CD Projekt Red's ransomed data has been leaked | Hacker News Reader

CD Projekt Red's ransomed data has been leaked

twitter.com

34 pointsbwidlar46 comments

I don’t understand who would buy this. If you’re a game developer buying stolen code isn’t going to help you. Most of their titles are offline focused so I don’t see value in using the code to write cheats. I could see someone who hates them paying for email to release and damage the company but even that seems thin.

Also having worked in games i had a chuckle when I saw the “test framework” folder in Gwent and my first thought was “hmm probably fake then.”

Someone who doesn't have to respect copyright law could use it to make their own game like it, saving years of effort. It'd be hard getting up to speed on it, but it could be worth it.

If you're in the market that doesn't respect copyright law there's a surprise for you - no one will buy legal copies of your game either, and it will be banned everywhere else.

Also code for the game itself means almost nothing without the tooling to produce assets for it. It could be written for scratch but then....just.....use unreal or unity? Pirate copies if you really don't care. Like, I work in games development and in house engines are incredibly inflexible, they are made for one game only usually and it's a titanic amount of effort to use them for anything else. You could probably use the Witcher engine to make a crappy clone of Witcher, but you're not going to use the engine for anything else.

> If you're in the market that doesn't respect copyright law there's a surprise for you - no one will buy legal copies of your game either, and it will be banned everywhere else.

Considering it's closed source I suspect it could get quite far before anyone notices. Also, people will buy legal copies, you over estimate how moral people are. Remember most of us shop on Amazon even tho we know it's terrible. And the money from those copies will go to CD Projekt Red.

> in house engines are incredibly inflexible, they are made for one game only usually and it's a titanic amount of effort to use them for anything else

Hah, one of the reasons I left the industry was I was frustrated that we were supposed to build the sequel to our game using a different custom engine intended for a different genre of game.

Sounds like EA and Frostbite.

That wasn't the one I was involved in but I suppose it's not surprising there's more examples.

Bethesda built a Fallout multiplayer game on their existing single player engine. "Minecraft alpha"-tier exploits and bugs where in the "finished" game and a lot of them were game breaking.

I could see someone making a knockoff version of Gwent to sell on Google Play. In terms of the Red Engine code... the custom engine I'm familiar with was a nightmare in terms of the asset build pipeline and lack of documentation. If you're planning on ripping off a custom engine to bootstrap your game I would highly recommend just using Unity or UE.

I'm not sure reverse engineering the mechanics and custom engine of a game infamous for terrible AI, stability issues and bugs and experience-degrading optimisations provides the best starting point for making a new game...

Particularly not when there are properly documented, stable and widely used game engines your devs are probably already familiar with available for no-up front fee.

Cyberpunk is not CDPR’s only game.

True, but it's pretty good evidence that access to CDPR's assets doesn't make it easy to get things right, even with the team that built them and the full toolchain. And the reports seem to suggest the source code for Cyberpunk and Witcher 3 is being auctioned separately, with Gwent already in the wild

That makes the lack of quality assurance even sadder.

You shipped any open world 3d games lately?

Have you seen how prolific copyright infringement is in china.

Compile cyberpunk, stick a couple of new assets and a new name on it and sell ot for $5. I guarantee it would sell

I don't see any one spending 1M.

There is some value though, a game dev don't need to copy all of it. Sub routines or component especially not in the UI, could save some dev some money. You could also learn a lot from the workings of the src code.

Value survived the source leak, ultimately the brand and experience is what worth money, plenty of open source projects make money.

True, and with $1M you could have a serious discussion with CDPR about licensing the bits you want.

> hmm probably fake then

could check bae897295e09f309fa35ea4fcec7674c05357589

Corporations put a lot of effort into avoiding leaks of their source code. Compared to the amount of AAA game projects, actual leaks happen rarely.

I can see "competitors" smelling value in buying source code of a project that generated a lot of profit.

I agree with you that the actual value is not that high, but I can nonetheless imagine people willing to pay a lot for it.

Seems overvalued. I mean, it's a game developer. There is no secret sauce in what they do, no secret list of customers, no hack with serious monetary value... There is an academic value to competitors, I guess, and maybe a value to scammers (employees' personal details) but that's basically it.

