11 ms·

Team Fortress 2 source code has leaked

309 points by adam_fallon_ 6y ago

usercheto21351 6y ago
magnet:?xt=urn:btih:21dda6847dde983f2f8063739249d2d1d09a5dda&dn=April%2022nd%202020%2c%20random%20leaked%20shit.rar&tr=udp%3a%2f%2ftracker.openbittorrent.com%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce
exabrial 6y ago
Cheats and hacks were already bad enough, I imagine this won't help :( Darn, one of the most fun games I like to play. Sadly, OSX Catalina killed the game for Mac users because Apple recognized the extreme demand by casual users to break all their old 32bit applications.
- skykooler 6y ago
  I wonder if it would be possible to use this source code to build a 64-bit version?
- ThomPete 6y ago
  I literally just downloaded Steam on the mac to show my boys Team Fortress only to be met by this sad news :( I really hope something like TF2 resurfaces in some form again. I never liked the feel of Fortnite.
  - minikites 6y ago
    What about Overwatch?
    - LanceH 6y ago
      Playing overwatch means playing the way blizzard intends you to play. No new maps, no private servers, no admins to get rid of jerks, etc... The game mechanics seem largely the same with respect to a lot of the characters, but then they added in one-directional shields and turned it into team strategy game with much less room for individual skill -- again with no real ability to just run your own server and mandate a different playstyle.
      - Revery 6y ago
        They've had custom games with the workshop that can serve most of what you request here, might be worth checking out
      - claudiawerner 6y ago
        >one-directional shields and turned it into team strategy game with much less room for individual skill There's plenty of room for individual skill, which goes beyond hitting Q. One-directional shields only reveal that teamplay is necessary, by themselves they don't add the necessity of teamplay. A poorly coordinated team doesn't do a good job. Even if both teams didn't use shield tank heroes, you'd still need just as much coordination.
    - tapland 6y ago
      > Overwatch is the first game from Blizzard to hit consoles the same time it was available on Windows PC. It's also the only game from the company that isn't on the Mac
      - meestaahjoshee 6y ago
        if you're gonna game on a Mac, i'd suggest installing windows via bootcamp. ime most games simply run better that way anyway and you don't have to deal with the issue of games that aren't MacOS compatible.
        LeSaucy 6y ago
        Parsec from an actual gaming system works very well.
        tapland 6y ago
        Which would be a great suggestion to the person wanting to play his favorite game on the Mac, instead of recommending another non-mac game, wouldn't it?
  - colinhmit 6y ago
    You should check out Overwatch, which I consider to be TF3. They reimplemented many characters 1:1 including soldier (pharah), medic (mercy), demo (junkrat), engi (torj), as well as the 2 point capture and pushthecart modes. Valorant, a beta game from Riot, is then a blend of overwatch + csgo, making it closer to tf2 6s.
    - markdown 6y ago
      The person you're replying to said he was disappointed to find that MacOS Catalina can't run TF2. Why recommend a game that won't run on any version of MacOS?
      - meestaahjoshee 6y ago
        > I really hope something like TF2 resurfaces in some form again. I never liked the feel of Fortnite.
    - qqssccfftt 6y ago
      Overwatch and TF2 do not really have that much in common. The skill in TF2 is far more movement based.
    - hajile 6y ago
      Having played both quite a lot, I believe the skill ceiling of TF2 characters is much higher. Plus, rocket and sticky jumping are just too much fun to give up (sorry, phara and junkrat just don't compare). I like the old-school movement abilities that held over from the Quake Engine. I'm also not a huge fan of timeouts and cooldowns for everything. Finally, I like all the different modded servers out there and the ability to play casually when I want to just mess around.
    - sushid 6y ago
      > reimplemented many characters 1:1 including soldier (pharah), medic (mercy), demo (junkrat), engi (torj) I would disagree that these are 1:1 (they share some abilities at best) but would agree that elements of TF2 and their character abilities are indeed nearly 100% spread out across different characters in Overwatch. E.g. Medic's uber = Ana's nano, engineer's teleporter = sym teleporter, engineer's turret = Torb's turret
  - quaquaqua1 6y ago
    Dont worry, Valve's official statement is that everything is fine and this was already leaked and patched in 2017 :)
  - hateMyIdeas 6y ago
    Install Windows? Simple enough solution
- gbrown 6y ago
  Security by obscurity... isn't.
  - exabrial 6y ago
    agree... but it's just a video game :/
    - xwdv 6y ago
      Just a video game? Imagine someone plays this game inside a corporate network, gets compromised, and the data for millions of people is stolen and leaked into the wild. The function of the actual program that gets exploited is irrelevant to security risk.
      - exabrial 6y ago
        https://en.wikipedia.org/wiki/Straw_man https://en.wikipedia.org/wiki/Straw_man I was referring to the relative importance in context of the parent comment. No need to conflate my words.
    - gbrown 6y ago
      and that changes things how?
    - Insanity 6y ago
      A video game that had millions of users
- exadeci 6y ago
