TF2Maps.net game server closure [OLD]

[Idolon]

EDIT: TF2 has been deemed safe to play by Valve and our servers are back online.
See below for the original post:

Due to the recent leak of TF2 and CSGO code, our servers are shut down for the indefinite future. We recommend that you do not play any multiplayer Source games until an "all-clear" announcement comes from Valve.

If you want to run maps on your own listen server, please make sure you have sv_lan set to 1 to disable any outside connections, and close any ports you might have open.

The contest deadline will be extended to make up for time lost due to this event. The amount of extra time will be decided based on how long this exploit prevents regular map testing.

For a tl;dr on what a source code leak means: Hackers having access to the source code means that they know exactly what they're trying to work around. This means that arbitrary code execution exploits are significantly more likely to happen. "Arbitrary code execution" more or less means "someone can make you download a virus just by joining a server." At time of posting, we don't have any confirmed cases that this is happening, but it is possible and inevitable, hence the server shutdown.

Also, please don't talk about who did the leak. Nobody here can do anything productive about it, and talking about it will not do anything except potentially start a witch hunt that gets people hurt. There's going to be a lot of misinformation going around for the next day or two.

 

[Pocket]

As I understand it, downloading the Source SDK includes at least a good chunk of the engine's source code, for the benefit of people who want to make total conversion mods that entail writing custom code. So whatever's being exploited here must be either a fairly recent addition or something specific to those two games. Which doesn't surprise me, but it does highlight my frustration with Valve's refusal to maintain the public codebase as the engine has evolved.

 

[iiboharz]

As I understand it, downloading the Source SDK includes at least a good chunk of the engine's source code, for the benefit of people who want to make total conversion mods that entail writing custom code. So whatever's being exploited here must be either a fairly recent addition or something specific to those two games. Which doesn't surprise me, but it does highlight my frustration with Valve's refusal to maintain the public codebase as the engine has evolved.

The Source SDK includes the game specific code that runs on top of the engine. What's present here is, to my knowledge, that code for TF2 and CSGO, and I think the whole engine itself? Which is unprecedented.

 

[Idolon]

Valve has confirmed that CSGO is safe. This confirms nothing about TF2, but it does make me optimistic.

As I understand it, downloading the Source SDK includes at least a good chunk of the engine's source code, for the benefit of people who want to make total conversion mods that entail writing custom code. So whatever's being exploited here must be either a fairly recent addition or something specific to those two games. Which doesn't surprise me, but it does highlight my frustration with Valve's refusal to maintain the public codebase as the engine has evolved.

It is worth noting that there is no actual confirmed exploit, and this leak doesn't necessarily mean there is one - it just means any exploits are now much easier for hackers to find. We're just playing it safe until we get word from Valve.

 

[Pocket]

Coulda sworn the devs of TF2 Classic said they forked it from an earlier TF2 code leak.

The Source SDK includes the game specific code that runs on top of the engine.

So that excludes the code for the rendering pipeline? I assumed that was already available since people have been able to write new custom shaders.

 

[iiboharz]

Coulda sworn the devs of TF2 Classic said they forked it from an earlier TF2 code leak.

So that excludes the code for the rendering pipeline? I assumed that was already available since people have been able to write new custom shaders.

You can write shaders and plug them into the system among other things but you can't modify things like the physics for example.

 

[Gᴇɴᴛʟᴇ Pᴜᴘᴘᴇᴛ]

https://twitter.com/TeamFortress/status/1253186405175418880

Team Fortress 2‏ @TeamFortress
Regarding today's reported leak of code, specifically as it pertains to TF2: This also appears to be related to code depots released to partners in late 2017, and originally leaked in 2018.

Team Fortress 2‏ @TeamFortress
From our review, we have not found any reason for TF2 players to be alarmed or avoid the current builds (as always, playing on the official servers is recommended for greatest security).

Team Fortress 2‏ @TeamFortress
We will continue to investigate the situation and will update news outlets and players if we find anything to prove otherwise. In the meantime, if anyone has more information about the leak, the Valve security page (next tweet) describes how best to report that information.

 

[14bit]

We already reopened the servers yesterday after we got the all clear, this thread just hasn't been updated yet. I'll let Idolon know he should update the main post and title. For the most up-to-date information about server status, check out the announcements channel on our Discord server, we're a lot quicker with our information there!