam. Does this also mean that they're going to delay having Steam be a requirement for HL? Or has that deadline already passed? To be honest, I stopped playing HL after Steam was released, so I don't know.

  86. Wrong--here's why the delay by Overly+Critical+Guy · · Score: 1

    Instead of making up conspiracies out of your ass, ever heard of a little thing called Steam? All mention of CD authentication and so forth aside, Steam was supposed to be the big thing to stop cheating. All of that will need to be rewritten.

    It's all been exposed. People were going to give their credit card numbers to this thing. Now it's open for all to see and anyone can exploit/spoof it. The whole point of it to get rid of cheating has backfired.

    Yes--contrary to the Slashbot idealist mindset--there are cases where security through obscurity is the best method. You have to look at each situation inviduallly and logically (instead of covering everything with a veil of ideology).

    This is nothing more than them using this as an excuse for delaying the game - something that would have happened anyway.

    Yeah, it's "nothing more," oh Valve Software insider. Please. The game was ready to ship for September 30. The hack happened September 11. Guess what was announced soon afterward? That's right, the delay.

    We'd already be playing this game if it wasn't for the source leak. Valve's plans were ruined. I'm hoping for late November.

    --
    "Sufferin' succotash."
    1. Re:Wrong--here's why the delay by Anonymous Coward · · Score: 0

      such a worthy reply, he typed it out twice!

    2. Re:Wrong--here's why the delay by Anonymous Coward · · Score: 0

      "to be the big thing to stop cheating. All of that will need to be rewritten."

      I thought we were long past the point that security by obscurity was "working". Even if I take the _whole_ source code to OpenSSH, the systems won't get compromised. If Steam is compromised because it's source code was leaked, it is crap (read: insecure) from start! After all, the compiled Steam is just a scrambled form of the source, and if the source revails all the secrets, so does the compiled form, and the system is practically dead.

      Maybe now they design Steam so that you can look at the OpenSource, and still not hack it or cheat. About time, is say, if it isn't already...

      Cheers,

      Tels

  87. Delay not confirmed by bios10h · · Score: 5, Informative

    Vivendi Universal Says Delay Not Confirmed
    Tuesday, October 7, 2003
    According to a news article posted today on a UK press release, there is a Half-Life 2 delay. We already know that Valve does is not mentioning a delay.

    We received an email from Mike Thompson who says he works for Vivendi Universal and writes:

    quote: "delay is not confirmed..."

    Here we go around and around... again...

    From Half-Life Source Dot Com

  88. Dely is NOT CONFIRMED by captainstupid · · Score: 1

    The delay has not yet been confirmed by VALVe. Last time VU said there was going to be a delay, VALVe spoke up and said that everything was still on track for Sept 30 (and we know how well that worked out). It was noted at that time that VU has no control over the games release and any OFFICIAL word about the release date comes from VALVe, not the publisher (VU). I'm surprised that /. even posted this story. I guess, though, that if Yahoo considers it news, so does /.

    --
    "Anyway, long story short... is a phrase whose origins are complicated and rambling...." - Abraham Simpson
  89. Re:Likely a change to stop "pirating". by Synn · · Score: 5, Insightful

    When will Slashdot users grow up?

    When people realize that when one slashdot user speaks, he doesn't speak for all slashdot users.

  90. This is the dumbest question I've ever read... by Anonymous Coward · · Score: 0

    and yet it's +5, Insightful.

    There is nothing remotely insightful about it-- in fact, it's a completely retarded question, accompanied by a plainly obvious observation.

    If I had any confidence in the M2 system, I'd sit back, comfortable that these idiot mods would eventually get their comeuppance. Instead, I'm going to have to go masturbate furiously until I calm down.

  91. lithmus test by CAPSLOCK2000 · · Score: 1

    As long as Condition Zero hasn't been released, HL2 won't be either. After HL2 has been released, no market will be left for CZ.

  92. Generic DX9 code B.S. by GoSpeedRacerGo · · Score: 1


    Maybe this will give them a chance to take out all the ATI-specific custom shader code that has been found in the source so that it can actually be "generic DX9 code" that is running on the ATI cards as they and Valve claim.



    Of course, maybe $6 million dollars (confirmed by ATI's earnings documents) will prevent that from happening (and would have prevented that from ever being known had the source not leaked).

    1. Re:Generic DX9 code B.S. by Anonymous Coward · · Score: 0
      You fucking idiot. There is as much specific NVIDIA code as ATI code in the source.

      Now shut the fuck up, NVIDIA fanboy.

  93. MOD PARENT UP by The+One+KEA · · Score: 1

    You're right. VALVe knows that if the crackers are able to crack the game and start running rampant over MP and Steam, it would be the end of the game. No one would play it, no one would buy it and it would die an early, messy death.

    From what I've been reading at www.halflife2.net and www.halflifesource.com, a lot of people are slowly but surely becoming disillusioned with HL2. More and more gamers are giving up on VALVe and Vivendi because of the nasty, messy way this PR disaster has been handled by both companies, with misinformation, speculation and contradictory statements coming forth at unpredictable times.

    A lot of other games like UT2004, Max Payne 2 and Call of Duty are coming out for Christmas. DOOM 3, based on rumors of a fully working game, sans a musical library, might be out January 2004. If HL2 can't get itself into shape in time for Christmas, then no one will buy it. And what could have been one of the greatest games to ever be played will probably fade into history.

    And that would be a terrible tragedy, IMHO.

    --
    SCREW THE ADS! http://adblock.mozdev.org/ Proud user of teh Fox of Fire - Registered Linux User #289618
    1. Re:MOD PARENT UP by Haeleth · · Score: 1

      > If HL2 can't get itself into shape in time for Christmas, then no one will buy it.

      Because, of course, nobody EVER buys games except at Christmas. ...do you really believe that?

  94. NOTE TO DEVS: Make private LANs. NOW. by Viewsonic · · Score: 1

    Set up one machine for your email, web browsing, MP3 playing.. Hook it to your internet exposed LAN, and set up a 2nd machine on its own non-Internet accessable LAN.. A completely seperate network that has NO WAY of touching the internet. Dont use gateway machines and the like, PHYSICALLY keep the private network on its own. If you need to patch stuff, or move data over USE DVDRW MEDIA. I cant believe such a large developer like those who are making HL2 weren't doing this. After the whole Quake fiasco of them getting a beta via a SAMBA exploit you would have thought every dev house would have set up two entirely seperate networks.. One for work, one for play.

    1. Re:NOTE TO DEVS: Make private LANs. NOW. by loopback_127001 · · Score: 1

      While they're at it, why don't they put all the development computers into a separate building and make people walk across the street to code! That'd be even SAFER.

      This is a plainly simplistic and idiotic approach to how to address security, from people who have never actually dealt with it.

      You have people who work remotely.
      You have people who work from home.
      You have people who think up fantastic ideas to fix a bug or implement a feature in the middle of the night.

      Should all of these people be forced to work in the office on that little private LAN that has no external connectivity? How about when it's time to test things like Steam? You have to put it on the 'net at some point to see how it plays with others.

      If you have a realistic suggestion that will work in the real business world, spit it out. Otherwise, enough with the endless harping on a completely idiotic idea that anyone who has actually worked at a large company would shoot down in moments.

      I mean, really.

    2. Re:NOTE TO DEVS: Make private LANs. NOW. by Anonymous Coward · · Score: 0

      "This is a plainly simplistic and idiotic approach to how to address security, from people who have never actually dealt with it"

      You must not know anything about security - there are TONS of great ways to secure/tie things down.

      Anyone involved in gov't work will tell you - there's a public LAN and a private LAN. There's also secure programs, VPNs, encryption, etc. There's a lot of things you can do to make things WAY secure. Just saying "it's not realistic" is not a valid answer.

      I hope the systems security team at Valve get publicly flogged for this one.

    3. Re:NOTE TO DEVS: Make private LANs. NOW. by bojan · · Score: 0

      wow, I'm sure nobody thought of this before.

      The word NOW in all capitals, that really got attention of developers.

  95. No backups? by Vegan+Pagan · · Score: 1

    First, was the code on their hard drives destroyed, or merely copied? If it was destroyed, why can't they restore it from CD-R backups? They should've backed up all their code on CD-Rs weekly, if not daily. Why didn't they?

  96. This just in: by Safrax · · Score: 1

    SCO claims the Half-Life 2 Source code contains System V code. Darl McBride is expected to announce a new licenscing scheme later today. Anyone that has viewed Half-Life 2 movies, screenshots, or other material concerning it will be required to pay a $699 license to have viewed such materials.

  97. Wrong by Overly+Critical+Guy · · Score: 1

    They're not rewriting the game, they're rewriting all the authentication. The entire Steam code was leaked.

    It has "EVERYTHING" to do with the code leak. Stop pretending like you know Gabe Newell's mind.

    --
    "Sufferin' succotash."
  98. its okay guys! by mschoolbus · · Score: 1

    A Christmas release of Half-Life 2 would probably have been most welcomed

    Yeah, we just have to settle for a pre Halloween release....

  99. gripe, gripe, bitch, moan by extrarice · · Score: 1

    All the comments I've seen are how much Valve sucks for delaying the game, how the source code theft is just a cover up, etc. Let me ask you this one question:

    Come release date, will you stick with the opinion that Valve sucks because of this and not buy the game? Or will you still fork over your cash and buy the game like the gamer you are?

    "Gripe, gripe, they suck, bitch and moan, hey waitaminute! It's out! Here's my money! Gimmeethegamedammit!!!"

    --
    "Jesus saves, but everyone else in a 10 foot radius takes full damage from the fireball."
    1. Re:gripe, gripe, bitch, moan by Anonymous Coward · · Score: 0

      I won't buy the game. I will pirate it.

  100. So let me get this straight by bogie · · Score: 1

    No Doom3 and no HL2 this year? Right? Wow what a letdown 2003 was for gaming. Yea I know everyone here can probably name a bunch of games that came out that they like, but they just can't be compared to what these two meant. These two games are the ones that will define what "state of the art" is for both single player FPSers and online gaming for years to come.

    This not only affects us gamers, but also cpu and graphics cards vendors. These people were counting on these specific titles to finally convince people that you needed a 2GHz+ cpu and a $300 DX9 graphics card. When the game you want to play is 6 months away why be stupid and buy a new system now? Even worse you'd still be foolish to buy a new cpu or gpu for Christmas because in the 3-4 months up till either game is released both of those items could drop by well over $100.

    I see a lot of Gamecubes being bought the Christmas and a lousy sales period for cpu and gpu vendors. Me I'm just bummed because something I've been looking forward to for so long is put off yet again.

    Oh well. Back to MAME.

    --
    If you wanna get rich, you know that payback is a bitch
  101. 23MB compressed. by Anonymous Coward · · Score: 0

    Totally feasible on a non-crap Internet connection.

  102. April? by Ender77 · · Score: 1

    Released in April of 2004? Unlikely, They will push it back to fall/christmass of 2004 for sales. This is a big bite on Valves ass since they made a big deal of saying that they kept the game a secret until it was near ready, so that they could ship the game on time withought delays. Can we say 'oops'.

    One ironic bit of news is that Vampire - Bloodlines might be released BEFORE half-life 2 which used a modified HL2 engine.

  103. Source code is just the beginning... by Drahca · · Score: 1

    The demo of Half Life 2 has apparantly also been leaked. See screenshots here. God only knows what else they downloaded from the computers at Valve and the implecations it will have on them.

  104. Did you notice-they've renamed it too Re:B.S by WolfWithoutAClause · · Score: 1

    Apparently now it's called 'Gordon Freeman Forever' :-)

    --

    -WolfWithoutAClause

    "Gravity is only a theory, not a fact!"
  105. Can't people just compile and play now? by Denver_80203 · · Score: 1, Informative

    Whats stopping this from happening?

  106. Re:Likely a change to stop "pirating". by cicho · · Score: 1

    I'm not sure why you're lumping games with movies and music here. Games need not cost *huge* amounts. Granted, you need to pay good money to developers, maybe even better money to graphics designers, and invest some in promotions. But that, plus hardware and dev tools, pretty much sums up the cost. You don't pay millions to the lead star (at least, one would hope they don't), you don't hire hundreds of extras, doubles, assistants, grips and and go-fors, you don't attempt to rent Sydney for a day (Matrix, anyone?), you don't crash cars, trains, choppers or airplanes to produce a game. The cost of amking a game vs the cost of making a movie should be different by orders of magnitude.

    And DRM is already being shoved down our throats, while it turns out that bootleg copies of pre-release movies are being distributed by insiders, not by teenage traders.

    --
    "Only the small secrets need to be protected. The big ones are kept secret by public incredulity." - Marshall McLuhan
  107. This doesn't make any sense. by Tom7 · · Score: 1

    OK, let's take a look at this.

    1. On face value, they seem to be saying, "Our source code was stolen from us, so we need to rewrite it."

    This doesn't make sense. Obviously, they still have a copy of the source code---if they don't, they can just download it from any of the million mirrors on the internet. Admittedly, this is much worse than copying mp3s or even the full HL2 CD when it is released, and it may even be misappropriation of trade secrets, but it's still not stealing. They still have the code.

    2. Maybe they really mean, "There are significant secrets in the code which, if revealed, make our product not viable."

    Perhaps. What might those secrets be?

    2a. The format of the network code.

    Reasonable. This is what people mean when they talk about how the release of the source code means in-roads for cheaters. But obfuscating the network code is not a four-month job. They only need to change basic things like the packet layout and their fake encryption or whatever. (Aside: IMO the best way to deal with current forms of cheating is to simply release frequent updates to the protocol and binaries. Reverse engineering is a lot slower than "forward" engineering, so exploit that asymmetry.)

    2b. The CD key code.

