5 ms·

> "Anytime source code gets leaked it's not good," said Ekram Ahmed, a spokesperson for the cybersecurity firm Check Point. "Hackers can comb through the code,

> "Anytime source code gets leaked it's not good," said Ekram Ahmed, a spokesperson for the cybersecurity firm Check Point. "Hackers can comb through the code, identify deeper flaws for exploit, and sell that previous code on the dark web to malicious threat actors." This seems like a strong argument against using open source codes. Should I take this argument seriously and avoid them?

mercora 5y ago
while i think this statement is flawed anyways, there is a difference in being the only one who can find these flaws easily or being part of a community were everybody could do this if qualified.
dncornholio 5y ago
Yes and no. I would say it's less likely there's exploitable code in open source because it's so open.
dijit 5y ago
No, he's being a bit stupid, security through obscurity is arguably no security at all however it makes identifying vulnerabilities _easier_. The main issue for leaking source code of _games_, especially _multiplayer games_, is that people learn how to bypass the anti-cheat mechanisms which leads to a degraded online experience for everybody. I worked on Tom Clancy's The Division and the mantra was always "write code like it will be public one day". (in their case it meant don't get to persnickety about a library not working how you wanted or swearing about how Windows was batshit insane at times -- but it also applied to making sure you did't just assume the code wouldn't be read by malicious people)
- ReptileMan 5y ago
  There is much simpler solution about cheaters. Local servers to play on lan. Many games came with them.
  - scambier 5y ago
    That completely disregards the fact that local multiplayer requires you to have players who are geographically close, willing and able to gather at the same time in the same place. Also, some recent world events you might have heard about somewhat made these kinds of gatherings quite difficult or illegal.
    - arpa 5y ago
      hosting your own lan on openvpn is not trivial, but doable. Or, if you trust the provider, there are a few solutions such as Hamachi.
      - Jare 5y ago
        I don't think EA Sports would want to base their online strategy and business on the ideas being put forth here.
        arpa 5y ago
        neither do I, but that doesn't invalidate the lan/self-hosted server idea.
  - jxf 5y ago
    Not everyone lives close enough to the people they are friends with to make this a feasible response, and there's still an active pandemic going on.
  - simion314 5y ago
    And other alternative is allow non official servers, then you can rent a server for yourself and invite your friends or make it public but you have the admin rights and options to configure it (like reducing the grind). The multiplayer part of some games made the single player section worse, because of the drastic anti-cheating measures.
    - deleted 5y ago
      [deleted]
scambier 5y ago
Open source projects that have a high usage and high visibility have their flaws quickly fixed _because_ the code is open and for everyone to see. It's an iterative process that grows with the popularity of the project. Popular open source projects have been open for years and/or have lots of people that participate, review, report bugs, and fix them. A closed source projects can have thousand of security bugs no-one will never know about. Since it's closed, it's hidden so no problem... until it's leaked.
lrem 5y ago
There's a presumption that open source code has been looked at by independent researchers. "Many eyes". In contrast, source code of games is a trade secret. It is being worked at by famously overworked developers. And companies in the industry are known to sit on vulnerability reports for months or years. Don't ever install games on a machine you use for work or identity.
- maybeOneDay 5y ago
  Could you clarify what you mean by identity please?
  - sildur 5y ago
    I think they mean a machine you use to identify to do something official, like banking or interacting with government.
  - lrem 5y ago
    I never put on my gaming computer things that I use to identify myself with important entities: - Banking. - Insurance. - Main Google account. - SSH keys. - GPG keys. - Pictures of any important documents. - Digital copies of any important documents. Basically: the moment you start installing games on a computer, assume it makes its contents world read/writeable.
    - jart 5y ago
      Can you link to any examples of this happening in the past? Like oops I installed The Sims and Starcraft and now my C:\ drive is on Shodan. With mobile games that sort of thing probably happens all the time since mobile apis are designed to let apps do it. But I'd be surprised if something like an EA game was responsible. The worst I've heard so far is a bug where Steam will `rm -rf` your home directory because Valve doesn't understand UNIX.
- bottled_poe 5y ago
  It’s very hard to believe that games are unique here.
tovej 5y ago
It's a question of information asymmetry. It's always easier to be on the attacking side of cyber security. If the attackers have good intel, and the defense isn't organized, their work is much easier. With (popular) open source projects, there are hundreds of eyeballs looking at the source and trying to fix security issues before they can be exploited. The closed source project is typically less secure, but attackers also have less information to work with. Open source is typically more secure, but attackers have more information. Leaked closed source is the worst of both worlds.
- jart 5y ago
  The logical conclusion of your statement is that the strongest software would be projects that are collaboratively maintained by a large number of people, similar to an open source project, except behind the veil of confidentiality at a big company.
  - tovej 5y ago
    It has potential. But it is better than open source only if you trust all the maintainers in the organization. And previous maintainers who have now left the org. And only if the codebase is routinely looked over and tested, no part of the codebase gets forgotten and becomes unmaintainable because somebody left the company. Open source has the added benefit that maintainers typically don't disappear complete from the project overnight because they got a new job/were fired.
viraptor 5y ago
I wish I could find the tweets, but I've heard multiple times already from people reverse engineering software - it doesn't matter that much. With enough experience some actually prefer the disassembled / processed graph view of the real executed code rather than potentially more complex multiple levels of abstraction in the source. I'm sure it will be contentious and not everyone will agree, but at least it shows that the barrier really isn't that large. But even then you have the whole area of protocol reverse engineering and data fuzzing which doesn't require the source at all.
rvz 5y ago
This is a typical free BBC advertisement for a cyber security firm to use this data breach and source code leak as an example to lure the fearful and confused to pay for their consultation fees. His argument is also complete horsesh_t to prop up the firm and to also spread FUD. Just look at this sentence: 'identify deeper flaws for exploit', tells you they don't even understand that you find the vulnerabilities first and THEN you develop an exploit for it. Another "death sentence" of journalistic quality at the BBC whilst also advertising for firms that have clueless spokespeople.
hnick 5y ago
The real win here would be access to server side code - account management, loot box rates, plus garden variety buffer overflows and hacks. Open or closed doesn't matter as much if it runs on a device you can control, you can always reverse engineer it. But for code you'd never get to run on your own device, you have more limited tools at your disposal. Even if they only got binaries of the server side code it'd still open up a lot of avenues.

