On one side, you have pieces like this, where seemingly there are constant fights between serious actors with large and properly distributed budgets, employing top tech and top minds; on the other - regular news of the hackz, where responsible person in charge of security with root access failed to grasp basic technical knowledge (several times), ticking every checkbox in "never do this" list from security best practices, which led to every customer being pwned.
It's like two parallel worlds, that exist in the same place at the same time, but somehow don't cross.
I started my career in the military, and got lucky enough that SOMEHOW, we convinced them to fund a trip to GDQ for educational purposes.
Anyways, while there I attended a little roundtable on software security. It was me, representing a small unit from the Air Force, some dude from Google, and like 15 game devs.
Despite only being a dev of 5 years at that point, I was SHOCKED at the lack of knowledge on software security. Even simple concepts seemed completely foreign to the game devs, though the Google dude seemed to have a really solid understanding of security.
Obviously game devs and website devs and all kinds of devs have different focuses, but it just blew my mind that out of all the topics there I might’ve been considered a comparative expert in, security was somehow the one. I wasn’t sure if that was a major plus for military devs or a major concern for the other devs, but now I’m starting to learn in the latter direction.
Without knowing when that was, I can't be sure how concerning it is.
As an end user, security in game development seems to hit a minimum is the early 2000s.
I recall playing EverQuest and using ShowEQ on a Linux machine on the same network as a proxy to silently eavesdrop on the traffic to show a map of the game with all the hidden/obscured/visible stuff all present. They either never encrypted that traffic or I quit playing before they did.
As multiplayer games started to become the default, netcode improved quite a bit and basic encryption was implemented - but I don't recall a single multi-player game, ever, that was free of hackers when playing online.
It feels like over the years the issue moved from remote exploitation to hiding processes on the user's machine. That has lead to kernel-level anticheat systems. I'm unsure of the effectiveness as when they started to become common I moved all of my gaming to dedicated hosts because I wasn't willing to give that level of access to my "real" computers. That said, I've certainly not noticed a decrease in the perceived number of cheaters.
These days, as far as I know - and to be clear, this isn't an area of deep interest for me - I'm not worried about my gaming accounts being compromised through technical means. It feels like that sort of security is a solved issue overall, although I suppose it's also possible that other forms of exploits have simply gotten easier/cheaper.
> It feels like that sort of security is a solved issue overall
...ish. The solution is false positives and a permanent underclass. You can't play those games unless you're on windows and you grant root to the anti-cheat.
I don't care much about that, but i do care about people being unemployable because some amorphous machine doesn't like the way they comb their hair.
Last century, if you grew up five to a room then at least you knew why you were marginalised. It wasn't just, but it was legible. Now, some of us are living in Terry Gilliam's Brazil.
I've never seen an exploiter on Clash Royale.
Security in the game industry is a sick joke. There are dozens of RCE riddled titles sold on Steam at this moment. For example, many past titles on "Call of Duty" series with CVE-2018-20817 [1].
BTW, I highly encourage all EU citizens to prepare Cyber Resilience Act complaints for September 11, 2026 when the law kicks in ;-)
[1] https://www.reddit.com/r/blackops2/comments/1v3xowq/just_ent...
Absolutely crazy that these CVE-ridden CoDs are being sold by Microsoft itself!
Crazy, but unsurprising.
Hah. It probably shouldn't be that surprising? Most engineers learn security on the job, not school. Game devs don't deal with -- and don't need to deal with -- the kinds of security issues Google and the military do.
Google has probably the best security team in the world, and they need to. The military deals with state actors by definition.
Gamedevs need to ship. I'm not saying they don't care about security, but short of some showstopper critical problem, it's not a thing and doesn't need to be.
It doesn't matter if your game is secure if nobody plays it lol
Games are a different product altogether. Game developers want to have fun and create a fun experience. Security is almost always something they'd avoid if they could. They'd rather spend the time on more polish, juice or play testing.
Besides stopping cheaters, in almost all conceivable cases, security doesn't make a game better.
I think that's going to be the central tension of the next few years. The article suggests that software becoming more secure is going to lead to renewed calls for a "legitimate" backdoor for law enforcement to access everything about the device. Well, that security means nothing if someone phishes Kash Patel, something which has already happened. You go through the weak link, which is almost always the human.
I could see a future where the government is replaced by the software system which has the fewest security flaws, simply because it is the last thing left standing as everybody hacks everybody else. We end up with a Matrix-like or Terminator-like future where humanity now lives in service of the machines.
K shaped economy and K shaped development?