18 ms·
CD Projekt Red has been subject to a cyber attack and ransom demand
- uncledave 6y agoNow the 2077 source is public, can we crowdsource the bug fixes?
- vmception 6y agoI heard it was better already, like key issues addressed
- extrememacaroni 6y agothe key issue is that they'll never reach a decent playing experience on some of the platforms they've released on: PS4 & Xbone.
- ohgodplsno 6y agoThe game doesn't crash that much on PCs and recent consoles. It is unplayable on base PS4 and Xbox One. They manage to add in softlocks in the main story with bugfix patches though. But even then, it remains a very average game.
- phire 6y agoIt's not a given that the hacker will even release the source code. With the ransom threat rebuffed publicly, they might not be bothered to actually distribute the files, or they might choose to keep them privately for bragging rights. And then it's entirely possible the source code might not be in a compilable state without lots of work. But the biggest problems are the copyright issues. CDPR will be well within their rights to go after anyone publishing unofficial builds of the source code.
- ethbr0 6y ago> publishing unofficial builds of the source code You could patch installed files and/or at runtime, no? With patches being wholly original work? I'm not actually sure how IP law works for something like that.
- rich_sasha 6y agoPresumably antything based in stolen IP is tainted. Not an exact analogy, but if you translate a copyrighted piece of work, you own the copyright to the translation, but cannot e.g. publish that without the original work’s copyright holder’s consent.
- rootw0rm 6y agoIANAL, but things are complicated. even if you're patching on the fly with original work, you could theoretically find yourself violating a user agreement against reverse engineering, etc. i think it's utter rubbish, but that seems to be the world we find ourselves in.
- phire 6y agoTo add to the complications, many countries have laws (or case law) which disable any anti-RE clauses in EULAs.
- atoav 6y agoI had one "I need to reload the game or else it won't work"-type of bug in 100 hours of gameplay. I have seen games that have been much much worse 4 years after the release than this game in it's current state.
- l33tman 6y agoYes same here, no problems whatsoever. One instance of a guy dropping through a floor so I had to reload and lose 5 minutes. Awesome game :) The console owners weren't as thrilled though.
- input_sh 6y agoMost of the complaints were related to older console version (PS4, Xbox One). PC bugs were mostly solved rather quickly.
- ohgodplsno 6y agoOn PC, I had softlocks, hardlocks, being catapulted at the other side of the map after climbing up a pile of trash, T-posing enemies with disabled AI, dead bodies talking, and plenty, plenty more. Neither your experience or mine is more valid, simply that "it did/didn't happen to me" isn't a good defense. Additionally, Cyberpunk is also being shat on for lacking mechanics or half-assing them. Cops being the more obvious one, or the complete lack of driving AIs.
- cafeoh 6y agoSame, about 60 hours in, and while I only had one game breaking bug (can not finish a cyberpsycho mission because the body I'm meant to investigate dropped through the floor), physics and AI bugs (I got catapulted like you said about a dozen times, cars are notoriously terrible, I died from "falling" down a 20cm drop more than 20 times) are plentiful. I'd estimate I've had to reload a save between 5 and 10 times to continue progress. It hurts immersion badly, but as far as raw gameplay/shooting goes, I just beared with it, the game saves often enough that I rarely lost more than 5 minutes of progress. Saying it's "hardly more bugs than most early access/new releases" is something that I've seen too often though. I'd be willing to assume my experience is way outside of the norm, if I didn't have a number of friends I played along with and that reported the exact same (sometimes worse) experience on PC.
- mulmen 6y agoIf the code is released then CDPR could obtain it as well. So why pay the ransom? The threat in a hostage situation is not “give me money or I release a hostage.”
- rincebrain 6y agoThey do say in the ransom note that "we understand you can most likely recover from backups", so it seems the encryption was expected to be nothing more than an inconvenience, and the extortion of releasing their documents and source trees publicly is the main ransom subject, not denying them access.
- raimue 6y agoBut selling or leaking the source code is exactly the threat used in the email as seen in the screenshot image on the linked the Twitter post.
- GlennS 6y agoI wonder how annoying it is to compile, and how long it takes.
- rootw0rm 6y agoI'm kind of curious too, but it can't be worse than building Windows VMWare
- viktorcode 6y agoThe biggest problem is not even the bugs. It is that the game isn't in the state that is anywhere near to release quality. There are whole classes of AI and physics interaction missing.It still needs tremendous amount of work which hasn't been done.
