(We have irregular security audits, which is better than nothing, but obviously not ideal.)įinally, I'd like to say "chin up" to the folks at Valve. It takes additional time, and the vast majority of time that cost is overhead, but Valve is certainly regretting not doing so at the moment. This is also another example of why it may be worthwhile to have a network admin that does regular security audits. SFTP exists and there are free clients all over - you do not have a good excuse for using FTP. I would urge folks who are working with *any* kind of important IP to do the same - do *not* rely on Windows filesharing, do *not* use trust relationships, and do not use unencrypted connections, even on your local network. These are all very easy to overlook, especially during crunch time, but as Valve has discovered, while the chances of things going sour may be low, the potential damages are enormous. I maintain a single trust relationship (pubkey based, not IP based), from a machine that has a superset of the information on a second machine, so there's little point in exploiting trust relationships (plus, if superset machine A were compromised, a keygrabber could easily allow compromise of machine B anyway). I don't use any computers at work that don't talk to each other through encrypted connections. This is a good example of why internal security is very important. Dunno as to whether this is true, but I'd like to point out that while this is technically not kosher, I suspect that a lot of places do it - as long as it's out by release time, I very much doubt that anyone will complain. Some people have said that Valve has included GPLed code in the Half Life 2 code. While I doubt a commercial gaming company would ever swipe code from Valve (too much potential damage - if there's even a 10% risk of exposure, they're better off just licensing it.) Cheating will obviously be a problem.if I were Valve, I think I'd consider significant protocol revisions. It's not often that you get such insight into game development (post-mortems are interesting as well, but source hasn't been neatly edited). I'm skimming through a copy of it that I downloaded with some interest. You know, I really hate to say it, but I'm sorry to see the source go down (Valve says that they're asking websites to take it down - not sure if that translates to asking or sending legal threats).
0 kommentar(er)
