Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Root keys for Sony’s PlayStation 3 go public

geohot.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: Root keys for Sony’s PlayStation 3 go public

#41

Post by marshray »

sliverstorm wrote: post #35
marshray wrote: post #33

Earlier quoted context omitted.

A chain of command that's savvy enough to really want him despite that is one you'd actually want to be in, though. Absolutely. But if they were the savvy type, would they have been pwned at nearly every security layer like that? If you haven't seen it, the video says it better than I can. So probably if he were hired, it would be with mixed feelings of some of his uppers. At best, he probably "wouldn't fit in with t…

Older versions of the PS3 support PS2 games. They dropped support around the time the Slim came out.

Thanks for the info. Clearly we have to read the fine print rather than relying on product names.

Congrats Sony, you thought you'd force your customers to repurchase their favorite games didn't you? Instead you made enemies of an upcoming generation of gamers.

If only they could have heard the tears of the small children on Christmas morning upon finding out that they would not, in fact, be able to use the dance pad and the older Dance Dance Revolution which had the actual anime songs that they had saved their allowance to buy and they would only be able to dance to Lady Gaga instead...

(that's only slightly an exaggeration)

Re: Root keys for Sony’s PlayStation 3 go public

#43

Post by daeken »

artmageddon wrote: post #39
daeken wrote: post #36

Earlier quoted context omitted.

> On the same token, I wonder if that could mean better performance... I found that running Yellow Dog Linux on it was awfully slow. The hypervisor is minimal in terms of overhead. The biggest impact comes from the fact that the PPC core in the PS3 doesn't do out-of-order execution. You'd be downright amazed how huge a difference this makes.

No kidding? I remember someone from GDC in 2005(the one, I believe from Maxis, who created a storm on Gamasutra after bashing the Wii two years later) that putting out-of-order execution on gaming consoles was going to cripple their capabilities... but the PS3 certainly doesn't seem to suffer from it as far as games are concerned. I don't know enough about the topic at this point so I'd have to read some more.

The strength of the PS3 doesn't lie with the PS3 core, but rather with the ring of SPEs that the Cell processor has. These allow insanely efficient data processing, where the PPC chip really doesn't do a whole lot except for managing logic and state.

However, nothing under OtherOS used the SPEs really, and it had no access to the GPU, so the speed came down to the in-order PPC core.

Re: Root keys for Sony’s PlayStation 3 go public

#44

Post by uxp »

JonnieCache wrote: post #26
Swannie wrote: post #15

Earlier quoted context omitted.

I'm not sure if that was hyperbole or not. As I understand it, all that was required was for them to use the same random number /twice/. Let's say you're Sony and you sign a patch, release it, realise there is a minor fix, and release within 2hours... maybe in your rush you failed to regenerate the random seed? Or, my initial thoughts, someone inside Sony did this maliciously?

If your build process requires you to manually generate a random number and copy and paste it in, you need to try harder. If you work for a bank handling payments, you should be fired and never allowed to work in software again. EDIT: that last bit about banks is OT, sorry about that, I've been watching the chip and pin hacking talk from CCC and got confused.

Personally, I don't think the domain matters. If a developer is required to provide security, either to protect a secret, maintain personal or company profits, or protect customer finances, and that developer fails by "int rand() {return 4;}", that developer should never work with technology again.

Re: Root keys for Sony’s PlayStation 3 go public

#45

Post by artmageddon »

marshray wrote: post #33
stcredzero wrote: post #29

Earlier quoted context omitted.

I'm not so sure I'd want to take a job having just made my new chain of command look like incompetent idiots A chain of command that's savvy enough to really want him despite that is one you'd actually want to be in, though. An organization that focused on results would be all edge like the fictional Maas Neotek from Gibson's Neuromancer.

A chain of command that's savvy enough to really want him despite that is one you'd actually want to be in, though. Absolutely. But if they were the savvy type, would they have been pwned at nearly every security layer like that? If you haven't seen it, the video says it better than I can. So probably if he were hired, it would be with mixed feelings of some of his uppers. At best, he probably "wouldn't fit in with t…

Backward compatibility of gaming systems, in my estimation, started with Sony. Nintendo and Sega certainly didn't have them on their systems, and Sony was the first to do it(again, AFAIK) with the Playstation 2. Gamecubes didn't play N64 games which didn't play SNES games which didn't play NES games, etc.. However, the PS2 accomplished that by having a PS1 core on the same board as the PS2 hardware-whenever a gamer inserted a PS1 disc, it would switch to the old core... which is why they ran perfectly but with no enhancements from the PS2 hardware.