- Daho0n 6y agoIt isn't the CP2077 source.
- pedroaraujo 6y agoI know this is completely unrelated to the discussion but why is this not a blog post on their actual blog (https://en.cdprojektred.com/news/ https://en.cdprojektred.com/news/) instead of a print screen of a bunch of text?
- szszrk 6y agoSimply because there is no info on that topic on news page, at least not now.
- daemin 6y agoScreenshot of some text because Twitter has a word limit, but you can easily attach as big an image as you want. In this case a picture is worth a thousand words. Not hosting on their blog because they just need to disclose this breach so it is public information for stock exchange and legal purposes.
- bspammer 6y agoI know it’s unethical, but I’m kinda excited for the source release. When was the last time we saw the source for a AAA game?
- skocznymroczny 6y agoDoom 3? Unreal Tournament 4 was kind of developed in the open too as far as I know.
- eterm 6y agoDOOM 3 is ancient, it was written closer to the time of DOOM than now.
- 2pEXgD0fZ5cF 6y agoA few months ago the source code of Counter Strike GO and Team Fortress 2 were leaked.
- klondike_ 6y agoHalf Life 2's source code was leaked in 2003 before the game even released
- gonzo41 6y agoDo you really think there'll be that much in it. Most triple A games aren't that massively different from old games. They just have better textures and the ability for threads to handle more complex game loops. Like sure there maybe some shaders or some cool performance mods. But it seems like where AAA makes its mark is by having the budget to build the environment.
- dvdkon 6y agoThe source code for Watch Dogs: Legion leaked just a few months back.
- throw_m239339 6y agoYes, it was very interesting to see how much all these AAA games rely on scripting and DSL.
- NetOpWibby 6y agoIronic
- martimarkov 6y agoPlease explain how a company being hacked is ironic?
- giantDinosaur 6y agoCyberpunk (presumably.)
- Beaver117 6y agoThat is the premise of the game
- ols 6y agoThe game itself looks like it was hacked already. Some of the filler assets are CDPR internal documents, there are many obvious typos (vending machines with „devilery” instead of „delivery”, „nigth city” on the border crossing). Plus stories found in the shards - allusions to Q&A processes in games/software projects, rebellion in space against mandatory crunch…
- NetOpWibby 6y agoOh wow, I haven't found any shards about crunch (I don't think...) but I did find one with placeholder text. https://twitter.com/SwitchOpWibby/status/1344823065893457921 https://twitter.com/SwitchOpWibby/status/1344823065893457921
- swebs 6y agoThey recently released a game called Cyberpunk. I haven't played this game myself, but the genre usually involves hackers as protagonists fighting corporations as antagonists.
- Hamuko 6y ago
- dijit 6y agoThe note makes it seem like the attackers got access to their internal network; but the (admittedly little) information I have on the subject indicates that the perforce server was hosted on the internet with username/password access (not cert based authentication as is recommended by Helix these days). I suppose the IT team got overwhelmed with requests to open up the firewall for people working from home during the pandemic and just opened it for the whole internet. CI runners (usually Jenkins) require a perforce user to function and those users often have very simple passwords, this is compounded by the fact that perforce itself does not have any backoff for brute force attempts. Perforce assumes that it's being hosted in a secure environment. The note indicates HR documents were stolen, but I have not seen any evidence of that, it is most likely posturing.
- valvar 6y agoThis may be a stupid question, but isn't it standard practice to require that employees use VPN? Why would they expose servers to the internet?
- vmception 6y agoAn employee could have got hacked, or defected They’re the ones getting screwed over the most here imo
- wokwokwok 6y agoPerhaps, but I’d say it’s quite hard to do this effectively when you’re using sass products. Even if you’re self hosting, and have dozens or hundreds of WFH employees, what’s the alternative? No access for anyone while you scale your VPN? Just wait while everyone pulls and pushes gigs of data over the VPN to perforce, you didn’t need that video meeting after all? You’ll get a big fat nope to that when you try to do it; this is a pretty tough challenge you’re trivialising here. Google “zero trust” as an alternative; clearly they didn’t do that properly either, but I can at least understand why they didn’t just demand everyone use a VPN. Trivial VPN use cases like people who d/l source code and have then occasional 5 person video meeting and this use case are not the same thing.
