Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Team Fortress 2 source code has leaked

techradar.com

Post reply on HN
Print view View original

141–150 of 167 posts

Re: Team Fortress 2 source code has leaked

#141

Post by onion2k »

hitpointdrew wrote: post #106
ocdtrekkie wrote: post #19

Earlier quoted context omitted.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

The point that "Open source code is much more likely to already have been audited better." is actually true, but with the caveats that 99% of code isn't audited at all, and the 'better' claim is dubious. Security-focused devs audit OSS projects for practise, for bounties, for the glory of finding something in a popular codebase, and just to contribute their skills. It does happen.

In the closed source world, very few companies will pay for their source code to be audited, because it's expensive and time-consuming, and most only do it if they're required to.

Re: Team Fortress 2 source code has leaked

#142

Post by fnord123 »

_pmf_ wrote: post #125
hitpointdrew wrote: post #106

Earlier quoted context omitted.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

> People just aren't auditing random code on github for fun No, just the important code that everyone is running.

I have to confess that I have run afl on random code on github.

Re: Team Fortress 2 source code has leaked

#143

Post by nestorD »

baby wrote: post #140
snvzz wrote: post #122

Remember that, while available, it isn't legally so. My advice is to avoid getting tainted. Do not read the code. Of course, archivists, please do archive it. Even if Valve does never open source this, it should be possible to preserve somewhat adequately, and it should be legal to publish, at some point in the future, in some country or another.

Avoid getting tainted? What does that even mean.

Avoid reading the code, being inpired by it and using the same pattern (or worse, snippets) in your project (which could result in legal actions against you).

I have often heard it in the context of windows operating system developper which should be careful of not accidently introducing open-source code in the kernel if it might have a license that is not compatible with Microsoft's one.

Re: Team Fortress 2 source code has leaked

#144

Post by baby »

nestorD wrote: post #143
baby wrote: post #140

Earlier quoted context omitted.

Avoid getting tainted? What does that even mean.

Avoid reading the code, being inpired by it and using the same pattern (or worse, snippets) in your project (which could result in legal actions against you). I have often heard it in the context of windows operating system developper which should be careful of not accidently introducing open-source code in the kernel if it might have a license that is not compatible with Microsoft's one.

There’s no law against that unless you’re implementing a patented algorithm, which is dumb in any case.

Re: Team Fortress 2 source code has leaked

#145

Post by bzb3 »

baby wrote: post #140
snvzz wrote: post #122

Remember that, while available, it isn't legally so. My advice is to avoid getting tainted. Do not read the code. Of course, archivists, please do archive it. Even if Valve does never open source this, it should be possible to preserve somewhat adequately, and it should be legal to publish, at some point in the future, in some country or another.

Avoid getting tainted? What does that even mean.

If you read the code and work in the same field, you may inadvertently implement some feature in a very similar way. That might lead to lawsuits.

Re: Team Fortress 2 source code has leaked

#146

Post by bzb3 »

ThrowawayR2 wrote: post #61
gbrown wrote: post #53

Earlier quoted context omitted.

> Unreal Tournament 99 though, has plenty of servers that put some dlls for "anti-cheat" software on your computer before you join. D: People put up with that?

Better than putting up with cheaters ruining the game.

As someone who plays CSGO, I agree with you. I wish valve did something like this. I'm tired of matches getting ruined by cheaters, which happens very often.

Re: Team Fortress 2 source code has leaked

#148

Post by iforgotpassword »

_pmf_ wrote: post #125
hitpointdrew wrote: post #106

Earlier quoted context omitted.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

> People just aren't auditing random code on github for fun No, just the important code that everyone is running.

You don't have to audit that. It's so popular, someone else must have done a thorough review already!

Re: Team Fortress 2 source code has leaked

#149

Post by numlock86 »

ocdtrekkie wrote: post #19
notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

The whole "open source is audited better than closed source" is nothing but a myth and I am actually quite surprised to see this statement appear on HN.

Re: Team Fortress 2 source code has leaked

#150

Post by bionoid »

onion2k wrote: post #141
hitpointdrew wrote: post #106

Earlier quoted context omitted.

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

The point that " Open source code is much more likely to already have been audited better. " is actually true, but with the caveats that 99% of code isn't audited at all, and the 'better' claim is dubious. Security-focused devs audit OSS projects for practise, for bounties, for the glory of finding something in a popular codebase, and just to contribute their skills. It does happen. In the closed source world, very f…

> very few companies will pay for their source code to be audited, because it's expensive and time-consuming, and most only do it if they're required to.

And even when they do, in my experience, they usually end up buying an expensive automated report that provides little or no real insight.

Post reply on HN