  Maybe it will actually get Valve to fix it or let mods be the new anti-cheat.
runawaybottle 6y ago
Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warning/ https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...
- cameronbrown 6y ago
  The HL2 code wasn't leaked, it was stolen: https://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article https://www.eurogamer.net/articles/2011-02-21-the-boy-who-st...
  - kroltan 6y ago
    Web link: https://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article https://www.eurogamer.net/articles/2011-02-21-the-boy-who-st...
    - cameronbrown 6y ago
      Updated to remove AMP link above.
- misnome 6y ago
  That was 2004, so not a very busy agent... I’m slightly shocked with the phrasing in that post “It is definitely possible that someone could install a virus on your machine by just being in the same server.” That.... seems like a pretty shocking security hole, unless they are talking about unknown possibilities, in which case the term “definitely” is a bad choice. If this can be done with the source, it could have been done before, no?
  - MisterTea 6y ago
    Servers can distribute custom maps and assets to players so there's a mechanism to download files to a users computer. As for uploads, players used to be able to set custom models in quake 2 which were distributed to other players on the server. Though I am not sure if that was done by server admins in special cases for clan payers or members or if there was an actual upload mechanism in the game engine.
VectorLock 6y ago
If the remote code execution thing in CS:GO is true I wonder if it could lead to virtual item theft. We're talking about potential loss of items worth of tens of thousands of dollars. I'm sure Valve could eventually recover them but that could be some serious anxiety and opportunity loss for item holders that are affected.
- adam_fallon_ 6y ago
  So far what i've send of the RCE i've seen so far has been a way of triggering pop-ups on the start screen - not to say its not more dangerous than that, but just thought i'd give some context. Most RCE's aren't carte blanche to run arbitrary code on a users computer, but are some way of triggering a particular code path on a remote computer.
  - dmurray 6y ago
    RCE by definition involves being able to run arbitrary code, for some reasonable definition of arbitrary. "Triggering a particular code path" doesn't get you anything: if you have a webpage you can trivially make your visitors' computers execute plenty of predictable code paths, like the one to render text to the screen or to send audio to the speakers.
- floatingatoll 6y ago
  Valve can unwind any item transaction that occurs within their marketplaces under fraudulent circumstances.
  - VectorLock 6y ago
    Thats why I said "I'm sure Valve could eventually recover them but that could be some serious anxiety and opportunity loss for item holders that are affected."
- deleted 6y ago
  [deleted]
trufas 6y ago
The fact that the servers didn't immediately get shut down is pretty irresponsible. There's tens of thousands of people logged in to tf2 who are at risk of having their computers pwned because the tf2 servers are still up.
- papermachete 6y ago
  There was (is?) also remote code execution on counter-strike 1.6 servers valve didn't act upon for 10+ years.
- seabird 6y ago
  Valve has no control over user-owned servers, only the listings for the server browser. Valve was informed of this leak years ago. All of this talk of an RCE is pure speculation; the leak hasn't even been out for a day. It's good to be informed and take steps toward being safe, but we're talking about a leak where any meaningful security flaws have had multiple years to be patched.
- deadbunny 6y ago
  Valve could shut down the servers they run but there are thousands of community servers they have no control over. Valve could possibly kill the server browser service for TF2 to stop people searching for servers but then people could just connect directly to the community server of their choice either from their favourites or by IP directly. They could push an update via steam which bricks the game completely but that would piss off a metric fuckton of the userbase when the game is still playable with some precautions in place (playing on password protected servers with people you know) A shutdown as you are suggesting would only work with a game with published provided multiplayer servers and no community servers. I know I for one don't want to live in a world with only publisher provided servers, those games regularly have the servers shut down because they are no longer profitable for the publisher/devs leaving any remaing community out in the wind.
gbrown 6y ago
Maybe they should just embrace it and open source the code (without giving away the trademarks). The community is pretty engaged, so I bet it would be a boon for both security and modding.
- plopz 6y ago
  I don't know what this contains, but many times games cannot be open sourced because they use libraries that would have to be removed before they could open source it.
  - hutzlibu 6y ago
    I've heard this a few times as well, but couldn't the game still be open-sources just without those libaries? And anyone who wants to compile it, needs a licence for those libaries, which in many times is free for noncomercial purposes, or students. Btw. what expensive libaries do exist in that area anyway?
    - LeoTinnitus 6y ago
      They could be using those libraries to make market items being sold.
