Ya une chose que je ne comprends pas trop... Pourquoi HL serait retardé à cause que le code source a été leaké? je veux dire... je comprends pas ce que ça change... Sortez moi de mon ignorence je vous prie...

Ou refaire ou resserrer le code du jeu. D'ailleurs, c'est peut-être une bonne chose (non ne sauter pas sur moi) car ca va peut-être permettre de faire quelque chose de meilleur

Je disais aujourd'hui meme que celon moi ce n'était qu'un coup de marketing.

http://www.gamatomic.com/ga/news.aspx?n ... 1&nws_sd=1

Finalement, je ne suis pas seul à croire ça!

Personellement, tant que je n'aurai pas une news d'un major (Associated Press, Reuters, MSNBC, Wired, ...) en information qui aura confirmé la nouvelle directement avec Valve, ça va demeurer une rumeur pour moi.

De quoi vous parlez ? N'importe qui peut le downloader et ils se sont tiré une balle dans le pied pour faire du marketing ??
Je suis désolé mais ça tient pas debout...

official update from valve:

1) We've taken our network connection down to pretty much a minimum. We're still finding machines internally that have been compromised.

2) The suite of tools that the attacker was using included the modified version of RemotelyAnywhere (basically a Remote Desktop-style remote admin tool), Haxker Defender (a process, registry key and file hiding tool), the key logger, and various networking utilities that allowed them to transfer files (compressors, NetCat, and FTP). We also are pretty sure they were sniffing our network to gather passwords and other information. Haxker Defender includes a file system driver that allows an attacker to have stuff on your machine that is invisible, unless you do something like mount the drive under another OS that has NTFS support.

We have determined one way of detecting some infected machines, which is using a connection viewer to detect connections to anomalous hosts external to our network.

We still don't know their entry method.

3) In general, the community has been remarkably swift at tracking down the sources of the leak. What would be most helpful now are IP addresses of the people who were responsible for the intrusion or for the denial of service attacks.

4) Also, please continue to send in URLs of websites hosting the source code. We've been contacting people and asking them to take it down.

5) There's anecdotal evidence that other game developers have been targeted by whoever attacked us. This hasn't been confirmed. We've been providing other game developers with more detailed information about the exploits and evidence of infiltration.

6) We're running a little bit blind with our network shut down, but it seems like some of the press has picked up the story. I've been fielding calls from the mainstream non-games, non-technical press.all day. Hopefully they will get to report shortly what a mistake it is to piss off a whole bunch of gamers and get them hunting you around the Internet.

For any information related to this, please send it to helpvalve@valvesoftware.com, or you can always send to gaben@valvesoftware.com as well.

All rumours currently are pointing to a hack to a machine NOT actually belonging to Valve but on the VPN link out to somewhere in the valve network. It appears that was compromised forst with root kit and key logger... a root kit smart enough to leave no trace of it's proces, files or registry - those things CANNOT be detected easily... and any company not under 'complete lock down' is highly likely to miss it. From there an internal machine was compromised and then a variety of machines had root kits and key loggers installed.... ultimately they arrived at Gabe's.... allegedly got access to email and then took 'at least' the source code... although rumours are a full near-gold ISO is out there somewhere. At almost every network it is the remote access that is the weakness.... that's why blaster hit so many companies - yes port 135-139 is blocked at the firewall.. that's just sensible... but a home worker gets it... remotely connects... and it's in - VPN and dial-up.... always dangerous.

Root kits [*] have been known about for quite a while, but have not been highly publicised. This is most likely because the anti-virus companies don't have anything to combat it, as their products work above that level.

Once you've been rooted, I can see that it would be possible to get enough info from keylogging and network sniffing to get enough passwords and usernames to get in and compromise other machines. If it was a VPN link, only the use of one-time-key authentication products such as SecureID or similar would have stopped penetration of the network.

I've worked on security projects for software houses, and the problem is that security is a scale that goes convenience<-------------->security. Developers generally don't want the hassle of strong security, and often think they know a whole lot more than an admin with a background in security. Strong security is also expensive and needs someone to be doing that as a primary job, not something that gets done on the side when nothing else is going on. It is often something that is pushed down the list as a luxury, rather than an essential (as seems to have been the case at Valve).

Lack of security is something that you can get away with until you get compromised, and as in this case, your reputation as well as your hard work goes down the drain. Who's going to trust Valve/Steam with their credit card details now? How much of Valve's programming techniques will be revealed to competitors looking at the source code?

[*] For those that don't know: Root kits hook into, or replace the kernal of the machine. When you (or an AV program) asks for a listing of a process or file, what actually happens is the kernel is requested to send this information back to the app. A compromised kernel is coded to simply never shows the keylogger and other hacking tools from being there at all. As far as the OS goes, it runs the hacking tools, but won't tell anyone or anything else about them. As the kernel runs everything, it's simply not possible to find the hacking tools by anything running on the same machine.

In this case you're only going to spot things by looking at network traffic, mounting the compromised volume on another machine for investigation/scanning, or booting off a CD for the same.

Non, c'est que le code source envoyer par valve ressemble étrangement a celui de quake 2 disponible sur le net. Les screenshot montre que quelque similitude entre celui de valve et celui de quake 2. dans le 3e screenshot les commentaires reste les meme..

Pour en savoir plus et pour mettre fin aux rumeurs de coup de marketing, voici quelques communiqués officiels de Valve...