It says private Youtube page, one of those that you need the link to view and possibly even account friendship. That implies that the person posted it on a private forum or sent it to just his buddies who may have had a hand in it.
I'm not saying it's a good thing but it's not necessarily that broad. They want people close enough to the guy that he would've sent them a private video.
It says private Youtube page, one of those that you need the link to view and possibly even account friendship. That implies that the person posted it on a private forum or sent it to just his buddies who may have had a hand in it.
I'm not saying it's a good thing but it's not necessarily that broad. They want people close enough to the guy that he would've sent them a private video.
I have already seen this posted in other places but without any mention of the YouTube video being private, suggesting instead that the Judge is forcing google to pass on the IP's of everybody who viewed a public youtube video. We've already had this discussion in D&D regarding judges v. technology, and how some people purposefully misrepresent the facts in order to perpetuate the myth that justice simply doesn't understand technology.
It says private Youtube page, one of those that you need the link to view and possibly even account friendship. That implies that the person posted it on a private forum or sent it to just his buddies who may have had a hand in it.
I'm not saying it's a good thing but it's not necessarily that broad. They want people close enough to the guy that he would've sent them a private video.
I have already seen this posted in other places but without any mention of the YouTube video being private, suggesting instead that the Judge is forcing google to pass on the IP's of everybody who viewed a public youtube video. We've already had this discussion in D&D regarding judges v. technology, and how some people purposefully misrepresent the facts in order to perpetuate the myth that justice simply doesn't understand technology.
Even still, why are they going after this YouTube guy and not the professor of law who posted not just the key, but a mirror to the place where you could learn how to use it?
It says private Youtube page, one of those that you need the link to view and possibly even account friendship. That implies that the person posted it on a private forum or sent it to just his buddies who may have had a hand in it.
I'm not saying it's a good thing but it's not necessarily that broad. They want people close enough to the guy that he would've sent them a private video.
I have already seen this posted in other places but without any mention of the YouTube video being private, suggesting instead that the Judge is forcing google to pass on the IP's of everybody who viewed a public youtube video. We've already had this discussion in D&D regarding judges v. technology, and how some people purposefully misrepresent the facts in order to perpetuate the myth that justice simply doesn't understand technology.
Even still, why are they going after this YouTube guy and not the professor of law who posted not just the key, but a mirror to the place where you could learn how to use it?
because he has a university full of lawyers behind him.
It says private Youtube page, one of those that you need the link to view and possibly even account friendship. That implies that the person posted it on a private forum or sent it to just his buddies who may have had a hand in it.
I'm not saying it's a good thing but it's not necessarily that broad. They want people close enough to the guy that he would've sent them a private video.
I have already seen this posted in other places but without any mention of the YouTube video being private, suggesting instead that the Judge is forcing google to pass on the IP's of everybody who viewed a public youtube video. We've already had this discussion in D&D regarding judges v. technology, and how some people purposefully misrepresent the facts in order to perpetuate the myth that justice simply doesn't understand technology.
Even still, why are they going after this YouTube guy and not the professor of law who posted not just the key, but a mirror to the place where you could learn how to use it?
because he has a university full of lawyers behind him.
Okay, so if nothing else are we allowed to condemn a company for legally nuking people in cases they know they probably can't win given an able defense team?
It says private Youtube page, one of those that you need the link to view and possibly even account friendship. That implies that the person posted it on a private forum or sent it to just his buddies who may have had a hand in it.
I'm not saying it's a good thing but it's not necessarily that broad. They want people close enough to the guy that he would've sent them a private video.
I have already seen this posted in other places but without any mention of the YouTube video being private, suggesting instead that the Judge is forcing google to pass on the IP's of everybody who viewed a public youtube video. We've already had this discussion in D&D regarding judges v. technology, and how some people purposefully misrepresent the facts in order to perpetuate the myth that justice simply doesn't understand technology.
Even still, why are they going after this YouTube guy and not the professor of law who posted not just the key, but a mirror to the place where you could learn how to use it?
because he has a university full of lawyers behind him.