      - hutzlibu 6y ago
        Ah yeah, the ingame market. A whole different story. But if it is centralized, you should not be able to tamper with it, much, even if you have your own local version running?
    - Arelius 6y ago
      So I've been involved in this sort of process before. IANAL but the answer likely yes, but it is complicated. So, firstly IP rights may not be your only encumbrances, NDA's can be even more restrictive, since leaking information about a library may be covered, for instance. Additionally, the IP of the game code itself may be encumbered, for instance with publisher agreements, or if your code is derivative, source for instance may still be considered partially derived from id code, which zenimax, or maybe some other party may own, and getting those rights may be difficult, (even if some large percentage may be released in the GPL'd id codebases) And if your core engine is IP encumbered, that may not be something you could "just release without" So then someone is going to have to actually do the work of separating out all the third-party libraries, which may not be trivial depending on how many, and how well separated they are. Then at any reasonably risk-averse company, somebody is going to have to do an audit, which could be a lot of work. And then we might not just have other people's files to remove, while it may not be an copyright violation to reference API calls of a copyright work (I'm honestly not sure) It sure could be an NDA violation depending on the NDA. Not to mention code that may be derived from library samples. So you either have to cut out all of that code, or rework it to just not be in violation. And lastly, most companies care enough about their reputation to not want to just dump a large pile of broken code in the wild (Maybe it'd be better if they would) but want to make sure it builds and runs. So once you've removed all those other bits, it may be a lot of work to just get everything building, or running again. And not to mention that asides from just IP issues, a lot of the build system may depend on local infrastructure, perhaps connecting to local databases, or cache servers, so you will want to make it work without that, and we also have to ensure no secrets are accidentally being divulged (maybe signing keys, or credentials to servers) As I understand it, Valve licenses Havok, which they possibly use for any and all collision (or maybe just rigid-body stuff, who knows) and if so, even if you get the game running you may fall through the world, or perhaps not be able to move at all, which is hardly the TF2 we all want open-sourced. And that's just one possible library, maybe they use RAD Granny to do animation, etc. Or if you want to allow people to buy the licenses to compile it, you still have to do almost all of the above, then setup the infrastructure to download the correct version, and set it up for builds, and that only works if they didn't make any internal modifications, or maybe they can setup a patch file that doesn't violate any copyrights, but that's also work. And that also implies that the company the libraries are licensed from still exists and is still selling, and still offers the old versions the game is built with. And now you have to release the engine under a license that's compatible with the third-party licenses, which given the precedent of using GPL that adds some extra complications. So, yeah, there is a good chance it's possible but there is a varying amount of work, which is most likely at least a lot. As for libraries that exist in that area, of the top of my head some examples: * Havok/PhysX, physics library * FMod/WWise, audio libraries * Natural Motion, animation libraries * Everything that RAD Game Tools offers, including audio/video codecs, compressors, animation libraries. * Scaleform, animation libraries * SpeedTree, tree modelling libraries * Enlighten, lighting (global illumination) libraries * Platform specific libraries * NDA encumbered IHV libraries Keep in mind, some of these are expensive, but some are more dependent on a corporate relationship, which is not the sort of thing that frequently offers a student or noncommercial version.
taawwwaaayyy 6y ago
I know some may consider this unethical, but in the name of curiosity, copy-left, whatever, here's a link: https://mega.nz/file/iUN33aBZ#4SsjlU_qixrRp0ifhkw0YTQjMAJhv723fne020bfANU https://mega.nz/file/iUN33aBZ#4SsjlU_qixrRp0ifhkw0YTQjMAJhv7... password: leak I'll remove this shortly. Taken from a random forum, so i offer no guarantees.
mappu 6y ago
The leak also includes most of something called F-STOP, a cancelled Portal project, that apparently looks like Superliminal: https://www.reddit.com/r/Games/comments/eebagv/gameplay_of_aperture_camera_fstop_valves/ https://www.reddit.com/r/Games/comments/eebagv/gameplay_of_a...
- philo23 6y ago
  The F-STOP included in this leak, from my understanding, isn't Valve's prototype. It's just in-development fan-made game to try and replicate Valve's unreleased prototype.
  - deleted 6y ago
    [deleted]
  - andbberger 6y ago
    Strong evidence that this is fan-made: there is Cave Johnson dialogue in the video [0]. F-STOP significantly predates Portal 2 and I presume the Cave Johnson character as well. [0] https://www.youtube.com/watch?v=HboQWe3FYbg https://www.youtube.com/watch?v=HboQWe3FYbg
    - thatguy0900 6y ago
      Cave Johnsons name was referenced in portal 1. It could be they already had the character idea in mind