    Seriously, the CD key code is rarely any more useful as a C function than as a compiled binary. People debug key checkers and write keygens in like, a day. Unless they have some seriously new regime here, that's not a reasonable cause for 4 months. (Aside: If they used RSA and a key was just a digital signature (of some token), then cracking keys would be really, really hard, like, net you an instant PhD hard. Also, revealing the keycheck algorithm would do nothing for hackers. It would probably make keys a bit longer, though.)

    2c. Buffer overflows and other exploitable bugs, or deliberate backdoors.

    Maybe. But if they know about them, maybe they should just get rid of them? If they're thinking of auditing for them, maybe they should have done that even if the source wasn't copied? In truth, I bet having the source code out there will incite a lot of the bugtraq attention-seeking white-hats to audit the code for them. HL2 is a pretty high-profile piece of software.

    2d. GPL violations.

    Ha, well, yeah. Apparently there are some of those in the code, though I don't know the specifics.

    3. Maybe they really mean, "We forgot how long it takes to actually polish a product and ship it. We were going to delay again at the cost of the fan community's ire, but now we can shift that blame onto hackers!"

    This is my guess: like a defeated player complaining about lag, they're just shifting the blame.

    1. Re:This doesn't make any sense. by Overly+Critical+Guy · · Score: 1

      Ha, well, yeah. Apparently there are some of those in the code, though I don't know the specifics.

      Nope. The GPL code was licensed Havoc physics code.

      What part of this don't people get? The sourcecode for Steam was released. Cheat writers are having a field day. All of that needs to be rewritten.

      --
      "Sufferin' succotash."
  108. Re:4 months to do what, exactly? Testing... by samsmithnz · · Score: 1

    Even changing a couple API names and such, should be simple, but I've done it before, and it requires a LOT of testing. If only simple changes were as simple...

  109. Boy are you Mac users jealous. by Anonymous Coward · · Score: 0

    Ever notice how retarded Mac users don't understand what the fuck they are talking about? From what I can tell it is Vendi Universal who isn't doing too well, not Valve. Just like 3drealms, I don't think Valve has to worry about their finances.

    I would also point out your inflated ego and "holier than thou" attitude that comes from people who pay so much for so little, but we already know this because you are Mac users.

    1. Re:Boy are you Mac users jealous. by Anonymous Coward · · Score: 0

      RTFA winfool: "VU Games has already suffered a 29% fall in revenue and an operating loss of $61.36 million this year.". YOU=O\/\/NED!

    2. Re:Boy are you Mac users jealous. by Anonymous Coward · · Score: 0

      VU Games = Vivendi Universal
      VU Games != Valve
      YOU=MORON

  110. Re:Slashdot has been ./'d by Anonymous Coward · · Score: 0

    Slashdot has been ./'d

    Tard, it is /. get it right and stop giving out my website address

  111. Well no wonder. by Anonymous Coward · · Score: 1, Funny

    They got in through weknesses in OUTLOOK!!!

    they almost deserve to have been hacked if they were running that huge open wound of an infection vector on a developement machiene.

    1. Re:Well no wonder. by Anonymous Coward · · Score: 0

      I think the "funny" rating is for the spelling... As an aside, why mod up AC postings like this? Sure - if they contain some merit or information... But this was a waste of a mod point. Of course, I'll be modded down... -1 honest.

  112. *This* is "Slashdot", isn't it? by anactofgod · · Score: 1

    I'm surprised no one has posted a "Code should be free" response. Isn't Valve developing a proprietary, closed-source game? And are they not going to charge the public money to buy a license for said game? I expected to see a flurry of posts to the tune of "THAT CODE SHOULD HAVE BEEN OPEN SOURCED TO BEGIN WITH!!!"

    But, I guess there are some sacred code cows for this crowd. Or at least, a lack of internal consistancy. Perhaps the "real" Slashdotters too busy file sharing archival copies of music to make the arguments anymore.

    *GRYNN*

    ---anactofgod---

    --

    ---anactofgod---

    "Equal opportunity swindling - *that* is the true test of a sustainable democracy."
    1. Re:*This* is "Slashdot", isn't it? by ivan256 · · Score: 2, Insightful

      Slashdot isn't populated by 400,000 clones of Richard Stallman. Many of us are sane people. It is quite possible for people to read slashdot and write closed source code. I personally, for example, feel that there is a place for open code, and a place for closed code. Neither option is the correct choice for all situations.

      I am surprised, however, that none of the security gurus that post here on a regular basis have commented on the fact that had the game been written correctly and securely, even to source wouldn't have assisted cheaters, and this delay could have been avoided. That is, of course, if you believe the leak was really the cause of the delay and not just an excuse to mask that they're not really done yet.

      One last thing:

      And are they not going to charge the public money to buy a license for said game?

      The game engine itself is worthless to the average game consumer. They make their money on retail licenses of the data. The reason they have a closed source game engine is so they can license it to other developers. If they were only aiming for retail revenue, an open source engine would have been a perfectly valid option.

    2. Re:*This* is "Slashdot", isn't it? by duffbeer703 · · Score: 1

      Do you have any background in software engineering at all? Or how about common sense?

      As long as human beings design & manufacture anything, there will be bugs, design flaws, etc.

      Please enlighten us with your sage knowledge of how to "correctly and securely" write software.

      --
      Conformity is the jailer of freedom and enemy of growth. -JFK
    3. Re:*This* is "Slashdot", isn't it? by ivan256 · · Score: 1

      Go back and read my comment and tell me how it's about writing software and not about the slashdot posters who wax poetic about security.

  113. scrub. by Anonymous Coward · · Score: 0

    and as best as I can tell, you're talking out of your ass. now hand over the karma, and go back to posting AC, you don't deserve the bonus.

  114. alternative business models... by dilvie · · Score: 1

    Of course, things like this would not be an issue if the game was open-source.

    But how do you sustain a game studio that releases open-source software?

    I have a proposition that may or may not work.

    Network party tours. Sell lots of swag. Announce regional, national, and world champions based on tour tournament results.

    Just a glimmer of an idea. I go into other copyright/ip/money issues in today's journal entry. Check it out and comment if you want to.

  115. WTF is with the "Th3y Deserve it!!!!11" excuse? by Anonymous Coward · · Score: 1, Insightful

    I sware just about every darn forum has someone posting about how much Valve deserved this.

    Some examples along the lines of the lame justifications I have heard:

    "They promised it on Sept 30th."
    Correct me if I am wrong, but I don't remember Vavle officially announcing a Sept 30th date. I wonder if these brain dead morons took the retailers dates as a fact.

    "They hyped the game, and they are teasing us."
    I can't even begin to say why this is a stupid reason. All I can say is that it is more then likely you hyped the game. I don't think they were teasing us, they announced the game when it is very close to ready instead of hyping the hell out of it for several years when they had nothing(i.e. Duke Nukem Forever) .

    "It will help the Mod makers."
    I would think that mod makers would have more ethics then to download and use the unoffically released code. Considering that Valve is going to have to re-write a lot of their code this leak might as well be useless to them. They are better off waiting for the official SDK.

    I think I have covered the main ones, feel free to add any more stupid "they deserved this" excuses you find.

    1. Re:WTF is with the "Th3y Deserve it!!!!11" excuse? by 44BSD · · Score: 1

      I don't think they deserve it, but they should have seen it coming. As others have said, their information security practices were TERRIBLE on this one, and they got bit hard, right in the nads.

  116. Simple solution by garymcg · · Score: 1

    Since we all want to avoid a rash of game-nerd holiday depression related suicides, would whichever one of you 1337 haxx0rs stole the code please just return it to Valve? They seem to have a problem with internet security, so simply print out the stolen code and mail it back to them. TIA.

    --
    --If 50,000 people say a foolish thing, it is still a foolish thing.
  117. Holy heck, what a great idea by Rogerborg · · Score: 1

    The product is slipping, the publisher is beating at the door, it's full of bugs, and you don't know what to do next.

    Leak the source!

    It's win-win. You get it reviewed, you flush out any vulnerabilities, and you get the publisher off your backs. And it's not your fault, because a wizard - sorry, evil cracker - did it.

    I can't believe that nobody has thought of this before. Next year, everyone will be leaking their code!

    --
    If you were blocking sigs, you wouldn't have to read this.
    1. Re:Holy heck, what a great idea by Anonymous Coward · · Score: 0

      except that, done once, ok. done twice, and your company has serious security issues that could bring breach of contract into play.

      if you don't think that there are hundreds of fledgling game companies out there waiting for a chance and take your place, you'd be fooling yourself.

    2. Re:Holy heck, what a great idea by Overly+Critical+Guy · · Score: 1

      Or not.

      --
      "Sufferin' succotash."
  118. More bad news: BETA copy of HL2 on IRC by Anonymous Coward · · Score: 0

    http://www.neowin.net/comments.php?id=14249&catego ry=main

  119. S-T-U-P-I-D by JamesP · · Score: 1

    Ok: games are diffcult, have lots of bugs, but come on, learn w the RIAA. Once something gets leaked, it gets released BEFORE THE ORIGINAL DATE!!!

    This will not be a HL2less xmas for the lovers. But it will be profitless to Valve.

    They've already shown their genious when leaving CODE machines ONLINE and USING OUTLOOK!!!

    --
    how long until /. fixes commenting on Chrome?
  120. TODO HACKHACKHACK by Leffe · · Score: 3, Informative

    There are a lot of TODOs and HACKHACKs in all Quake-derived code, even the Quake 'SDK' probably has a couple of them left. It's some kind of design style I think. At least it's not a bad one as it highlights the areas that are not really finished(not that anyone will ever fix it though, they are more like - I want this, someone do it for me?).

    If you grep through the official Half-Life SDK you'll find at least 50 TODOs and HACKHACKs. (Much more than that probably, but I'm playing safe.)

    1. Re:TODO HACKHACKHACK by shird · · Score: 1

      Yeah I know its common to have those in "finished" code. There just seemed to be a hell of a lot, with comments like 'TODO: complete re-write of AI code for such and such, at the moment it just walks in circles'.. ie, the TODOs/HACKs seemed to need quite a bit of work. But maybe that code isn't entirely necessary, or is in the newer version, or exists elsewhere. whatever, I think the artwork etc would be more behind than the code anyway.

      --
      I.O.U One Sig.
    2. Re:TODO HACKHACKHACK by Leffe · · Score: 1

      // FIXME: BUG BUG: HACK HACK: okay, you get the point
      // when we finally fix the delta encoding relative to multiple
      // players and the baseline, we can remove this

      // HACK: Bogus, but the logic is too complicated in the engine

      //!!!HACKHACK E3 2002 (sjb)
      // The gunship wants a large impact effect.

      // HACKHACK Don't kill npcs in a script. Let them break their scripts first
      // THIS is a Half-Life 1 hack that's not cutting the mustard in the scripts
      // that have been authored for Half-Life 2 thus far. (sjb)

      And so on... 1433 occurrence(s) have been found.

  121. Re:Likely a change to stop "pirating". by edrain · · Score: 1

    Assume that a game costs $10 million to produce at the high-end. It's not entirely uncommon for the high-end of movie budgets to exceed $100 million. So, there you go - at least one order of magnitude.

  122. Re:Likely a change to stop "pirating". by godders · · Score: 2, Funny

    When people realize that when one slashdot user speaks, he doesn't speak for all slashdot users.

    April 2004

  123. UGH! You fucking script kiddie hax0r pirates by zapp · · Score: 0, Offtopic

    Hey assholes, listen up. This goes to everyone who participates in leaded material. This includes HL2 source, it includes the Doom3 leak.

    Same goes to pirates of already-released material.

    I used to do it too, I know... it's fun, it's a rush, whatever.

    This is the consequence. Valve was making a huge effort to release a ground breaking product. HL2 is quite possible the most anticipated game to come out in a LONG time.

    You motherfuckers had to steal the source, and this is what happened. Why? Was it worth it? You still can't play it, can you? You don't have the models, the textures, or anything.

    All you did is hurt their business and the community.

    Go die somewhere.

    --
    no comment
  124. So, the complaints... by praedor · · Score: 1

    about the lack of a linux client (even an unsupported one, I mean, c'mon...idsoftware sure has no problem with this on EVERYTHING they release) are irrelevant now as there wont even be a windoze client available.

    --
    In Bushworld, they struggle to keep church and state separate in Iraq as they increasingly merge the two in America.
  125. Re:Likely a change to stop "pirating". by homer_ca · · Score: 1

    I should remind you that Counterstrike started out as a free mod done by hobbyists for the fun of it. Sure, there's plenty of crap mods out there, but don't discount the free work of the mod community.

  126. This is not good by failedlogic · · Score: 2, Interesting

    Valve is legitimately trying to protect their IP and if takes them until April to recode some parts of it then so be it. Gabe said its taken at least 30 people 5 years to code the game. Hopefully, Valve doesn't go broke because of this.

    To have a trojaned e-mail sent to Gabe's computer is somewhat to be expected. I'm sure script kiddies have also tried similar things on Microsoft computers, etc. It was stupid to actually have any of the computer(s) with the source code connected on the Internet. If they have the budget to run w/o release for 5 years they have the money to buy a few extra computers for Internet use ONLY.

    I think its kind of ironic though. Valve is acceptably asking that everyone respect their IP and remove links to and delete stolen source code. Everyone but the script kiddies and hax0rs will comply. But if you try and take credit for a script kiddies' work they'll whine and complain to no end.

  127. Enough time.. by maximum_high · · Score: 0

    ..for NVIDIA to release their first "DirectX 9.0 Compliant" video card. Good stuff for NVIDIA.

    Hmmm, the only company to benefit from the HL2 leak. Hey, wait a minute ...

  128. October + 4 months != April by Anonymous Coward · · Score: 0

    "Delayed by at least four months, that is to April 2004"

    With math skills like this, is it any wonder their network had holes?

