Team Fortress 2 source code has leaked • Hacker News Board

Re: Team Fortress 2 source code has leaked

#131

Post by stevekemp » Thu, Apr 23, 2020, 5:23 AM UTC

hitpointdrew wrote: post #106

ocdtrekkie wrote: post #19

Earlier quoted context omitted.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

I used to do it, every time I installed a new package/game/service I'd look at the code. That resulted in a whole bunch of security reports.

I still do it for fun, but not methodically, and not regularly. It's a great way to look at code, to learn, and sometimes it pays off.

e.g. Reporting a bunch of trivial predictable filename issues in GNU Emacs, including something referring to the (ancient) Mosiac support:

https://bugs.debian.org/747100

Fuzzing is definitely useful, and I've reported issues in awk, etc, but fuzzing tends to be used when you have a specific target in mind. I'd rarely make the effort to recompile a completely random/unknown binary with instrumentation for that.

Re: Team Fortress 2 source code has leaked

#132

Post by gfxgirl » Thu, Apr 23, 2020, 5:30 AM UTC

runawaybottle wrote: post #4

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

No, it's probably some random steam game downloaded an entire hard drive or network share. It's not like games installed via steam provide any kind of security or sandbox whatsoever. Every game you download and every library those games use could be downloading all your files, capturing your screen, logging your keyboard, scanning your network for vulnerable devices, etc...

Re: Team Fortress 2 source code has leaked

#133

Post by mayneack » Thu, Apr 23, 2020, 5:31 AM UTC

hitpointdrew wrote: post #106

ocdtrekkie wrote: post #19

Earlier quoted context omitted.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

Code intended to be closed and released unexpectedly seems like the worst of both worlds though.

Re: Team Fortress 2 source code has leaked

#134

Post by rataata_jr » Thu, Apr 23, 2020, 5:35 AM UTC

stevekemp wrote: post #131

hitpointdrew wrote: post #106

Earlier quoted context omitted.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

I used to do it, every time I installed a new package/game/service I'd look at the code. That resulted in a whole bunch of security reports. I still do it for fun, but not methodically, and not regularly. It's a great way to look at code, to learn, and sometimes it pays off. e.g. Reporting a bunch of trivial predictable filename issues in GNU Emacs, including something referring to the (ancient) Mosiac support: https…

That is awesome.

Re: Team Fortress 2 source code has leaked

#135

Post by josefx » Thu, Apr 23, 2020, 5:40 AM UTC

_pmf_ wrote: post #125

hitpointdrew wrote: post #106

Earlier quoted context omitted.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

> People just aren't auditing random code on github for fun No, just the important code that everyone is running.

Afaik it had the opposite effect for OpenSSL. Not only was the code so bad that it would crash if ran with a secure malloc implementation. Due to being free and open source nobody felt the need to donate[1], with only one developer employed to work on it full time.

[1] https://arstechnica.com/information-technology/2014/04/tech-...

Re: Team Fortress 2 source code has leaked

#136

Post by moftz » Thu, Apr 23, 2020, 5:40 AM UTC

trufas wrote: post #29

3fe9a03ccd14ca5 wrote: post #21

Earlier quoted context omitted.

I’m wondering the same thing. Is there any evidence of an RCE bug out in the wild? Or was it just wild speculation because the source code is now available? Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

Allegedly there's already an exploit in the wild that lets you open a popup in game to all other players in a server. You can find screenshots if you look around the /r/tf2 subreddit.

I remember a custom CSS server doing this. The admin would fire off some command and a typical in-game browser window would show that would immediately go to a site the admins ran that hosted audio files. One would start playing. You could turn it off but they could push out the link again.

Re: Team Fortress 2 source code has leaked

#137

Post by exadeci » Thu, Apr 23, 2020, 6:23 AM UTC

exabrial wrote: post #3

Cheats and hacks were already bad enough, I imagine this won't help :( Darn, one of the most fun games I like to play. Sadly, OSX Catalina killed the game for Mac users because Apple recognized the extreme demand by casual users to break all their old 32bit applications.

Maybe it will actually get Valve to fix it or let mods be the new anti-cheat.

Re: Team Fortress 2 source code has leaked

#138

Post by ent » Thu, Apr 23, 2020, 6:27 AM UTC

falcolas wrote: post #112

sgillen wrote: post #109

Earlier quoted context omitted.

Maybe the person you are replying to should have qualified “popular open source repositories”.

Like openssl? Rhetorical question; OpenSSL was both open source and broadly used, and it took over two years to identify heartbleed. Plus. many companies, Microsoft included, open up their source code to partners. The openness of source code has little correlation to its security.

I know it's not quite that simple but isn't OpenSSL exactly an example of how a bug in open source software was found and fixed? Of course it took a while and the software was already extremely widely used at that point but bugs happen and at least it's not just lying around unfixed. I can't remember bugs in closed software getting the same kind of exposure.

Re: Team Fortress 2 source code has leaked

#139

Post by baby » Thu, Apr 23, 2020, 6:50 AM UTC

ocdtrekkie wrote: post #19

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

open source code being more secure is a myth.

Re: Team Fortress 2 source code has leaked

#140

Post by baby » Thu, Apr 23, 2020, 6:53 AM UTC

snvzz wrote: post #122

Remember that, while available, it isn't legally so. My advice is to avoid getting tainted. Do not read the code. Of course, archivists, please do archive it. Even if Valve does never open source this, it should be possible to preserve somewhat adequately, and it should be legal to publish, at some point in the future, in some country or another.

Avoid getting tainted? What does that even mean.