Comment by jsheard | Hacker News Reader

Comment by jsheard | Hacker News Reader

Parent Full thread

Nintendo (or rather Nvidia) was behind the curve on fault injection counter-measures, Sony and Microsoft did their homework and it's never been achieved on their last two generations of systems as far as I know. Microsoft openly talked about it here: https://www.youtube.com/watch?v=U7VwtOrwceo

Seriously, console security is getting really good. The Switch had some major hardware blunders between the bootloader bug and fault injection, but the developer of the main Switch CFW project is on record that their custom microkernel is absolutely bulletproof and he expects there will never be another software exploit. If Switch 2 gets the hardware right, there's no way in.

https://twitter.com/SciresM/status/1486787208333774848

https://twitter.com/SciresM/status/1327721899862888448

The Playstation is the weakest of the bunch, since they run FreeBSD on bare metal there's a large attack surface and a lot of eyes on the code. The Xbox uses some variant of NT but each application gets its own Hyper-V virtualized NT instance, so to jailbreak you need to escape Hyper-V, which is easier said than done and has a $250,000 bug bounty so MS would probably be the first to be informed.

I felt called out in that YouTube video when the guy said 'This is what people do to not spend $60 on games'.

$60 for a game is very expensive though. Especially so with digital distribution which means it can't be resold.

It's not expensive compared to what games used to cost.

When I bought a $60 game in 1996, I knew it was a complete product. It might have a bug that made it impossible to finish, but returns are a solved problem. I knew I had a product that was made, possibly incompetently, for fun, or to tell a story.

I wasn't buying something that was trying to nudge me into spending another $400 on different pixel colors, or worse, different characters, abilities, or effects.

Modern video games have adopted techniques used by the gambling industry to trigger essentially addiction, because game companies prefer 3 whales to a thousand happy individuals buying the game a single time and playing it forever happily.

Because they were not satisfied with making a million dollars off a video game. That wasn't enough money.

You used to be able to buy games used for a tiny fraction of the original price, and you used to be able to sell games you finished or didn't like. Now you have to pay the full price, every time, irreversibly.

It’s really not…

I'm sorry for not living in a first-world country and not having grown up in a rich family.

Games are a luxury, you aren't entitled to them (though in a third world country you probably aren't entitled to basic necessities either)

> you aren't entitled to them

Nobody said that.

> though in a third world country you probably aren't entitled to basic necessities either

I think you should travel more before writing that kind of comments.

It really depends where you live eh.

Videogames are usually not made in cheap countries

That is irrelevant to how affordable or not it is for the end user.

If you can’t afford to pay for the labour to produce it, then why would you expect to be able to buy it?

Here's the thing: if I can't afford a game because it's so outrageously expensive, I'm not going to just not play it and miss out, I'm going to pirate it.

And now that I'm an adult who totally can afford these things (after bypassing all the roadblocks that the world's entertainment companies put for customers from Russia), I still pirate everything because that's what I'm used to, and that's what I'm convenient with.

That's fine, the problem is people acting like it's outrageous to charge $60 for 100+ hour length multi-million dollar projects. Factorio recently increased its price by $5 to $35 in line with inflation and gamers are outraged. How dare they charge more money, it's totally immoral, etc. I don't get why people feel outraged about it.

My main complaint is not that games cost this much money, but rather about digital distribution. Especially with console games, it used to be such that you could buy pre-owned cartridges/discs and sell yours. It was really cheap to you, and technically the game developers also got their asking price for each copy they sold. You were also able to swap games with friends who had the same type of console.

With digital distribution, you still pay the full price, but your copy is "single-use" in essence. You're never getting any of that money back. And, the only way to buy games digitally is "new" for that full price.

You don't pay for the labour to produce it, you pay for a gamble over an investment. The labour to produce the game can totally be paid if the price of the game is reduced but the amount of copies sold increase by a significant amount to make up for the price reduction.

And wallet and income of the consumers in region X of the world do not stretch magically because game companies in region Y decide to invest more on games. It is not that simple.

On the other hand the Switch is the best platform to make money on as an indie game developer.

While I'm not saying most people by far aren't doing it to save money, I have bought switch games and then emulated them just to try the graphics at 4k 60fps that isn't possible on the console.

That's the part I'm sad about - that we won't get emulated games that look and feel better due to faster hardware in the future. Money isn't an issue for me.

I don't. I bought 1 game for my original xbox- Mech Assault

Xbone has no hacks. It has dev mode, no exclusives both which killed hacking and piracy.

yup, the "cat-and-mouse" game ended when they embedded the decryption key physically to the CPU.

You can't read it without breaking it.

The PS3 had "OtherOS" for lucrative import/export levies. Saving a dime on removing it post sales and export/import is what lead to hacking & piracy.

It seems surprising to me that they went from shipping a vulnerable WebKit with numerous public CVEs on day 1, to producing a more or less bulletproof OS?

"console security is getting really good." - It's not nor will it ever be. There is no point in investing extra millions for let's say anti electron microscope measures for example. Developers aim for secure enough and don't care much about a single nerd who cracked his individual system using exotic specialists tools more valuable than the console and the entire game collection combined. It's more lucrative to just send a lawyer. ( Until it goes wrong. )

I would class making it uneconomical to hack a console for any practical purpose as "really good security". Could someone with nation-state resources hack the Xbox? Maybe? But who cares, they're not going to.

Funny, I was just wondering if such an entity would not actually quite like the xbox and Playstation as targets. I mean, they are powerful machines, well connected to the internet and the ownership class by and large dont blink when they power them on and are told they need to download a system update or game patch. Feels like a fertile place to build a bot net?

I wonder if you really even need to hack the console. It might be easier to, say, subvert Rockstar's supply chain to put some code in the next GTA that spent a few cycles doing whatever botnets need to be doing.

Surely cheaper to mandate that microsoft ship the patch, if they wanted to do that.

Why going through the hassle when so many IoT devices are wide open?

Tony Chen even addresses this directly in the video above.

They literally had a hard line in the sand. $600. If it costs more than $600 to hack it then they really don't care.

The other big thing is games being locked to a specific OS version, meaning some games require updates to play them. This has been key in their security strategy. It's basically pointless to hack it, it will be patched and you'll have to opt in to the patch to play anything new.

Another smart move by Microsoft was shipping Xboxes in an uninitialized state that has to connect to the internet and download the latest firmware before it can be used. Sony has been repeatedly burned by patching an exploit but having the vulnerable firmware still pre-installed on machines still in retail channels, so someone willing to abuse return policies can easily get one. MS doesn't need to worry about that, every new Xbox ends up on the latest firmware regardless of when it was manufactured.

PS5 and XS was attractive hack target for crypto mining when it was boom and GPU were in shortage. I wonder anyone had hacked it (and keep it secret) or hadn't.

not going to and publish it.

>There is no point in investing extra millions for let's say anti electron microscope measures for example.

TPM designs that protect against such an attack will become a commodity reducing the cost to include it onto a console. Every desktop, phone, laptop, tablet, microwave, fridge, server, etc will all need TPMs. The demand and scale exists for this to become cheap over time.

Reply on news.ycombinator.com