    1. Re:October + 4 months != April by Mongo222 · · Score: 1

      Since it was scheduled for release at Christmas, which is in DECEMBER. Lets seee....... Janurary, Febuary, March, April! Hay that's four! (Ok, yes I know November was put out as a release date as well.)

    2. Re:October + 4 months != April by Anonymous Coward · · Score: 0

      (Ok, yes I know November was put out as a release date as well.)

      Actually it was famously scheduled for September 30, and only in the past couple weeks did they say that was being changed to the holidays. Then this happened (well, at the same time actually), and they say it's being delayed 4 months to April... seems like they should say it's being delayed 7 months.

  129. TCO by bl8n8r · · Score: 2, Insightful

    There's a TCO argument if I ever heard one.

    --
    boycott slashdot February 10th - 17th check out: altSlashdot.org
  130. Re:Likely a change to stop "pirating". by Anonymous Coward · · Score: 0

    I don't know, Blender got over $100K in donation funding - and they are not a high use, high priority project. Could you imagine if KDE, GNOME, Mozilla, or Linus Torvalds himself asked the community to donate for their respective projects, and set up goals, financial progress reports, and really pushed it? I'm sure they could bring in a lot if they really wanted to/tried.

  131. In other news... by elvum · · Score: 1

    In other news, Elbonian hacker group "l33tgr0up" announced the imminent release of their previously unnanounced "ground-breaking" new FPS game, "h4lfl1f3 II".

  132. Not with regard to FPS's by Myrv · · Score: 2, Insightful

    In your online poker example you can have a central trusted server that insures that nobody is cheating (at least technically).

    There is no way to do that with FPS's (not yet at least). The amount of info that would be needed to be passed between the client and the server in FPS games would be cripling if you expected the server to be the final arbitrator of all actions.

    The only way FPS games can maintain the required speed is by offloading the majority of processing to the individual clients. In order to do this you have to trust the client. One of the key ways to trust the client is to obfuscate it. Not perfect, but at least it's one level more of protection than you would have if somebody has your source.

    Really, the only way to protect the code is to build in some kind of self sanity check (i.e. return some kind of checksum to the server which verifies the client). This is only as good as the verification routine though. Once the method of verification is determined you're back to square one. You can improve upon this by constantly supplying new verification code to the client but it still comes down to security through obscurity.

    When you need to trust your client but you don't have control over it this is about all you can do.

    1. Re:Not with regard to FPS's by anthony_dipierro · · Score: 1

      In your online poker example you can have a central trusted server that insures that nobody is cheating (at least technically).

      Well yeah. Of course. You have to have that.

      There is no way to do that with FPS's (not yet at least). The amount of info that would be needed to be passed between the client and the server in FPS games would be cripling if you expected the server to be the final arbitrator of all actions.

      Well yeah, some things you can't do. Something in between a FPS and something like poker is something like Starcraft. Theoretically you could make Starcraft completely uncheatable. So like I tried to say before but probably didn't get it out right, yes, perhaps half-life can't be made uncheatable. But that's an aspect of the game itself, not an aspect of multiplayer gaming in general.

      When you need to trust your client but you don't have control over it this is about all you can do.

      That is, until Microsoft rolls out a true trusted computing platform. Bad for music lovers, perhaps, but this might be just the thing for gamers.

    2. Re:Not with regard to FPS's by Anonymous Coward · · Score: 0

      "the only way FPS games can maintain the required speed is by offloading the majority of processing to the individual clients. In order to do this you have to trust the client. One of the key ways to trust the client is to obfuscate it"

      Bullshit. You're thinking of client side *prediction*. This means both server and client do the calculation. But usually the server has the last say on everything that matters, like position, health, ammo etc.

      Of course there will never be a way to avoid wallhacks etc, so in a way you have to trust the client. But saying game calulations get offloaded to clients is silly. Only stuff that doesn't matter, like the physics particles that don't do damage etc. is calculated by the clients.

      Okay I'm a bit talking about of my ass here, maybe there is someone who can correct us both.

      Cheers, sniser

    3. Re:Not with regard to FPS's by ThePyro · · Score: 1
      Theoretically you could make Starcraft completely uncheatable.

      Actually, most RTS games are even more prone to cheating than FPS games are. At least FPS games are client/server, meaning that there IS an all-powerful server that decides once and for all what is going on in the game, and what information to send to each client.

      RTS games, if I'm not mistaken, lean much more towards the peer-to-peer model. There's simply too much information ( hundreds of units! ) to hand back & forth over a network connection. Consequently, each client runs its own simulation going of the entire game - the network traffic just serves the purpose of keeping everybody's simulations synchronized.

      Thus a hacked RTS client would be like the ultimate wallhack... it would allow you to see exactly what everyone else in the game is up to. So much for strategy.

    4. Re:Not with regard to FPS's by Dirtside · · Score: 1
      it would allow you to see exactly what everyone else in the game is up to. So much for strategy.
      Because god knows you can't have strategy in a game where you know the positions of all the pieces. Like, say, chess. :)
      --
      "Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
    5. Re:Not with regard to FPS's by anthony_dipierro · · Score: 1

      There's simply too much information ( hundreds of units! ) to hand back & forth over a network connection. Consequently, each client runs its own simulation going of the entire game - the network traffic just serves the purpose of keeping everybody's simulations synchronized.

      Seems like poor design to me. Each client should run a simulation of its own units, and any enemy units which it can see. If the client can't see the enemy's units, why does it need to have information about it? The server, of course, would have the full information about the entire game. Wouldn't necessarily have to run the simulation, as long as it recorded the information long enough to handle any disputes.

      Maybe the way you explained is the way it's implemented, but that's not the best way.

    6. Re:Not with regard to FPS's by Anonymous Coward · · Score: 0

      Nobody is arguing the way most network games are designed is the "best" way -- just that given the constraints (56K modems, vhosted servers), it's the way that works.

      In theory, someone could design a LAN-only "trusted" FPS, but that would sell like crap.

    7. Re:Not with regard to FPS's by ToadSprocket · · Score: 1

      Really, the only way to protect the code is to build in some kind of self sanity check (i.e. return some kind of checksum to the server which verifies the client). This is only as good as the verification routine though. Once the method of verification is determined you're back to square one

      I thought this was exactly what Punkbuster does, or at least what it did initially. (I stopped playing CS once cheating became completely rampant a couple years back, so a bit out of touch.) Wasn't this method broken in some way as well?

      --


      If this article confuses you, don't worry. It was posted yesterday in a much clearer fashion.
  133. YHBT by Anonymous Coward · · Score: 0

    HAND, asshole!

    1. Re:YHBT by Anonymous Coward · · Score: 0

      YHBT? You Have Been Trolled?
      HAND? Have A Nice Day?

      Just curious....

  134. Microsoft conspiracy theory by Animats · · Score: 1
    Maybe Microsoft was behind this, to build support for "trusted computing".

    On the other hand, maybe Valve will stop using Outlook. Installing Outlook is essentially installing a package of random security holes.

    Searched the web for "Outlook exploit". Results 1 - 10 of about 246,000. Search took 0.20 seconds.

    1. Re:Microsoft conspiracy theory by Anonymous Coward · · Score: 0

      Results 1 - 30 of about 714,000. Search took 0.41 seconds

      When searching for Linux Exploit
      HMMMMMM!!!

    2. Re:Microsoft conspiracy theory by UltimaL337Star · · Score: 0

      OH! and maybe It could all be a giant conspiracy to give Valve more time to finish half life 2! so they MUST BE including duke nukem forever as a mod at launch!

    3. Re:Microsoft conspiracy theory by Lobo93 · · Score: 1

      Results 1 - 10 of about 3,970. Search took 0.29 seconds.

      - when searching for "windows exploit"

      Results 1 - 10 of about 1,520. Search took 0.27 seconds.

      - when searching for "linux exploit"

      Googling is a lesson in quantum mechanics, me thinks...

      --
      "The only clear view is from atop the mountain of our dead selves." - Peter Carroll
    4. Re:Microsoft conspiracy theory by Anonymous Coward · · Score: 0

      "Your search - 'slashdot geeks have sex' - did not match any documents."

      Search took 0.0 seconds.

  135. 2nd machine by Anonymous Coward · · Score: 0

    The company I work for has all developers on a separate "clean" network. they have two machines, and two LANS at their desks. The ports are restricted via MAC address so that noone can slip their "clean" machine onto the internet.

    Works great, no security holes. This company does develop intrusion detection software and systems., so maybe we are a bit more paranoid than the game world. Even with this security mindset, it was deemed wise to go with the expense of an extra locked down LAN.

    We played with KVMs but since there was a clean email and an external email system, the developers themselves prefered two keyboards/monitors.

  136. let's face it by stranamorte · · Score: 1

    Valve isn't a serious game company. The way they handled the whole thing (from early delays to stolen code) is absolutely poor imho. I'm not going to spend hard-earned money on a game made by such a company. I'm gonna turn my attention to something else. (some great games are coming out for the holidays anyway). I'm growing tired of all this source code leak advertising campaign. (respect is something you can't buy with ads/marketing money) bye bye fellow /.ers

    1. Re:let's face it by Mongo222 · · Score: 1

      A company releases the arguably most popular video game fo all time and they aren't serious? Boggle. Being good game developers and being "good businessmen" are wildly different things. Have you been to id's offices lately? Think "Flyn" from Tron, living over his arcade and not giving a rip about corporate structure. id, and valve, have been, and still are, the best there is in there own seperates ways.

    2. Re:let's face it by BattleTroll · · Score: 1

      Nice troll there bud, lying through your teeth like that. We all know you'll be first in line to pick up the game when it's released.

  137. Amazon says... by toupsie · · Score: 1

    I ordered HL2 a while back on Amazon so it would be a surprise when it arrived. I went and checked the order and it still says Nov. 8th delivery. I hope it isn't delayed but that's ok if it is, I just noticed that HALO for the PC is waiting for me tonight.

    --
    Strange women lying in ponds distributing swords is no basis for a system of government.
  138. Check out this link... by Anonymous Coward · · Score: 0

    Does this mean more was stolen?
    http://www.warezxinc.com/hl2/

  139. how much does security cost again? by Anonymous Coward · · Score: 0

    Cause I betcha that a small part of that 26% drop in valuation would have paid for one HELL of a security admin. I mean, hell, I'll admit straight out I'm not the one for that job, but for 250k-500k a year you could probably have Foyder or one of the l0pht guys, or someone equally skilled/famous standing guard over your network and this shit WOULD NOT happen. Security is a process, and a process requires people, people cost money and in this case, the money was there.

    I betcha now they wish they had spent it.

    ( damn..that post is good..wish I signed up for an acct so I could put some points to it so someone would actually read it )

    1. Re:how much does security cost again? by Patersmith · · Score: 1


      In my experience, security is not a product, service, or a figurehead you can throw money at. It is a state of mind that most business folks don't have. It is incompatible with the reactive mindset that is exhibited by most company leaders today.

  140. that's not it by aeoo · · Score: 1

    He's talking about security as in GnuPG or OpenSSH. Yea, OpenSSH had one bug in it recently, but generally it is very secure. Both open and closed source programs can contain bugs, but the advantage of the open source is that you can verify that the algorithm itself is secure. In other words we know that RSA encryption itself is secure and that SSL, the algorithm, is secure.

    In relation to games that means not relying on obscurity to hide important game data, but rather not sending it to begin with. Yea, I know about optimization for speed, etc. Still, I do think it's possible to create a secure protocol game network protocol that wouldn't need to rely on obscurity, but could be verifiably secure barring implementation bugs.

    1. Re:that's not it by Anonymous Coward · · Score: 0
      GnuPG and OpenSSH still rely on obscurity to work. There is obscurity of data somewhere down the line that creates a sense of security. Even if the source is completely open, obscurity is relied on in the algorithm itself. Just because the algorithm is open does not make it secure, either. Most likely, very few people have the time or knowledge to actually create exploits for them. It is really just an extended case of early security mechanisms and algorithms. You could break a password via brute force or dictionary lookups, and you will in the future too. SSH is simply more complex than old authentication mechanisms.
      In relation to games that means not relying on obscurity to hide important game data, but rather not sending it to begin with. Yea, I know about optimization for speed, etc. Still, I do think it's possible to create a secure protocol game network protocol that wouldn't need to rely on obscurity, but could be verifiably secure barring implementation bugs.
      And there we have the problem. You can only trust the client so much, yet the client must have access to every gaming feature as others do. In other words, everyone must be on the same trusted level. If you think about other network applications such as FTP, or whatever, there are various levels of trust. In FTP you have different accounts. For example, consider a 3D shooting game. It is IMPOSSIBLE to actually draw a target (enemy) model on the client's screen without having the position of the target. If you have source code then it is much easier to find the section of code and create a cheat. Going back to FTP.. you can download a file if and only if you have permission to that file. Gaming can not have permissions or user levels. The only practical thing to do is make the source code obscure.

      People have this idea that code itself is not data. But it is! In the symbolical Lisp-ish way. Given any encryption algorithm and an input key, the resulting "encrypted" data is simply the input key (source code) transformed (compiled). It is nothing more and nothing less. All your login/passwords are simply source code that an encyption program (compiler) transforms from one form to another. Therefore, we have ALWAYS relied on obscurity of our source code (passwords). If you extend this encryption "compiler" further, your result will be much much more complex. This is exactly what is happening. For example, if you write in assembly and use an assembler, the binary code will be very readible. But, if you take the most advanced C++ compiler and write in C++, the result will not make sense at all! Infact, it could take an expert or two just to figure out what is going on in certain cases. This is the case with SSH and various newer encryption methods.
    2. Re:that's not it by aeoo · · Score: 1

      You make good points about obscurity. So obscurity cannot be taken out of the equation (point taken) and we do rely on it.

