Shame on Valve

All I can really get from this whole Half-Life 2 story is that Valve knows nothing about security, otherwise they would've seen it coming or prevented it in the first place.

Embaressing I just say.... and downright poor effort on the IT security, knowing that Valve survive on the basis of coding.

When stuff like this happens, there is only one to blame, yourself.

Flix

sappo said:

At one point in time the staff at Valve should have asked themselves, "If given the opportunity, would someone steal or source code? If so, should we keep it safe?"

Let's not get kid ourselves into being surprised that someone was willing to steal the most anticipated game in years. Instead, might i suggest people focus a little more energy on Valve's failure to protect their property. Of course we dont know ecactly what happened (and probably never will). However, after reading Gabe's forum post, I think It's safe to say Valve didn't protect thier property as well as they should. To make matters worse for Valve, having your source code stolen, isn't exactly the industry norm --espeically in such a close-nit software company. Take the proper precautions and you don't have a problem *cough idsoftware cough* In my mind they were neglegent, so Gabe's sob stories wont work on me.

Click to expand...

I disagree. Do you know the level of Security they were using? Privy to that were you? ... Then how can you comment on their security measures? Perhaps they thought their security measures were adequate. Any Security system can be beaten in time. Do you know how the penetration was made? Did it occur to you that the theft might have been done by a disgruntled employee on the inside. The best security in the world wouldn't stop that attack. I don't think it's right to blame the injured party whether they were lax or not. The crime here is the theft, NOT whether Valves security was working or not, and the jury is still out on that until they figure exactly how it was done. YOU are one of those people Ed was talking about in his article on "Sabotaging the System" where he states...

"Why put all the blame(on) the attacked, and spare the attacker? If someone shoots you, do the police arrest you for not wearing a Kevlar vest? No, they go after the people with the gun.

This rather elemental logic simply does not compute in large sections of geekdom. "


Twisted logic. and this goes for any others here who feel the same way. Valve probably took what to them, seemed like adequate Security measures. Any system can be hacked by someone with enough knowledge, time and persistance. (or inside assistance). I don't blame Valve. I blame the thief. (may he roast in hell... or wherever appropriate to his religion, if he has one)

HardwareJedi,


If I left a brief case filled with a million dollars cash out on the streets would you sympathize with me if I came back later only to find it stolen? Heck no. If I had it in a secure safe and it was stolen, would you sympathize? I'd hope so. The bottom line is that it all comes down to the security Valve put on the HL2 source.

I said that from what it sounds like security at Valve was not tight. If after the smoke clears we find that they went above and beyond their duty in keeping it safe, THEN i'll sympathize. But until then, I stand by my comment.

Just a friendly reminder...

skip said:

Overclockers Forums Rules :

1. Absolutely NO personal attacks will be tolerated, no exceptions!

Click to expand...

Re: Re: Shame on Valve

Originally posted by Ed
"Why put all the blame(on) the attacked, and spare the attacker? If someone stabs you, do the police arrest you for not wearing a Kevlar vest? No, they go after the people with the knife.

This rather elemental logic simply does not compute in large sections of geekdom. "

Click to expand...

And for the record, Kevlar vest generally protect against bullets. Thus the phrase "bullet proof vest." Enjoy: http://www.darwinawards.com/darwin/darwin1999-05.html

Lets all just stay calm - it feels to me that tempers might be getting frayed.

I think that really the person who is mostly in the wrong is the cracker who stole the code. As we do not know exactly what security measures were taken then we cannot say conclusively that Valve was 100% at fault. You dont really know if your security is not good enough until someone breaks through it : the best they can do is secure the code as best they feasibly can, and hope that it is sufficiently secure.

I agree also that HL2 should be kept to the designated thread, whether this is or is not a different approach to the issues raised by the code leak.

sappo said:

HardwareJedi,


If I left a brief case filled with a million dollars cash out on the streets would you sympathize with me if I came back later only to find it stolen? Heck no. If I had it in a secure safe and it was stolen, would you sympathize? I'd hope so. The bottom line is that it all comes down to the security Valve put on the HL2 source.

I said that from what it sounds like security at Valve was not tight. If after the smoke clears we find that they went above and beyond their duty in keeping it safe, THEN i'll sympathize. But until then, I stand by my comment.

Click to expand...

thats not a very good analogy, valve im sure did have SOME SORT of prtection on the code. you make it sound as if they put the code on a forum and HOPED no one would take it from there. now lets use this analogy, lets say you were just walking along with that briefcase, and some people came along and beat you down and stole it. that would be a bit different now wouldnt it? should i not sympathize because you werent moving it in an armored car? someone shouldn't HAVE to go above and beyond to protect something from theft, the people shouldnt be trying to steal it in the first place.

My point is that at some point, you cant sympathize with the victim. It sounds like Valve was not exactly using "industry standard" methods to keep thier code safe.

I just read the yahoo headline "HL2 delayed because of code theft" @#$&*%.

what alot of you dont realize is how easy it will be for people to create cheats now, this si just a larger example of quake2 when idsoftware realeased the q2source code, now there are tons more cheats than there were before it was released, in my opninino hl2 is f*cked

correct me if i am wrong, i am no software engineer, once the game was released, couldnt a hacker just reverse engineer it, and make cheats that way? so all it would do is speed up the inevitable.

snyper1982 said:

correct me if i am wrong, i am no software engineer, once the game was released, couldnt a hacker just reverse engineer it, and make cheats that way? so all it would do is speed up the inevitable.

Click to expand...

