Sony: The Company That Kicked the Hornet's Nest
businessweek.com
businessweek.com
As soon as the PSN is up and I'm able to delete the PSN account (which they're saying will only be possible from your original PS3) we're going to pawn the PS3 and games.
I don't want Microsoft to win the living room and so won't be supporting them either. I guess unless Wii2 has beautiful graphics we'll be an exclusive PC gaming house.
The whole situation is disgusting. I don't get to play much but it really pisses me off that Sony has essentially killed one of the only great activities that I've kept from child to adulthood.
On which PC operating system?
What do you mean by this?
I'm still playing Atari 2600 games, decades later, because they still work. Tying down use to a single-point-of-failure-authorization-system guarantees that your investment in creative works has a short shelf life. But most gamers know at least what the original Super Mario Bros theme song sounds like as coming from an NES.
Sony is all-too-familiar with people pirating games on their consoles. Online authorization eliminates huge swaths of pirates.
Most consumers aren't thinking about 10 years from now when they buy. They're thinking about getting their dopamine fix RIGHT NOW. And online authorization makes them give up their CC# to get it.
And anecdotally, the activation has pretty much stopped casual sneakerware piracy. People don't loan out their Windows CDs like they used to.
ebay can get too expensive REALLY quickly. emulators are legal, but the games I would play on them are definitely pirated. That, and I have to deal with a control scheme the game wasn't designed to be played on. virtual consoles offer pretty much the exact experience as the real thing, and they're affordable.
So, yeah, I'd much rather pay for a Virtual Console than go out and buy hardware which is older than me.
Talk to Thomas if you want actual numbers, but the overwhelming majority of AAA games have fairly predictable sales curves with a peak window measured in weeks or, in some cases, days. See also books, movies, music, etc.
Evergreen content is highly anomalous in creative industries.
If a AAA title doesn't move 1 million copies in opening week, the studio is going to be in trouble either directly financially, or with the publisher (see: Mirror's Edge).
Everyone is fully aware of the ridiculousness of where the market is right now.
This I much prefer the path many MMO's have taken or a game like TF2, continue to add over time to keep a solid value proposition for years to come rather than the 2 weeks after it comes out.
Old game mags used to have a metric called "replayability". Games with poor re-playability were dinged by the gaming press as offering low-value for the dollar to the gamer. I'm just wondering if the Movie style approach offers similar low-value for the dollar for the game makers in terms of the amount of money required to advertise to gamers for every AAA title that comes out the door, only to throw all that work away next month. It's almost like the industry is pumping out Mandalas, then sweeping them away.
Heck Mega Man (Rock Man) has had 7 or 8 games with virtually the same artwork (the most expensive part of game production). A modern developer might look at this and say "we'll just release a MegaMan game and every year release more enemies with more stages, weapons and bosses that just figure into the main release."
(I'm thinking Mega Man of course because I'm in the process of replaying through the series again and Capcom is losing millions from the PSN nonsense).
I guess what I'm rambling about is that there has to be a better way for the studios and the gamers to find better value in terms of longevity on both the development costs and the purchase price of the games -- and tying the games to a transient online auth system isn't going to do it.
To everyone except hardcore gamers the current release method is probably very tiring, as in I might pick up a new game and play it for a few months at the rate I play games. In that time so many of these big titles would have come out.
It also means once these releases drop off best seller lists they quickly become unloved. I've seen big bugs and game mechanics issue that just never get fixed I guess because most of the sales have already happened.
Yep, big games are horrendously front-loaded and with very short legs (you can see that if you follow sales threads at e.g. Neogaf).
This is why DRMs which technically "fail" (they fall in, say, 2 weeks) have performed admirably, and as asked/required: for two weeks, where 90% of the game's sales happen, pirated games were not competition.
This is why I can only shake my head in disbelief when people claim DRMs fail as a DRM finally gets cracked 1 month after a game release: as far as publishers are concerned, a DRM which lasted 4~5 weeks has performed way beyond the call of duty, and you can be sure their next game will be using the same breed of DRM.
My PS3 has been working fine since the PSN went offline. Actually, it's been disconnected from the internet (for unrelated reasons) since long before that. All my games play fine. All my blu-ray discs play fine. I have no reason to suspect that they will not continue to work decades from now should I choose to keep them that long.