- themacguffinman 6y agoDo companies ever give into straightforward extortion like this? It doesn't seem like it would ever make sense for a company to pay the ransom. Do hackers like these have some kind of smart play that I'm missing?
- giantDinosaur 6y agoIt only really obviously makes sense to pay in one scenario: they've encrypted everything (including backups), or you didn't have backups at all. Having immutable / offsite / offline backups may well be less common than one would hope.
- zaarn 6y agoIf a company has paid for insurance, might make sense to just pay.
- PurpleFoxy 6y agoUsually they are betting on the company not having any backups in which case they usually do pay the ransom to restore their data.
- detaro 6y agoNowadays it's usually also a threat to publish company secrets if they don't pay. You can restore your system from backup, but you can't unsteal data with a backup.
- leonroy 6y agoCompanies usually give in to avoid bad press so we’d be unlikely to hear about it. In this case the leak is public knowledge now so CDPR have even less incentive to pay.
- munhitsu 6y agoLet's not forget that data is still encrypted. It's all in Polish :) PS: For reference, I speak the language
- EugeneOZ 6y agoWeirdly, no amount of money was requested to pay...
- mvolfik 6y agothe note is likely truncated (there aren't contact details either)
- Havoc 6y agoRansomware crews are bottom of barrel scum of the internet regardless of who the victim is
- raverbashing 6y agoNo kidding. I'd like to see real prosecution of those kind of people
- metalliqaz 6y agorussian gangsters... don't hold your breath
- Netcob 6y agoReading the replies there tells me I did the right thing when I decided against a career in game development over a decade ago. It looks like a constant war between developers and gamers now. Developers are investing a lot of time into making their games literally addictive in the worst way possible, and not even remotely by making it fun - it's all about overpriced DLC, gambling and weird reward systems. Which has ruined mobile gaming and is now making its way into console and PC gaming. As an intern I attended a company-wide meeting where the CEO proclaimed that game quality didn't matter and making money is the sole focus. On the other side of the war, a very vocal subset of the gamers is treating gaming as the only purpose their lives have, and will viciously attack developers personally with death threats and doxxing, or review-bomb even unrelated games into oblivion if the game publisher did something wrong. Which will hardly affect the giants at all (what will you do, not buy the next game from a popular series?), but can crush indie developers. Not to mention the whole work culture that expects any game developer to work 80h per week for less pay because you "love gaming". CDPR devs must be close to a nervous breakdown by now. Crunching for months/years despite their bosses promising it won't happen, seeing their game released too early and then ripped apart by critics and fans, and finally getting their personal data leaked.
- CraneWorm 6y ago> what will you do, not buy the next game from a popular series? Yes. The problems you describe are real, and damage both the developers and the gamers and it seems like "the only winning move is not to play". I'd argue that if you don't buy the next hyped title nothing of value is lost. Wait out the hype, if you want to play the big title. The world might be better of if you get it as discounted, second hand or pirated.
- bluefirebrand 6y agoYeah I stopped buying Assassin's Creed a long time ago not because I don't enjoy them but because I didn't like the direction Ubisoft was heading with them.
- dirkc 6y agoRead up on Jonathan Blow [1], sounds like you might like his philosophy. The short of it is that he believes time is valuable and should be respected. I also love Braid, a game he made. [1] https://en.wikipedia.org/wiki/Jonathan_Blow#Philosophy_and_views https://en.wikipedia.org/wiki/Jonathan_Blow#Philosophy_and_v...
- flcl61 6y agoImagine their users' data holding systems being as buggy as the game
- sneak 6y agoEver since gamergate, I can't read the phrase "gaming journalism" without laughing. I'm surprised the extortionists thought such a threat would work. Source code isn't really that valuable.
- mjevans 6y agoIt's probably too early to know for sure, but do 'we' know that it was just data taken, not data modified / added? I really hope they take proper measures to quarantine, re-validate, etc.
- trzeci 6y agoThis can be verified with local copies from developers - history in SCM in unmodifiable - and if it is - it's easy to spot due to different SHAs
- torgian 6y agoSucks. I liked cyberpunk, if only because of the story. I like games with decent - excellent stories. Sure, I wish cyberpunk could’ve been even better but it was enjoyable. It’s hard to find games with good stories and lore nowadays, I think.