Okay, so if nothing else are we allowed to condemn a company for legally nuking people in cases they know they probably can't win given an able defense team?
It is a very common tactic. I'm not saying it's right, but very common. Their best bet is that the Electronic Frontier Foundation, or another public interest group, takes up their case.
I hope they take a stand, Sony's got a really weak case to get them to give up private information, although since its only IP addresses they might
In today's world IP addresses are almost as unique as social security numbers. While there are exceptions to the rule, the burden will always be on the defendant to show how the IP number registered to them wasn't in their possession at the time of the wrongdoing.
TL/DR: It is pretty close to being considered private information.
Well Good news. Sony's motion to expedite discovery has been denied. Also looks like the trial is set for March 11th, which means the motion to dismiss will also be denied as well. So it looks like it's in California.
Here is the facts on the the IP dragnet. Sony is trying to get the IPs of anyone who viewed/posted on the video that GeoHot posted where he used his own keys to load his "hello world" program while it public. This is probably so they can match ISPs/IPs with other collected "hackers" from other subpoenas.
Yea, this has nothing to do with publishing keys or game piracy. They want the people who watched him load his own program into the PS3.
As for "Google standing up to them" well, if they get a subpoena, they have to hand over the IPs or risk being in contempt of court. However, no subpoenas have been issued yet. Sony is asking the judge to issue them.
Hey DoctorArch, was the judge's decision to keep the venue in California instead of Hotz's New Jersey place of residence reasonable, all other things considered?
It's not really. The alleged "crime" never happened in California. The video that set this all off was recorded in New Jersey. The 9th Circuit is really friendly to these kind of cases.
9th Circuit (where California resides) is also the most overturned all the courts.
Ohoh! Look what snuck in under the wire!
There is hearing tomorrow that was granted by request of Hotz himself. He is going to try and stop the restraining order before having to go dead silent before March.
Erm, no professional publisher will ever release unlicensed games for a very simple reason:
What is different now than when Codemasters were producing unlicensed games for the NES?
1) The relative impossibility of developing professional-quality games without development kits
2) The lack of alternative revenue channels (Codemasters in the day made most of their money on Spectrum/C64 games, and Nintendo was an emerging market: if their NES game flopped, they still had income)
3) The degree of investment required in an individual game (much more risk-averse: if they make a game they can't find vendors for, that's disastrous now)
4) The relative entrenchment of the licensing model (Nintendo's licensing model was novel and not universally appreciated: now it's much more the status quo and therefore supported by retail)
5) The influence of licensors on retail - pissing off Sony now is much worse than pissing off Nintendo then
Erm, no professional publisher will ever release unlicensed games for a very simple reason:
What is different now than when Codemasters were producing unlicensed games for the NES?
1) The relative impossibility of developing professional-quality games without development kits
2) The lack of alternative revenue channels (Codemasters in the day made most of their money on Spectrum/C64 games, and Nintendo was an emerging market: if their NES game flopped, they still had income)
3) The degree of investment required in an individual game (much more risk-averse: if they make a game they can't find vendors for, that's disastrous now)
4) The relative entrenchment of the licensing model (Nintendo's licensing model was novel and not universally appreciated: now it's much more the status quo and therefore supported by retail)
5) The influence of licensors on retail - pissing off Sony now is much worse than pissing off Nintendo then
Those are all good responses, I too don't think anyone is going to release professional software on the PS3 but I have been slightly annoyed at the way it's been stated as if it is a completely unbelievable happening with absolutely no precedent.
Erm, no professional publisher will ever release unlicensed games for a very simple reason:
What is different now than when Codemasters were producing unlicensed games for the NES?
Everything. I don't get how you could even ask this question seriously. The entire industry and its internal relationships evolved and changed, the costs and revenues are orders of magnitude bigger, the legislation and courts have changed too.
It's like asking what's the difference between a chariot race in ancient Rome and a Formula 1 GP.
