PVP:Yes | Distribution:Download,Retail | Retail Price:$29.99 | Pay Type:Subscription
Desktop Client | System Req:
| ESRB:T
EVE Online News - Client Source Code Leak Story
Posted by Keith Cross on Apr 15, 2008 | 46 comments in our forums
Slashdot is reporting that the game client source code for EVE Online has been leaked, prompting another round of concerns for CCP's handling of security issues. CCP, on the other hand, has issued a statement of their own in response, stating that the leaked code was not leaked from an employee, nor does it pose a security risk for players.
Here is the Slashdot article:
An anonymous reader writes to tell us that the game client source code for the popular MMO, Eve Online, has been leaked via torrent. In addition to the source code the user also posted a lengthy chat transcript with someone from CCP customer support. While the end goal may have been to call attention to the continuing security issues within Eve (and ultimately themselves), there are probably better ways of getting through to support. Unfortunately, CCP seems to be responding with the usual knee-jerk reaction of banning everyone breathing a whisper of this incident. I wonder if any large MMO company will ever be brave enough to calmly address an issue rather than wielding the ban-hammer.
CCP's Response can be found here:
We are aware that an individual claims to have access to the source code of the EVE client, but this access is not a security risk to CCP or our customers in any way. The Python scripting language that is used by the client can be easily decompiled to generate readable code, and we have designed our server-side systems with that understanding. Therefore, there is no reason to believe that the code was leaked by an employee and our internal investigations confirm that.
Access to the source code for the EVE client exposes no security vulnerabilities, has no privacy protection issues, and poses no threat to our customers billing information. The server-side interface used by the client is carefully protected to ensure that no abusive or unwanted information is transmitted to or from the EVE system.
Nothing the EVE client can do can affect the game state, a manipulated EVE client cannot affect the server, no advantageous or disadvantageous information can be transmitted to other EVE users by altering the EVE client. The EVE client is signed with a security certificate registered to CCP. Hashes are available on our web site for those who wish to ensure the integrity of EVE client download files they may have received from a source other than direct download from CCP’s web site.
Finally, there have been no mass bannings, as reported in some news articles, though we do remove all message board posts regarding violations of our EULA and Terms of Service as per standard policy and procedures. We consider any alterations of the client software, including decompilation, or discussions thereof, to represent such a violation.
I, in a brief moment of idiocy decided to have a look at said Source code...
It was just out of curiosity. Im not a coder or whatever i havent got a clue what to do with it i just wanted to see what it was...
But low and behold i was banned from Eve.
Countless months of work pissed away due to my stupidity.
But you know what they say "Curiosity killed the Eve character"
You Have been warned dont even look at it... dont even look at this thread dont even think about looking at this thread. and so on.
Ashamed and pretty pissed
/Psilo
I'm no fan of CCP, but, this is neither a feature or an editorial. Good un-biased news report.
And people don't think that MMO companies have too much control. Not only are innocent people being banned simply because they're curious, but other people are getting banned simply for asking if this is true or not.
Overreacting much CCP?
This is absolutely idiotic. People who did nothing wrong are getting banned, and the few people who want to look at the source code in order to find exploits in the game are simply downloading it from another location. The only people being banned are the ones who are just curious.
I was thinking about playing EVE, but not after this. This just proves that the people running the game are total idiots who don't deserve a cent of my money.
LOL, LOL, LOL, and LOL some more.
Hmm, not that I'm going to bother trying, but how did CCP know that you looked at the source code?
I call shenanigans on your story.
In the linked article inthe comments, people say CCP is whatching the IPs of people getting the torrent, and matching it to players accounts. And of course you can always "fake" IPs and all that, but you know some don't do that, get caught, and now they are where they are.
Anyway, the story has been updated! Check it out!
Its a torrent, anyone getting/sending a torrent can see all the other IPs connected to it.
Edit: although in this case it doesn't matter I guess :P
Jon, you may want to delete the second quote as the validity of it was under heavy scrutiny from what I read.
Still it's really interesting to read, especially the full chat log (though at some points it's hard to understand what the hacker is saying since his native language is Russian and not English).
Fair enough, but I honestly don't see CCP taking the time and energy to do that. It really doesn't make any sense from their point of view. What would that do other than enrage people?
I don't think it was CCP at all, just someone pretending to try and get a rise out of people.