Getting to the point, the PS3's with the PS2 core were dropped not long after release due to their high cost. I understand your frustration, but it's becoming increasingly important to do research and understand each system's capabilities before putting your dollars down... the 360 is no exception here either.

Re: Root keys for Sony’s PlayStation 3 go public

#46

Post by boredguy8 »

ronnier wrote: post #5

"if you want your next console to be secure, get in touch with me. any of you 3." I would take the mans word and hire him. I'd even through Apple into his list, he did after all release jailbreaks for the iPhone too.

Clearly brilliant, but he also faked a photo of a jailbroken iPhone 4, which (apparently) motivated his partial withdraw from the scene.

Though talk about a comeback... This is a much better online "hire me" than the ones that were popular on HN several months ago.

Re: Root keys for Sony’s PlayStation 3 go public

#47

Post by Swannie »

gnaffle wrote: post #17
Swannie wrote: post #15

Earlier quoted context omitted.

I'm not sure if that was hyperbole or not. As I understand it, all that was required was for them to use the same random number /twice/. Let's say you're Sony and you sign a patch, release it, realise there is a minor fix, and release within 2hours... maybe in your rush you failed to regenerate the random seed? Or, my initial thoughts, someone inside Sony did this maliciously?

No, it was parabole. :) From what I understand, they use the same number every single time without exception.

That's really quite astounding. Thanks.

Re: Root keys for Sony’s PlayStation 3 go public

#48

Post by Swannie »

JonnieCache wrote: post #26
Swannie wrote: post #15

Earlier quoted context omitted.

I'm not sure if that was hyperbole or not. As I understand it, all that was required was for them to use the same random number /twice/. Let's say you're Sony and you sign a patch, release it, realise there is a minor fix, and release within 2hours... maybe in your rush you failed to regenerate the random seed? Or, my initial thoughts, someone inside Sony did this maliciously?

If your build process requires you to manually generate a random number and copy and paste it in, you need to try harder. If you work for a bank handling payments, you should be fired and never allowed to work in software again. EDIT: that last bit about banks is OT, sorry about that, I've been watching the chip and pin hacking talk from CCC and got confused.

I agree. It is unlikely that the release manager would have been expected to generate a random number. I'd have expected, possibly, a pre-generated list of random numbers, maybe 1000 or so, so a duplicate is not unlikely, and cannot happen maliciously.

I find it most likely that the build process code was flawed. This sort of code is, in my experience, not written by your most talented developer (unless one of your top developers has a build fetish). All too often you only find deficiencies in the build/release process the month of release, when you have the least time to fix them.

Re: Root keys for Sony’s PlayStation 3 go public

#49

Post by JonnieCache »

Swannie wrote: post #48
JonnieCache wrote: post #26

Earlier quoted context omitted.

If your build process requires you to manually generate a random number and copy and paste it in, you need to try harder. If you work for a bank handling payments, you should be fired and never allowed to work in software again. EDIT: that last bit about banks is OT, sorry about that, I've been watching the chip and pin hacking talk from CCC and got confused.

I agree. It is unlikely that the release manager would have been expected to generate a random number. I'd have expected, possibly, a pre-generated list of random numbers, maybe 1000 or so, so a duplicate is not unlikely, and cannot happen maliciously. I find it most likely that the build process code was flawed. This sort of code is, in my experience, not written by your most talented developer (unless one of your t…

If the whole project is about signing code packages to prevent the platform being hacked, you would've thought the key generation would be considered a critical part of the application code, rather than a detail of the build process. Even if the code necessarily exists in the build script. The build script is the project in this case.

If a developer has ever even thought about generating a list of 1000 random numbers to pick from at a later date, then they shouldn't be developing production code.

Re: Root keys for Sony’s PlayStation 3 go public

#50

Post by comex »

boredguy8 wrote: post #46
ronnier wrote: post #5

"if you want your next console to be secure, get in touch with me. any of you 3." I would take the mans word and hire him. I'd even through Apple into his list, he did after all release jailbreaks for the iPhone too.

Clearly brilliant, but he also faked a photo of a jailbroken iPhone 4, which (apparently) motivated his partial withdraw from the scene. Though talk about a comeback... This is a much better online "hire me" than the ones that were popular on HN several months ago.

Huh? I don't remember any such thing and doubt he would do that.
Post reply on HN