You CANNOT reverse engineer source code. That's the fundamental difference between software companies and virtually ever other business out there. And IMO the reason software companies are so prone to monopolistic practices.

sappo said:

You CANNOT reverse engineer source code. That's the fundamental difference between software companies and virtually ever other business out there. And IMO the reason software companies are so prone to monopolistic practices.

Click to expand...

well you can source code (after all its just programming, C++ in this case) but not the final release cannot really, or at least not in any close to reasonable way).

snyper1982 said:

correct me if i am wrong, i am no software engineer, once the game was released, couldnt a hacker just reverse engineer it, and make cheats that way? so all it would do is speed up the inevitable.

Click to expand...

There is a difference between source code and a final release product. Source code is a text file with the text written in some programming language that is easy for people (well easy if you know what you are doing) to read. However, the source code is not a form that your processor can do anything with.

To turn source code into something your processor can work with it has to be run through another program made specifically for that purpose (a compiler). Assuming that the programmer did not make any serious mistakes (it is routine to have to compile a program several times to get the worst mistakes out of the source code), what comes out is something that not even the most talented programmer will be able to read. This is what you get when you buy a game.

It is certainly possible to load finished code into a compiler and turn it back into something resembling the original but it will never be an exactly correct translation. Also, when the compiler was originally run, it stripped out all the little notes the programmer used to keep track of what is going on in the code. Without those notes, it is practically impossible to actually do anything with the decompiled code.

all bogus so valve can delay HL2 more without 'officially' delaying it?!?!





j/k



The media can really only point the finger at one party, and so far, the only evidence/ reputable information is from valve, so they can really only find stuff to make them look bad, as we know nothing of how and who stole the data. So for now, medias going to constantly badger valve and try to make our perceptions of everything seem as if it was somehow valves fault.

Lazlo Panaflex's avatar!

sappo said:

I agree, but let's not play the semantics game. Open source, leaked source, whatever. Either way, Valve has inadvertantly released intelectual property onto the internet. Intelectual property is good for everyone. Leaked intelectual property only hurts the party it is leaked from.

Click to expand...

Since you agree, let’s not play the semantics game. Valve spent several years making a program that they would hope to be as good as the original. I do not know how many programmers worked on the project but Valve has paid them right along for their work and some of that money was used to pay for their rent and groceries. Any day now, all of that work should be going gold and we should be able to have a great new game to play. Once we start paying for the game, then Valve gets to reap the benefit of all the cash they have laid out over the years. Now we are back to waiting for a new game and Valve is back to waiting before they can ever see a penny of the money they have laid out.

sappo said:

Open source, leaked source, whatever. Valve has inadvertantly released intelectual property onto the internet.

Click to expand...

How do you figure that Valve has released anything? I really do not care what their security protocols are nor do I care if there was someone inside Valve who helped the effort, none of that matters. The fact is that someone who does not have the right to release the code got hold of it and then put it out where everyone can see it. This is not about how it happened; it is about the fact that it happened.

sappo said:

Intelectual property is good for everyone. Leaked intelectual property only hurts the party it is leaked from.

Click to expand...

How do you figure that? Your desire to play a game for free has no bearing on the matter. What matters here is that Valve spent a mountain of cash to get to the point of having a viable product only to have it stolen mere days before it went gold. Taking the attitude that it only hurts the people who made the game is short sighted at best.

Consider this example: I am not Valve but I have a great idea for the next big thing in gaming. Now I can spend all my time putting this thing together and put it on the market or I can say “why bother, someone will just steal it from me before I can make a buck off of it”. Now tell me why I should spend my time making something worth playing. I could spend my time doing many things that I consider to be rewarding other than making the game that someone else want to steal from me the day before I start making money on it.

sappo said:

Leaked intelectual property only hurts the party it is leaked from.

Click to expand...

Well then how come I can't play the full released verseion of HL2 online winthin this year (that was the proposed release date right?).

Because someone freaking stole the code to a decent portion of the game and now the release date has been postponed till somthing like April (sorry I don't have a link :/). IMO that consitutes hurting more than the party it was leaked/STOLEN from.

Either way its wrong that it was stolen. Semantics or not. Look at the RL issues here. Valve used what they probably thought was proper security on their network. Some script kiddie or pro decided it would be nice and malicious to out right steal the source code. They used the fact that Valve communicates alot with the gaming community in general to find their way in. These coders aren't geeks with no lives. They have families and have been bustin their asses for almost 5 years to give US a product that we like and that they can be proud of. Not to mention the fact that the HL2 engine is supposed to revolutionize gaming as we know it today. Sure Valve was shortsighted with their security if that turns out to be the case but that NEVER excuses the illegal actions of another person to steal their source code. Its against the law period. To make up excuses to justify the illegal action is narrowminded at best.

Michfan said:

Either way its wrong that it was stolen. Semantics or not. Look at the RL issues here. Valve used what they probably thought was proper security on their network.

Click to expand...

Who cares what they thought. If they hired me as some security consultant guy, I'd of been all "NO GABE, you CANT have HL2 source code on the computer you're emailing from."

Here's a good example. So the Chinese steal the United States' smart missle nuclear missle technology. Then they build them and point them at the US. Who are you going to blame? Should the US act shocked because a country tried to do that? Should the US stomp it's foot and demand it back? The cat is out of the bag, the genie will not go back in the bottle. The only thing that can be done at that point is to see some heads roll from the people that were supposed to keep information safe in the first place.

you make it sound as if it is ok for people to steal. its not, it is wrong in every way. it understand that there are dishonest people in this world, and precautions should be taken, but it is still WRONG, and the only person to blame is the thief NOT the victim. this isnt a matter of national security by the way.