Sony’s problem is memes, not security | Hacker News Reader

Sony’s problem is memes, not security

leavesofcode.com

37 pointstsunamifury25 comments

To be specific, it is a meme now that Sony has bad security. Because of this, hackers are more willing to attempt hacks against Sony, because A. they feel greater confidence in their chances at success, and B. people spread stories that confirm preconceptions, so succeeding in a way that confirms the "Sony has bad security" preconception will increase their reach, and therefore their feeling of reward.

Take, in juxtaposition, OSX's security. It is a meme that OSX is more secure than Windows—even though the opposite is true, as each Defcon competition proves. However, because of the prevalence of the meme, few amateurs are willing to attempt to hack OSX; most virus, worm and exploit writers instead tend to get their start hacking Windows. Then, because people tend to fall into patterns of doing what has brought them success in the past, when these people become security professionals (whether white-hat or black-hat) they specialize themselves to the Windows malware/exploit ecosystem—and the meme perpetuates itself.

There are also quite a lot more Windows machines than OSX machines. Hacking Windows has a higher expected rate of return (whether it's information extraction, phishing, botnet creation, etc.)

Fighting to keep their system closed, to keep users from something as innocuous as installing Linux on their hardware is not worth the trouble at this point. Learn when the winds have changes, and go with it.

Just to play Devil's advocate...

Perhaps Sony is taking the "maximize shareholder revenue" avenue. What is their financial loss for months of PSN downtime? A few people switch to xbox live? They have to provide a few free accounts?

For their other hacked services, they can simply shut them off as failed experiments, fire all the developers, and save even more money.

Because there is not some huge fine for leaking all the credit card information, this doesn't affect Sony at all, financially. But allowing people to run Linux means they may take a loss on a lot more devices (and if they don't take that loss, people will buy Wiis or Xboxes instead), and it makes piracy a lot easier. If piracy becomes too rampant, developers will stop targeting the Playstation, killing the entire line of business.

So while it makes them look dumb to keep getting hacked over and over again, maybe it isn't hurting them at all.

It's worth remembering that the expression "maximize shareholder value" is composed of three words, each of which represents a highly elastic variable. In combination, this set of terms can be defined (and redefined!) in a manner that will justify virtually anything.

Take "maximize" - depending on your timeframe, this can mean a range of very different things. And if you cleverly avoid specifying any timeframe at all, you've effectively said nothing whatsoever.

Now take "shareholder," which can refer to everyone from mutual funds that may buy and hold for decades to bots on high-frequency trading platforms that measure their holds in nanoseconds. There is virtually nothing that these extremes have in common. Given a hoplessly conflicted set of interests, how does management decide whose benefit they're going to privilege? More to the point, if they DON'T make a clear choice, how can they claim that the generic word has any legally-binding meaning?

Same goes for "value" - not only can this mean different things to different investors, those meanings can be diametrically opposed. For instance, does "value" mean providing a return big enough to outweigh very substantial exposure to risk? Or does "value" mean bunker-grade protection from risk, even at the cost of a low return? It's yet another very elastic term that can mean a lot of different things - or nothing at all, if the appropriate frame of reference is withheld.

The takeaway is simple: if anyone tells you they're "maximizing shareholder value" without carefully defining ALL THREE words, they're probably lying, which is ironic, because they're also implying that they're living up to their fiduciary responsibility. In reality, chances are good that they're doing the opposite.

In real life, it means: "the share price should increase faster than the broader market".

The problem is that now Sony's laughable security has become a meme that's growing in strength with every breach.

In the last week I've mentioned Sony's situation to a number of lay people who've never owned a Sony gaming machine but have all heard about these security issues and insist they'll never trust Sony with personal information ever again.

Every time a new headline is printed it strengthens this image.

they'll never trust Sony with personal information ever again

Fair enough, but Sony isn't in the "personal information" business. They can always create some new company to handle the PSN billing, which is the only personal information that matters to their bottom line.

Such divisions rarely will actually occur to someone considering whether to use a Sony product. More generally though, I question that most people are going to think about this too much before buying - they'll think more about the downtime.