"This is What Irony Tastes Like: Capcom and the PSN Outage" http://news.ycombinator.com/item?id=2539591
Games like those published by Ubisoft do this on PC, and when it goes down, they say "well, if only you guys didn't pirate our games all the time, we wouldn't have to abuse you this way." And, to be honest, they have a point, because PC game piracy is out of control.
No-one thinks online authorization is great. It pisses off legitimate customers and it's another service you have to run. It's not like the publishers are really getting anything tangible out of it bar the hope that their games won't be pirated to all hell (they will be).
I would like it if games/consoles had a kill switch on them, so that after x years they no longer require an authorization in case the service goes away, but I highly doubt that will happen.
I /think/ there are 360 titles that do this, at least to some content.
It's not something that the console makers do themselves.
[edit, spelling]
No, they do not have a point. I bought Settlers 7, shortly after release, for full price. I couldn't play it. My internet connection at the time would "blip" every ten minutes or so, it would go down for a couple of seconds and come back up. Every time this happened I got kicked out of my game.
The next Ubisoft game that came out, I pirated. Why? Because the pirated version of Settlers 7 /works/. If I'm paying something, I expect a better experience than I would get if I didn't pay. To me, that seems like a fairly basic tenet of economics.
Many game companies "get it". Valve for example provide me with unending streams of new content for games I have paid for, even going as far as giving me a free copy of Portal 2. Thanks Valve! You win money.
Companies like Epic have basically gone out on the record and said "we stopped supporting PC because of piracy." If you were a publisher, what would you do? There are precious few successes of games without DRM, and remember that all Steam games are also DRM'd.
- Sony a big company with big company HR bureaucracy
- The worldwide interest group re: Hacking
Conclusion? When it comes to big companies vs. the hacker communities, it's asymmetrical warfare, and the big companies are the underdogs. Big companies are outnumbered and outclassed.
However, instead of behaving like the outclassed guerillas they are, they keep acting like they're the empire, and keep getting bloodied in losing fights. All it takes is a few minutes of thought to realize that DRM is the worst possible tactical position they could possibly take. Companies that do this are deluded.
But here's the real kicker: It is possible for companies to use the principles of asymmetrical warfare and win fights. You have to pick your battles based on sound economic principles. You have to pick your battles, such that the huge numerical and training advantages of the adversary are moot.
I know how to do this.
EDIT: Here's a hint. Take a look at your bug tracker. Imagine that it only has reports where the bugs are hard or impossible to reproduce. Imagine that the consequences of the bug are separated by several weeks time from the probable causes. Imagine that there are tens of thousands of such reports. Imagine that the reports only constitute a small fraction of actual occurrences.
It is quite possible to put parties trying to crack your system in exactly this position. If you make it easy to "crack" your program, and instead put all of your effort towards clandestine detection, then there is no incentive for people to fully crack your system, such that they can find the detection mechanisms. Separate the consequences of detection from the actual detection by a time span of several weeks. Use detection to protect value-add and up-sell revenue which is inherently dependent on server-side implementation.
Use honeypots. Your "easily cracked" version 1 becomes a kind of honeypot for detection, which protects your real revenue stream. Present a hack-y feeling loophole that lets people acquire your value-add content for a sizable discount from full-price.
Remember, you're fighting an asymmetrical conflict. Be sneaky. Don't even let your opponent know she's even in a contest if you can help it. Fool them into thinking they've "won."
None of the above applies to HBGary.
No! That is not what I'm advocating! Under no circumstances should you introduce faux bugs. The "bugs" I am referring to are incomplete cracks, and they are only bugs for those providing the cracks.
Disgruntled pirates can give you a real PR headache, since they don't self-identify as anything but "ordinary users" when they post comments to forums.
Forums are a bad idea because they take so much effort to curate. The downside is huge -- to the point of creating pernicious fictions such as this.
(Laura Roeder's take, is that community forums are most often not worth the effort. http://mixergy.com/laura-roeder-interview/ )
If you are in the business of selling software, you are probably not making money off of a community forum. Why have it if it has such huge downsides? Have the community meet only in-game.
The scenario you propose is slander and complete falsehood. If your userbase is so corrupt that this works, then I posit you have the wrong customer base. The strategy I am advocating requires that you can control the message in your userbase. This again fits the asymmetrical warfare analogy. Any group of successful guerilla fighters has a well crafted message. If this message can't be communicated properly, then there is no point to the fight.