- krackers 6y ago
  Here's a gameplay video which I assume is from this leak on account of the upload date: https://www.youtube.com/watch?v=HboQWe3FYbg https://www.youtube.com/watch?v=HboQWe3FYbg
  - klmadfejno 6y ago
    I think it's obvious why FStop wasn't finished... It looks boring. The gist seems to be that you can use the device to move and resize objects. Kind of cool but looks hella tedious. I always assumed it was going to be about making different sized portals so you could change size of things (including yourself) by passing through. Those non-euclidean rooms at the end of the video are sweet though. Honestly the most surprising thing is that we didn't actually see any of these in the portal games given that it's the same exact tech required to make it work as the portals themselves. Edit: The concept looks boring, not the obviously unfinished tech demo
notaplumber 6y ago
What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.
- whymauri 6y ago
  I've been hearing that an RCE for TF2 is confirmed but not for CS:GO or the other leaked code/clients.
  - weaksauce 6y ago
    The csgo twitter says csgo should be fine. (At least on valve’s servers)
- ocdtrekkie 6y ago
  Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.
  - 3fe9a03ccd14ca5 6y ago
    Every statement you just made is speculation and not backed up by any meaningful data. While it’s obviously “easier” to find bugs when you can view the source code, making it one or the other doesn’t bestow any magical protections on the software.
    - d1str0 6y ago
      "Time and effort required" in order to find vulnerabilities is not a magical protection. It is a legitimate protection. Not one that should be relied on, but very much something that factors in. Open sourcing software doesn't immediately improve security, but it drastically lowers the barrier of entry for researchers to start looking into it.
abathur 6y ago
@valvesoftware has commented on Twitter as of ~25m ago, I guess, by retweeting https://twitter.com/CSGO/status/1253075594901774336 https://twitter.com/CSGO/status/1253075594901774336
- pas 6y ago
  https://twitter.com/valve_software_/status/1252993460354740224 https://twitter.com/valve_software_/status/12529934603547402...
ghostbrainalpha 6y ago
Once you have the source code, how easy is it to "build" the game? Using this code could I edit the character models so that certain characters looked like Sesame Street characters and then publish that game to my personal PC for my kids to have fun with?
- HideousKojima 6y ago
  You could already do that even easier with the modding tools available for TF2
etaioinshrdlu 6y ago
Maybe the community can help recompile the Source engine for 64 bit on macOS now.
BetaDeltaAlpha 6y ago
Any clues as to Half-Life 3?
humaniania 6y ago
What are the odds that this is a black hat move by Epic?
chaostheory 6y ago
This is another reason why I have a computer for specific uses. One used exclusively for gaming and nothing else, with the same for bills, random browsing, and development. It's much easier for maintenance and sanity.
- Polylactic_acid 6y ago
  The more common and realistic attack is anti cheat software and DRM. They are functionally identical to rootkits/spyware in that they install themselves as kernel drivers and monitor literally everything you do (sometimes when the game is not even running) to work out if you are cheating/attempting to crack the game. And we have no idea if they are limiting themselves to just that, they could be selling your browsing history on the side as well. The DRM is super invasive as well, A lot of wine developers have to deal with denuvo repeatedly banning them as well as one user reporting that they were banned from valorant after plugging in their phone to charge it.
- leetbulb 6y ago
  I do the same. One for work, one for personal, one for gaming and all on their own isolated networks.
mindslight 6y ago
usercheto21351 posted a magnet link that appears to be legitimate, but which is now [dead] for some reason. Do we really want to read speculative blogspam while rejecting the original material?
snvzz 6y ago
Remember that, while available, it isn't legally so. My advice is to avoid getting tainted. Do not read the code. Of course, archivists, please do archive it. Even if Valve does never open source this, it should be possible to preserve somewhat adequately, and it should be legal to publish, at some point in the future, in some country or another.
- baby 6y ago
  Avoid getting tainted? What does that even mean.
  - nestorD 6y ago
    Avoid reading the code, being inpired by it and using the same pattern (or worse, snippets) in your project (which could result in legal actions against you). I have often heard it in the context of windows operating system developper which should be careful of not accidently introducing open-source code in the kernel if it might have a license that is not compatible with Microsoft's one.
    - baby 6y ago
      There’s no law against that unless you’re implementing a patented algorithm, which is dumb in any case.
      - snvzz 6y ago
        Alternative implementations of programs often use Clean Room reverse engineering, for a reason.
      - nestorD 6y ago
        What if you copy paste code that is under a viral license ?
  - bzb3 6y ago
    If you read the code and work in the same field, you may inadvertently implement some feature in a very similar way. That might lead to lawsuits.
justlexi93 6y ago
Does that mean, the game is safe to play now?

