It all occurred rather suddenly yesterday, and was everywhere on the internet shortly after; the source code for Counter-Strike: Global Offensive, and Team Fortress 2, was leaked online yesterday. Immediately there was a bevy of misinformation as everyone rushed to publish first, ranging from fear-mongering to the apparent doom of Valve. The truth of the matter is nowhere near such drastic and absolute consequences; first, it would be wise to explore precisely what happened, and how, before we explore the nuances of consequence.
Code for integral parts of the Source Engine was leaked to specific people by a user that was working on a mod; he was apparently fired yet still had access to a build, and he sent that build to various bad actors out of spite. Valve was immediately informed of this by Tyler McVicker, who is also known for running Valve News Network on Twitter and YouTube.
Tyler has found himself embroiled in many allegations and accusations at this time, as the leak was coupled with a private conversation of Tyler McVicker; this was coupled in an attempt to target Valve News Network as the original leaker, which currently has no supporting documents to prove this. Tyler has been in consistent contact with Valve’s legal department, showing who the leak stemmed from (as evidenced by logs).
We have reviewed the leaked code and believe it to be a reposting of a limited CS:GO engine code depot released to partners in late 2017, and originally leaked in 2018. From this review, we have not found any reason for players to be alarmed or avoid the current builds.
— CS2 (@CounterStrike) April 22, 2020
This code was actually available to specific entities already; various aforementioned bad actors have had access to this segment for years already, as far back as 2018. The main difference is that this is now in the hands of everyone.
Ultimately, it’s an old build of Source Engine, and as such Valve has already informed everyone that it’s more than safe to log back into the game without a threat of RCE (remote code execution) vulnerabilities still being present. It’s an old build, everything has been patched, and there is very little threat to players. Further, it’s not too likely that new exploits will surface from this, either; there is very little change expected overall to the gameplay of both Counter-Strike: Global Offensive as well as Team Fortress 2, which is admittedly unfortunate for the latter title.
If anything is to come of this, it’s the knowledge that Valve, in all of their impeccable PC gaming glory, codes just like real humans; the code is littered with comments containing various profane epithets about why functions won’t work, or bizarre results from variables and statements.
One of the more tame comments that litter the Source Engine leak – Source Engine via Valve
So, to summarize this entire event: angry ex-employee leaks things years ago, then it leaks again being packaged with VNN conversations to point the blame at Valve News Network. The leak is old, and both titles have been patched consistently since this build that has now been made public.
The person who created these leaks is allegedly known by both Valve legal and Valve News Network, and neither have interest at this point in time to make that information public. Finally, and arguably the most interesting facet, is that Valve programs exactly how the rest of us do; by hurling insults and profane statements levied at computers within comments.
