The conversation

kulahanHNSource author
Lessons learnedExperience excerpt · English

I started my career in the military, and got lucky enough that SOMEHOW, we convinced them to fund a …

I started my career in the military, and got lucky enough that SOMEHOW, we convinced them to fund a trip to GDQ for educational purposes. Anyways, while there I attended a little roundtable on software security. It was me, representing a small unit from the Air Force, some dude from Google, and like 15 game devs. Despite only being a dev of 5 years at that point, I was SHOCKED at the lack of knowledge on software security. Even simple concepts seemed completely foreign to the game devs, though the Google dude seemed to have a really solid understanding of security. Obviously game devs and website devs and all kinds of devs have different focuses, but it just blew my mind that out of all the topics there I might’ve been considered a comparative expert in, security was somehow the one. I wasn’t sure if that was a major plus for military devs or a major concern for the other devs, but now I’m starting to learn in the latter direction.

Original discussionEverything is about to "go dark"249 source comments · at import
4

What was this responding to?

Parent context · original excerpt

IN
InsimwytimHN

On one side, you have pieces like this, where seemingly there are constant fights between serious actors with large and properly distributed budgets, employing top tech and top minds; on the other - regular news of the hackz, where responsible person in charge of security with root access failed to grasp basic technical knowledge (several times), ticking every checkbox in "never do this" list from security best practices, which led to every customer being pwned. It's like two parallel worlds, that exist in the same place at the same time, but somehow don't cross.

Full original

Community replies 0

No community replies yet. Add your perspective.

Replies from the source 4

Direct replies available in this import. Original-language excerpts.

AN
AncapistaniHN

Without knowing when that was, I can't be sure how concerning it is. As an end user, security in game development seems to hit a minimum is the early 2000s. I recall playing EverQuest and using ShowEQ on a Linux machine on the same network as a proxy to silently eavesdrop on the traffic to show a map of the game with all the hidden/obscured/visible stuff all present. They either never encrypted that traffic or I quit playing before they did. As multiplayer games started to become the default, netcode improved quite a bit and basic encryption was implemented - but I don't recall a single multi-player game, ever, that was free of hackers when playing online. It feels like over the years the issue moved from remote exploitation to hiding processes on the user's machine. That has lead to kernel-level anticheat systems. I'm unsure of the effectiveness as when they started to become common I m…

Full original
HA
habineroHN

Hah. It probably shouldn't be that surprising? Most engineers learn security on the job, not school. Game devs don't deal with -- and don't need to deal with -- the kinds of security issues Google and the military do. Google has probably the best security team in the world, and they need to. The military deals with state actors by definition. Gamedevs need to ship. I'm not saying they don't care about security, but short of some showstopper critical problem, it's not a thing and doesn't need to be. It doesn't matter if your game is secure if nobody plays it lol

Full original
VE
veetiHN

Security in the game industry is a sick joke. There are dozens of RCE riddled titles sold on Steam at this moment. For example, many past titles on "Call of Duty" series with CVE-2018-20817 [1]. BTW, I highly encourage all EU citizens to prepare Cyber Resilience Act complaints for September 11, 2026 when the law kicks in ;-) [1] https://www.reddit.com/r/blackops2/comments/1v3xowq/just_ent...

Full original
ZA
zahlmanHN

Other responses are an interesting juxtaposition. I would think "you can cheat in multiplayer games" is in a completely different category from "you can hack your opponent's computer in multiplayer games".

Full original
Continue on Hacker News

Respect different perspectives. Share concrete experiences.

Sign in to post, reply, repost, and quote.