Half-Life 2 Source Code Leak

A post to the Halflife2.net Forums by Gabe Newell finally has a comment on the leaked Half-Life 2 source code, brought to the world's attention by Gamer's With Jobs and Slashdot. Here's the deal:
Ever have one of those weeks? This has just not been the best couple of days for me or for Valve.

Yes, the source code that has been posted is the HL-2 source code.

Here is what we know:

1) Starting around 9/11 of this year, someone other than me was accessing my email account. This has been determined by looking at traffic on our email server versus my travel schedule.

2) Shortly afterwards my machine started acting weird (right-clicking on executables would crash explorer). I was unable to find a virus or trojan on my machine, I reformatted my hard drive, and reinstalled.

3) For the next week, there appears to have been suspicious activity on my webmail account.

4) Around 9/19 someone made a copy of the HL-2 source tree.

5) At some point, keystroke recorders got installed on several machines at Valve. Our speculation is that these were done via a buffer overflow in Outlook's preview pane. This recorder is apparently a customized version of RemoteAnywhere created to infect Valve (at least it hasn't been seen anywhere else, and isn't detected by normal virus scanning tools).

6) Periodically for the last year we've been the subject of a variety of denial of service attacks targetted at our webservers and at Steam. We don't know if these are related or independent.

Well, this sucks.

What I'd appreciate is the assistance of the community in tracking this down. I have a special email address for people to send information to, helpvalve@valvesoftware.com. If you have information about the denial of service attacks or the infiltration of our network, please send the details. There are some pretty obvious places to start with the posts and records in IRC, so if you can point us in the right direction, that would be great.

We at Valve have always thought of ourselves as being part of a community, and I can't imagine a better group of people to help us take care of these problems than this community.

Gabe
View : : :
329 Replies. 17 pages. Viewing page 8.
Newer [  1  2  3  4  5  6  7  8  9  10  11  12  13  14  15  16  17  ] Older
189.
 
And all across the industry...
Oct 3, 2003, 06:42
And all across the industry... Oct 3, 2003, 06:42
Oct 3, 2003, 06:42
 
...people are thinking 'oh shit that could have been us.' and tightening security like you wouldn't believe. Year, maybe it was time I downloaded those outlook patches. Hmm, that quirky behaviour my PC does from time to time... Oh my god oh my god...

Seriously, I doubt there is a secure system out there that couldn't be hacked by someone. The kudos points these nerd hackers have with one another as if they were out big game hunting means someones basking in all this attention. I feel sincerely sorry for Gabe and Valve. I recently submitted a four year thesis (a microcosm in comparison perhaps) but if someone had stolen this, published it and seriously tarnished it's content I'd have been devestated.





--------------------

A stitch in time would have confused Einstein.

Steven Wright
This comment was edited on Oct 3, 06:43.
188.
 
Appoligies if this is posted
Oct 3, 2003, 06:17
Appoligies if this is posted Oct 3, 2003, 06:17
Oct 3, 2003, 06:17
 
Good luck 28 pages of DRAMA

http://halflife2.homelan.com/forums/showthread.php?s=8e0897c32af345d4e2cdadfcb59e6955&threadid=10781&perpage=15&pagenumber=1

Scorpio Slasher: ... What about you boy, what do hate?
Marcus: ... Bullies. Tiny d*ck egotists who hurt people for no reason, make people lock their doors at night. People who make general existence worse, people like you.
Avatar 1858
187.
 
Re: sigh...
Oct 3, 2003, 05:34
Re: sigh... Oct 3, 2003, 05:34
Oct 3, 2003, 05:34
 
BeOS owned Windows. People just didn't know or want to write anything for it.

186.
 
Re: Direct Attacks, Maturity and Security
Oct 3, 2003, 05:27
Re: Direct Attacks, Maturity and Security Oct 3, 2003, 05:27
Oct 3, 2003, 05:27
 
Re: 182
Good point and analogy: Potter 5 was delayed due to one thing: it wasnt finished. No publisher would publish a book with chapter 12 missing and no page numbers, and game devs even have an advantage in that they can patch etc. I didnt see any of the 9 year olds queueing up for the book complaining anything like as much as the 30 year old mature people we supposedly have on these boards. Furthermore, the Potter book got leaked about a fortinght before release - an employee at the printers took some unfinished copies, a "pre release Alpha" if you like, so those that say gaming is the only industry that suffers from leaks are wrong. However, to extend the points made so far about airplane, car, aerospace etc industries and the inevitable delays with complex projects, I would suggest that delays with complex projects that involve any form of creativity are even more inevitable. Nobody bemoans authors with writers block, nobody said "Hurry up" to Monet. And, as many examples have shown, when this has happened, it's resulted in inferior products.
My point? (;P) My point is that those that whine about delays, particularly with creative things, are missing the point. If a delay means I get a better product, fine.