Edit: twitter thread says they are "selling immediately for $7m". I'd be very surprised if they found a buyer at that price.

> There is an academic value to competitors, I guess, and maybe a value to scammers (employees' personal details) but that's basically it.

Just hire their devs, it's a legal and cheaper way to get that knowledge.

And faster; there was a post recently named "architecture.md", that explained that for most new code contributions most of the time is spent finding where to go to fix a bug. Following that idea, it makes sense that it will take a very long time for a new dev team to pick up the code base, or at least more time than it is worth it.

What are these "exploit forums" where the trade happens? Are they behind the Tor network like the Silkroad or are these in the open but with exclusive access that only few have actually an access? Any insights on the workings of this business?

Tencent is the most likely buyer given their history of building fast follower games. Likely to be some useful components here. Other fast follower studios like Mihoyo could scrape some value, but $6M RMB is no joke to add to a budget of their size.

An update: the auction has ended, the seller claims they accepted a private offer

1. https://www.ign.com/articles/stolen-cd-projekt-red-files-rep...

2. https://twitter.com/vxunderground/status/1359890201686990863

How does the Bitcoin auction work? Can't they also participate as a separate bidder and push the price to whatever they want?

True of nearly any auction. Actual buyers stop bidding when they think the price has exceeded the value to them. If the music stops with a fake bidder holding the bag, the auction will have to be re-held, now with increased scepticism by real bidders, likely securing a lower final price.

"Auctioning again because the previous buyer didn't pay after winning" - ebay, somebody justifying why they've reopened the auction.

taking this a bit further, the original authors could probably employ this as a strategy: Since it's an anonymous auction, the original author could win the auction and then refuse to pay repeatedly until all the real potential buyers have given up.

Apparently, you have to deposit BTC 0.1 (~= $4,700) to be allowed to bid. Presumably, you'd be losing this deposit upon each iteration if you refused to pay.

Sorry to see they've been hit. There is some historical value to their data, and I hope they manage to recover it somehow.

I wonder if there's any risk GOG was compromised as well. That could be an impressive watering hole attack...

They have 1000 employees.

If we assume that 100 of those worked full time for 2 years on a game, at a salary of $33k USD per year (Game designers in Poland are CHEAP!!)... That works out to $6.6M.

So a price of $1M seems pretty reasonable for a copyright-ignoring competing game house to buy all that code to have something to work from. It's a bit on the high side considering any resulting game would never be able to be sold anywhere in Europe/the US.

The cost to produce is not equal to the value of the work.

The only thing of value would be source code / data dumps of the store. That potentially can be exploited.

Anything else is pretty worthless. The systems in the game and artefacts likely don't meet the requirements for a game your building. Anything you use opens you up to do a law suit. Might as well spend $1M legitimately producing the game.

If I were the CEO of such a dishonest company I wouldn't even bother bidding $1M. I'd try to get the source code for a far lower price.

The cheap game designers part is probably not entirely true. The company may be located in Poland but they use a lot of foreign talent, and foreign talent would not be willing to work for average Polish salaries.

Who has the incentive to buy it at that price point?

Maybe they're just trying to crank up the pressure on CDPR to pay.

CDPR already said that they won't pay. Stock price would take a major hit if they reversed the decision.

Agree, I don't think it will work.

Just what I was thinking. In light of the entire cryptoransom thing the idea of stealing some data and then finding a buyer seems so anachronistically 1990ies retrofuturism that it almost feels like a roleplayed cyberpunk submarine ad.

Maybe the randomers are begrudged cyberpunk fans who want to show CDPR a proper cyberpunk dystopian story.

Games are developed with a ship it and forget it model. The value of that source code being non public is zero to CDPR.

You can pirate the game without the source code.

The leak supposedly also includes an upgraded version of The Witcher 3 they've been working on, scheduled to be released later this year. [1]

Although it's supposed to be a free update for anyone who bought it before, it's not only past releases that might be affected if that's the case.

1. https://twitter.com/witchergame/status/1301826520311369728

kk? Seriously? Have they never heard of M?

Usually I have only seen kk and kkk being used in asia...

That is a hint then, of where those people come from.

Reply on news.ycombinator.com