309 points by adam_fallon_ 6y ago

magnet:?xt=urn:btih:21dda6847dde983f2f8063739249d2d1d09a5dda&dn=April%2022nd%202020%2c%20random%20leaked%20shit.rar&tr=udp%3a%2f%2ftracker.openbittorrent.com%3a1337%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce

exabrial 6y ago

Cheats and hacks were already bad enough, I imagine this won't help :( Darn, one of the most fun games I like to play. Sadly, OSX Catalina killed the game for Mac users because Apple recognized the extreme demand by casual users to break all their old 32bit applications.

skykooler 6y ago
I wonder if it would be possible to use this source code to build a 64-bit version?
ThomPete 6y ago
I literally just downloaded Steam on the mac to show my boys Team Fortress only to be met by this sad news :( I really hope something like TF2 resurfaces in some form again. I never liked the feel of Fortnite.
- minikites 6y ago
  What about Overwatch?
  - LanceH 6y ago
    Playing overwatch means playing the way blizzard intends you to play. No new maps, no private servers, no admins to get rid of jerks, etc... The game mechanics seem largely the same with respect to a lot of the characters, but then they added in one-directional shields and turned it into team strategy game with much less room for individual skill -- again with no real ability to just run your own server and mandate a different playstyle.
    - Revery 6y ago
      They've had custom games with the workshop that can serve most of what you request here, might be worth checking out
    - claudiawerner 6y ago
      >one-directional shields and turned it into team strategy game with much less room for individual skill There's plenty of room for individual skill, which goes beyond hitting Q. One-directional shields only reveal that teamplay is necessary, by themselves they don't add the necessity of teamplay. A poorly coordinated team doesn't do a good job. Even if both teams didn't use shield tank heroes, you'd still need just as much coordination.
  - tapland 6y ago
    > Overwatch is the first game from Blizzard to hit consoles the same time it was available on Windows PC. It's also the only game from the company that isn't on the Mac
    - meestaahjoshee 6y ago
      if you're gonna game on a Mac, i'd suggest installing windows via bootcamp. ime most games simply run better that way anyway and you don't have to deal with the issue of games that aren't MacOS compatible.
      - LeSaucy 6y ago
        Parsec from an actual gaming system works very well.
      - tapland 6y ago
        Which would be a great suggestion to the person wanting to play his favorite game on the Mac, instead of recommending another non-mac game, wouldn't it?
- colinhmit 6y ago
  You should check out Overwatch, which I consider to be TF3. They reimplemented many characters 1:1 including soldier (pharah), medic (mercy), demo (junkrat), engi (torj), as well as the 2 point capture and pushthecart modes. Valorant, a beta game from Riot, is then a blend of overwatch + csgo, making it closer to tf2 6s.
  - markdown 6y ago
    The person you're replying to said he was disappointed to find that MacOS Catalina can't run TF2. Why recommend a game that won't run on any version of MacOS?
    - meestaahjoshee 6y ago
      > I really hope something like TF2 resurfaces in some form again. I never liked the feel of Fortnite.
  - qqssccfftt 6y ago
    Overwatch and TF2 do not really have that much in common. The skill in TF2 is far more movement based.
  - hajile 6y ago
    Having played both quite a lot, I believe the skill ceiling of TF2 characters is much higher. Plus, rocket and sticky jumping are just too much fun to give up (sorry, phara and junkrat just don't compare). I like the old-school movement abilities that held over from the Quake Engine. I'm also not a huge fan of timeouts and cooldowns for everything. Finally, I like all the different modded servers out there and the ability to play casually when I want to just mess around.
  - sushid 6y ago
    > reimplemented many characters 1:1 including soldier (pharah), medic (mercy), demo (junkrat), engi (torj) I would disagree that these are 1:1 (they share some abilities at best) but would agree that elements of TF2 and their character abilities are indeed nearly 100% spread out across different characters in Overwatch. E.g. Medic's uber = Ana's nano, engineer's teleporter = sym teleporter, engineer's turret = Torb's turret
- quaquaqua1 6y ago
  Dont worry, Valve's official statement is that everything is fine and this was already leaked and patched in 2017 :)
- hateMyIdeas 6y ago
  Install Windows? Simple enough solution
gbrown 6y ago
Security by obscurity... isn't.
- exabrial 6y ago
  agree... but it's just a video game :/
  - xwdv 6y ago
    Just a video game? Imagine someone plays this game inside a corporate network, gets compromised, and the data for millions of people is stolen and leaked into the wild. The function of the actual program that gets exploited is irrelevant to security risk.
    - exabrial 6y ago
      https://en.wikipedia.org/wiki/Straw_man https://en.wikipedia.org/wiki/Straw_man I was referring to the relative importance in context of the parent comment. No need to conflate my words.
  - gbrown 6y ago
    and that changes things how?
  - Insanity 6y ago
    A video game that had millions of users
exadeci 6y ago
Maybe it will actually get Valve to fix it or let mods be the new anti-cheat.