LOL! "There were no mass bannings." That is funny and open ended a bit I'd say. Banning people for looking at the code or mentioning to the GMs they have seen the code is very harsh and another reason why CCP is on my "Do not buy from" list. This is like the forth time in the past two years this company has really screwed over their community. IMHO, it is time for someone to take a class action lawsuit against them. They a bit too power hunger. If the EU can fine M$ for anti-competive practicies, I'm sure they can sue CCP for client abuses regardless of the EULA.
You would be surprised what some people's jobs are. ;)
what client abuse. you pay for the privalege of accessing a service they provide. They can at any time for any reason take away that privalege.
Hmmm....And I thought that pretty fresh listing filed under the Misc category at a quite prominent bittorrent tracker site which shall remain unnamed was just a fast one? But then again if:-
"Access to the source code for the EVE client exposes no security vulnerabilities, has no privacy protection issues, and poses no threat to our customers billing information. The server-side interface used by the client is carefully protected to ensure that no abusive or unwanted information is transmitted to or from the EVE system.
Nothing the EVE client can do can affect the game state, a manipulated EVE client cannot affect the server, no advantageous or disadvantageous information can be transmitted to other EVE users by altering the EVE client."
..so no harm done....yet...right???
According to www.massively.com ...
"As they brace to control the impact of the theft, CCP has stocked up on turret ammunition and kicked in the afterburners. They are reportedly seeding the stolen source code in an attempt to ban anyone downloading the file who also maintains an EVE account."
Also...
"In addition to this, users on the EVE forums who even mention the torrent are having their posts edited and locked or simply deleted. Bans are flying around the forums and EVE players are warned to do their best to avoid a collision."
The client code is not the source code. This is not a story, but a bad attempt of something trying to pass off as something else all together. The first clue was that it was posted by anonymous and not a creditable source. As for what CCP is doing, bah, it is in the EULA not to do that stuff. If your curious, and you get baned then you did it to yourself. Quit your complaining and move on with your life.
As for Slashdot, they should not of allowed that story to post by an anonymous. That was a big mistake on their part. Nothing creditable there. Bad Slashdot, no biscuit!
Yeah, they would totally do this, because ya know, they just don’t need customers.
^sarcasm.
I disagree. Despite whatever implications the leak has, CCP is going overboard, even so far as entrapment by seeding the torrent themselves!? Dag yo.
Btw, ever heard of "Deep Throat," Watergate, President Nixon? Anonymity is a protection, not incompetence.
And as regards CCP's statement that this poses no threat to other players, they are correct, in the security sense. However, it does pose the threat of someone manipulating the client very heavily: macros, server overload, game control manipulation... the list goes on. It does pose a threat to the gameplay itself, allowing jerks to exploit all they want.
Bottomline: This is no good for CCP or Eve. Unfortunate, it's an amazing game.
This does not impact me. I will continue to play EVE regardless of this attempt to cause more grief by someone who's holding a grudge agasint CCP.
Interesting read none the less.
This game still rocks regardless of some ass hat trying to blackmail the developers. And people, there's no defense for curiosity through theft. That's downright ignorant.
If you're sincerly "curious" use a proxy.
I'm confused. What advantage could someone get by looking at the CLIENT source code?
AFAIK the first rule of MMO programming is to not trust the client. If you trust the client data implicitly then you will have hacks of all sort and description.
I just don't understand what could be gained. If all data is checked for validity by the server (as I assume it is given there aren't any real "hacks" in EVE that I'm casually aware of) then decompiling the client gets you what? Graphical data? Communications code?
EVE (and CCP) is such a drama magnet.
success does that.
It does make bot building easier but as said in other places this isn't really news at all because it's not leaked source code, it's decomplied binaries which means any bot builder would probably have decompiled it him self long ago anway.
IF you can get a grasp of what data is flowing, and how it's handled there is a LOT one could do with the source code. For example one could figure out ways to automate tasks in EvE and write the code into a 'hacked' client. Or if you're even more enterprising you could just transfer the datum from the client to a secondary program that would interact with the client to automate the tasks. Either way it could cripple the game's economy which is one of the things that make the game work as well as it does. And that's just one example from the top of my head.
Thing is none of that automation will work, if CCP decides to make a few changes to the client and or host you’re back at square 1.
It's sad to me that we have the organized CCP hate machine. These yo-yos spread their brand of Fertilizer to anyone who listens, they even have full time Trolls to make sure the EvE entry on Wikipedia keeps its controversy and criticisms section. If you don't like a game don't play, if they did you wrong, vote with you wallet and don't support them anymore, what is going on here is the stuff of long intensive therapy sessions and a prescription of Thorazine to control the irrational anger.
