J
Joovilhar
Guest
I've spent the last 20 minutes or so browsing this forum, having followed a link from theregister.co.uk.
Across several threads, I've read cries of "Oh my god, how terrible! The fiends must be caught!" and similar protests. But I must say that I'm appalled at the lack of security at Valve. Without which, I might add, the hackers would not have succeeded. If I were in the entertainment business, and had to worry about the security of a project with as high a profile as Half-Life 2, I would have outlawed MS Outlook (and probably even Windows, too - except for build and test machines) from the very beginning. Or at the very least isolated all machines with access to source code from the Internet. That's just common sense, duh. In the past, I have worked for govornment organisations - and they take security seriously. No external internet access if you don't have a business need for it - and you'd better ditch IE if you do, because Netscape is all you're using inside of company premises. That's common sense in the public and private sectors of IT.
What really amazes me is that Valve had a network that was so insecure that you even managed to have a hacker implant keystroke-monitoring software on several of your machines? Oh my god, it's a miracle you're still in business! If your network admin is so incompetent, how can you be sure that the source code is all you had leaked? If I had been in your shoes, I would have changed passwords and demanded a full audit on all machines at the slightest sign of suspicious activity.
Of course, hindsight is always 20/20 vision ... but some things have been known for a while. The Blaster virus and its variants have posed some of the biggest threats to Windows users recently, and as a high-profile developer, Valve, you should not have been so complacent. Mere firewalls are not enough to prevent hackers getting into your organisation - this has hardly been a secret. Thanks to the Microsoft Windows platform and the proliferation of Outlook and Outlook Express (both of which have had several known issues with security for MONTHS now), hacking into any organisation these days is child's play.
I'm probably going to get flamed for this, but to be truly honest I really don't care. I might appear unsupportive to Valve, but that would be a mistake in judgement on your part. I will be buying HL2 when it comes out, but I would hope that Valve makes sure that no trojans were implanted in the software (I just hope your software configuration management practices aren't as crap as your security practices) - because I can imagine a lot of hacked-off customers sueing Valve if an embedded virus started formatting all their hard discs. We live in an age where class-action lawsuits are a very real threat to any organisation. To Valve, this e-mail might seem like a kick in the teeth - but frankly, I am the least of your worries. You need to look after your customers' interests better.
Across several threads, I've read cries of "Oh my god, how terrible! The fiends must be caught!" and similar protests. But I must say that I'm appalled at the lack of security at Valve. Without which, I might add, the hackers would not have succeeded. If I were in the entertainment business, and had to worry about the security of a project with as high a profile as Half-Life 2, I would have outlawed MS Outlook (and probably even Windows, too - except for build and test machines) from the very beginning. Or at the very least isolated all machines with access to source code from the Internet. That's just common sense, duh. In the past, I have worked for govornment organisations - and they take security seriously. No external internet access if you don't have a business need for it - and you'd better ditch IE if you do, because Netscape is all you're using inside of company premises. That's common sense in the public and private sectors of IT.
What really amazes me is that Valve had a network that was so insecure that you even managed to have a hacker implant keystroke-monitoring software on several of your machines? Oh my god, it's a miracle you're still in business! If your network admin is so incompetent, how can you be sure that the source code is all you had leaked? If I had been in your shoes, I would have changed passwords and demanded a full audit on all machines at the slightest sign of suspicious activity.
Of course, hindsight is always 20/20 vision ... but some things have been known for a while. The Blaster virus and its variants have posed some of the biggest threats to Windows users recently, and as a high-profile developer, Valve, you should not have been so complacent. Mere firewalls are not enough to prevent hackers getting into your organisation - this has hardly been a secret. Thanks to the Microsoft Windows platform and the proliferation of Outlook and Outlook Express (both of which have had several known issues with security for MONTHS now), hacking into any organisation these days is child's play.
I'm probably going to get flamed for this, but to be truly honest I really don't care. I might appear unsupportive to Valve, but that would be a mistake in judgement on your part. I will be buying HL2 when it comes out, but I would hope that Valve makes sure that no trojans were implanted in the software (I just hope your software configuration management practices aren't as crap as your security practices) - because I can imagine a lot of hacked-off customers sueing Valve if an embedded virus started formatting all their hard discs. We live in an age where class-action lawsuits are a very real threat to any organisation. To Valve, this e-mail might seem like a kick in the teeth - but frankly, I am the least of your worries. You need to look after your customers' interests better.