runawaybottle 6y ago

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warning/ https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

cameronbrown 6y ago
The HL2 code wasn't leaked, it was stolen: https://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article https://www.eurogamer.net/articles/2011-02-21-the-boy-who-st...
- kroltan 6y ago
  Web link: https://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article https://www.eurogamer.net/articles/2011-02-21-the-boy-who-st...
  - cameronbrown 6y ago
    Updated to remove AMP link above.
misnome 6y ago
That was 2004, so not a very busy agent... I’m slightly shocked with the phrasing in that post “It is definitely possible that someone could install a virus on your machine by just being in the same server.” That.... seems like a pretty shocking security hole, unless they are talking about unknown possibilities, in which case the term “definitely” is a bad choice. If this can be done with the source, it could have been done before, no?
- MisterTea 6y ago
  Servers can distribute custom maps and assets to players so there's a mechanism to download files to a users computer. As for uploads, players used to be able to set custom models in quake 2 which were distributed to other players on the server. Though I am not sure if that was done by server admins in special cases for clan payers or members or if there was an actual upload mechanism in the game engine.

VectorLock 6y ago

If the remote code execution thing in CS:GO is true I wonder if it could lead to virtual item theft. We're talking about potential loss of items worth of tens of thousands of dollars. I'm sure Valve could eventually recover them but that could be some serious anxiety and opportunity loss for item holders that are affected.

adam_fallon_ 6y ago
So far what i've send of the RCE i've seen so far has been a way of triggering pop-ups on the start screen - not to say its not more dangerous than that, but just thought i'd give some context. Most RCE's aren't carte blanche to run arbitrary code on a users computer, but are some way of triggering a particular code path on a remote computer.
- dmurray 6y ago
  RCE by definition involves being able to run arbitrary code, for some reasonable definition of arbitrary. "Triggering a particular code path" doesn't get you anything: if you have a webpage you can trivially make your visitors' computers execute plenty of predictable code paths, like the one to render text to the screen or to send audio to the speakers.
floatingatoll 6y ago
Valve can unwind any item transaction that occurs within their marketplaces under fraudulent circumstances.
- VectorLock 6y ago
  Thats why I said "I'm sure Valve could eventually recover them but that could be some serious anxiety and opportunity loss for item holders that are affected."
deleted 6y ago
[deleted]

trufas 6y ago

The fact that the servers didn't immediately get shut down is pretty irresponsible. There's tens of thousands of people logged in to tf2 who are at risk of having their computers pwned because the tf2 servers are still up.

papermachete 6y ago
There was (is?) also remote code execution on counter-strike 1.6 servers valve didn't act upon for 10+ years.
seabird 6y ago
Valve has no control over user-owned servers, only the listings for the server browser. Valve was informed of this leak years ago. All of this talk of an RCE is pure speculation; the leak hasn't even been out for a day. It's good to be informed and take steps toward being safe, but we're talking about a leak where any meaningful security flaws have had multiple years to be patched.
deadbunny 6y ago
Valve could shut down the servers they run but there are thousands of community servers they have no control over. Valve could possibly kill the server browser service for TF2 to stop people searching for servers but then people could just connect directly to the community server of their choice either from their favourites or by IP directly. They could push an update via steam which bricks the game completely but that would piss off a metric fuckton of the userbase when the game is still playable with some precautions in place (playing on password protected servers with people you know) A shutdown as you are suggesting would only work with a game with published provided multiplayer servers and no community servers. I know I for one don't want to live in a world with only publisher provided servers, those games regularly have the servers shut down because they are no longer profitable for the publisher/devs leaving any remaing community out in the wind.

gbrown 6y ago

Maybe they should just embrace it and open source the code (without giving away the trademarks). The community is pretty engaged, so I bet it would be a boon for both security and modding.

