Half-Life 2 Source Code Leak [Oct 02, 2003, 5:41 pm ET] – Share – Viewing Comments
A post to the Halflife2.net
Forums by Gabe Newell finally has a comment on the leaked Half-Life 2 source
code, brought to the world's attention by Gamer's
With Jobs and Slashdot.
Here's the deal:
Ever have one of those weeks? This has just not been the best couple of days for me or for Valve.
Yes, the source code that has been posted is the HL-2 source code.
Here is what we know:
1) Starting around 9/11 of this year, someone other than me was accessing my email account. This has been determined by looking at traffic on our email server versus my travel schedule.
2) Shortly afterwards my machine started acting weird (right-clicking on executables would crash explorer). I was unable to find a virus or trojan on my machine, I reformatted my hard drive, and reinstalled.
3) For the next week, there appears to have been suspicious activity on my webmail account.
4) Around 9/19 someone made a copy of the HL-2 source tree.
5) At some point, keystroke recorders got installed on several machines at Valve. Our speculation is that these were done via a buffer overflow in Outlook's preview pane. This recorder is apparently a customized version of RemoteAnywhere created to infect Valve (at least it hasn't been seen anywhere else, and isn't detected by normal virus scanning tools).
6) Periodically for the last year we've been the subject of a variety of denial of service attacks targetted at our webservers and at Steam. We don't know if these are related or independent.
Well, this sucks.
What I'd appreciate is the assistance of the community in tracking this down. I have a special email address for people to send information to, helpvalve@valvesoftware.com. If you have information about the denial of service attacks or the infiltration of our network, please send the details. There are some pretty obvious places to start with the posts and records in IRC, so if you can point us in the right direction, that would be great.
We at Valve have always thought of ourselves as being part of a community, and I can't imagine a better group of people to help us take care of these problems than this community.
Gabe
... Zeph. is actually right about the requirement for Steam for CS and other HL based games that are played online. At some point in the future, the current server lists will be shut down, and switched to Steam, forcing you to use Steam if you want to play any of them online any longer.
That much of it doesn't really bother me, since I don't play CS any more. The major issue that I now have with steam (other than a few new security worries) is the requirement to be online to play HL2 single player, I really wanted them to ditch this in favour of "if you happen to be online while playing HL2 single player, we will authenticate you".
Unfortunately, the release of this code makes me wonder if it's even worth postponing my purchase untill they do that, since I'm no longer certain that they will. On the other hand, since the code is out there, I can't see how they can prevent people from patching Steam out of HL for single player, so perhaps they'll see the futility in knackering their real customers with this lame requirement.
I'd like to think that my personal descision for a boycott was perhaps a little more balanced than thinking that Valve deserved all manner of nasty things happening to them though.
I'd submit this as another reason why this release really hurts Valve. I don't know a huge amount about it, but I predict that in some way cracking the eventual release of halflife to remove both the CD-key and Steam is going to be much easier, and make pirated single player copies a *lot* easier to create in a game that was designed to be deployed in a way that hopefully deterred piracy. With this code, you could even probably write a seperate program that worked like a firewall to block and then reply to HL2's connections, allowing HL2 to think it was steam authenticated without ever actually having connected to a real server.
That much of it doesn't really bother me, since I don't play CS any more. The major issue that I now have with steam (other than a few new security worries) is the requirement to be online to play HL2 single player, I really wanted them to ditch this in favour of "if you happen to be online while playing HL2 single player, we will authenticate you".
Unfortunately, the release of this code makes me wonder if it's even worth postponing my purchase untill they do that, since I'm no longer certain that they will. On the other hand, since the code is out there, I can't see how they can prevent people from patching Steam out of HL for single player, so perhaps they'll see the futility in knackering their real customers with this lame requirement.
I'd like to think that my personal descision for a boycott was perhaps a little more balanced than thinking that Valve deserved all manner of nasty things happening to them though.
I'd submit this as another reason why this release really hurts Valve. I don't know a huge amount about it, but I predict that in some way cracking the eventual release of halflife to remove both the CD-key and Steam is going to be much easier, and make pirated single player copies a *lot* easier to create in a game that was designed to be deployed in a way that hopefully deterred piracy. With this code, you could even probably write a seperate program that worked like a firewall to block and then reply to HL2's connections, allowing HL2 to think it was steam authenticated without ever actually having connected to a real server.
Date
Subject
Author
Copyright © 1996-2025 Stephen Heaslip. All rights reserved.
All trademarks are properties of their respective owners.
Privacy Policy. Manage Cookie Settings.
News CGI copyright © 1999-2025 James "furn" Furness & Blue's News. All rights reserved.
Chatbear v1.5.0/blue++: Page generated 13 July 2025, 15:40.