4 ms·

Honestly, what would happen if a company like Riot Games would just release their source code? As far as I can see, perhaps the two most relevant "risks" are th

by kleiba 4y ago

Honestly, what would happen if a company like Riot Games would just release their source code? As far as I can see, perhaps the two most relevant "risks" are the following: 1. Competition: now your competitors know exactly how to program a game like League of Legends. Well, guess what: they already knew that before. 2. Attack vectors: if your game's security relies on the code not being available, that basically boils down to "security by obscurity". I don't quite get from the vice.com link whether the assets were also stolen but I understand that there's probably more value in them than in the code.

psychphysic 4y ago
I guess one risk is that they see a copy pasted chunk of GPL code. Or that a portion looks suspiciously like something a former Dev wrote for you before moving to riot. Worse still a bunch of competitors suddenly have insight into prospective future features. I'm sure the source code is part of the company's net worth should things go tits up.
- wepzen 4y ago
  Yeah, that's definitely a risk for any company. If a competitor gets their hands on their code, it could be a major setback for them. And if someone sees a copy-pasted chunk of GPL code, it could lead to legal trouble. But, the real problem is that it's hard to put a number on the potential losses. A leak could lead to all sorts of unforeseen consequences that can't even be predicted. The best thing a company can do is invest in protecting their source code. It's not just a line item on a balance sheet, it's a crucial part of a company's net worth.
thot_experiment 4y ago
The idea that "security through obscurity is not security" is a dumb meme that needs to die. In the real world security through obscurity is absolutely security. Your threat model is not super hackers with unlimited resources, obscurity helps, in some cases it helps a LOT. (to be clear I'm responding specifically to your second point, I believe RIOT is institutionally incompetent and it is fully possible to have a game with an open source core that has less cheating than LoL, I also believe that the folks at RIOT are incapable of such a thing because of a combination of bad incentives and incompetence)
- psychoslave 4y ago
  >Your threat model is not super hackers with unlimited resources, obscurity helps, in some cases it helps a LOT. You don’t know who is going to try to hack the system, and the security strategy should handle the fact that the system is going to be compromised at some point. Otherwise you don’t have a security policy, but simply a more or less efficient palliative to fear that risks generates. Yes, if you know who is going to have a will to attack, in which timeframe and with which resources at hand, security by obscurity surely can help a lot. Otherwise this is just buying the comfort of delusion, in my humble opinion.
  - thot_experiment 4y ago
    > Otherwise this is just buying the comfort of delusion The same goes for any other security "guarantee". Security isn't something you rely on, it's a constant fight, obscurity is a reasonable thing to have in your arsenal. If you're at some point claiming "this is secure" you're deluding yourself, the only reasonable claim is "we have a lot of barriers to being compromised" or perhaps "we are secure against this vector", if obscurity is one of those barriers that's real and it provides a tangible benefit. Penetration is stochastic, the measures you take to prevent it change the odds.
  - UncleMeat 4y ago
    Kerckhoff's Principle only applies to cryptosystems. In systems security it is more like an onion or layers of swiss cheese.
- SturgeonsLaw 4y ago
  Yep. Too often people fall into a binary way of thinking - it's either perfectly secure, or not secure at all. It's like that bell curve meme with the dunce at one end ("we should obscure our system"), the midwit at the peak ("security through obscurity is not security"), and the genius at the right ("we should obscure our system"). Obscurity *by itself* is a poor security measure, but it can decrease the surface area for automated attacks substantially. A determined human can figure them out eventually, but if their bot never sees you in the first place, the human might never even attempt the attack. Obscurity is not a bulletproof shield, it's another layer of Swiss cheese.
blueprint 4y ago
cryptographic obscurity is like, the only way we know how to do security right now
z3phyr 4y ago
Obscurity is a key ingredient to almost all the real world physical security in the world.
notshift 4y ago
Here's a #3: It would probably make running LoL private servers much easier. Riot has been extremely aggressive with shutting down private servers (of old versions of the game that people want to be allowed to play, but cannot).

by kleiba 4y ago

psychphysic 4y ago

I guess one risk is that they see a copy pasted chunk of GPL code. Or that a portion looks suspiciously like something a former Dev wrote for you before moving to riot. Worse still a bunch of competitors suddenly have insight into prospective future features. I'm sure the source code is part of the company's net worth should things go tits up.

wepzen 4y ago
Yeah, that's definitely a risk for any company. If a competitor gets their hands on their code, it could be a major setback for them. And if someone sees a copy-pasted chunk of GPL code, it could lead to legal trouble. But, the real problem is that it's hard to put a number on the potential losses. A leak could lead to all sorts of unforeseen consequences that can't even be predicted. The best thing a company can do is invest in protecting their source code. It's not just a line item on a balance sheet, it's a crucial part of a company's net worth.

thot_experiment 4y ago

The idea that "security through obscurity is not security" is a dumb meme that needs to die. In the real world security through obscurity is absolutely security. Your threat model is not super hackers with unlimited resources, obscurity helps, in some cases it helps a LOT. (to be clear I'm responding specifically to your second point, I believe RIOT is institutionally incompetent and it is fully possible to have a game with an open source core that has less cheating than LoL, I also believe that the folks at RIOT are incapable of such a thing because of a combination of bad incentives and incompetence)

psychoslave 4y ago
>Your threat model is not super hackers with unlimited resources, obscurity helps, in some cases it helps a LOT. You don’t know who is going to try to hack the system, and the security strategy should handle the fact that the system is going to be compromised at some point. Otherwise you don’t have a security policy, but simply a more or less efficient palliative to fear that risks generates. Yes, if you know who is going to have a will to attack, in which timeframe and with which resources at hand, security by obscurity surely can help a lot. Otherwise this is just buying the comfort of delusion, in my humble opinion.
- thot_experiment 4y ago
  > Otherwise this is just buying the comfort of delusion The same goes for any other security "guarantee". Security isn't something you rely on, it's a constant fight, obscurity is a reasonable thing to have in your arsenal. If you're at some point claiming "this is secure" you're deluding yourself, the only reasonable claim is "we have a lot of barriers to being compromised" or perhaps "we are secure against this vector", if obscurity is one of those barriers that's real and it provides a tangible benefit. Penetration is stochastic, the measures you take to prevent it change the odds.
- UncleMeat 4y ago
  Kerckhoff's Principle only applies to cryptosystems. In systems security it is more like an onion or layers of swiss cheese.
SturgeonsLaw 4y ago
Yep. Too often people fall into a binary way of thinking - it's either perfectly secure, or not secure at all. It's like that bell curve meme with the dunce at one end ("we should obscure our system"), the midwit at the peak ("security through obscurity is not security"), and the genius at the right ("we should obscure our system"). Obscurity *by itself* is a poor security measure, but it can decrease the surface area for automated attacks substantially. A determined human can figure them out eventually, but if their bot never sees you in the first place, the human might never even attempt the attack. Obscurity is not a bulletproof shield, it's another layer of Swiss cheese.

blueprint 4y ago

cryptographic obscurity is like, the only way we know how to do security right now

z3phyr 4y ago

Obscurity is a key ingredient to almost all the real world physical security in the world.

notshift 4y ago

Here's a #3: It would probably make running LoL private servers much easier. Riot has been extremely aggressive with shutting down private servers (of old versions of the game that people want to be allowed to play, but cannot).