Here, the message should be: Those warez guys are providing you defective cracks. Just buy the real game -- it's much less hassle. (Then someone else points out that there's a loophole if you purchase the "competitive upgrade" that will work even with the standard version, and only have to pay 50% of retail etc...)
Is there any evidence that Sony's data breach is in any way related to a hacker backlash? The closest thing the article provided was a file left on Sony's servers referencing Anonymous. That's pretty week.
I think it is fair to say that Sony did "kick the hornet's nest." Is that what caused them to become a target for black hats? Unlikely. Whoever did this was likely looking for a big score, likely to try and sell the data to organized crime, and thus an ideological attack doesn't make a lot of sense.
However, it seems very plausible that some gray hats like Anonymous started kicking the tires of their security systems, and shared information that indicated things were looking lax, and that's what brought the black hats in.
If you're gonna be dumb, you gotta be tough. And Sony obviously wasn't.
The type of hacker that brought down PSN and stole credit card data needs no motive other than the millions of dollars of credit fraud that will follow. They need only opportunity.
Let's just say Geohotz accepts the offer and works in PSN. I think the general public will be convinced that PSN is now secured by the top elite hacker in the world who pointed out Sony's security flaws. Furthermore, Sony will appeal to consumers that they're humbly admitting their mistake and are dedicated to improve their security.
Yes, I know the root key and identity theft are completely different. Also, whether Geohotz actually does anything to Sony is irrelevant.
I'm strictly talking within PR scope.
Yes. Because he is quite clearly a talented hacker. Do you think it would make more sense to hire somebody who may not have experience with sony's technology?
That paragraph I just quoted up there is some of the sloppiest journalism I've ever seen. The analogy being drawn is completely without merit. Microsoft is "hacker" friendly because they allow people to fool around with the Kinect? And Sony is hacker unfriendly because they removed a feature (the Linux install option) that they feared would lead to massive piracy? And Google is just great because they offer bounties for security flaws? In what way are any of those facts similar? None of them are even referring to the same sort of "hacking." If Google made a game system that made its money based on licensing fees from software sales, it would do everything within its power to prevent piracy. Microsoft already does this. Running homebrew was not what Sony was trying to stop.
What I'm about to say will probably be very unpopular here. Anyway, the "hacker" (I hate their usage here... they should say cracker) excuse that they are just trying to enable homebrew software is utterly laughable as well. As soon as Geohotz was successful, numerous other companies capitalized on it and went to that next (tiny, tiny, tiny) step to enable running pirated games. Should Sony have sued Geohotz? Probably not. But what did Geohotz honestly think people were going to do with his developments? Does he want people to keep making games for the PS3? Did he honestly think that people wouldn't immediately turn around and use his progress to pirate games? The ethics of this supposed "hacker" community leave a lot to be desired, and I truly wish we could return to the old usage of the term, and stop applying it to people that are really just safe crackers and thieves.
Our laws are completely inadequate for addressing this kind of abuse now, and I dread to see what sort of draconian measures will be put in place in response to this sort of shortsighted, unethical, and lame "hacking." If you don't want a closed system, then don't buy it. This is what will give us more open systems in the future, not enabling pirates.
What difference do you see between hacking your PS3 and hacking your kinect? How is hacking your ps3 "cracking"? In my opinion, and I suspect that the vast majority of technologically literate people would agree with me, what happened with the PS3 fits the classic definition of hacking perfectly.
On the other hand, the PS3 hack will primarily be used to enable piracy. That's it really. Did it initially enable homebrew games? Yes, but is that what the vast majority of people will use it for? You're deluded if you think otherwise.
The problem I have with non-ethical non-consequentialist crackers like Geohotz is that they are not solving a legitimate problem in the first place. If you want to make open systems, then stop providing monetary support to closed systems in the first place.
Another example, If I hack the US ID card to see what data is stored on it..am I now a criminal by what the popular use of that hack is?
" ~geohot
props to fail0verflow for the asymmetric half no donate link, just use this info wisely i do not condone piracy
if you want your next console to be secure, get in touch with me. any of you 3. it'd be fun to be on the other side.