Edit: BTW, I was clearly and obviously referring to the big, relevant publishers the whole time, and I was clearly and obviously referring to the PRESENT moment the whole time.
Of course chinese shovelware sweatshops are gonna pump a lot of shit, and there's gonna be homebrew and so on.
I hope that Sony not only loses this case miserably, but is thoroughly embarrassed in the process.
"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety."
I don't give a shit that this hack opens avenues for thieves & cheaters, and neither should you, because that's always going to be a symptom when you open avenues for everyone. Sony is engaging in this lawsuit in the interest of establishing a business monopoly, full stop (and leveraging a monopoly in order to undermine fair business practice & competition in a free market is just as illegal as any act of software piracy). The invocation of the DMCA as a means of pre-emptively browbeating anyone or anything that might possibly be used to infringe upon copyright is ludicrous.
As an extreme example, imagine if the next version of Windows only allowed you to ever install certified Microsoft products, and also disallowed you from uninstalling Windows - and if you altered your system so that you could bypass the protection, Microsoft took you to court. As a more plausible example, imagine if a future version of Windows totally prohibited the user from making use of .torrent files. Everyone knows that there are large websites dedicated to using torrents as a means of distributing pirated materials at unprecedented volumes - but that would, again, be a symptom of the functionality of .torrent file sharing, which is an excellent way of sharing large file archives and protecting / backing-up documents (I'm quite proud of my personal collection of unpopular political documents, ranging from the writings of David Irving to the recent leaks by Julian Assange, that are torrented to many thousands of users. Uncensorable, non-erasable; large scale file sharing has effectively rendered it impossible to hide the stains of our past transgressions, and that's worth the cost of any number of stolen video games - contrary to what a mogul like Kotick might tell you). If Microsoft starting to take anyone who published ways of getting around these restrictions to court, would you side with Microsoft because, "Damn those pirates!"?
I sure hope not, or the Internet's future as a medium for open discourse probably won't have as long a shelf life as I'd like to imagine.
-UPDATE-
Well, the trial went OK today. Of course the case was not dismissed (It was worth a shot), however Sony's attempt to subpoena the world was shot down. Hotz still has to turn over his computers but only so much as to the tools that were used to unlock the PS3. No personal information and no razing the internet for IP address and personal information.
Sony's not very pleased. In their filing to ask the Court turn down Hotz's request to narrow discovery, they had this to say.
Hotz contends that the Order is overbroad because it prohibits him from hacking other companies’ secure systems and because it requires him to do the “impossible”: retrieve information distributed through the Internet. The Order does neither. He further argues that he should remain free to continue his campaign of “unauthorized access” to the PlayStation®3 computer entertainment system (“PS3 System”) and to publish information gained thereby, despite his having unlawfully circumvented the Technological Protection Mechanisms (“TPM”) in the PS3 System and having trafficked in circumvention technologies – charges he does not, and cannot, refute.
So I came across this little video which is really significant...
This is a stand alone PS3 booting Linux from from the hard drive. There are no dongles, no keys or anything else plugged into the system. The Hard drive carries normal non-PS3 partitions. The GameOS has been wiped with none of Sony's code on the system anymore.
Booting Linux now simply works
Now, I ask... How is this supposed to be an illegal action? How is this even copyright infringement? Can you tell me what illegal act this guy is doing?
It seems reasonable that they could do what Nintendo has done: start releasing consoles that fix this vulnerability, but continue to support older consoles.
my understanding is that they cant fix it without making every PS3 game in existance right now unplayable.
What's wrong with a hash table signed with a new key?
mspencer on
MEMBER OF THE PARANOIA GM GUILD
XBL Michael Spencer || Wii 6007 6812 1605 7315 || PSN MichaelSpencerJr || Steam Michael_Spencer || Ham NOØK QRZ || My last known GPS coordinates: FindU or APRS.fi (Car antenna feed line busted -- no ham radio for me X__X )
0
proyebatGARY WAS HEREASH IS A LOSERRegistered Userregular
It seems reasonable that they could do what Nintendo has done: start releasing consoles that fix this vulnerability, but continue to support older consoles.
my understanding is that they cant fix it without making every PS3 game in existance right now unplayable.