      What I was trying to say, in light of this, is that we shouldn't rely on obscurity more than we have to. Clearly there is a difference between SSH and telnet.

  141. nVidia by heli0 · · Score: 1

    >>Puts on tinfoil hat<<

    I guess this gives nVidia time to release nv40 before the HL2 launch. Now their crappy DX9 inplementation in nv30+ will not matter. Seems like this has worked out perfectly for them

    >>Removes tinfoil hat<<

    --
    Whenever the offence inspires less horror than the punishment, the rigour of penal law is obliged to give way...
  142. how it happened by Anonymous Coward · · Score: 0

    doc brown did it, he 0wn3d joo guise!!!!11!!!

  143. Huh?? by goldspider · · Score: 1
    WTF does this have to do with "security through obscurity" (a bullshit cliche')?? How do you propose that opening the source will make the game more secure and less able to be illegally copied?

    Or were you just itching to say "security through obscurity"?

    --
    "Ask not what your country can do for you." --John F. Kennedy
    1. Re:Huh?? by anthony_dipierro · · Score: 1

      What's the difference between the source code and the binary? The binary is more obscure.

      How do you propose that opening the source will make the game more secure and less able to be illegally copied?

      Well, by opening the source, it makes it legal to copy, so therefore it makes it impossible to be illegally copied... But that wasn't my point...

    2. Re:Huh?? by Anonymous Coward · · Score: 0

      Then by all means explain how this is a case of "security through obscurity"?

    3. Re:Huh?? by canajin56 · · Score: 2, Insightful

      I think he was saying that they have to halt everything for 4+ months because if somebody has seen the source, they can cheat. But with a game, that is somewhat understandable. Somebody can change their executable to, say, aim automatically, or draw all of the walls 75% transparent, or something. It's not like a ftp daemon, where just because they see the source doesn't mean they can hack a server.

      There is NO way to prevent that. How would you do it? Checksum on the executable they are running? They could send you whatever value they want. Have a seperate app that checksums both files? That is how current anti-cheat systems work. They are pretty good, but not 100%. The only way to get the people with the source at about the same cheating-ability-level would be to change the protocols so they would have to do some work to actually get it to connect. And change the file formats so it won't be able to load the game maps without some work, either. And they can't be minor changes, because the less work the changes were, the less work the hackers have to do to make the same changes.

      The piracy thing isn't as much of an issue. Sure, a pirated version will run single player, which is a good game in of itself (Judging by the first one.) But it won't play online. With a few changes, this could be extended to the single player game as well. When you install, it tells Valve your CD key and registers you. Whenever you play single player, it tells Valve that you are playing. Sure, you could play single player if you disconnect your internet (Because it would SUCK if you MADE them so they had to connect for single player) but how many people would be willing to do that? And as for being able to change the binary so that it doesn't check for the cd....Half-Life doesn't check for the CD.

      On the other hand, STEAM shouldn't be compromized because somebody saw the source! It isn't like a game, it's like FTP. Seeing code for the client shouldn't let you download whatever you want. If they do ANY authorization at the client, its their own damn fault. NEVER TRUST THE CLIENT.

      Oops, I didn't say "Security though obscurity" once :O

      --
      ASCII stupid question, get a stupid ANSI
    4. Re:Huh?? by Anonymous Coward · · Score: 0

      huh? so the walls are 75% transparent. OK...so tell me WHY THE FUCK the server has to send the client information about what's behind the friggin walls ?
      the only thing that is a problem is auto aim. the rest should be secure.

    5. Re:Huh?? by Electrum · · Score: 1

      so tell me WHY THE FUCK the server has to send the client information about what's behind the friggin walls ?

      Latency.

  144. thank you for clearing that up by penguin7of9 · · Score: 0

    Now it's all exposed. People were going to give their credit card numbers to this thing. Now it's open for all to see and anyone can exploit/spoof it.

    Yes, just like Mozilla, PGP, and lots of other secure software. There are lots of instances of open source software that is secure.

    But you are missing the point: the real reason these people have to delay the launch is not because someone knows their source code but because someone may have planted something. They now have to go through their code with a fine toothed comb to see whether anybody has installed anything.

    And the real reason not to type your credit card number at this thing is not that the source code is known, but that it was written by people whose many million dollar source code was stolen through a bug in Outlook Express. I mean, how incompetent can they get? Obviously, these guys have no idea what they are doing in terms of security. Given their history, you have to assume that HL2 will be full of security holes and backdoors.

    In fact, you are a fool if you install any kind of networked game on a machine you use for anything important: game programmers are unlikely to be attuned to security, and your bank account will be just as drained whether people break into your MS Money software through IE or through HL2.

    Yes--contrary to the Slashbot idealist mindset--there are cases where security through obscurity is the best method. You have to look at each situation inviduallly and logically (instead of covering everything with a veil of ideology).

    When people like you have trouble with inconvenient facts of life, you try to shut up people by labeling them as "idealism" and "ideology". Sorry, but that's just covering up incompetence. And incompetence in the area of security is apparently rampant at Valve; what shows that is not the hypothesis that they may have been achieving security-through-obscurity, but the fact that someone managed to break in and install a keyboard logger on one of their developers machines.

    1. Re:thank you for clearing that up by Tralfamadorian · · Score: 1

      In fact, you are a fool if you install any kind of networked game on a machine you use for anything important: game programmers are unlikely to be attuned to security, and your bank account will be just as drained whether people break into your MS Money software through IE or through HL2.

      I've never heard of anything like this happening. Do you have examples of a networked game being comprimised and exposing the users system to crackers?

    2. Re:thank you for clearing that up by penguin7of9 · · Score: 1

      See here.

      Networked games are full of security holes: their users don't think about it, they crash often enough on their own, they tend to be written in C, and their programmers are graphics hackers, not security experts. You have a prescription for disaster.

      Whether anybody actively uses those holes to drain money out of bank accounts, I don't know. But if you run anything buggy on the same machine as Quicken or Money, your finances are wide-open.

  145. Blessing in Disguise. by headkase · · Score: 1

    From what I've read they're going to be rewriting the multiplayer sections of the code. This could be a bonus because if they're rewriting the network code, they already have the experience of writing it the first time fresh in their minds. Since they should already know what the limitations and tradeoffs that were present in the original code were, they should be able to rewrite it this time around to be even more secure and reliable when compared to the original.

    --
    Shh.
  146. Re:There should be an investigation... of Valv[ot] by FroMan · · Score: 1

    [offtopic]
    In your sig, the filename should be "-rf *", the 'f' is for force, it will help to take care of anyone who removes that 'w' bit from their files when they have archived something.
    [/offtopic]

    --
    Norris/Palin 2012
    Fact: We deserve leaders who can kick your ass and field dress your carcass.
  147. Poor wording of the Headline by Anonymous Coward · · Score: 0

    The source code was NOT "leaked", that would imply a Valve employee was involved, it was stolen - GET IT RIGHT.

    1. Re:Poor wording of the Headline by bottlerockets · · Score: 1

      it was leaked by the person who stole it ;)

      --
      i am the walrus
  148. Re:Likely a change to stop "pirating". by Lordrashmi · · Score: 2

    But could they have made such a great mod without having something to start with? I don't think so. How many from scratch, free, quality games do you see?

  149. 64 Million in lost revenue? by ryan76 · · Score: 1

    Will someone please explain the 64 million in lost revenue? And how this at all effects the release date?

    --
    http://threetechguys.info Come, discuss Technology. Got a technology question? Come ask!
  150. Burn the witch by Anonymous Coward · · Score: 0

    They just wanted a good excuse to delay anyway...

    Better blame it on someone else.

  151. Re:Likely a change to stop "pirating". by jrockway · · Score: 1

    Bzflag, frozen-bubble, etc. There are some good games that are GPL'd.

    --
    My other car is first.
  152. Conspiracy Theory by FerretFrottage · · Score: 1

    Perhaps Value was already running late, behind schedule, and over budget. They or some evil PHB come up with this source/game "leak" as an elaborate scheme to justify delaying the release of the game to some later time. Hey...it could happen...I mean look at California. FerretFrottage

    --
    "Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
  153. Re:Likely a change to stop "pirating". by Lordrashmi · · Score: 2

    I had never heard of those games but I googled for them. They look interesting and I will try atleast bzflag as soon as I finished my latest game (halo on the PC...which isn't nearly as good as XBOX'rs said it was). However, I don't think those can compare to HL, CS or HL2.

  154. This theory crossed my mind by Anonymous Coward · · Score: 0

    considering the financial situation of the company, it would be bad PR to just say that HL2 is being delayed becuase of the development timeline. but to say it was due to outside sources, this is "good" PR - HL2 gets some free pub and the company is vindicated for the delay.

    you have to wonder though about the lie of the email backdoor. you'd think that there would be some virus protection running that would catch this. hence, this is either a so-so lie or among the stupidest things i've ever heard.

    imagine having to tell your boss, "I just lost half of code that we've been developing for years because I downloaded a backdoor." My guess is 80% of us get canned on the spot. My wife's network admin accidentally emailed her company's entire email password list to the everyone on the email directory and was fired.

  155. Or the guy could just quit running vbs attachments by BoomerSooner · · Score: 1

    and Outlook. Who the hell uses that piece of shit anymore?

    Email is a fucking joke. Spam, viruses, stupid ass coworkers emailing bullshit, ... An enormous waste of time. I bet most companies lose 5-10% of their daily productivity to workers using email (not to mention slashdot).

  156. Re:Likely a change to stop "pirating". by homer_ca · · Score: 1

    Yes, I know 3d engines and level editors don't write themselves, but id has been very gracious in GPL'ing their last generation Quake source. You won't get cutting edge graphics working with an old engine, but who cares about eye candy if the gameplay is crap?

  157. Sorry but I dont buy it. by AzraelKans · · Score: 1

    I can feel sympathetic for any programmer who lose his hard worked code some way, but this whole deal seems too convenient.
    For starters I cant believe a hacker could enter valve workstations and got hold of: drumrolls please: the code for the game! instead of the latest beta. I mean what the ? they had better security for ART and levels than the code? thats just fishy.
    2nd as far as I understand the code as it is, is mostly useless not only it cant run without the art and scripts (which are not there), most of the "leaked" code comes from quakegl (which is gpl) havok (gpl as well) and the halflife sdk which is free and is pretty similat to the quake2 source (ehich is GPL), the only part thats worth a look is the dx9 rendering engine (which as far as I know is not completely functional yet) and the network engine (which is not functional either) some people thought the steam code was there too, but it turns out IS NOT!

    And now they announce the delay, great! what for? the leaked code is suposed to be one month old (although considering all the TODO tags it was a lot older), the game was due in december that means they had 3 months to work on it, more than enough time to fill the security gap (I mean ANY code that they change in the net code, will make the Leaked and new version games NOT sync!) any change they could make in the BSP or model structure will render the leaked code unusable! now they say they are releasing it in february? how convenient!

    Here is the real reason why this may be happening: Halo 2 ATA February 2004, Doom3 ATA March 2004, Half life 2 ATA April 2004, what do you know! they will be released just a few months away from each other! and THEIR xbox/ PC versions!. Max payne 2 is being released this month (we hope) and just 2 months later the XBOX version will be out, could it be PC publishers are holding up their release dates to match the XBOX versions release? if not it certainly seems convenient all of them (except MP2 apparently) will be released AFTER Halo 2! is MS bags of cash behind this delays?

    --
    Go ahead MOD my day!
    More opinions here
    1. Re:Sorry but I dont buy it. by Anonymous Coward · · Score: 0

      1) The source compiles and people have made small test maps for it, which works!

      2) A playable version of the game has now been released as well. 1.5Gigs...

  158. Re:Can't people just compile and play now? by Anonymous Coward · · Score: 0

    the fact that its only source code. Games needs models textures and maps to work.

  159. Re:There should be an investigation... of Valv[ot] by Lord_Pain · · Score: 1

    Lol!
    Thanks for the heads-up, FroMan! :)

    --
    -- What's this '-r *' file doing here? -- Oh well, a simple 'rm' should do the trick.
  160. Offtopic Question About Original Halflife by kisrael · · Score: 1

    Ok, I decided to see what all the fuss about Halflife was about, got it for PS2.

    My friend points out that I'm probably not going to see what ALL the fuss was about, simply because that doesn't include Counter Strike.

    Anyway, I'm totally stuck in the level with all the conveyor belts in a big room. I ride around, finally end up over a big machine looking thing with two conveyor belts, one heading in, the other out. If I ride the one heading in, I go back to to just below where I entered the room (having ducked some mashers there). The one heading out just dead-ends. All the other conveyor belts head to dead ends (just have meat parts dropping in) and one time I fell to the floor, climbed stairs, and managed to get...back to the conveyor belts.

    Anyone know what I was doing wrong? What do I do next?

    --
    SO YOU'RE GOING TO DIE: The Comic for Dealing with Death
    1. Re:Offtopic Question About Original Halflife by Anonymous Coward · · Score: 0

      To the right of the area where the belts level off for the first time is a room with three switches that control the direction of the belts. Move the switches so that all the belts are moving forward.

    2. Re:Offtopic Question About Original Halflife by kisrael · · Score: 1

      To the right of the area where the belts level off for the first time is a room with three switches that control the direction of the belts. Move the switches so that all the belts are moving forward.

      No, I think it's after that...I think you mean before, where thre were 3 (not 2) belts, you hit the switches, disable the mashers with another switch, and then RUN. I've gone through that, a bit more, got past some horizontal battering ram looking mashers, then a few more stompers, and into a very large room, where if you keep riding the conveyour belts (dropping from one to another before going into the big vats of water) you end up near where you started, and one of the belts goes through a hot furnace you should run through.