plopz 6y ago
I don't know what this contains, but many times games cannot be open sourced because they use libraries that would have to be removed before they could open source it.
- hutzlibu 6y ago
  I've heard this a few times as well, but couldn't the game still be open-sources just without those libaries? And anyone who wants to compile it, needs a licence for those libaries, which in many times is free for noncomercial purposes, or students. Btw. what expensive libaries do exist in that area anyway?
  - LeoTinnitus 6y ago
    They could be using those libraries to make market items being sold.
    - hutzlibu 6y ago
      Ah yeah, the ingame market. A whole different story. But if it is centralized, you should not be able to tamper with it, much, even if you have your own local version running?
  - Arelius 6y ago
    So I've been involved in this sort of process before. IANAL but the answer likely yes, but it is complicated. So, firstly IP rights may not be your only encumbrances, NDA's can be even more restrictive, since leaking information about a library may be covered, for instance. Additionally, the IP of the game code itself may be encumbered, for instance with publisher agreements, or if your code is derivative, source for instance may still be considered partially derived from id code, which zenimax, or maybe some other party may own, and getting those rights may be difficult, (even if some large percentage may be released in the GPL'd id codebases) And if your core engine is IP encumbered, that may not be something you could "just release without" So then someone is going to have to actually do the work of separating out all the third-party libraries, which may not be trivial depending on how many, and how well separated they are. Then at any reasonably risk-averse company, somebody is going to have to do an audit, which could be a lot of work. And then we might not just have other people's files to remove, while it may not be an copyright violation to reference API calls of a copyright work (I'm honestly not sure) It sure could be an NDA violation depending on the NDA. Not to mention code that may be derived from library samples. So you either have to cut out all of that code, or rework it to just not be in violation. And lastly, most companies care enough about their reputation to not want to just dump a large pile of broken code in the wild (Maybe it'd be better if they would) but want to make sure it builds and runs. So once you've removed all those other bits, it may be a lot of work to just get everything building, or running again. And not to mention that asides from just IP issues, a lot of the build system may depend on local infrastructure, perhaps connecting to local databases, or cache servers, so you will want to make it work without that, and we also have to ensure no secrets are accidentally being divulged (maybe signing keys, or credentials to servers) As I understand it, Valve licenses Havok, which they possibly use for any and all collision (or maybe just rigid-body stuff, who knows) and if so, even if you get the game running you may fall through the world, or perhaps not be able to move at all, which is hardly the TF2 we all want open-sourced. And that's just one possible library, maybe they use RAD Granny to do animation, etc. Or if you want to allow people to buy the licenses to compile it, you still have to do almost all of the above, then setup the infrastructure to download the correct version, and set it up for builds, and that only works if they didn't make any internal modifications, or maybe they can setup a patch file that doesn't violate any copyrights, but that's also work. And that also implies that the company the libraries are licensed from still exists and is still selling, and still offers the old versions the game is built with. And now you have to release the engine under a license that's compatible with the third-party licenses, which given the precedent of using GPL that adds some extra complications. So, yeah, there is a good chance it's possible but there is a varying amount of work, which is most likely at least a lot. As for libraries that exist in that area, of the top of my head some examples: * Havok/PhysX, physics library * FMod/WWise, audio libraries * Natural Motion, animation libraries * Everything that RAD Game Tools offers, including audio/video codecs, compressors, animation libraries. * Scaleform, animation libraries * SpeedTree, tree modelling libraries * Enlighten, lighting (global illumination) libraries * Platform specific libraries * NDA encumbered IHV libraries Keep in mind, some of these are expensive, but some are more dependent on a corporate relationship, which is not the sort of thing that frequently offers a student or noncommercial version.

taawwwaaayyy 6y ago

I know some may consider this unethical, but in the name of curiosity, copy-left, whatever, here's a link: https://mega.nz/file/iUN33aBZ#4SsjlU_qixrRp0ifhkw0YTQjMAJhv723fne020bfANU https://mega.nz/file/iUN33aBZ#4SsjlU_qixrRp0ifhkw0YTQjMAJhv7... password: leak I'll remove this shortly. Taken from a random forum, so i offer no guarantees.

mappu 6y ago

The leak also includes most of something called F-STOP, a cancelled Portal project, that apparently looks like Superliminal: https://www.reddit.com/r/Games/comments/eebagv/gameplay_of_aperture_camera_fstop_valves/ https://www.reddit.com/r/Games/comments/eebagv/gameplay_of_a...