I doubt anyone would think of PSN as giving their information to anyone other than Sony, regardless of the legal status of it. If this new 'meme' is putting people off Sony, they presumably wouldn't buy a PS4 in the first place, regardless of who handles the billing.

> In the last week I've mentioned Sony's situation to a number of lay people who've never owned a Sony gaming machine but have all heard about these security issues and insist they'll never trust Sony with personal information ever again.

No offense, but the tiny sampling size of the few people you talk to doesn't mean anything. The public happily gives more personal information to Facebook than Sony has on them.

I think thats a good argument, but it doesn't take into account the long term effect of brand destruction. Yes they can save money with a few games of organization, but the permanent damage your customer relations will hinder your production adoption, maybe irrevocably.

Going the more open route with Kinect seems to have done wonders for Microsoft and "shareholder value". At first they wanted to crack down on "hackers", too, but then they quickly learned that all those hacks are getting them a lot of free press in the big blogs, which in turn made it more popular with early adopters and tech influencers.

Ultimately, I think the loss is that a lot of people who were considering buying PS3's in the future now won't, and both existing and new users will think twice about buying Sony products in future.

Compared to the financial havoc that kind of reputational damage could reap, the cost of allowing Linux is pretty small.

Agreed, but their problems are memes AND security. They could have had the bastard image and still established a secure infrastructure (like, for example, the TSA).

Certainly true that they should have better security, but at a point when so much stirred up, no amount of security will protect you from the havoc of thousands of determined hackers. Its better, at that point, to try to quell the storm than build stronger walls.

I agree that by acting smarter they could have limited their exposure, and by limiting their exposure, avoided being hacked so many times (i.e. http://throwingfire.com/security-through-obscurity/), but a company as large as Sony really should've gotten their security auditing act together a decade ago. All of the vulnerabilities that were exploited in the past few days were scriptkiddie-things -- SQL injections and archaic versions of Apache. I mean, come on.

This is a dangerous line of reasoning. Sure, you can't absolutely guarantee that a talented, experienced, and determine group of hackers won't be able to gain access to your system, regardless of how much effort you put into it. But that's no excuse for slap dash security measures.

The fact that breaches of Sony's systems have led to leakage of plain-text passwords and credit card data is a failure that absolutely can be prevented with a modicum of effort and every single iota of shame that has been visited on Sony for failing to put forth even that degree of effort is honestly earned and deserved.

Sony's problem is having people around who think storing passwords in the clear is OK.

You would be very surprised at the number of people in management positions at any size company that think this is OK.

At the jobs (consulting and otherwise) I've held in the last few years 75% of the companies stored passwords in plaintext. I'm not justifying it in any way shape or form, but Sony shouldn't be singled out. Until there is an immediate and clear financial incentive to use proper security companies are going to continue to ignore it.

I'd say that's neither surprising nor something to be annoyed about. It's the developers who should know better, and their responsibility alone to inform management about why.

Worker: Boss, this is bad, we shouldn't do this.

Boss: If we don't save passwords, how can we email passwords back when they forget them?

Worker: . . .

Boss: Don't change anything.

sixtofour's response is dead on. No offense, but how many companies have you worked at? Developer's ideas (good and bad) get shot down all the time for incredibly trite and/or stupid reasons.

Until the people in decision making positions take notice nothing is going to change.

That opening paragraph is the most beautiful writing about memes that I have ever read. Absolutely lucid.

Hmmm, I would say that honor should go to Richard Dawkins who coined the term itself 35 years ago: http://www.rubinghscience.org/memetics/dawkinsmemes.html

Yes, it's evocative, with some pleasing poetic imagery. Not being a poet myself I would have tidied up his punctuation and adjusted or questioned some of the plural/singular nouns ('memes ... are a force which flow?', 'surprisingly brief', 'the world's stage', 'undulating patterns', 'confined space?', 'by the gazillion?').

But poets are more interesting to read than copy editors...

Reply on news.ycombinator.com