      --
      SO YOU'RE GOING TO DIE: The Comic for Dealing with Death
    3. Re:Offtopic Question About Original Halflife by Anonymous Coward · · Score: 0

      The middle switch should in the earlier room should control the belt direction in the room you're stuck in. If all three belts in the earlier room are going forward, you should be able to ride the belt on the left side of the room where you're stuck into a tunnel that will lead to the last or second to last room in the episode.

  161. Support for newer Microsoft software? by MtViewGuy · · Score: 1

    There is one other possibility: Valve Software may have gotten the code for an incremental release to DirectX 9.0 (DirectX 9.1?) and possibility they are on the beta program for Windows Longhorn, the successor to Windows XP.

    Maybe when Half-Life 2 is finally released in possibly June-July 2004 it will support the features of the next incremental release of DirectX, and possibly the program code will be easily be able to run under Longhorn when that is released some time afterwards?

  162. You can have a network without "the internet"... by Shalome · · Score: 2, Insightful

    There IS such a thing as an intranet that is physically separated from the internet.. internal servers completely inaccessable from the commercial 'net.. KVM switches so all machines are accessable from one workstation.. completely internal secure shell, telnet, ftp, whatever. A setup like that is totally realistic and desirable for a production and/or testbed environment.

    Of course, this eliminates the ability of a coder to work from home or do things like surf the internet and check e-mail from the same box they code on.. But if you don't want your code leaked, don't put it on a box that's in any accessable from the commercial internet.

    --
    Moderation totals that amuse me for one of my posts: Flamebait=1, Insightful=2, Funny=2, Overrated=1, Underrated=1
  163. A thought by Anonymous Coward · · Score: 0

    Almost makes you wonder if they were going to miss the deadline anyway, so rather then get the bad publicity, they set this up.

    Just a thought. Still sucks though halflife rocks.

  164. No, don't by Politburo · · Score: 1

    If HL2 is the same or better than HL, then there is no question: People will buy it when it comes out.

  165. Mind-bending by phorm · · Score: 1

    However, it's mind-bending that their Outlook weren't patched(it's a very old exploit) and that he uses the preview pane in Outlook, on his work related computer. I know that they are backed by Microsoft, and thus probably gets all the MS toys, but they still forgot to patch them.

    I find it more mind-bending that they are still using outlook. Proprietary hard-to-port mail format, tons of bug, too integrated into the OS... it's also a little disconcerting to see that they used it on a machine with a available net connection and available production code. This isn't one mistake, it's a bunch of little silly silly things that add up to one big oops.

    Realistically, they could have had their production machine live if they needed email, but done the following:
    Proxy www requests, with password validation (no sneaking through port 80)
    Restrict SMTP/POP ports to communication with their mail server(s) only (why would they need elsewhere)
    Block all other unneeded ports.

    In a properly configured network, even getting infected with a trojen isn't the end of the world if it has no way to escape. While many may sneak by on known ports, simply restricting them to appropriate hosts and/or proxying them with passwords (not saving the password in winblows) would help a lot.

  166. This sucks... by silan · · Score: 1

    ...now my new computer is gonna be a waste of money for the next 1/2 year :(

    1. Re:This sucks... by obotics · · Score: 1

      Run Folding@Home or some similar distributed computing project on it. :-)

  167. Linux Port Anyone? by Anonymous Coward · · Score: 0

    Anyone feel like taking the HL2 code and making a linux port?

    1. Re:Linux Port Anyone? by Anonymous Coward · · Score: 0

      irc.quakenet.org #hl4linux

  168. Whiners! by Anonymous Coward · · Score: 0

    Up until five months ago, HL2 wasn't on anyones radar. It came out at E3 and blew everyone away. Even if it comes out in April, we've only waited a year since it's first announcement. I do believe this leak caused a significant delay. Any change at this stage of development is at least a full day task. Any change made has the potential to ripple through god knows how many other modules and affecting their operation. So even minor changes are viewed with scrutiny. When you talk about overhauling huge pieces like the network or STEAM, I can easily see that taking weeks or months. Just remember, a game is only late until it's released, but a bad game is bad forever.

    Outcast

  169. Oh by Anonymous Coward · · Score: 0

    Does it have a multiplayer mode then?

  170. valve is not worried about the players by Anonymous Coward · · Score: 0

    it is worried about its competitors. The leaked code is much more dangerous in the hands of an organization than it is in the hands of habbists. Instead of forking out hundreds of thousands of dollars for a license to the source engine, the competitors *might* be able to modify the existing code enough to get away with it. This should cost valve a lot of money if it does happen.

    Now I only wish someone would do this to Microsoft. Hack the gibson!

  171. The BS Valve Opens! by webzombie · · Score: 1

    Give me a break...

    Valve claims the hacker(s) gained access to the source code via Gabe's email account...wink, wink.

    I think Valve is having serious second thoughts about Steam and their whole game strategy regarding Steam.

    I've seen the Steam BETA in action and I can't for the life of me figure out why anyone would want to run their games remotely or in any way tied to this brutal piece of code.

    Valve was looking for an excuse... however lame!

    And the one they decided to use is BEYOND lame!

  172. Poor security by FreekyGeek · · Score: 1

    It's clear that Vivendi had extremely poor security. At a MINIMUM, they should have had both a central hardware firewall AND a good software firewall like Zone Alarm installed locally on each machine. Not only would ZA have probably kept the trojan out in the first place, but it would have alerted them to the outgoing traffic generated by the key logger.

    Their IT people should probably be fired, unless the policy was to run software firewalls and the president shut his off.

    There's one and only one cause of stuff like this incident: PEOPLE not taking security seriously. Maybe it was the IT people at Vivendi, or maybe it was the users. In any case, this was perfectly preventable if real security measures had been in place and people had been following them. Unforgivable in this day and age to let a trojan slip through. There are a thousand tools to prevent exactly that, and clearly they were not using one.

    1. Re:Poor security by Anonymous Coward · · Score: 0

      Vivendi has nothing to do with this at all as far as I can tell. Valve isn't owned by Vivendi and doesn't answer to Vivendi, Vivendi is just publishing HL2. Other than that Valve is completely independent.

  173. Conspiracy Theory #574: Valve Leaked HL2 Code? by superultra · · Score: 1

    I thought this as soon as I saw the words "delay" and "leaked" in the same sentence a week ago. What if Valve leaked the code themselves to explain a delay? It's a perfect answer to the question, "How the hell do we explain a delay when we said as early as the first week in September that it was coming out September 30th?"

    I think publishers need to start penalizing developers for missing release dates. I know, I know, it will result in subpar work. My assertion is that only at first. You can't possibly tell me that creating HL2 is any less complicated or involved than creating a $250 Billion dollar film, and yet when was the last time you heard of a movie getting pushed back within a month of its release date?

    All this date pushing reveals is how disorganized and rabbled the game industry truly is, on both the developer and publisher side.

    It's also not that gamers need to somehow communicate with their wallets that release dates need to be both accurate and stable. A game that's been pushed back too much loses
    "steam" (no pun intended) and can eventually backfire (the most obvious example being DNF). Most industries and corporations work with deadlines every day, and while they do slip, there are certain penalties and ramifications of slipping.

    Basically: if you give a release date as certain as Valve did, you better be hauling ass and anticpating crap like this. Call me merciless, but in any other job if I gave a deadline to a client you better believe I'll have it done by then. So why aren't gamers being treated as clients?

  174. Re:Likely a change to stop "pirating". by Colonel+Blimp · · Score: 1

    Dang...I was gonna try to pick it up off the street in Thailand this November...

  175. Doom (was Re:Delayed anyways?) by Anonymous Coward · · Score: 0

    Three months is a lot of time. And back in '93, in around five months Doom matured from a animationless buggy 3D *engine* (0.5) into a high quality *game* (0.99). Sure, it took some time to reach 1.9 but around 1.666 it was mostly bugless already. And most of the bugs were mostly harmless.

  176. Re:Likely a change to stop "pirating". by SuperDuperMan · · Score: 1

    If everyone started asking for donations then there would be even less than there is now to go around.

    Companies are lucky to make money on a game at all let alone make a killing. HL is an exceptional product so it's likely to make a lot of money but "trusting" your users not to freely distribute your product without reimbursement is just foolishness.

  177. When a delay is NOT a delay... by Chordonblue · · Score: 1

    We need to actually hear from VALVE on this - not the Euro publisher. The only thing that matters here is VALVE's decision to go forward.

    I believe that they must go forward anyway. I fired off an email to ATi to remind them that the only reason why I was interested in upgrading my Radeon 8500 was because of games like HL2. If HL2 isn't coming, I have no real reason to upgrade.

    With 6 million dollars on the line and the chance that NVIDIA might actually get their act together in 4 months time (NV40 by then), VALVE will be under mucho pressure by ATi and it's partners to get this out NOW. They do have some options however:

    1) There was talk of a mini-game prequel to HL2, a kind of HL 1.5 to be shipped with the ATi cards initially. Perhaps this will be front burnered again.

    2) No initial multiplayer support. This could happen. They could release the game in it's current form minus the multiplayer until its re-written.

    3) Wait until April. Forget the fans, this will piss off a lot of vendors - although it may bring a major sigh of relief to NIVIDA who is clearly not ready for DX9 gaming yet. Conspiracy theories might suggest that this was the plan all along...

    --
    "...Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam..."
  178. Steal the code, screw everyone by DaveCBio · · Score: 1

    I'd like to thank the jerks that stole the source code. Also, to those that say it's Valve's fault does that mean if you forget to lock your car doors that I have the right to steal your CD player, cell phone and CDs?

  179. Uh, no. by JonTurner · · Score: 1

    >Having a seperate machine on a seperate physical network would be more secure, but would cost much more than the VMWare approach.

    Sure, until a "29% fall in revenue and an operating loss of $61.36 million this year" results when the code is stolen via some previously undiscovered exploit or plain old carelessness. Physical separation from the Internet is the solution. Everything else is a compromise with varying levels of risk.

    Besides, what's a half-dozen development machines, a server, and some cables cost? Under 50k easy. Seems like reasonable insurance, to me, given the risks of losing control over intellectual property.

  180. Hardware puchases on hold pending HL2 by Anonymous Coward · · Score: 0

    This sucks. I'm waiting to buy a new PC and top of the line video card for when HL2 comes out. I want the new PC for other reasons, too, but timing is basically dictated by HL2. I may buy the PC now and get the video card later now--too bad for ATI.

  181. Re:Conspiracy Theory #574: Valve Leaked HL2 Code? by DaveCBio · · Score: 1

    Time to invest in aluminum futures?

  182. doomed by butane_bob2003 · · Score: 1

    anyone else thinking this game is slowly spiraling towards its doom? If I was a developer at Valve I would definately be pissed off. An probably more than a little burned out. Now some jackass using IE gets 1/3 of the source code stolen and the boss says we have to re-write it and delays the ship date again. That would suck. Hopefully the game will do well even after the delays. Too bad All of the source tree wasnt stolen. Then we could build it and start playing now! They should just release it now, add a patch in a few months to kill the cheats and call it a day. Thats what I would have done, but then, I'm just a lowly senior programmer. I'm not smart enough to make Business decisions..

    See, even non open source developers can benefit from using Linux as a development platform. They can test their code on windows as well, but there would be no need to have people using Outlook, IE, Word or SourceSafe (eek.) or even have windows machines connected to the internet. Actually when I need to test some code on windows, I fire it up in Wine or Virtual PC..

    --


    TallGreen CMS hosting
  183. Give them the other two-thirds... by Diplo · · Score: 1
    " It was revealed today that a third of the code was stolen..."
    Perhaps Valve should 'leak' the other two-thirds to the hackers, as well. Given these people are officially more l337 than Valve they could probably finish, compile and release it for Xmas :)
    1. Re:Give them the other two-thirds... by Spellbinder · · Score: 1

      i think this code leak, how ever it happened, gives them a good excuse for not releasing hl2(maybe they needed a good argument for not releasing hl2 yet for their managers) or they have some OSS zealot there which leaked it :p(they say it has been a virus but who knows)
      and in longer term they when they don't fix cheats they can always say "We can't fix it because they have the source code!"

      --


      stop supporting microsoft with pirating their software!!!!!
  184. How about this donation model? by Ohreally_factor · · Score: 4, Insightful

    It's already in place and seems to function.

    It's called paying for the damn game.

    --
    It's not offtopic, dumbass. It's orthogonal.
    1. Re:How about this donation model? by Anonymous Coward · · Score: 0

      grandparent must be quite dumb to suggest it.

  185. 4 months? by Anonymous Coward · · Score: 0

    October + 4 months = January. Where do they get April? That would be like 7 months.

    1. Re:4 months? by Anonymous Coward · · Score: 0

      Holiday season(Translation: Christmas) + 4 months = April

  186. Smokescreen ONLY, lets recap by Jboy_24 · · Score: 1

    Late Sept, news breaks halflife won't be available on Sept 30th. Rumors fly about early 2004, investors freak out about no Xmas, Valve stutters maybe by the holiday season.

    Early Oct, source leaked. Why? Hacked? Maybe, maybe a developers was calling BS on the holiday season estimate.

    Now, we get word its delayed til April 2004. So, rather then being done in time for XMAS, its now a full 4 months late.

    Hmm... smells like "Cover my ass". Some Director was able to sell to the upper brass this lame excuse.

    Or

    It might be retribution against the hacker. "Hey, we were going to notify we're late, why don't we just blame the hacker as well. See how popular that hacker's going to be with the public when he's the cause of the delay?"

    Just my thoughts..

    1. Re:Smokescreen ONLY, lets recap by Overly+Critical+Guy · · Score: 1

      Guess what, cupcake, the hack happened on September 11th, and the delay was announced later that month. Why do you think that is?