philo23 6y ago
The F-STOP included in this leak, from my understanding, isn't Valve's prototype. It's just in-development fan-made game to try and replicate Valve's unreleased prototype.
- deleted 6y ago
  [deleted]
- andbberger 6y ago
  Strong evidence that this is fan-made: there is Cave Johnson dialogue in the video [0]. F-STOP significantly predates Portal 2 and I presume the Cave Johnson character as well. [0] https://www.youtube.com/watch?v=HboQWe3FYbg https://www.youtube.com/watch?v=HboQWe3FYbg
  - thatguy0900 6y ago
    Cave Johnsons name was referenced in portal 1. It could be they already had the character idea in mind
krackers 6y ago
Here's a gameplay video which I assume is from this leak on account of the upload date: https://www.youtube.com/watch?v=HboQWe3FYbg https://www.youtube.com/watch?v=HboQWe3FYbg
- klmadfejno 6y ago
  I think it's obvious why FStop wasn't finished... It looks boring. The gist seems to be that you can use the device to move and resize objects. Kind of cool but looks hella tedious. I always assumed it was going to be about making different sized portals so you could change size of things (including yourself) by passing through. Those non-euclidean rooms at the end of the video are sweet though. Honestly the most surprising thing is that we didn't actually see any of these in the portal games given that it's the same exact tech required to make it work as the portals themselves. Edit: The concept looks boring, not the obviously unfinished tech demo

notaplumber 6y ago

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

whymauri 6y ago
I've been hearing that an RCE for TF2 is confirmed but not for CS:GO or the other leaked code/clients.
- weaksauce 6y ago
  The csgo twitter says csgo should be fine. (At least on valve’s servers)
ocdtrekkie 6y ago
Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.
- 3fe9a03ccd14ca5 6y ago
  Every statement you just made is speculation and not backed up by any meaningful data. While it’s obviously “easier” to find bugs when you can view the source code, making it one or the other doesn’t bestow any magical protections on the software.
  - d1str0 6y ago
    "Time and effort required" in order to find vulnerabilities is not a magical protection. It is a legitimate protection. Not one that should be relied on, but very much something that factors in. Open sourcing software doesn't immediately improve security, but it drastically lowers the barrier of entry for researchers to start looking into it.

abathur 6y ago

@valvesoftware has commented on Twitter as of ~25m ago, I guess, by retweeting https://twitter.com/CSGO/status/1253075594901774336 https://twitter.com/CSGO/status/1253075594901774336

pas 6y ago
https://twitter.com/valve_software_/status/1252993460354740224 https://twitter.com/valve_software_/status/12529934603547402...

ghostbrainalpha 6y ago

Once you have the source code, how easy is it to "build" the game? Using this code could I edit the character models so that certain characters looked like Sesame Street characters and then publish that game to my personal PC for my kids to have fun with?

HideousKojima 6y ago
You could already do that even easier with the modding tools available for TF2

etaioinshrdlu 6y ago

Maybe the community can help recompile the Source engine for 64 bit on macOS now.

BetaDeltaAlpha 6y ago

Any clues as to Half-Life 3?

humaniania 6y ago

What are the odds that this is a black hat move by Epic?

chaostheory 6y ago

This is another reason why I have a computer for specific uses. One used exclusively for gaming and nothing else, with the same for bills, random browsing, and development. It's much easier for maintenance and sanity.

Polylactic_acid 6y ago
The more common and realistic attack is anti cheat software and DRM. They are functionally identical to rootkits/spyware in that they install themselves as kernel drivers and monitor literally everything you do (sometimes when the game is not even running) to work out if you are cheating/attempting to crack the game. And we have no idea if they are limiting themselves to just that, they could be selling your browsing history on the side as well. The DRM is super invasive as well, A lot of wine developers have to deal with denuvo repeatedly banning them as well as one user reporting that they were banned from valorant after plugging in their phone to charge it.
leetbulb 6y ago
I do the same. One for work, one for personal, one for gaming and all on their own isolated networks.

mindslight 6y ago

usercheto21351 posted a magnet link that appears to be legitimate, but which is now [dead] for some reason. Do we really want to read speculative blogspam while rejecting the original material?

snvzz 6y ago

Remember that, while available, it isn't legally so. My advice is to avoid getting tainted. Do not read the code. Of course, archivists, please do archive it. Even if Valve does never open source this, it should be possible to preserve somewhat adequately, and it should be legal to publish, at some point in the future, in some country or another.

baby 6y ago
Avoid getting tainted? What does that even mean.
- nestorD 6y ago
  Avoid reading the code, being inpired by it and using the same pattern (or worse, snippets) in your project (which could result in legal actions against you). I have often heard it in the context of windows operating system developper which should be careful of not accidently introducing open-source code in the kernel if it might have a license that is not compatible with Microsoft's one.
  - baby 6y ago
    There’s no law against that unless you’re implementing a patented algorithm, which is dumb in any case.
    - snvzz 6y ago
      Alternative implementations of programs often use Clean Room reverse engineering, for a reason.
    - nestorD 6y ago
      What if you copy paste code that is under a viral license ?
- bzb3 6y ago
  If you read the code and work in the same field, you may inadvertently implement some feature in a very similar way. That might lead to lawsuits.

justlexi93 6y ago

Does that mean, the game is safe to play now?