Time for an "IMHO."

#154, I'd hope Valve have better stuff to do than create a whole new source code just to fool some hackers ;P. I dont know what to make of the leak. It's disappointing, may make online gaming even more annoying, and, if steam were compromised to make it insecure, may make a whole world of trouble for Valve. Which would be a shame, because (again, IMHO) Steam-style publishing platforms are probably "A Good Thing(tm)."
Time will tell, it always does.

Tango

Avatar 18712
185.
 
Re: sigh...
Oct 3, 2003, 05:18
Re: sigh... Oct 3, 2003, 05:18
Oct 3, 2003, 05:18
 
"Windows is the accepted standard" "It's because nothing is good enough and easy enough to use to compete yet."

Yeah and for some reason people are unwilling to revert to installing hardware and software by using a command prompt.

184.
 
Re: No subject
Oct 3, 2003, 05:18
Re: No subject Oct 3, 2003, 05:18
Oct 3, 2003, 05:18
 
chris,
he is just troling and you know what they say.. don't feed the trols

I feel for you man, hope everything will turn out OK (as I hope.. read my other post, if you are in the know - pass it on to gabe or somebody),

shul

183.
 
Maybe the community is mature enough ?
Oct 3, 2003, 05:10
Maybe the community is mature enough ? Oct 3, 2003, 05:10
Oct 3, 2003, 05:10
 
This is going to look like a trol, but bare with me...

I don't think this has to be such a fatal blow to HL2, I don't think we, as gamers, are being screwed here.
Why? because having the source code isn't going to change anything.
The source code being out there only means more people will be able to look at the cause of the problem (when such a cheat/hack/bug will be in existence), nothing more. This means that the community will be able to remedy situations before valve does (not that they didn't do a great job with HL1, but having a cheat/bug without any ability to solve it is pretty frustrating for anyone with C knowledge),
So - it will be transparent. copyright laws and the "changing code any hour, any day, any second" scheme of valve (if it will work) will be enough from stealing the important, break-through stuff in HL2, and all the rest is already open source so why bother?

I think that as a whole , unjustifiably as it is, this will be a good step for the community, not something which will ruin it.

The only thing which worries me is what will come of valve after all of this, a company which obviously should not have been the target of such an attack. I hope they will gather up the pieces and understand that this is not the end of the world as they know it.

182.
 
Direct Attacks, Maturity and Security
Oct 3, 2003, 04:59
Direct Attacks, Maturity and Security Oct 3, 2003, 04:59
Oct 3, 2003, 04:59
 
Time for me to pipe up again.

First off, people do directed attacks at anyone. My server is constantly getting attacked, some of them where people are personally attacking and not using automated scripts.

I have friends that have had their computers directly attacked because they are female and the hackers are trying to see if they can find a diary or get in to their emails. Some one has even gone after my grandmother's computer directly.

In reply to the gaming industry being immature because of not being able to meet target dates. Does this mean the book industry and movie industries are immature as well. After all, Harry Potter and the Order of the Phoenix was delayed twice and I believe it was almost a year late coming out.

I also mentioned movies, there have been many movies that have not meet their original release time. Harry Potter and the Prisoner of Azkaban was originally scheduled to be released December this year. Things happened like the original director decided he didn't want to do another one so they had to find a new director. Then one of their actors died.

So is the book industry, which has been around for thousands of years immature? Are you saying the the movie, Airplane, Car, Software Industry, Aerospace Industry, Nuclear-Power Industry, Ship-Building, Instrument, Sound system and just about every other business that makes products is immature?

Even seemingly simple products can run in to complication, for more complex products it's harder to determine exactly when they are going to be done. Is this immature, or is this just because things are becoming more complex? Should all the industries just wait until the final product is ready then start advertising it? Companies advertise their products before they know exactly when they will be ready because it makes the customer aware that the product is coming out and when to expect it. With complex thing, this date becomes harder to estimate.