      --
      "Sufferin' succotash."
    2. Re:Smokescreen ONLY, lets recap by Jboy_24 · · Score: 1

      Well then, Snuggums, why then do you think a release of source could be responsible for a 6 month delay in software? I mean, who EVER heard about releasing the SOURCE to a project? That is sooo unsecure, I betcha nobody's doing it!

      Missing XMAS casued a huge drop in the stock price of the whole fricken company... there is no way, if it was ready, that the brass would have allowed it to be bounced 4 months after xmas.

      Come on, you think that the whole game was 1 month away from being pressed and sold on the shelves, and they delayed it because of the leak?

  187. well nameless, ur security ALSO suX0rz by Anonymous Coward · · Score: 0

    >> for truly critical (read millions of dollars) work, you're best off having the production machines OFFLINE.

    >Pain in the ass?? Try impossible. How do you think game programming works, anyway?

    I think you are -- deliberately -- twisting his assertion that development systems are intended for WORK, turning it into an allegation that development is single-man work, and then attacking that much weaker position. That, or you got emotional and lost sight of the comments.

    Surely your Development, QA & R&D departments have CLOSED networks for testing... how else would you EVER get meaningful performance statistics?

    Surely you have an *Administrative* PC for "work" tasks such as Microsoft Office/Outlook, etc. and all the admin boxes are firewalled from the development systems since you're most likely to get trojaned on a development system.

    Surely your "work" system is WORK-ONLY -- no Administrative rights. ... just a straight route to source control servers and that is ALL. What else do you need except one-way copying of binaries to a code-drop machine??

    If this isn't the case, well, it's your "right" to gamble. I only hope you are not a public company and I happen to own stock. If you ARE this carefree and you DO get hacked and *I* lose money for trusting you... expect a lawsuit.

    Being hacked is NEVER excusable... even if it is an "inside" job, which in this case it is not clear that is the case.

    Note the person in the story experienced "strange Explorer crashes"... No moron with Kazaa and "unregistered", trojaned pirate software should be allowed to compromise the company mission. Or whatever careless act was committed to get a back door in.. the result is the same.

    Hire an experienced IT person older than 31, and get with the program.

    -Nameless ...Because, working in IT, we know bring critical of Microsoft can get you fired (@ Stake). I stand behind my opinions , but don't necessarily want them viewed with prejudice on a background check. :-)

  188. How to delay w/o getting everyone pissed at you by Atario · · Score: 1
    1. Anonymously post some non-critical source code someplace public
    2. Claim you were hacked
    3. Push back release date four months
    Gotta remember that one for future reference.

    [Disclaimer: JOKING! Heh heh! Ehh.]
    --
    "A great democracy must be progressive or it will soon cease to be a great democracy." --Theodore Roosevelt
  189. are we a bunch of suckers? by Nandeyanen · · Score: 1

    Hmm.

    So, a third of the source code was stolen, and a game that was already delayed until somewhere around Christmas is now delayed until april 2004?

    Is nobody's BS filter going off here?

    Any company this large has all kinds of backups. Any company this large that can be set back four months by a 'loss' of one-third of the source code, which at worst should be one day's loss of work (to the most recent backup) is asking for trouble.

    We'll get complicated techincal and/or BS explanations for it, but in the end, they don't want to look like a bunch of losers for having to push their game out another few months.

    Look at Thief 3. That was supposed to come out last fall, and it's now not due till next year sometime.

    The 'terrorist' scares we're so used to now and the propaganda we're used to hearing might make this kind of excuse seem probable to most- I don't buy it. Bunk economy, pipe-dream graphics performance, why not push it out to next fall? Shall we start a betting pool?

    1. Re:are we a bunch of suckers? by Anonymous Coward · · Score: 0

      1) Read other posts
      2) Get a clue
      3) Kill yourself

  190. Same Xen? by Clipper · · Score: 1

    From the article:

    "Half-Life II" stars Gordon Freeman, a scientist battling aliens from the planet Xen in a mysterious European locale known only as City 17.

    Surely this isn't the same Xen that gave us multiple virtual machines running on a single x86 chip? Would be quite funny if it was though. Imagine a first person shooter in which you kill multiple Linux distributions from all running at the same time on a single chip. Wonder if Billy Boy would be the first buyer?

    --
    /<en
    1. Re:Same Xen? by Anonymous Coward · · Score: 0

      ... You don't know anything about Half-Life, do you?

      If anything, that chip was named after the game.

    2. Re:Same Xen? by dlb · · Score: 1

      Apparently the first game was before your time.

  191. Re:New theory: code was not leaked, just a lie by Alan · · Score: 1


    The only reason a person would rewrite code, is if the code lost was part of the networking subsystem(which would cause lotso cheats to be created).


    Erhm... according to this article the code stolen was mostly related to the multiplayer aspect. Nice theory though :)

  192. Re:New theory: code was not leaked, just a lie by Enucite · · Score: 2, Informative

    having to rewrite the part that was lost

    You do know that when people say "stolen" now they just mean "illegally copied". Valve still has all the code.

    And just for clarification, the "part that was lost" is the entire source tree for Half-Life 2, Counter-Strike, Team Fortress 2, Steam, and all the dev-tools/utilities (map editor, 3dsmax plugins, etc). Which would probably take them another 5 years to rewrite if they chose to take that route. ;)

  193. Re:Likely a change to stop "pirating". by Overly+Critical+Guy · · Score: 1

    Or TO them. Relax.

    --
    "Sufferin' succotash."
  194. The same should happen to MSFT by infinii · · Score: 1

    Just imagine what would happen if the same thing happened within Redmond and someone stole the source code to say, Office.

    Maybe that would make MSFT give notice and finally make a true effort of fixing the problems within their software products.

    How fabulous would it be for us if those funky Office file formats were exposed because someone stole the source code through an Outlook exploit. Forget those cream pies, this is the kind of egg in your face humiliation that MSFT needs in order to be serious.

  195. How to mask a product delay 101 by taco+sauce · · Score: 1

    Could it be...

    Valve knew the code would not be ready for a holiday release and rather than suffer the humiliation of another delay, they engineered the "leak" and used it as an excuse for another four months of development.

    That way they get public support behind them without having to answer all the tough questions regarding missed timelines.

    Just something to chew on until April.

  196. Re:Likely a change to stop "pirating". by RichardX · · Score: 1

    >>How many from scratch, free, quality games do you see?
    >Bzflag, frozen-bubble, etc. There are some good games that are GPL'd.


    I'm not deriding these games in any way - in fact, they're both superb.. I've wasted many a night playing BzFlag.. but it's no Half Life 2 or Doom 3, is it?

    There are many superb freeware/shareware/open source games out there, but when did you last see an amature game with the same quality as a commercial title? (I mean, not just gameplay wise, but graphics, sound, engine, etc)

    --
    Curiosity was framed. Ignorance killed the cat.
  197. it really was myg0t that did it -- some logs by Fo0eY · · Score: 2, Interesting

    chat log of myg0t member talking about hacking valve and stealing the code

    http://gtwy.hl2arena.com/big_log.txt

    and an email myg0t "recieved" that was sent internally at valve
    remember, valve was hacked using an outlook virus and gabe talked about them knowing people where in his email

    http://www.myg0t.com/ChrisNewcombe-PR.txt

  198. bullshit. by twitter · · Score: 3, Insightful
    It's not because the game leaked, but because the underlying systems that ensure that players can't easily cheat, warez the game, or access the personal information of other players.

    Next you will tell me that XP is so full of holes because someone "stole" it's source code before M$ sold it to China and the former KGB. That's almost as good as them swearing that revealing the source code to Windoze would be a national security disaster. Give me a break, will you?

    Warez only needs to hack a binary copy.

    Cheats only need to watch their traffic.

    None of this makes a difference if the system is well made to begin with. This is why OpenSSH is a secure system despite open publication of it's source code.

    This is just more anti-open and anti-free FUD. Shame on VU for using Outlook and M$ for anything they wanted to keep to themselves. Shame on them for blaming software and the philosophy behind it for their own failures and shame on them for not being able to get their shit together. ID games rules, VU drools under Bill Gates thumb.

    --

    Friends don't help friends install M$ junk.

    1. Re:bullshit. by LousyPhreak · · Score: 1

      comparing openssh and a fpd game shows you are obviously no game programmer! with usual openssh applications it doesnt matter if your latency is below 100ms or over 1s. ever tried to play quake while beeing 1 second behind? so in games there has to be some tradeoff made for keeping games smooth (on the cost of security as the server cannot check every player action as this would kill off the gaming experience)

      --
      -- Karma: beyond good and evil - mostly affected by posting political
    2. Re:bullshit. by The+Cookie+Monster · · Score: 1

      You appear to know little of games, people can cheat by running a modified client. Open source can secure a protocol sure, but open source can't ensure that the client it is talking to is running the code it is supposed to be, and not for instance rendering everything with the lights on, or the walls see-through.

      I'm a fan of open source, but thinking that OpenSSH demonstrates that open source is as good as closed source at impeding cheaters is just wrong - they're not compareable problems.

  199. Re:Likely a change to stop "pirating". by c4ffeine · · Score: 1

    A friend of mine is currently about 4 months from completion of a 3d game that vaguely resembles Morrowind and Neverwinter Nights. All he needs(pretty muich, anyways) is a graphics engine that isn't proprietary; he's too busy to write a graphics engine. That, and he doesn't know how. I'm already helping him with the levels. In conslusion, if a freind of mine can write a good 3d game, imagine what a dedicated group of people can do.

    --
    "73% of quotes on the Internet are made up" -Ben Franklin
  200. This is the reason why it is delayed: STEAM. by Anonymous Coward · · Score: 0

    I snagged this from the IRC chat the night that the story broke on /. From: Chris Newcombe Subject: Potential PR issue: I just got suckered by a social engineering a ttack Date: Sat, 27 Sep 2003 Boy do I feel like an ass... I hope I did the right thing damage-control wise (I asked him politely not to publish/share any of this, and he agreed). The Friends session below started 20 seconds after I approved 'lombardi@valvesoftware.com' as a friend, so I assumed it was Doug. When you see the subject the irony will kill you (or me, more likely). > Doug says: > hello mate > chris says: > Hi > Doug says: > http://www.halflife2.net/forums/showthread.php?s=& threadid=10021 Any thoughts on that? :) I can't see to get a response from anyone at the moment > chris says: > That happened to gabe - someone created an account in his name when we reset the database. I had to reset the account password so Gabe could use it. > chris says: > We had planned (and started work) on an email verification system but it was one of the features that Rick cut when Muru left. > chris says: > I certainly agree that the downside is horrendous -- most of the email addresses in our database are useless or obscene or both. > Doug says: > Do you know if this will be sorted in the future? > chris says: > We do plan to address this later, but I wouldn't hold your breath. Right now the crippling problem is lack of bandwidth. I've been causing an (unpopular) stir on that, saying that we should add peer-to-peer now not later (as we had planned). Gabe seems to agree and wants to see an immediate plan to do that. It's a huge amount of work and will occupy the team for a long time -- IMO we _really_ need it for HL-2 launch to succeed on Steam. > Doug says: > So is Steam one of the major reasons Half-Life 2 was delayed? Also will we be seeing peer-to-peer in the future? Obviously I got totally suspicious right here. So I sent Doug an email with the exchange so far, asking to confirm if it was him. Then VPN and wemail died _right_ after I sent the email, so I couldn't check for a response (I just found I got an out-of-office auto-reply). So, unable to check email and fearing the worst... chris says: Did you get my email? Doug says: Nope Doug says: try again at munro@halflife2.net please? [me: Aaaarrrrgghhhhh! Oh Nooooooooooooooooooooo!] Doug says: something meant to be coming through? Doug says: Come on Chris you can't leave me like this :) chris says: OK, so I realize that you are not actually Doug. Nice stunt :) I'm asking you to _not_ share the comments which I made here in good faith (believing that you were Doug). They are matters internal to Valve. I think you've proved your point very nicely, and I'd appreciate your help with this. Doug says: ah damn Doug says: all this juicy info and I can't do anything with it ;( chris says: You've just succeeded in making an excellent point directly too a Steam developer -- I hope that would make you happy :) Doug says: Sorry I thought you realised I was the thread starter and that Doug didn't have an account here :[ chris says: No, I'm simply not allowed to make public comments -- you'll have to talk to the real Doug Lombardi for that. Obviously I'll be sharing this with him -- please email him at... wel you know the address :) Doug says: Heh so I'll get a very harsh slap if I should publish on the web then? chris says: That would not be helpful -- please take it as read that you have made the point you intended to make. Please don't publish anything from this exchange. Doug says: I had the perfect exclusive then :) Doug says: Any chance you could speak to the real Doug or Gabe or someone and get them to send me some kind of info I can publish? Doug says: You sure I can't publish this? :) chris says: I'll certainly ask them -- and they'll s