What's wrong with a hash table signed with a new key?
Sony can and will create updates that use new keys, it's just theat to use new keys there would need to be two update: the first update would only function to revoke old keys and install new keys, then a second update that is signed with the new keys be run. The problem with that is that the first update can be cracked and the new keys are revealed.
I don't think you're replying to the same discussion, or perhaps I was being unclear.
Sony can release a new version of the console that fixes this vulnerability.
They cannot patch existing consoles to fix the vulnerability, for the reason you described.
A new version of the console can have a new, uncracked key, and a signed hash table indicating which previous-key signatures are genuine and should be honored.
This would allow all old AND new consoles to run all old AND new content, leaves the old vulnerable consoles vulnerable, but fixes the vulnerability on new consoles. Kinda like what Nintendo did.
mspencer on
MEMBER OF THE PARANOIA GM GUILD
XBL Michael Spencer || Wii 6007 6812 1605 7315 || PSN MichaelSpencerJr || Steam Michael_Spencer || Ham NOØK QRZ || My last known GPS coordinates: FindU or APRS.fi (Car antenna feed line busted -- no ham radio for me X__X )
0
proyebatGARY WAS HEREASH IS A LOSERRegistered Userregular
edited February 2011
Ok you caught me looking at only the recent post, but seriously, Sony is going to have to make a new revision of console.
I don't think you're replying to the same discussion, or perhaps I was being unclear.
Sony can release a new version of the console that fixes this vulnerability.
They cannot patch existing consoles to fix the vulnerability, for the reason you described.
A new version of the console can have a new, uncracked key, and a signed hash table indicating which previous-key signatures are genuine and should be honored.
This would allow all old AND new consoles to run all old AND new content, leaves the old vulnerable consoles vulnerable, but fixes the vulnerability on new consoles. Kinda like what Nintendo did.
Yeah but if you can sign code with the old keys, how is that going to prevent you from running it on a new console?
I don't think you're replying to the same discussion, or perhaps I was being unclear.
Sony can release a new version of the console that fixes this vulnerability.
They cannot patch existing consoles to fix the vulnerability, for the reason you described.
A new version of the console can have a new, uncracked key, and a signed hash table indicating which previous-key signatures are genuine and should be honored.
This would allow all old AND new consoles to run all old AND new content, leaves the old vulnerable consoles vulnerable, but fixes the vulnerability on new consoles. Kinda like what Nintendo did.
Yeah but if you can sign code with the old keys, how is that going to prevent you from running it on a new console?
Or am I missing something?
It's the second half of what mspencer said, which isn't an inherent property of code signing: the hash table of valid signatures. Basically, you whitelist by explicitly identifying every bit of software signed with the old key (and then cryptographically signing the list, so it can't be altered).
So what the new firmware would have is a new public key that the private key was used to sign all software going forward from some point in time. It would also have a list of all legitimate software made previously that was signed with the old key and the calculated hashes of each, so that you can't substitute something on the list with another.
It's not quite that simple, as the implementation of the old consoles will probably mean that they are always vulnerable, even if they're updated with firmware that contains the new signing key and the whitelist. But, Sony being arrogant bastards, will probably screw up the implementation again, and since they've pretty much pissed off every hobbist who's capable of taking their DRM protections apart, it'll probably get more intense scrutiny and effort (And fail faster) than Enigma did during WWII.
And probably for much of the same reasons, come to think of it...
The problem is that a PS3 can not determine if a key has been signed by Sony or not as both generated keys are valid based on the master key. If you invalidate the master key, both Sony and non-Sony software will not authenticate any more.
If they make a new key, they still have to allow the old key so the old software will still work and we are still stuck with not being able to tell which software packages are non-Sony.
