I have been reading since about noon, that Valve’s Half-Life 2’s source code has been leaked onto the internet. And I felt the need to voice my opinion on the topic, since I am a software engineer.
I have been reading people’s comments like “Why did he have the source code on his computer that was connected to the internet? Why didn’t he protect it better?” and stuff like that, but it is really easy to look back on the situation and point out all the things he could have done, but how many of you keep personal records on your computer? I will bet you that you don’t have nearly the security system running on your network/computer that Valve has running on theirs, yet you, and I still do it, why?
Is it because we are stupid? Is it we are uneducated? Well the answer may be both, but there are other reasons as well. Most of took a good portion of the following into account.1.
Risk vs. cost/convenience. Now you may not have sat down and did all the figuring, but a version of it has passed through your mind. It may have even been unconscious, but you still did it. When you went down and bought, or decided not to buy that software/hardware firewall, unless you fall into that first question, you are aware that nothing is impenetrable. So buying that 50 dollar firewall as opposed to the 3,500 dollar firewall we use here at work seemed like a good investment. Then again who owns a second computer specifically to do their finances? And who wants to? I like using 1 computer for everything, it is all setup the way I like, and if I change something it stays. Or who wants to re-boot their computer to a different OS just to check their e-mail after playing a game, because that OS is more secure? I don’t.2.
Motive vs random attack. What are the 3 dangers of the fire swamp? Flame spouts, Lightning sand, and ROUSes. Wait, no, that’s not it but close. There are the random attacks: i.e. Send out a non-targeted virus that installs a Trojan and see who runs it. Well we all know of this one anymore, and think we can avoid these pretty easily. i.e. don’t open e-mail we don’t trust. Direct attack, well who is going to attack my computer directly? As long as I am not out there on the internet spouting off about my millions of dollars, it is unlikely my computer’s address will draw enough attention to be directly attacked. And 3rd if I keep my stuff at least decently hidden/password protected who is going to spend the time getting to the few dollars that I might have available.3.
Ego/experience. The belief that “It will never happen to me.” Or it never has happened to me, so what’s the likelihood that it will in the future?4.
Someone you trust in “The Field” told you it was ok.
Between these things you have made the rationalization that it is ok to do. Well if anyone of you ever gets something taken, any one or all of those reasons above will fail you, and someone can point it out that you where foolish. Well Gabe at Valve, and his IT department definitely went through the same process, likely more formalized than the version you went through though. I have gone through the same thing here at work with my boss as well. We plug the holes we see as glaring, or we have had experience with in the past, and we try to learn from others experiences to be prepared for the future. They did the same thing, and I don’t fault them for that. The attack that took their source code, was specifically directed at them, and likely took a lot of planning, intelligence, and time to pull off. Plus was excessively risky for the culprits future, if they are caught it could mean a good deal of time behind bars. Who would have guessed that source code was that important to someone? Now we can say beyond doubt that it was that important, but then again that is looking into the past.
Anyway, I think it is a shame this has happened, and although I don’t think I will play Half-Life 2(I am looking forward to Doom III myself), I am still very sorry to hear of this happening. That code took them a very long time to create, and now it isn’t worth much.
Take the last 5 or so years of your life, and undo it, and see how that makes you feel? That will then touch on what I am sure the guy’s over at Valve are feeling now.
/*New and stirring things are belittled because if they are not belittled, the humiliating question arises, ``Why then are you not taking part in them?'' -H.G. Wells*/