...and this is a real self, hello world although it's not NPDRM, so please wait to run... shouts to the guys who did PSL1GHT without you, I couldn't release this
first piece of homebrew you can run put in service mode, put on usb stick, boot"
So, in that initial post, he does not solicit donations (although he had before and does after). He then announces that he doesn't "condone piracy", then he solicits employment from the three major console manufacturers. What reason would they have to employ him? What he's doing just enables homebrew software, right? They don't really care about homebrew now do they? No, they care about piracy. So what he's really conveying here is this: "I just enabled massive piracy on the console that so far has been hardest to crack. I don't approve of it, but I know that's what it will actually be used for. Hey, why don't you give me some money so this won't happen again?" Sounds like extortion and accessory to theft to me. But our laws don't really work out that way. Yet. I don't want our laws to enable that. I want people with Geohotz' skill to be responsible and actually work with companies like Sony. Is it partially Sony's fault that he didn't? Maybe, but that's a tenuous conclusion at best (does anyone know if he ever privately gave this information to Sony? or if he even attempted to?). On the other hand, it's patently obvious that he knew exactly what his work would be used for, and released it to the masses anyway.
What's hard about this? Do you not understand that companies will lobby very hard and very successfully to enable laws that are so strict that it will not only make what geohotz did illegal, but what the (admirable) kinect hackers did illegal as well?
The Laws that can and will be made as the result of his craven greediness, stupidity, and arrogance will not be favorable to any real hacker, because laws are not a precise enough instrument for enforcing ethical standards. We must enforce the ethical standards. Geohotz should be a pariah, not a hero, for anyone other than the piracy enablers that will make a fortune from his work.
They added it because they knew that the PS3 could be used in cluster computing and that it could be an interesting feature for Linux enthusiasts that wanted to use the PS3 beyond its original capabilities (e.g. as a better, crazier home theater device, or as a desktop replacement even). Then people started to get closer to being able to run pirated games with certain versions of the "Other OS."
At that point Sony realized that it would be better to drop that feature from their hardware rather than risk massive piracy. But what did the removal of that option really entail? Did it mean that all those massive compute clusters could no longer run? Nope. Did it mean that people that were using the console with games that they bought up until that point couldn't play those games any more? Nope.
It just meant that if they wanted to play new games, or play online, that they couldn't have that option any more. No killswitch. Nothing too awful. Protecting their business interests. And who really forced them to do that? It was the crackers that were trying to enable piracy, err... sorry... "homebrew." Sony is not against hackers. They want hackers. They don't want crackers and thieves.
XBMC led to incentives to accelerate the development of home media center components like audio/video decoders. This obviously helps everyone in the growing media center industry.
XBMC also is directly responsible for the birth of at least two startups in the media center space, Boxee and Plex.
So while some companies in an established and profitable industry lost some revenue from piracy, a new industry got a big boost from people being able to experiment with and innovate on top of a console.
The PS3 was a freer console for the masses before his work. His work enabled piracy, theft, and constitutes extortion. What part of his initial explanation of the PS3 root key divulgence don't you understand? Here it is:
" ~geohot
props to fail0verflow for the asymmetric half no donate link, just use this info wisely i do not condone piracy
if you want your next console to be secure, get in touch with me. any of you 3. it'd be fun to be on the other side.
...and this is a real self, hello world although it's not NPDRM, so please wait to run... shouts to the guys who did PSL1GHT without you, I couldn't release this
first piece of homebrew you can run put in service mode, put on usb stick, boot"
"i do not condone piracy" = I don't think you should use this for piracy
"if you want your next console to be secure, get in touch with me. any of you 3." = I know this shit I did will be used for piracy, that's why you 3 (Nintendo, MS, Sony) may want to consult me to avoid the massive piracy that will surely result due to my hacks in the future
Is this not, in a sense, extortion? Is he not willfully and knowingly enabling theft?
My point is that the PS3 was a more open platform before Geohotz arrived on the scene. It would be more open today if it weren't for his efforts, which are almost entirely in aid of piracy and theft. Please, name one thing that he has enabled that wasn't previously possible with an Other OS install that is not essentially just stealing. Please. Go for it. Tell me I'm wrong.
I'm just a guy that makes a living making software, Geohotz is a guy that is making a living by robbing the companies that pay me. Why should we grant him the glorified title of hacker? RMS is a hacker. Linus is a hacker. PG is a hacker. Carmack is a hacker.
Geohotz is a cracker.
It's much better than jumping through DLNA hoops.
This "enable massive piracy" claim sounds really scary. You do know, that right now, there are millions of vehicles out there that can all be used to commit crime, murder people, crash into banks and run off with ATMs, etc. And yet, these criminal enabling machines just lying around (OMG theres two outside my house right now), there is no outbreak of "massive vehicular crimes".