As for CCP's handling of the case it's typical game western game company reaction do ban people..
However I played EVE-Online for 3 years quited last spring which was after lots of problems with with CCP's ability to fix minor problems and bugs that made things disappear so you had to go through a lenghty 2-3 weeks discussion with them to finally get your stuff back which was rather annoying if it was minor items it would be ok but they found the flaw in the end and corrected it but when these things occur time after time and it takes a long time to get things back I finally had enough.
As for todeswulf's posting, there are haters for all games and will always be just let them be it won't make any difference if you start complaining about the ones that complains.
All in all EVE is a medicore game with poor game mechanics it looks dashing nice .. and that's all.. not content just a waste of time and money.
It might be worth playing if it were free but paying for tormenting yourself is a BIG no no.
I think CCP is doing the right thing in protecting their code. I would not take any chances.
I always find it interesting that MMORPG.COM sometimes chooses to bite the hand that feeds them.
Over the past few weeks, I've been bombarded with banners and "We Want You Back" emails from CCP and I was almost ready to jump back into a tiny little ship and get my ass kicked for awhile.
But then I remembered why I closed my account in the first place...
I dnt care anymore im not going back to eve now i know that the cource code has been released... think of the amount of hacks, bots and exploits on their way because of this.
/Psilo
american commitment to excellence and openness clashes with icelandic dirty tricks itt
Decompiling copyrighted software is a law violation in most country, who is surprised that CCP takes action?
Anyway, all MMO clients have been decompiled by someone to make bots, it's just making it public was a move to hurt the community more than CCP.
Firstly, Im not an EVE hater, I think the game is good, with a solid foundation and a great premise. However, it is plaugued with problems and issues that have put me off the game. Some of them are technical issues, most however are issues with CCP and their management of the game and their complete lack of ability to offer decent customer service.
Fistly, as I believe has already been mentioned, the game is plauged with minor bugs and glitches that simply havent been fixed. Some of these bugs have been present in the game from day one and would be so simple and easy to address, but CCP is simply ignoring them.
Second, CCP hasnt done anything to address the trust issues that have arisen because of various events that have taken place regarding collusion of CCP Devs with certain player factions. Yes, Im talking about the T20 incident and others such as banning one of their own voulanteers at the behest of members of BoB and the rigging of RP events to favour particular groups within the game. These events were supposed to be open...with no set winners or losers, but the GMs seem to favour one or more groups over others. This is a poor way to handle things and the fact that they havent been commented on or addressed by CCP adequately has shattered alot of peoples trust in CCP.
Third, CCP is far to heavy handed with its customers. They throw bans around like toilet paper to the point that it weighs down the communitys trust even further. Deleting posts and banning people for commenting on things that CCP doesnt want people to talk about is abridgement of the freedom of speech. Talking about such things isnt a breach of the EULA, actually participating in such things is...not talking about them. Therefor, banning an account on the premise that they were disscussing something that makes CCP uncomfortable is in itself a legally not to mention moraly dubious act.
And finally, if CCP is hosting torrents of the decompiled code, cross referencing the IP addresses and banning the accounts that happen to match up...thats illegal entrapment and leaves them open to lawsuits. Not to mention the fact that blanket banning IP addresses will eventually impact on innocents with Dynamic IP addresses, not to mention the fact that those people intending to do bad things with the code will likely be baffling their IP Addresses, so an IP address ban is totally ineffectual.
In short, CCP made a great game, but they all need customer relations training and management lessons. Their handling of all the issues that they have had to deal with over the past years is incompetent at best Deliberate at worst. EVE Online would be a great game, if it werent for CCP running it.
I paste here a link to a site with just some of the many indiscretions that CCP and thier Devs have committed against their own community just so that you know that all the above is confirmed as having happened and isnt rumour or suposition: http://www.escapistmagazine.com/articles/view/editorials/op-ed/847-Jumpgate-EVE-s-Devs-and-the-Friends-They-Keep
OMFG you people are too much. There has been a grand total of 1 incident involving a CCP employee abusing their powers. Everything else was either volunteer's abusing power they were given or new GM's doing the same, which I don't consider to be CCP employee's. CCP has done plenty to address the trust issues by forming the IA division, but you won't recognise that because they didn't do exactly what you wanted to handle the situation with T20.