mercora 5y ago

while i think this statement is flawed anyways, there is a difference in being the only one who can find these flaws easily or being part of a community were everybody could do this if qualified.

dncornholio 5y ago

Yes and no. I would say it's less likely there's exploitable code in open source because it's so open.

dijit 5y ago

No, he's being a bit stupid, security through obscurity is arguably no security at all however it makes identifying vulnerabilities _easier_. The main issue for leaking source code of _games_, especially _multiplayer games_, is that people learn how to bypass the anti-cheat mechanisms which leads to a degraded online experience for everybody. I worked on Tom Clancy's The Division and the mantra was always "write code like it will be public one day". (in their case it meant don't get to persnickety about a library not working how you wanted or swearing about how Windows was batshit insane at times -- but it also applied to making sure you did't just assume the code wouldn't be read by malicious people)

ReptileMan 5y ago
There is much simpler solution about cheaters. Local servers to play on lan. Many games came with them.
- scambier 5y ago
  That completely disregards the fact that local multiplayer requires you to have players who are geographically close, willing and able to gather at the same time in the same place. Also, some recent world events you might have heard about somewhat made these kinds of gatherings quite difficult or illegal.
  - arpa 5y ago
    hosting your own lan on openvpn is not trivial, but doable. Or, if you trust the provider, there are a few solutions such as Hamachi.
    - Jare 5y ago
      I don't think EA Sports would want to base their online strategy and business on the ideas being put forth here.
      - arpa 5y ago
        neither do I, but that doesn't invalidate the lan/self-hosted server idea.
- jxf 5y ago
  Not everyone lives close enough to the people they are friends with to make this a feasible response, and there's still an active pandemic going on.
- simion314 5y ago
  And other alternative is allow non official servers, then you can rent a server for yourself and invite your friends or make it public but you have the admin rights and options to configure it (like reducing the grind). The multiplayer part of some games made the single player section worse, because of the drastic anti-cheating measures.
  - deleted 5y ago
    [deleted]

scambier 5y ago

Open source projects that have a high usage and high visibility have their flaws quickly fixed _because_ the code is open and for everyone to see. It's an iterative process that grows with the popularity of the project. Popular open source projects have been open for years and/or have lots of people that participate, review, report bugs, and fix them. A closed source projects can have thousand of security bugs no-one will never know about. Since it's closed, it's hidden so no problem... until it's leaked.