Back in tech school my professor had a saying he was fond of. "The only secure computer is one encased in concrete and buried 50 feet under." He was one of the team that made the first wireless computers. They were for police cars and found out that no matter how much security you have, if some one wants to get in to some thing, if they have any access at all to it, they'll probably find a way.

That being said if you live in an area of town where cars have their windows smashed on a regular basis when they are parked out front, but it is less likely they will be smashed if you park out back. Doesn't it make sense to park your car in back? Either way it's not your fault if your window gets smashed, but you should take steps to try to prevent it.

181.
 
Just some thoughts...
Oct 3, 2003, 04:30
Just some thoughts... Oct 3, 2003, 04:30
Oct 3, 2003, 04:30
 
Noel, don't get upset, but actually, out of that 1 million
copies sold, you are right, only THOUSANDS(and by that I
mean UNDER 10,000) will be clueless customers(although,
one has to wonder, how did a clueless customer decided to
make HL2 the FIRST game he has ever played).
Pretty much, around 990,000 of those copies will be bought by people who have played games, FPS mostly and your biggest success with HL2 would be if if you would convert
some heavy RTS/RPG players to HL2 fans for life.
Otherwise, the majority of HL2 buyers wil be people that,
as I was saying above, are into FPS games.
I consider myself such a gamer: I had a PIII 800 with a
Ti4600, and, when I heard that HL2 will be out on September 30th, I KNEW I would have to MAJORLY upgrade my computer(because, as any heavy gamer, I want to play the best on the latest). I now have a P4 2.4 with a 5900 Ultra.
That was a $700 investement, TRIGGERED by YOUR game.
I think these kind of people will be your main percenatge of buyers...
Best regards !

180.
 
Re: Frightening...
Oct 3, 2003, 04:26
Re: Frightening... Oct 3, 2003, 04:26
Oct 3, 2003, 04:26
 
doom3 leak was probably a publicity stunt.

Never argue with an idiot. They will drag you down to their level and beat you with experience.
179.
 
hmmmm
Oct 3, 2003, 04:18
hmmmm Oct 3, 2003, 04:18
Oct 3, 2003, 04:18
 
I kind of think this is a result of people being pissed about Steam. Say 'duh' or whatever but thats my two cents.

178.
 
Re: hmmm
Oct 3, 2003, 04:03
Re: hmmm Oct 3, 2003, 04:03
Oct 3, 2003, 04:03
 
HAHAHAHAHAHAHAHA This is so funny.

Muppets. Your development machines were connected on a blind link to the internet? Have you never heard of MS proxy server (if you had to use an MS machine for some reason)? Do you not monitor outgoing traffic? Webmail used for anything other than arranging meetings? Why do you think VPN was invented with secure links (again if you have to use MS). Direct dial for critical component transfer (or courier an encrypted CD)

I develop software for banks and we have *never* had a security breach ever and I bet we are paid less than a quarter you guys are. Software development for large scale projects (or large money projects) is easy. You use certain rules, you keep machines separate and off the network. You have drity machines and clean machines (i.e. outside facing and inside facing) This is pure and simple ineptitude.

PS Has anyone seen any doom3 code? Maybe Carmack uses a firewall or a unix machine, or both.
This comment was edited on Oct 3, 04:25.
Never argue with an idiot. They will drag you down to their level and beat you with experience.
177.
 
Re: hmmm
Oct 3, 2003, 02:17
Re: hmmm Oct 3, 2003, 02:17
Oct 3, 2003, 02:17
 
Frax - Thanks for proving my last point so well. I never said *I* was more important than any other person on the street. I certainly am not! I just also don't think that he is, either - so equating his impatience with Valve somehow "deserving" to be ripped-off is folly. Also, those mod developers *SOLD* their stuff to Valve - Valve didn't rip people off or you'd see lawsuits; so just chill on the "Big Bad Wolf" theory. Some hobbyists made something that people loved, and saw a chance to get paid for their work. Valve thought it was worth it to pay them - the mod makers agreed. Where's the crime? If YOU got offered money and/or a real job, for a "hobby" project you did, wouldn't you take it?