    1. Re:This is the reason why it is delayed: STEAM. by Anonymous Coward · · Score: 0

      Now it's readable... grrr... From: Chris Newcombe Subject: Potential PR issue: I just got suckered by a social engineering a ttack Date: Sat, 27 Sep 2003 Boy do I feel like an ass... I hope I did the right thing damage-control wise (I asked him politely not to publish/share any of this, and he agreed). The Friends session below started 20 seconds after I approved 'lombardi@valvesoftware.com' as a friend, so I assumed it was Doug. When you see the subject the irony will kill you (or me, more likely). > Doug says: > hello mate > chris says: > Hi > Doug says: > http://www.halflife2.net/forums/showthread.php?s=& threadid=10021 Any thoughts on that? :) I can't see to get a response from anyone at the moment > chris says: > That happened to gabe - someone created an account in his name when we reset the database. I had to reset the account password so Gabe could use it. > chris says: > We had planned (and started work) on an email verification system but it was one of the features that Rick cut when Muru left. > chris says: > I certainly agree that the downside is horrendous -- most of the email addresses in our database are useless or obscene or both. > Doug says: > Do you know if this will be sorted in the future? > chris says: > We do plan to address this later, but I wouldn't hold your breath. Right now the crippling problem is lack of bandwidth. I've been causing an (unpopular) stir on that, saying that we should add peer-to-peer now not later (as we had planned). Gabe seems to agree and wants to see an immediate plan to do that. It's a huge amount of work and will occupy the team for a long time -- IMO we _really_ need it for HL-2 launch to succeed on Steam. > Doug says: > So is Steam one of the major reasons Half-Life 2 was delayed? Also will we be seeing peer-to-peer in the future? Obviously I got totally suspicious right here. So I sent Doug an email with the exchange so far, asking to confirm if it was him. Then VPN and wemail died _right_ after I sent the email, so I couldn't check for a response (I just found I got an out-of-office auto-reply). So, unable to check email and fearing the worst... chris says: Did you get my email? Doug says: Nope Doug says: try again at munro@halflife2.net please? [me: Aaaarrrrgghhhhh! Oh Nooooooooooooooooooooo!] Doug says: something meant to be coming through? Doug says: Come on Chris you can't leave me like this :) chris says: OK, so I realize that you are not actually Doug. Nice stunt :) I'm asking you to _not_ share the comments which I made here in good faith (believing that you were Doug). They are matters internal to Valve. I think you've proved your point very nicely, and I'd appreciate your help with this. Doug says: ah damn Doug says: all this juicy info and I can't do anything with it ;( chris says: You've just succeeded in making an excellent point directly too a Steam developer -- I hope that would make you happy :) Doug says: Sorry I thought you realised I was the thread starter and that Doug didn't have an account here :[ chris says: No, I'm simply not allowed to make public comments -- you'll have to talk to the real Doug Lombardi for that. Obviously I'll be sharing this with him -- please email him at... wel you know the address :) Doug says: Heh so I'll get a very harsh slap if I should publish on the web then? chris says: That would not be helpful -- please take it as read that you have made the point you intended to make. Please don't publish anything from this exchange. Doug says: I had the perfect exclusive then :) Doug says: Any chance you could speak to the real Doug or Gabe or someone and get them to send me some kind of info I can publish? Doug says: You sure I can't publish this? :) chris says: I'll certainly ask them -- and they'll see the full transcript of this exchange. Obviously I can't

    2. Re:This is the reason why it is delayed: STEAM. by Anonymous Coward · · Score: 0

      Yes, that is much more readable.

  201. Don't worry. by twitter · · Score: 1
    some of these fanboys I've been reading posts from on USENET might just kill themselves. Maybe someone should set up a crisis counciling center?

    Just tell them to download the source code from SCO's site and compile it themselves. They did a code audit and found that Half Life is really an inferior copy of BSD Games, which they own since they purchased the System V copyrights. Though they are in the process of issuing cease and dissists letters, they still host the source code and are drawing up licensing plans, "just to be safe".

    --

    Friends don't help friends install M$ junk.

  202. To warez, or not to warez. That is the question. by JebuZ · · Score: 1

    I'm not sure if this is a torrent day, or a torrent free day. So, I'll disregard tact and post this.

  203. Re:Likely a change to stop "pirating". by Lordrashmi · · Score: 2

    Not to nitpick, but if he doesn't have a graphics engine, how does anything else work?

    As for an engine, the source for Quake2 is released. Could he use that?

  204. Valve can take its time by evilfrog2 · · Score: 1

    it's entirely reasonable that this source code leak would delay the release of the game. however, i also think it's simply a good excuse to spend more time on it.

    the original Half-Life missed its release-date by a year (gamasutra.com had a nice article on it by Ken Birdwell). they produced one of the best games ever, so the delay was a good thing! i'm excited about HL2 and i for one do not mind waiting another year for it -- if that's what it takes.

    finally, i'd like to say that i would be thrilled to have the opportunity to study the source code for valve's engine. i'd prefer to see it legitimately (as with id's GPL releases) of course, but still...

  205. Re:To warez, or not to warez. That is the question by Anonymous Coward · · Score: 0

    http://www.bittorrentmovies.de/newphp/htmls/d569.h tml#BETA

  206. been there, seen that, AT A NUKE. by twitter · · Score: 1
    n short, his own account information was stolen via Outlook, then several other employees were hit with a Outlook preview-pane virus that installed a keylogger.

    Yep, I had the same thing happen to me when I was working for a Nuclear Generating station 18 months ago. A porn spam jumped out of the preview pane, launching several full screen instances of M$IE directed at porn sites, while the hard disk spun furiously. Exactly what it did, God and the sender only know. I hit the off switch.

    IT was no help at all. They thought I was worried about being fired for browsing porn and opend an investigation into my web browsing habits. The clueless exchange admin remoted into my machine while I was away from my desktop and ran it to completion. She did not have the patience to watch events unfold and disconected. She then had the nerve to tell me that things cant run from the preview pane and tell me I had clicked something. I insisted and made her watch it. Even after seeing it she did not get it. When I asked her if she though that arbitrary code from anywhere on the internet being run on my computer was a bad idea, she told me that it was "a normal part of advertising" and that she got several such spams a day.

    It makes sense that crackers would target admin on any windoze network.

    Corporate networks that use M$ are so owned it's not even funny. The stupid, arrogant and brainwashed M$ fanboys they have running them have no clue. M$ partners forever, baby yeah! 2003 and eXPensive software will solve your every click and drool need. Tthththpthpththht-tit!

    --

    Friends don't help friends install M$ junk.

    1. Re:been there, seen that, AT A NUKE. by Anonymous Coward · · Score: 0

      I'd like to belive this one...but it seems a little too good to be true.

  207. Re:Likely a change to stop "pirating". by c4ffeine · · Score: 1

    I forgot to mention, he liscensed a proprietary engine for now, but he won't distribute it until a good open-source engine comes out. He wants really good graphics; his target is 4000 polygons in the main char

    --
    "73% of quotes on the Internet are made up" -Ben Franklin
  208. publicity stunt by Anonymous Coward · · Score: 0

    Maybe this is a publicity stunt/unity of users appeal/excuse for delaying their game mix.

  209. Re:Sounds fishy (but it isn't) by Pvt_Waldo · · Score: 1

    Trust me. The company is in lockdown as far as the internet goes. This is not made up.

  210. And Valve Fires Back! by vix86 · · Score: 1

    Looks likes VALVe seems to think other wise.

    As someone has stated, "it's like VU and Valve has a war between them or somthing."

    1. Re:And Valve Fires Back! by loosewing · · Score: 0

      Its not a war.

      Its a tug of war.

  211. Someone post this maggot's address details pls... by Anonymous Coward · · Score: 0

    Lets lynch this menace. String him up boys! This kind of behavior is unacceptable. Even if the filthy maggot didn't steal the code, he helped traffick it. Someone please post this guys physical address, email address, phone number, etc.

  212. Who emails 1/3 of the code? by filenabber · · Score: 1
    They emailed 1/3 of the code? Seems odd. Why would you email it?

    Brian

    --
    Are you a Candy Addict?
    1. Re:Who emails 1/3 of the code? by Anonymous Coward · · Score: 0

      No one mailed the code. A trojan keylogger was isntalled from an email. That started the process of how the person got in.

  213. And now for a moment of humor by AzraelKans · · Score: 1

    I just checked out the planned release date for Duke Nukem Forever for xbox in Neoseeker: dec 2003
    (The date when half life 2 PC was going to be released)

    OH crap, I guess now they will have to delay that one too.

    --
    Go ahead MOD my day!
    More opinions here
  214. Blender got quite a bit by nurb432 · · Score: 1

    Remember the collection to buy out the source from those whom bought NAN..

    100K was the figure if i remember right...
    thats not exactally pocket change for most of us around here.

    I doubt its millions made ( NET $$ ) off some stupid game as well.. id like to see proof of that.

    --
    ---- Booth was a patriot ----
    1. Re:Blender got quite a bit by YOU+LIKEWISE+FAIL+IT · · Score: 1
      I doubt its millions made ( NET $$ ) off some stupid game as well..

      The "buzz" is that these days the Gaming Industry is a big money place to be. However, good games are also expensive to make, and you've got publishers and so on to worry about.

      Unfortunately, Valve won't disclose sales figures or financials to the general public ( and as a privately held company, they have no reason to do so ), so it's hard to tell. I do recall a rumour a while back they were filing for Chapter 11 because of a royalties dispute - I think it ended up being an April Fools joke.

      id like to see proof of that.

      Yes, well, I'm sure id has seen proof of that. id's Technology Licensing page claims that just by themselves, Quake I, II & III have shifted four million copies, and I'd hope they're making more than a dollar net profit on each. This doesn't even include licensing revenue, arguably more important, and there are 22 licensed titles listed on the same page.

      Frankly, I think they're going to beat out NAN on this one.


      -- YLFI
      --
      One god, one market, one truth, one consumer.
  215. Liars! by Cyberllama · · Score: 1

    When a game gets delayed, the distributors are the first to hear about it. Once the distributors know, their customers, or at least their big ones are the second to know. If you had gone to any Gamestop or EB store in the past month and a half and asked what the release date for Half Life 2 was, they would have checked thier computer system and told you right out "It's April 2004." I know, because I work in such a store -- and was quite dissapointed when I checked one day and discovered it had been pushed back.

    These dates are not random guesses, I've seen "official" street dates listed as the release dates for games in our computer system while the game companies say "there is no release date". It never fails, 2-3 weeks later, the game company will announce the street date as the date in our computer system thats been there for weeks.

    For instance, I remember the release date for Warcraft 3 was pegged exactly in our computer system for about a month before Blizzard officially announced that day as the release day. Meanwhile, the entire month, Blizzard kept insisting publicly that there "was no release date".

    In other words, I can tell you this from previous experience: If our computer systems said April 2004 over a month ago (and it did) that was NOT just a guess, that was based on information coming (albeit indirectly) from Valve.

    So, long story short, Valve is lying. They had decided on the April 2004 release date long before any source code was made public. This just provides an easy excuse to be late.

  216. To the jackasses who leaked the code... by daVinci1980 · · Score: 1

    ...and those who now have it and are looking at it...

    Thanks from all of us who were waiting eagerly for this one to come out. We appreciate your contribution of the additional four month wait.

    assholes.

    --
    I currently have no clever signature witicism to add here.
    1. Re:To the jackasses who leaked the code... by Anonymous Coward · · Score: 0

      You're going to blame the people who are curious enough to look at the code? You seem to be something of a moron.

      Oh yeah, if thousands of average people hadn't downloaded it, the opportunistic fucks that write wallhacking tools wouldn't have done so either.

      Fuckwit.

    2. Re:To the jackasses who leaked the code... by JohnFluxx · · Score: 1

      Do you honestly believe that this leak is the only reason for a 4 month delay?
      Nobody seems to have come close to a plausible explanation for a 4 month delay.

    3. Re:To the jackasses who leaked the code... by shird · · Score: 1

      What everyone else said. Do you seriously hink me having a browse of the code is causing a delay? Fuck.. valve wouldn't even know that I was, and it'd make no difference whether I was or not.

      Vavle has to assume that anyone going to abuse the use of the source has got a copy. Whether they do or not, and whether joe sixpack does or not is irrelevant.

      The source has been leaked. _that_ is the problem, not me or anyone else having a look. _that_ makes no bloody difference.

      --
      I.O.U One Sig.
  217. Re:Conspiracy Theory #574: Valve Leaked HL2 Code? by My+name+isn't+Tim · · Score: 1

    I just noticed that DNF or Duke Nukem Forever can also be seen as Did Not Finish

    Fun stuff :)

  218. mod parent up by Anonymous Coward · · Score: 0

    rofl

  219. Re:To warez, or not to warez. That is the question by Anonymous Coward · · Score: 0

    Doesn't seem to be working... timed out.

  220. Re:Likely a change to stop "pirating". by FatalTourist · · Score: 1

    When people realize that when one slashdot user speaks, he doesn't speak for all slashdot users.

    Unless he's the Lorax! He speaks for the geeks!

    Or maybe he speaks for something else. Can't remember.

    --


    Escape Pod Films: Sketch Comedy and Web Series
  221. delay? lost revenue? why? by Eric+Smith · · Score: 1

    How can the leak possibly cause a schedule delay? There's no point in delaying the schedule unless they want to do so for other unrelated reasons. And there's no cause for lost revenue unless they delay. It's just another lame excuse they're putting out to draw attention away from whatever their real problems are.

  222. grains of salt by r13 · · Score: 1

    Shesh, has there been any OFFICIAL word from valve regarding the delay, or is all this just a rumor manifesting it way through the news sites as fact? I think I'll take all these rumorous reports with a grain of salt until something more firm is given by the source of the game.

    P.S., How the hell does cnn friggin money have the scoop on whether or not there is a playable version of HL2 floating around!?! I think I'll take that with a truckload of salt...

  223. Buzz! Thanks for playing. by Anonymous Coward · · Score: 0
    It isn't impossible, it just takes more work. I've been working in this industry for a while now and I've seen in both ways. My largest project (a major seller for a company that has a plummer as a mascot ;)) was done without any connection from the development PCs to an external net. We got assets from outside sources (art, music, code libraries) but we never exposed any internal machine to the outside except for a couple of "net PCs" that had their external drives (CD, Floppy) removed.


    At the time this felt a little ext ream, but I can see the logic in it now.

  224. no bit torrents? by fldvm · · Score: 1
    there's a newly public leak, allegedly involving a partially playable, Beta pre-release of the game

    ..but no bit torrent links in the slashdot comments Modded up to 5? Come on guys you are slipping..