lrem 5y ago

There's a presumption that open source code has been looked at by independent researchers. "Many eyes". In contrast, source code of games is a trade secret. It is being worked at by famously overworked developers. And companies in the industry are known to sit on vulnerability reports for months or years. Don't ever install games on a machine you use for work or identity.

maybeOneDay 5y ago
Could you clarify what you mean by identity please?
- sildur 5y ago
  I think they mean a machine you use to identify to do something official, like banking or interacting with government.
- lrem 5y ago
  I never put on my gaming computer things that I use to identify myself with important entities: - Banking. - Insurance. - Main Google account. - SSH keys. - GPG keys. - Pictures of any important documents. - Digital copies of any important documents. Basically: the moment you start installing games on a computer, assume it makes its contents world read/writeable.
  - jart 5y ago
    Can you link to any examples of this happening in the past? Like oops I installed The Sims and Starcraft and now my C:\ drive is on Shodan. With mobile games that sort of thing probably happens all the time since mobile apis are designed to let apps do it. But I'd be surprised if something like an EA game was responsible. The worst I've heard so far is a bug where Steam will `rm -rf` your home directory because Valve doesn't understand UNIX.
bottled_poe 5y ago
It’s very hard to believe that games are unique here.

tovej 5y ago

It's a question of information asymmetry. It's always easier to be on the attacking side of cyber security. If the attackers have good intel, and the defense isn't organized, their work is much easier. With (popular) open source projects, there are hundreds of eyeballs looking at the source and trying to fix security issues before they can be exploited. The closed source project is typically less secure, but attackers also have less information to work with. Open source is typically more secure, but attackers have more information. Leaked closed source is the worst of both worlds.

jart 5y ago
The logical conclusion of your statement is that the strongest software would be projects that are collaboratively maintained by a large number of people, similar to an open source project, except behind the veil of confidentiality at a big company.
- tovej 5y ago
  It has potential. But it is better than open source only if you trust all the maintainers in the organization. And previous maintainers who have now left the org. And only if the codebase is routinely looked over and tested, no part of the codebase gets forgotten and becomes unmaintainable because somebody left the company. Open source has the added benefit that maintainers typically don't disappear complete from the project overnight because they got a new job/were fired.

viraptor 5y ago

I wish I could find the tweets, but I've heard multiple times already from people reverse engineering software - it doesn't matter that much. With enough experience some actually prefer the disassembled / processed graph view of the real executed code rather than potentially more complex multiple levels of abstraction in the source. I'm sure it will be contentious and not everyone will agree, but at least it shows that the barrier really isn't that large. But even then you have the whole area of protocol reverse engineering and data fuzzing which doesn't require the source at all.

rvz 5y ago

This is a typical free BBC advertisement for a cyber security firm to use this data breach and source code leak as an example to lure the fearful and confused to pay for their consultation fees. His argument is also complete horsesh_t to prop up the firm and to also spread FUD. Just look at this sentence: 'identify deeper flaws for exploit', tells you they don't even understand that you find the vulnerabilities first and THEN you develop an exploit for it. Another "death sentence" of journalistic quality at the BBC whilst also advertising for firms that have clueless spokespeople.

hnick 5y ago

The real win here would be access to server side code - account management, loot box rates, plus garden variety buffer overflows and hacks. Open or closed doesn't matter as much if it runs on a device you can control, you can always reverse engineer it. But for code you'd never get to run on your own device, you have more limited tools at your disposal. Even if they only got binaries of the server side code it'd still open up a lot of avenues.