And for the record: (A) I never WAS at Valve, I was at Sierra. (B) I'm still designing levels, I'm not an ex-level-designer.

chacro - "apologist"? Let's see, tell ya what: You try having a couple-thousand people look over your shoulder while you try to work your day job - and even if omly 10 of that 1,000 kibitz or cajole you, I bet you'd get tired of it REALLY quickly. :-P I'm not excusing bad behavior on the part of dev's or publishers, I'm just trying to tell it like it is. And again, I was making a point *to* someone - there's context there.

Tangled - My reviews are opinion pieces - like ALL reviews (movie, book, game, etc). Its OK to disagree with them dude; doesn't hurt me - its not like Loonyboi paid me to do them (I assume you're referring to my time at Loonygames), I did it for fun. Oh, and if you want to actually suggest ways for me to write better ones, I'll gladly take them - but "they sucks" doesn't really help.

BTW, you are 1 customer. Out of 1 MILLION copies they are going to sell of this game. *YOU* as an individual, expecting the game on day #23,756 instead of #23,757 are not important, compared to the THOUSANDS of mass-market clueless consumers that need to buy this game and have it work straight out of the box - because they can't even manage AOL or auto-update programs if the game is buggy and needs a patch. The delay of a product is a strategic thing - its done for important reasons and is not just some WHIM designed to frustrate you.

Lastly, to the guy that said that the delays in any other industry get you fired or your product cancelled: I refer you to the Airplane industry, the Car Industry, the Software Industry, the Aerospace Industry, the Nuclear-Power Industry, Large-Ship-Building companies, and ANY OTHER company or industry in which large and complex projects happen. You'll find cost and time overruns in ALL of them. The complexities of a project interact, so that the costs, time, and UNPREDICTABILITY of a project go up FASTER than the actual increase in complexity. Games have to run fast, smooth, and on a WIDE variety of hardware and software. Each piece of hardware may or may not fully conform to standards and specs; and each has its own bugs or quirks. This is why Microsoft has labs with THOUSANDS of machines hooked up, all testing the same thing. A 50-person company like Valve (or an average 20-person game developer) cannot possibly have these resources at hand. Even big Publishers cannot duplicate that sort of testing endeavour - which is one of the many reasons why game schedules are less predictable than, say, the next version of Windows. The other thing is that Windows also doesn't have a storyline or script that is being written or worked with either. Windows doesn't have a specific number of HOURS of enjoyment to provide, for a $50 value. Windows versions aren't as hotly anticipated as games either - so changes in release dates and schedules don't show up "on the radar" as much as highly-visible game projects.

Again: This is a complex business.

Take care,

--Noel "HB" Wade


176.
 
No subject
Oct 3, 2003, 01:55
No subject Oct 3, 2003, 01:55
Oct 3, 2003, 01:55
 
Azer, you give the peeps at valve too much credit

XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ExcessDan
175.
 
Re: hmmm
Oct 3, 2003, 01:52
Re: hmmm Oct 3, 2003, 01:52
Oct 3, 2003, 01:52
 
Creston -

If people stopped buying games, many game developers would still develop - just on a smaller scale as they couldn't afford to do it as a "day job". News flash: Less than 5% of ALL video-games are profitable! There are notable hits that make bucko bucks, to be sure - but that's not WHY game-designers do what they do, 12 hours-a-day for 2-5 years for one freakin' game. :-P

And yes, my comment came out as arrogant; and no, I didn't intend it that way. It was intended as a slap at an immature poster who had no clue as to the realities of the business. Most game developers *aren't* arrogant - they just (a) Can't take the time to sit down with every gamer out there and talk to them and explain whatever it is that person is going on about or percieves to be true; and (b) They are often discouraged by the vocal minority out there that are jerks, rabid fans, or both. :-P

Its a bit like politics, really: If you admit some things, people will harangue you with those admissions. If you with-hold information, or try to make the best of a situation, you're called on the mat for "covering up" or "manipulating" things. Its a lose-lose situation; and so you want to remain quiet - but if you're too quiet then you won't generate a "buzz" before the product's release. And sure those of us "in the know" will still get the game; but the hardcore / online gamer is really a TINY fraction of the overall sales. The average person hasn't a CLUE about most of our gaming sites, and ONLY goes to the game store when they know they are buying something. Therefore marketting, PR, word-of-mouth campaigns, etc. are all important and complicate things.

