Live data from Hacker News

Team Fortress 2 source code has leaked

techradar.com

71–80 of 167 posts

Re: Team Fortress 2 source code has leaked

#71

Earlier quoted context omitted.

I literally just downloaded Steam on the mac to show my boys Team Fortress only to be met by this sad news :( I really hope something like TF2 resurfaces in some form again. I never liked the feel of Fortnite.

You should check out Overwatch, which I consider to be TF3. They reimplemented many characters 1:1 including soldier (pharah), medic (mercy), demo (junkrat), engi (torj), as well as the 2 point capture and pushthecart modes. Valorant, a beta game from Riot, is then a blend of overwatch + csgo, making it closer to tf2 6s.

Overwatch and TF2 do not really have that much in common. The skill in TF2 is far more movement based.

Re: Team Fortress 2 source code has leaked

#73

Earlier quoted context omitted.

You should check out Overwatch, which I consider to be TF3. They reimplemented many characters 1:1 including soldier (pharah), medic (mercy), demo (junkrat), engi (torj), as well as the 2 point capture and pushthecart modes. Valorant, a beta game from Riot, is then a blend of overwatch + csgo, making it closer to tf2 6s.

The person you're replying to said he was disappointed to find that MacOS Catalina can't run TF2. Why recommend a game that won't run on any version of MacOS?

> I really hope something like TF2 resurfaces in some form again. I never liked the feel of Fortnite.

Re: Team Fortress 2 source code has leaked

#74
post #68

Earlier quoted context omitted.

What about Overwatch?

> Overwatch is the first game from Blizzard to hit consoles the same time it was available on Windows PC. It's also the only game from the company that isn't on the Mac

if you're gonna game on a Mac, i'd suggest installing windows via bootcamp. ime most games simply run better that way anyway and you don't have to deal with the issue of games that aren't MacOS compatible.

Re: Team Fortress 2 source code has leaked

#75
post #29

Earlier quoted context omitted.

I’m wondering the same thing. Is there any evidence of an RCE bug out in the wild? Or was it just wild speculation because the source code is now available? Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

Allegedly there's already an exploit in the wild that lets you open a popup in game to all other players in a server. You can find screenshots if you look around the /r/tf2 subreddit.

"allegedly" means nothing and screenshots are so easy to fake, it's 2020. I want to see concrete proof of this alleged exploit.

Re: Team Fortress 2 source code has leaked

#76
post #23

Earlier quoted context omitted.

I don't know what this contains, but many times games cannot be open sourced because they use libraries that would have to be removed before they could open source it.

I've heard this a few times as well, but couldn't the game still be open-sources just without those libaries? And anyone who wants to compile it, needs a licence for those libaries, which in many times is free for noncomercial purposes, or students. Btw. what expensive libaries do exist in that area anyway?

So I've been involved in this sort of process before. IANAL but the answer likely yes, but it is complicated.

So, firstly IP rights may not be your only encumbrances, NDA's can be even more restrictive, since leaking information about a library may be covered, for instance.

Additionally, the IP of the game code itself may be encumbered, for instance with publisher agreements, or if your code is derivative, source for instance may still be considered partially derived from id code, which zenimax, or maybe some other party may own, and getting those rights may be difficult, (even if some large percentage may be released in the GPL'd id codebases) And if your core engine is IP encumbered, that may not be something you could "just release without"

So then someone is going to have to actually do the work of separating out all the third-party libraries, which may not be trivial depending on how many, and how well separated they are.

Then at any reasonably risk-averse company, somebody is going to have to do an audit, which could be a lot of work.

And then we might not just have other people's files to remove, while it may not be an copyright violation to reference API calls of a copyright work (I'm honestly not sure) It sure could be an NDA violation depending on the NDA. Not to mention code that may be derived from library samples. So you either have to cut out all of that code, or rework it to just not be in violation.

And lastly, most companies care enough about their reputation to not want to just dump a large pile of broken code in the wild (Maybe it'd be better if they would) but want to make sure it builds and runs. So once you've removed all those other bits, it may be a lot of work to just get everything building, or running again. And not to mention that asides from just IP issues, a lot of the build system may depend on local infrastructure, perhaps connecting to local databases, or cache servers, so you will want to make it work without that, and we also have to ensure no secrets are accidentally being divulged (maybe signing keys, or credentials to servers)

As I understand it, Valve licenses Havok, which they possibly use for any and all collision (or maybe just rigid-body stuff, who knows) and if so, even if you get the game running you may fall through the world, or perhaps not be able to move at all, which is hardly the TF2 we all want open-sourced. And that's just one possible library, maybe they use RAD Granny to do animation, etc.