FFS people that was over 2 years ago now, they will never let anything like that happen in the game again because it would hurt their business too much.
To Quote from one of the articles in the link I gave you:
Remedial: They need to fire t20, no bones about it. In any profession which is governed by rules of professional responsibility, the penalty for entering willingly into a clear conflict of interest to the detriment of your duties is that you lose your license. If he exploited his position to rain favors down on his friends and then failed to disclose that to his superiors, that's the very essence of unprofessional behavior and he needs to be gone. It would serve as an example to the rest of the devs or GMs who were considering favoritism as well. Those blueprints and any income derived from them should also be stripped from BoB, and arguably the higher-ups who knew of the abuse deserve bans (or at least warnings at a minimum)
His actions were nothing short of professional misconduct and he should have been fired on the spot.
Edit: And on a side note, having a IA department made up from the very GMs and Devs that were under suspiscion in the first place isnt going to instill a sense of trust. Maybe when they get the elected player independant oversight in place...things will improve, but right now...the IA is defunct in terms of instilling trust and being 'trusted' to do an unbiased job.
How better would it have been to fire him? Firing a useful member of a dev team is a pain in any project. Replacing him and having the replacement attain a good knowledge of the software can take a very long time.
If his job had been delivering beer to employees, he would have been easy to replace, anyone can do this!
A GM would have been easier to replace.
And about what happened to the BPOs, were they removed and so on, no one can know as internal affairs job is to work silently.
So, you think Internal Affairs can't be trusted? It's like you're saying that CCP's CEO is running the company for his own pleasure and getting personnal advantages in game.
So, IA should have been a player elected independant entity? How does this help really? Are people elected the best of us all? I don't think I would trust them more, just as all politicians often have little trust from even the people that elected them.
As the IA was stated to be directly under the CEO's responsibility and that all employees have their accounts watched all the time, I don't see how it makes it a bad thing.
The main thing that hurts CCP is that they speak of such subjects, most game companies would not speak of internal issues and then, there would only be rumors that are easyly broken. Well, that just makes CCP better in terms of transparency, and they do it at the cost of their own reputation.
If t20 had been working in any other company, and his misconduct had been uncovered, whether it would be difficult to replace him or not...he would have been fired. I dont care how good a programmer or developer he is. He did wrong, he admited he did wrong, and to set an example to the other Devs and GMs...he should have been fired. There is no middle ground here. In the real world of big business companies...even small business companies, someone guilty of doing what he had done would have been out of the door.
As to the IA, Im very sorry, but I dont know where you get the idea that IA is a secret police force. Amongst the police, they work very openly and when an investigation is taking place, everyone in the department knows...ontop of that, they then release their findings. There is no silence...and that is the problem with CCP. They try to keep a lid on things, usually using brute force and bans...thats the wrong way to go about it. Its like trying to cut out cancer using a blunt carving knife.
Stop with this rumour. NOW.
The "decompyle" of the Dragon release (which is more than 2 years old) is common knowledge for ages, and it has been seen my a multitude of people, and it's just what it is: decompile of some APIs, not "client source code".
3mb of Python APIs might be useful, (for the evemu.sourceforge.net guys) however, there's no reason for this nonsense.
The amount of news sites spreading this lie is amazing.
Company Secrets (trade secrets), such as how a product is made or company strategy (Example: Seven herbs and spices of KFC chicken)
This is taken from a Wikia about the freedom of speech. Companies are forced to abide by the first amendment unless is breaches the above. Just note, I never once said I agreed with releasing the decompiled code...but your arguement that Free Speech only applies to government is simply wrong.
EDIT: Also;
Freedom of speech is being able to speak freely without censorship. The right to freedom of speech is guaranteed under international law through numerous human-rights instruments, notably under Article 19 of the Universal Declaration of Human Rights and Article 10 of the European Convention on Human Rights, although implementation remains lacking in many countries. The synonymous term freedom of expression is sometimes preferred, since the right is not confined to verbal speech but is understood to protect any act of seeking, receiving and imparting information or ideas, regardless of the medium used.
EDIT: Also;
The United States First Amendment theoretically grants absolute freedom, placing the burden upon the state to demonstrate when (if) a limitation of this freedom is necessary. In almost all liberal democracies, it is generally recognized that restrictions should be the exception and free expression the rule; nevertheless, compliance with this principle is often lacking.