Plus, you have an industry where the money is controlled by the Publishers, the content by the developers, the community-relations by the Publishers, the schedules split between them, Managers in both companies who think they know "what's best" for the game, developers that take too long, publishers who are impatient to get a return on their million-dollar investments, and everyone in both camps has access to the Internet... I've said it many many times here: It's a complex business. I don't MEAN to sound arrogant - but you can't KNOW it until you've been in it. Its a lot like Car-Manufacturing or Hollywood Movies (though I grew up near Hollywood and despise it) - its a complex process with steps that lots of people outside the industry don't even realize are there (or necessary!). Its also DEFINITELY a business! Its there to make money. Not for the designers or creative people so much, but for the publishers who can afford to PAY us to work "day jobs" as designers. Despite all appearances, game-company pay typically is LESS than you'd get working on normal business-applications programs. But without this funding, gamers would still be playing 2d Arcade shoot-em-ups. The average adult just does NOT have the time to work two full-time jobs; and the complexity of today's 3d games take far too much time to be just a hobby. Example: I could build a complete DOOM (1 or 2) map in 5 hours. I could build a complete Quake-1 map in 60 hours. A Half-Life map takes a good 150 hours; and newer games are only lengthening that development time as environments get more and more detailed.

In summary: I think at heart, most designers aren't arrogant; they just wish that people gave them a little more space and respect online - instead of hearing demands all the time and having every move, every press-release, every gameplay decision criticized and second-guessed, from every corner of the globe. Since there aren't effective tactics to really counter the "problem posters" online, designers tend to get some frustration pent-up and lash out from time to time when they feel defenseless or un-supported at every turn.

In closing, I'll make my own observation - guaranteed to start another controversy: Free speech is awesome, but not everyone deserves to be heard equally! :-)

Take care,

--Noel "HB" Wade

174.
 
Re: Weird...
Oct 3, 2003, 01:27
Re: Weird... Oct 3, 2003, 01:27
Oct 3, 2003, 01:27
 
gs - Source Code is plain text. It compresses very well with ZIP and RAR techniques - like a WORD document. You can fit the entire source code for a game engine into less than 50MB. Its the compiled EXE and (especially) the art assets that take up the vast majority of space. Only the source was yanked.

--Noel "HB" Wade


173.
 
I wonder if id's thinking ...
Oct 3, 2003, 01:17
Tom
I wonder if id's thinking ... Oct 3, 2003, 01:17
Oct 3, 2003, 01:17
Tom
 
"suddenly that DOOM 3 alpha leak ain't lookin' so bad now ..."

172.
 
Re: Frightening...
Oct 3, 2003, 01:16
Re: Frightening... Oct 3, 2003, 01:16
Oct 3, 2003, 01:16
 
BTW,did they ever catch the guy that leaked the Doom 3 beta? I doubt they'll catch this Cracker since its been 2 weeks supposedly.

171.
 
Frightening...
Oct 3, 2003, 01:06
F1
Frightening... Oct 3, 2003, 01:06
Oct 3, 2003, 01:06
F1
 
From the handling of code carelessness and as well as the boldness of the Cracker. I bet it was a friend of a friend inside job, even if this Cracker did try too sell or do evil with the source code in the future, that Cracker will be facing a very big fine and law suit, if caught, maybe even years from now.
Give it up Cracker! the implications are way over your head and your newbie bragging will become your demise sooner or later. Only an Expert lonely Cracker will take the secret to the grave, but who will ever know then?
that's no fun

Normally Company do not like Customers directly handling there balls products unless they paid for it.

I bet Cracker if you give back Gabes balls pride ASAP, you might still have a normal life, with bragging rights, which is the only "common sense" reason why you are a newbie to begin with anyhow.

Avoiding Stupidity for a better America, I think
-ForGoTTeN OnE-

Can't wait to see news about this idiot when caught.
THIS AIN'T mp3's... you are facing few million dollars in future Damages here.

170.
 
Re: Keystrokes
Oct 3, 2003, 00:58
Re: Keystrokes Oct 3, 2003, 00:58
Oct 3, 2003, 00:58
 
Tangled - I didn't realize that you were SO important that your eagerness for this game was worth the livelihood of *30* PEOPLE. Damn, you sure are an important kid!

--Noel "HB" Wade

I am important, I'm the customer of Valve and Vivendi. Oh btw, your reviews sucks. Kind words from a customer.


329 Replies. 17 pages. Viewing page 8.
Newer [  1  2  3  4  5  6  7  8  9  10  11  12  13  14  15  16  17  ] Older