- naosouumapessoa 6y agoIs it though? Out of the top of my head: pillars of eternity, divinity original sin 1/2, what remains of Edith finch, firewatch...
- deleted 6y ago[deleted]
- dkersten 6y agoWhile those games (and many others) do have excellent stories, where Cyberpunk shines for me is less in the actual storyline(s) but rather in how emotionally invested I became in the characters. The situations they were in was less interesting to me. Like, the main story itself is mediocre at best. Many of the side stories are good, but not amazing. What is absolutely top notch, though, is the characters: their personalities, how they're portrayed, their actors (voice and animation) etc. They are likable, believable and I got emotionally invested in them more than for many games with otherwise better stories.
- torgian 6y agoWell, I think I’ve been waiting for a good sci-fi game that has a good storyline. Cyberpunk kinda filled that void a bit. Battle tech is another that I enjoy, but the story was mediocre at best. I think one of the other posters here put it plainly; the cyberpunk story was just ok, but the characters really stood out and I got emotionally invested in them. Maybe that’s what I’m really after. Characters I actually care about.
- SSLy 6y ago>It’s hard to find games with good stories and lore nowadays, I think. Let me introduce you to Disco Elysium. You're welcome.
- w4rh4wk5 6y agoWhile certainly not as easy as it sounds, but maybe CDPR should just put the source code (of the released) games online and accept contributions.
- Hiopl 6y agoMan, the potential. It could turn into such a massive game if people were given the ability to contribute directly.
- agilob 6y agoDoes this message sound very artificial, fake to anyone? I haven't seen many ransom messages, a few have been published, but this one and the way it's screenshotted just seems so fake to me
- kdtsh 6y agoWhether it sounds fake or not, there is next to zero chance it is fake. Imagine the consequences if it wasn’t.
- agilob 6y agoWell, their stocks went down today, Elon Musk manipulated TSLA stocks too for personal gain, he faced consequences, but looks like it was worth it in the long run.
- phone8675309 6y agoThat was my first thought - this seems like bullcrap to me.
- Bakary 6y agoI have seen a few other ransom messages from various other events, and they have exactly the specific brand of cringeworthy writing that is displayed here. It's the same sort of distinctive style you see on .nfo files from scene releases and on Anonymous-related statements. I'm not saying we can conclusively determine anything, just that the format of it appears quite plausible to me.
- meowface 6y agoAs someone who's read a lot of ransomware ransom notes, it sounds very similar to all the ones I've read and looks likely to be legit. It's often exactly in this form, with a text or Word file named something like "read_me_unlock.txt" as it's named here, and text similar to this. They're trying to get the attention of whoever happens to see the mysterious file, and they often use that kind of extravagant tone with a lot of exclamation points. The goal is to extort as much money as possible and they think this is the best scare tactic to achieve it. Ransomers also may not necessarily be the smartest, oldest, or most educated people. I'd be extremely surprised if it was somehow fake, given the company posted it all themselves.
- tgtweak 6y agoThose sneaky netrunners
- mm983 6y agoi'm really sorry for the devs. imaging spending a few years on developing an engine and game, just for all your competitors to get it for free
- detaro 6y agoWhat would competitors do with it? Touching it is a massive legal risk, and most of the work in a game is in things they can't use.
- Ekaros 6y agoI would say that engine code doesn't have too much value without expertise to go with it. It's massively complex system with many moving parts and clearly they are also struggling to get it to work. Now try to take game out of it and with same effort you might just write a new one... Without legal hassle or baggage of existing games. For example some devs told that HL: Alyx has some hacks left-over from HL2... And I don't think CdProjekt is any better...
- oedmarap 6y agoThese hackers are clearly are a misguided bunch. CDPR is the only major studio that doesn't enforce copy protection on their games. The CEO spoke about this multiple times and that's gotten them a lot of goodwill in the gaming community. The fact that some gamers and these hackers are angry that "a software company isn't immune to software bugs" is a testament to a) their lack of maturity and b) a sign of the times. I hope CDPR pulls through and gets past this.
- XCSme 6y ago> a software company isn't immune to software bugs This was not the problem though. The problem was that they released the game regardless of those issues, and publishing a game that was not finished.
- Newtonip 6y agoThe source code to Gwent has already been leaked online.