That means that CCP would have to have a valid and enforceable reason for censoring those posts, deleting them and banning the accounts that would hold up in a court of law, then take it to court and win the case. It also means that only the government could finalize an amendment to the freedom of speech, which I doubt they would do for a company in another country.
If you haven't figured it out. Freedom of speech is a farce. Everything you do is governed by a social more and norm.
Also the first amendment only gives us freedom of censorship by the government, not private companies.
A private company reserves the right to deny their service to whomever they wish. This is not against any law. They do what they want, because you PAY for the service. All this garbage about suing someone over a bloody game is just stupid. Many people should get off their soap-boxes and realize it's about a game. Sure it's a game many people put a great deal of time into, but it's a game. If you don't like the supposed rumors about a companies practices, don't play the bloody product.
CCP is defending their IP. The code belongs to them and they don't want people mucking around with it, even though it doesn't affect gameplay.
In short: get off your bloody soapboxes and play (or don't play), there are no legal grounds to sue someone from banning you from using their website. There are no freedoms from private companies. This is the same garbage we've been hearing about SWG for way too long. Give up and go away. I'm sick of hearing people whine about garbage because they have nothing else to whine and cry about.
T20 couldn't have been fired given the way it all went down. It was mishandled yes, but if T20 had been fired at the end of it all he could have sued and probably won.
He was caught and punished months prior to the playerbase finding out about the situation. Lucky for him he was caught while the vast majority of the upper management (CEO, Senior Producer et al) were on leave. The guys left in charge didn't want to make the tough choice to fire a dev that had been there since the beginning and so elected to punish him without termination. When the upper guys got back and found out there was nothing they could do without exposing themselves to possible legal problems - so they went with it and put policies in place to prevent a similar situation from ever going down again.
Every other incident of proven abuse of power since then was met with termination. GMs and longtime volunteers got the axe without question once something was proven against them - and the number of cases was really small, somewhere around 4 to my recollection.
IA was a positive step. An entity reporting directly to the CEO with the mandate of making sure the game is fair for the players. They take their jobs seriously and have all the integrity you'd expect of any other person with a shred of morals. They realize that their job is protecting their livelihood - so they do it professionally.
Frankly - anyone that believes it's all a big smoke and mirrors farce designed to allow the devs to do whatever they want in a virtual world is really far out on the ragged edge. They're in the business of providing entertaining and competitive gameplay - and that business demands keeping things as fair as possible.
Oh - and freedom of speech and similar rights only apply to public areas. That's why you don't hold demonstrations inside buildings such as malls - it's private property and you will be removed. Same goes with forums hosted by gaming companies. You have the right to say whatever you like about their game - but you have to come to a forum that permits it - such as this one here.
Okay, I can agree with all that. I dont think any sort of precident has been set yet on fredom of expression and the internet. I could be wrong. But, it doesnt change the fact that t20 was handled...well, in short, horribly and the company still hasnt recovered from it. Even to this day in the EVE universe the repercussions are being felt. You could argue that the war against BoB at the moment has in some way been instigated by the t20 affair. And yes, I admit that having an IA is a good thing, but, no one really knows the people that are operating it. Im not saying they are crooked but its hard to trust someone that you know nothing about.
Anyway, as I said, this year there is going to be a player elected oversight on CCP. They will meet with CCP once or twice a year, with CCP paying all their expenses. This should improve matters a great deal. I think that this is something that CCP was on the ball with, its a good decision and should hopefully start to smooth out things with the more disgruntled of the playerbase.
It always does mean something for the individual, and negative forum posting can mean others follow and cancel or people thinking about subscribing not doing so. It's just a drop in the ocean mostly for the big company, but if you feel that strongly about it it sure is better then continuing your subscription.
>This is taken from a Wikia about the freedom of speech....
Yeah, because Wikipidia is the most reliable source on ANYTHING...
Further the documents you cite aren't even ratified nor are they enforcible as law with the exception of the United States Constitution. And your understanding of that latter document is obviously lacking. If you know anything about the U.S. Constitution at all you would know that it limits and enumerates the power of the U.S. GOVERNMENT, not corporations or private entities. If you had a 'right' to 'free speech' at say your workplace in the U.S., no company could fire you for using language of a racist nature or even for telling a customer to frack off. Try either and see what happens.
Sorry to hijack the thread a bit, but I get tired of the 'freedom of speech' people. A person who doesn't know or understand their rights has none.