    1. Re:no bit torrents? by Anonymous Coward · · Score: 0
    2. Re:no bit torrents? by size1one · · Score: 1

      http://www.bittorrentmovies.de/newphp/bits/halflif e2-beta-english-seeded-by-[www.bittorrentmovies.de ]2.rar.torrent rar pass is www.bittorrentmovies.de

      can anyone confirm this is in fact the beta? i heard there were some versions floating around that were actually 1.5 gigs of gay porn.

    3. Re:no bit torrents? by T40+Dude · · Score: 1

      That's probably wishful thinking on your part.

  225. Re:Likely a change to stop "pirating". by Overly+Critical+Guy · · Score: 1

    When you put "pirating" in quotes, I knew your post would be worthless.

    --
    "Sufferin' succotash."
  226. The "Beta" leak is real by Anonymous Coward · · Score: 0
    I am downloading it right now from a topsite... 100 x 15MB. From what I hear, it's the playable E3 demo.

    Here's the NFO (sans ascii art and special chars to get around the lameness filter):
    October 7. 2003
    Half-Life 2 - "Chosen 9" release
    Company: Valve Corporation ( http://www.valvesoftware.com )
    File size: 100 x 15MB
    Release: November 2003

    Quote from http://www.planethalflife.com/ : "There were a ton of rumors the past couple days about the existence of a leaked, playable Half-Life 2 beta, but thankfully those stories have been confirmed to be completely false."

    Well, I hope nobody believed this rumor. Who would actually be good enough to get the source, but forget the game ?

    To myg0t: this is too big for you to take credit :P

    - Anonymous leaker

    Gordon Freeman is back! Along with scientist Eli Vance and his daughter Alyx, your mission is to save the world from total alien domination. See, that little incident in Black Mesa was just the beginning: now those pesky Xen invaders and a new threat called the Combine have spread across the whole Earth, causing massive amounts of death and destruction. It's up to you to set things right.

    + Scientist-with-a-crowbar Gordon Freeman joins a ragtag human resistance fighting extradimensional invaders for the survival of a conquered Earth
    + Unnervingly realistic graphics the likes of which have not been witnessed outside of a motion picture or pre-rendered cut scene
    + Realistic physics: objects have varied and appropriate mass, density, physical properties
    + Ingenious artificial intelligence: enemies will adapt, plan, improvise, and respond
    + Hordes of new aliens and other enemies, plethora of guns and other weapons

    Minimum system requirements:
    + Windows98/2000/Me/XP
    + 700 MHz CPU
    + 128 MB RAM
    + DX6 compatible video card
    + ~3 GB free hdd space

    Recommended system requirements:
    + Windows98/2000/Me/XP
    + 2 GHz CPU
    + 256 MB RAM
    + DX9 compatible video card
    + ~4 GB free hdd space

    Have fun playing, but buy the game, cause this wasnt intended to be leaked! After the source leak, there was no reason for keeping the beta private.

    - Anonymous leaker
  227. Look, you simply dont get it. by Viewsonic · · Score: 1
    You're talking about people working at home and remote sites? As if this should just be allowed? If so, then they need to expect their code to be stolen. Period. If they dont want it to, they need to maker everyone come in, work in the same building like everyone else on the planet. If the company is so lax on letting people dink around with code on their laptops while they're on a business trip, or sitting on a beach trying to keep stress levels down, then they need to realise that if their code gets stolen, its their own damn fault. Two seperate machines and two LANs is not hard to do!. It's all tradeoffs. Do you want your code stolen or not? It's that freaking simple!

    And yes, testing stuff like Steam will require reimaging machines over and over when they're done doing it. Like I said, if you want the resources of the internet, then keep it on a seperate machine. It's just stupid to have someone get your lives work just because you want to check your email on the same damn machine or work at home. Never take those compromises.

    1. Re:Look, you simply dont get it. by loopback_127001 · · Score: 1

      Because so much source code has been stolen in the past from Microsoft and Valve and every other company on the planet that allows people to work remotely.

      Are you really this aggressively stupid, or is this some sort of 'method acting' thing for a part in the sequel to "Antitrust" ?

      You do realize that the level of 'tradeoff' you are suggesting is not unlike saying we should build all buildings underground from now on so we can avoid having planes fly into them, right? I MEAN LOOK AT WHAT HAPPENED ON 9/11!! If those skyscrapers had been COREscrapers, that never would've happened!

      And it is all tradeoffs, and the ludicrous idea you are presenting has far too many negatives for an ostensible positive "keep your code from being stolen". And carefully ignoring the years and years of source code _never being stolen before now_.

      Really. Truly. go get a dollar from your mom, head out the door. Get on your bike. (put the helmet on first!) and ride down to the corner clue store. Walk in, slap that dollar on the counter and say "Give me one of your best, my good man!"

  228. Code leak by Anonymous Coward · · Score: 0

    To those who leaked this code:
    f**k you.

    Sorry, but I've been longing to play this game ever since I saw the E3 demo video.

  229. All You "Information Wants To Be Free" Assholes by FatHogByTheAss · · Score: 1

    Well, now it's free, and this is what you get.

    I believe crackers should be beheaded in the public square.

    --

    --
    You sure got a purty mouth...

  230. How about a glue trap? by loosewing · · Score: 0

    If you absolutely have to have a connection to the net from the network, why not install a tar pit on the download side?

    What I mean is if you try to download something that is 100MB + on a 33.6kbps downpipe, would it not make a sloooow process allowing any network admin time to turn around and say ; "HMMMM what's this?"

    Eitheir a thin pipe (14.4 or 33.6) or a verrrrry slow machine would stall such a caper, no?

    To catch a rat, put a glue trap!

    Just my thought...

  231. The src code appears complete - but no models by netdemonboberb · · Score: 1

    According to Half-Life Source Community
    and Half Life 2 Source Code Resource Page, Gabe Newell and Valve Software reported that the source code stolen wasn't enough to compile a complete game and was only a small amount of the source. They said that even though it compiles, it isn't enough to be usable. This goes along with information from those that have tried building it [I'm not saying whether or not I have tried ;-) ]: that most binaries (although some believe all except setup binaries) are built but the game doesn't run beyond the "Loading..." screen. Apparantly, there are no textures, prefabbed models, maps, and game configuration files to put the icing on the cake. These graphical resources alone should probably account for most of the source's size. At least for those lucky enough to get the incomplete source, they can get a good idea how a premier 3d first-person-shooter is written and maybe have a better idea of what is causing errors in the game when they write modifications.
    Also, word is that Valve will be making modifications to the game so that binaries built from the stolen code will be inoperable with the releases they have delayed. Word is they are also close to finding the identity of the hackers. I wonder if they will sue Microsoft for the security issue in Outlook Express that allowed the hackers to get in. We can only hope.

    --

    Volunteer Mozilla developer, RPI Student.
  232. I smell poop by Lord+Kano · · Score: 1

    of the male bovine variety.

    Maybe I'm just a little too paranoid, but is it possible that Valve allowed an early alpha version of their code to leak so that they'd have an excuse when they didn't ship this game on time?

    Sure, they can take advantage of this time to rewrite some things and prevent cheaters from exploiting the available code, but is the money that they'll lose by not releasing on time less than the money they'll lose when cheaters cause people not to buy the game? I don't think so.

    I suspect that the game was going to be late anyway and this is just a convienent excuse.

    LK

    --
    "Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
  233. parent is troll. by Anonymous Coward · · Score: 0

    need to reboot to un write protect the files

    wtf? somehow, i'm not convinced. 1) I'd like to know how you turned your system off. 2) the fact that a robust linux system can be distributed on a floppy and yet there's no room on a 40mb hdd for a 21kb binary needed to shutdown? Even if the program was staticly compiled, it shouldn't take any more than 200kb. But I know you couldn't statically link since you were low on space (hence the intended purpose of dynamic linking) and did not have gcc. 3) How did you get apache work without libraries?

    Bzzzt! Thanks for playing, mr. troll.

    Since you apparently need to restart the system to "un-write protect" the files, how about something quicker:
    $root:>umount /dev/hdxx
    $root:>mount -t filesystem /dev/hdxx /mountpoint.

    And how does this machine work so "perfectly" if it exhausts all 8megs of RAM for every printjob and boots users off on every print job? And what the hell are you using apache for on a print server?

    1. Re:parent is troll. by Anonymous Coward · · Score: 0

      And how is this "security through obscurity" I might add? What exactly is obscured?

  234. Valve is just like everyone else.. by Anonymous Coward · · Score: 0

    Businesses (and people in general) are always looking for a fall guy that can be blamed for their own short sightedness, delayed production, lost income, or workers that have been laid off.

    "We had to lay off 1,000 people here in Nowheresville, Canada because of the devastating impact of 9/11 on our 'fake dog poop' manufacturing plant."

    "The Internet is to blame for lost income in the music industry, not our high prices or poor quality of musicians."

    "Video games, television, radio, and books are to blame for poor academic achievement and violence in our schools."

    Valve was going to delay it either way, but they would much rather have someone to place the blame on rather than admitting their own shortcomings.

  235. download it for yourself by Jukashi · · Score: 1
    1. Re:download it for yourself by Anonymous Coward · · Score: 0

      there is a trojan compiled in it. downloader.trojan. norton antivirus will pick it up and delete it though.

  236. Press Error? by sik+puppy · · Score: 1

    According to the inquirer (www.theinquirer.net?article=11984), this may be in error:

    Reports of Half Life further delay mistaken?

    It will ship at Yuletide, it appears

    By INQUIRER staff: Tuesday 07 October 2003, 19:24

    SOURCES CLOSE to Valve Software tell us that despite wires - including us - picking up a Les Echos report that Half Life is delayed, it won't be. And it isn't.
    Apparently Valve is close to issuing a statement about all of this - and our sources maintain that it's still going to ship in the "holiday" period - Yuletide to you and me.

    What a fascinating tale this is all becoming.

    --
    The first thing we do, let's kill all the lawyers. Shakespeare, Henry VI, Part 2, Act 4, Scene 2
  237. Screenshots by Anonymous Coward · · Score: 0

    http://underground.infinity.net.pl/halflife2/

    screenshots ahoy.

  238. bittorrent by lune+tns · · Score: 1
    http://suprnova.lagalot.com/torrents/413/Half.Life .2.Beta-ANON(2).torrent

    here.

    1. Re:bittorrent by lune+tns · · Score: 1

      http://www.emptylogic.com/suprnova/torrents/413/Ha lf.Life.2.Beta-ANON(2).torrent Oops. Fixed the URL.

  239. Punkbuster by harikiri · · Score: 1
    Halflife 2 should integrate PunkBuster into the game client, something like this is the only long-term method of keeping the game free of cheating.

    How it works is detailed here.

    I'm suprised if this isn't already present in the game. The games I play (Enemy Territory and America's Army) have been a pleasure to play compared to back when cheats where prevalent (in America's Army at least).

    --
    Man watching 6 MSCE's around a sun box, looks alot like the opening scene's of 2001:space odyssey...
  240. Why the Rewrite? by serutan · · Score: 1

    Maybe this is a naive question, but I don't understand why the theft of some of the source code forces them to rewrite the game. Was the game going to be late anyway and this is just a handy excuse? Or am I just clueless?

  241. It's a little extreme but... by _Sexy_Pants_ · · Score: 1

    Being pretty frustrated and seeing how many people feel similarly, I wonder if there's anything we can do to help. Perhaps Valve would let those who have the code patch up any of the faults they find in the less harmful parts. Of course this would be extremely hard to organize. The primary goal is that I wish I could contribute somehow. Merely sending Valve money won't really do much and I can't exactly join them (I wouldn't be much help anyway). Any thoughts?

    --
    Look it's a joke about my sig IN MY SIG! LOL!
  242. because lots of us already got suckered by waspleg · · Score: 1

    I already bought a brand new radeo 9800 pro 128 mb just to play hl2 and my brother just dropped almost $1k on a new system mostly for playing hl2... There are also quite a few people who have pre-orders both for the game and for the bundles w/ the video cards. I'm sure I'm not alone here and hell maybe they figure it's good for them cause now they have some of the pressure off to amke the game work better w/ existing cards while ATI/NVidia get some breathing room to plot and scheme and hold off on releasing hteir next line until the games that can actually use them are available... everyone in the industry wins from this situation because it's a given that the game will go platinum as soon as it touches the stoes regardless of any delays and thes ame came be said for Doom3.. the only people who lose are We the consumers; once again left holding the empty bag of hope...

  243. Did anyone bother with a backup?? by Charcharodon · · Score: 1

    I see people arguing back and forth about separate networks and security holes, but how about the fact that they said 1/3 of the code was stolen. So do they mean it as in taken, gone, or deleted? So where is the back-up to the code? Don't tell me these geniuses actually trusted their entire and only copy of the code that was worth millions of dollars, without a single DAILY back up somewhere separate. The whole projetct could have been backed up on a daily basis on less than $2 worth of optical media and put in a safe. Sounds kind of weird to me that they wouldn't do something like that.

    1. Re:Did anyone bother with a backup?? by Charcharodon · · Score: 1

      Hehe, guess I should read at least 100 posts deep before I throw a dumb reply out there, oh well. I can see why they postponed now.

  244. Son of a BITCH by Geekwad · · Score: 0, Troll

    WHAT THE FUCK, you cock-smoking little bitches! I'm gonna find where you live and sodomize each of you with a fucking broken JOYSTICK, you little fuckfaces! I SWEAR TO FUCKING GOD!!

    --

    - http://pakman.sytes.net/
  245. Why doesent he just sue a 12 yr old that psycho... by UltimaL337Star · · Score: 0

    Who would do such a thing and ruin such a perfect game release... it's like kicking a dog and driving to Alaska and never paying for gas at self-serve's and clubbing a baby seal... I for one, will buy a clean legal valve bred and released official copy of half life 2 no matter what. I hope the leaker is found and cast out from society.. he types like a little kid with gun. I think I'll hate this guy more then the RIAA if he goes on... THE RIAA!