Hacker News Reader

Comment by OmarIsmail | Hacker News Reader

This is a much much bigger deal than the Gawker security breach. Sony had substantially more information on its users than Gawker could ever hope to dream of. Specifically information on real names, addresses, and potentially credit cards.

This is a big F'N deal and I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death.

I don't think this will kill PSN or the PS3, but it's going to significantly dent things. I'm curious to see how much media attention this gets and if we'll see a macro shift towards the Xbox 360 and Wii.

If I was Nintendo and particularly evil I would leverage this opportunity to tout the new system and emphasize the cutting-edge online modes with rock solid security. And MS can also talk about their great track record in the online world.

View on HN

"I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death."

Banks, colleges, hospitals, and credit card processors do this all the time, and it doesn't cost them anywhere near a billion dollars despite the fact that they have vastly more personal information. Sure they usually only have a few hundred thousand records and not a few million, but even still the idea that this is going to cost them a billion dollars is absurd.

I would argue the cost of the RRoD was a heck of a lot more than $1B because of all the lost sales. People didn't want to invest in hardware that was going to break 5 times over.

The direct damage from this won't be $1B (still tens of millions at least). But what about the impact of the lost sales and customers from the loss in credibility and trust? That is what could be huge.

It was relatively "easy" for Microsoft to replace broken hardware. How easy and how much is it going to cost Sony to replace broken trust?

I would argue the cost of the RRoD was a heck of a lot more than $1B because of all the lost sales. People didn't want to invest in hardware that was going to break 5 times over.

Agreed. Microsoft only wrote down the $1B as an expected total cost of fixing broken Xboxes. Who knows how much money they lost?

I've been seeing the notion of accounting for the loss of sales due to "reputation" come up on HN recently and I wish to dispute it.

First, most of the time when we're talking about business and we talk about costs we're clearly talking about accounting costs. This applies to startups, too. When you're talking about accounting costs, you don't get to include economic costs (e.g., opportunity cost.)

Second, isn't trying to include these extra "costs" due to lost sales the same thing that the music industry is doing? That is, claiming that they lost trillions of dollars due to file sharing from, you got it, "lost sales." [1]

I don't think there's any real way to measure these costs, so let's stop trying.

[1] http://www.p2pon.com/2011/03/25/greed-hits-climax-music-indu...

"Goodwill" is the difference between the book value of a company (value of tangible assets) and what it can be sold for. A manufacturer with tooling, machines and inventory might not have much, but a software company's book value is near zero.

People are asked to put value on intangibles all the time. You might want to write them all down to zero, but the rest of us value Wordsworth more than the dead trees his words are printed on.

No. Goodwill is the difference between the price paid to acquire a company and the book value of the acquired company. To put goodwill on the books, you must buy a company.

Right, the key here is that goodwill is measurable. Opportunity costs are not.

Opportunity costs are measurable. It all depends on your assumptions whether the measurements are reasonable or not.

Ex. If I make $2000 a week as a contractor on a steady contract, I know that the opportunity cost of taking a week of unpaid vacation time is $2000. That's a reasonable, measurable assumption.

However, I could also say that the opportunity cost of that week of vacation will be $12000, because there might be a one-week rush project that will come in that I can bill for $10000 in addition to my normal steady contract. Assuming there's not a pattern of that happening in the past, it's not a reasonable assumption and thus measurable in that way.

I'd say this second scenario is akin to the record companies assuming that every instance of piracy is also an instance of lost sales.

You're estimating an opportunity cost here, not measuring it.

Goodwill can be measured in the sense that goodwill = purchase price - book value. No assumptions are involved in its calculations--goodwill is calculated based on two fixed values.

Opportunity costs are not as concrete. In your example above you state your opportunity cost is $2000...but what if that rush project comes through? What if your steady contract scales back for that week? There are assumptions involved; ideally your opportunity cost would be the expected value of all probable incomes during that week. Identifying those probabilities a priori is impossible.

My point is: opportunity costs are based on assumptions. They cannot be measured--only estimated.

I definitely agree, and any "lost sales" are clearly evident in future revenue data. Opportunity costs are factors in economic decisions, but writing them down would be laughable.

My point was that Microsoft probably had some revenue trajectory with slope X before the write-down, and experienced a new revenue trajectory with slope Y < X after the write-down. I'm curious about the area between the two lines.

60 million users isn't "a few million"

I'm not sure where that number comes from, they've sold less than 50 million PS3s to date.

PSPs are also on the PSN.

You can have more than one PSN account in a home i think (not a ps3 owner), one for each family member, i suppose there is where you can find the gap between the numbers.

Yes, you can have multiple accounts per console. And because it's free, I would think (based on a small sample, my friends who own PS3s), it's far more likely that there will be multiple PSN accounts, versus XBL accounts which cost money (to play online).

My PS3 has three PSN accounts on it, do three or four of my friends'. Everybody I know who has a 360 shares one Live account across everybody who uses the console.

Numbers I've heard floated for leaks on the smaller scale are around $15-20 per person for post-leak mitigation and damages, which could push near $1b if the same per-person cost held with this size leak (which it might not). When my university had some data stolen, their lawyers advised them to buy everyone a year of some identity-theft insurance/monitoring package, which I believe cost them around $10 per person just for that.

Things are cheaper in bulk right?

Monoprice did the same thing when they were hacked last year. Two months after it happened, I got a letter from them with a few papers describing the identity theft monitoring service I would receive for a year.

Agreed. Look at the T.J. Maxx breach, in which approximately 94 million credit card numbers were stolen. Despite media claims of billions of dollars in damages, and multiple class action lawsuits, T.J. Maxx didn't pay any huge settlements or face any special penalties.

If T.J. Maxx can get away with it, Sony can too.

Microsoft had millions of pieces of defective hardware out there which they were warranting free replacement on for several years. Unless Sony's going to replace all the PS3's in the wild, the direct costs for dealing with this PR nightmare shouldn't come close to what Microsoft set aside.

if pki alone is at the core of their infrastructure problems, and the key is in the chip, this may well be what they have to do. however i don't know that this is entirely because their public key infrastructure.

Would replacing all the PS3's fix it? It seems that this is more related to the infrastructure of PSN than the actual PS3 hardware. If that's the case, there's not much that Sony can do to really fix the situation.

You can diss your competitor for poor security practices only if you have some confidence in your own.

>You can diss your competitor for poor security practices only if you have some confidence in your own.

Nope, companies usually don't leave any chance to point to the competition's faults and laugh, even if they themselves are worse in that regard.

It does carry a risk though - if you make securing a major online service sound too easy by ridiculing your competitor then down the line when you get breached its more damaging imo. eg I dont remember any Car companies in recent history pointing to Service recalls of their competitors in their advertisements, ditto for Airlines and crashes.

Airline crashes would be such a bad PR idea I mean, that's just bad taste.

It is, and that's the example I thought of in response to the point. But car companies do advertise the safety of their cars. The situation is different, though, since different cars do have different safety measures, and such things do get rated.

All big companies claim total confidence in their own security... right up to the moment they're proved wrong. (and sometimes beyond)

Reply on news.ycombinator.com