Or if you want to allow people to buy the licenses to compile it, you still have to do almost all of the above, then setup the infrastructure to download the correct version, and set it up for builds, and that only works if they didn't make any internal modifications, or maybe they can setup a patch file that doesn't violate any copyrights, but that's also work. And that also implies that the company the libraries are licensed from still exists and is still selling, and still offers the old versions the game is built with. And now you have to release the engine under a license that's compatible with the third-party licenses, which given the precedent of using GPL that adds some extra complications.

So, yeah, there is a good chance it's possible but there is a varying amount of work, which is most likely at least a lot.

As for libraries that exist in that area, of the top of my head some examples:

* Havok/PhysX, physics library

* FMod/WWise, audio libraries

* Natural Motion, animation libraries

* Everything that RAD Game Tools offers, including audio/video codecs, compressors, animation libraries.

* Scaleform, animation libraries

* SpeedTree, tree modelling libraries

* Enlighten, lighting (global illumination) libraries

* Platform specific libraries

* NDA encumbered IHV libraries

Keep in mind, some of these are expensive, but some are more dependent on a corporate relationship, which is not the sort of thing that frequently offers a student or noncommercial version.

Re: Team Fortress 2 source code has leaked

#77

If the remote code execution thing in CS:GO is true I wonder if it could lead to virtual item theft. We're talking about potential loss of items worth of tens of thousands of dollars. I'm sure Valve could eventually recover them but that could be some serious anxiety and opportunity loss for item holders that are affected.

So far what i've send of the RCE i've seen so far has been a way of triggering pop-ups on the start screen - not to say its not more dangerous than that, but just thought i'd give some context. Most RCE's aren't carte blanche to run arbitrary code on a users computer, but are some way of triggering a particular code path on a remote computer.

RCE by definition involves being able to run arbitrary code, for some reasonable definition of arbitrary. "Triggering a particular code path" doesn't get you anything: if you have a webpage you can trivially make your visitors' computers execute plenty of predictable code paths, like the one to render text to the screen or to send audio to the speakers.

Re: Team Fortress 2 source code has leaked

#78

Earlier quoted context omitted.

> Open source code is much more likely to already have been audited better. Worth keeping in mind this isn’t a silver bullet. OpenSSL with Heartbleed comes to mind.

Very true, but OpenSSL in particular is rather infamous. Unfortunate given that so much relies on it. https://news.ycombinator.com/item?id=7556407

This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true (even for incredibly core/important projects with a wide scope) and is potentially dangerous to rely on.

Re: Team Fortress 2 source code has leaked

#79
post #76

Earlier quoted context omitted.

I've heard this a few times as well, but couldn't the game still be open-sources just without those libaries? And anyone who wants to compile it, needs a licence for those libaries, which in many times is free for noncomercial purposes, or students. Btw. what expensive libaries do exist in that area anyway?

So I've been involved in this sort of process before. IANAL but the answer likely yes, but it is complicated. So, firstly IP rights may not be your only encumbrances, NDA's can be even more restrictive, since leaking information about a library may be covered, for instance. Additionally, the IP of the game code itself may be encumbered, for instance with publisher agreements, or if your code is derivative, source for…

Thank you for your detailed answer!

But I now go to bed, dreaming of a world, where Open-Source is the standard and IP and NDA madness forgotten ..

Re: Team Fortress 2 source code has leaked

#80
post #76

Earlier quoted context omitted.

So I've been involved in this sort of process before. IANAL but the answer likely yes, but it is complicated. So, firstly IP rights may not be your only encumbrances, NDA's can be even more restrictive, since leaking information about a library may be covered, for instance. Additionally, the IP of the game code itself may be encumbered, for instance with publisher agreements, or if your code is derivative, source for…

Thank you for your detailed answer! But I now go to bed, dreaming of a world, where Open-Source is the standard and IP and NDA madness forgotten ..

Ohh, I agree, I've been working on trying to make this happen for a project I worked on previously for about 4 years now. Have gotten some traction.
Post reply on HN