Keeping a table to "pre-authenticated" software is not the answer as the table can be patched now. Also. That would be a huge table. Every firmware package, every SFO, every game, every demo, would have to be checked against every single time a program is ran...
The other issue is that Sony is suing for simply running legitimate software that they don't want on the system anymore (Linux). That's the bigger issue
Halkun, you made the same error of misunderstanding that proyebat made. What you said is still correct, but it shows that there was a misunderstanding, and I think the misunderstanding could have been my fault for being unclear.
When you talk about a table that can be patched now, you're right in the sense that you cannot fix the existing PS3 consoles' vulnerability using this method. You CAN, however, create a new version of a PS3 with a different, uncracked key, and protect the contents of an valid-old-key-signatures hash table using that key.
The hash table solution may be invalid or insecure for other reasons, but not for the reasons you've suggested. Yes the hash table would need to contain an entry for every signed piece of content ever released. Yes that could very well be two or three million bytes worth of hash table data, retrieved in O(log n) time, and would conceivably add as much as a whole millisecond to the execution of a new program.
I think it's quite informative, and not at all misleading, to tell people to expect a new PS3 hardware revision where Sony does something like what Nintendo did.
mspencer on
MEMBER OF THE PARANOIA GM GUILD
XBL Michael Spencer || Wii 6007 6812 1605 7315 || PSN MichaelSpencerJr || Steam Michael_Spencer || Ham NOØK QRZ || My last known GPS coordinates: FindU or APRS.fi (Car antenna feed line busted -- no ham radio for me X__X )
The other issue is that Sony is suing for simply running legitimate software that they don't want on the system anymore (Linux). That's the bigger issue
Seems like that's going to be a pretty hard sell to a courtroom, especially considering that Linux support was originally included in the PS3. We all know it (along with the PS2's Linux Kit) was just a classification/tax ploy, but still.
I think the reintroduction of Linux will be pretty interesting, since it will mean you will be able to pick up what will essentially be a silent, tiny, blu-ray capable, bluetooth and wifi supported, multi-core media center PC for $300 that also just so happens to play PS1 and PS3 games, among others.
On a side note, I really hope someone can release software that will let me use Remote Play... remotely without signing my PS3 onto the PSN. It would be nice to have access to my music collection on my PS3 while I'm at work without having to eat up space on my Go, and since I'm sticking with 3.55 for the time being (in anticipation of Linux, an NTFS/multi-codec capable media player, and a better web browser) I can't do that.
Posts
I'm not saying it's a good thing but it's not necessarily that broad. They want people close enough to the guy that he would've sent them a private video.
I'm sorry, but you said the word "code" in a thread about Sony, here are your papers, see you in court
I have already seen this posted in other places but without any mention of the YouTube video being private, suggesting instead that the Judge is forcing google to pass on the IP's of everybody who viewed a public youtube video. We've already had this discussion in D&D regarding judges v. technology, and how some people purposefully misrepresent the facts in order to perpetuate the myth that justice simply doesn't understand technology.
Even still, why are they going after this YouTube guy and not the professor of law who posted not just the key, but a mirror to the place where you could learn how to use it?
because he has a university full of lawyers behind him.
Okay, so if nothing else are we allowed to condemn a company for legally nuking people in cases they know they probably can't win given an able defense team?
It is a very common tactic. I'm not saying it's right, but very common. Their best bet is that the Electronic Frontier Foundation, or another public interest group, takes up their case.
It probably depends on what Google considers to be more valuable in the long term.
In today's world IP addresses are almost as unique as social security numbers. While there are exceptions to the rule, the burden will always be on the defendant to show how the IP number registered to them wasn't in their possession at the time of the wrongdoing.
TL/DR: It is pretty close to being considered private information.
Here is the facts on the the IP dragnet. Sony is trying to get the IPs of anyone who viewed/posted on the video that GeoHot posted where he used his own keys to load his "hello world" program while it public. This is probably so they can match ISPs/IPs with other collected "hackers" from other subpoenas.
Yea, this has nothing to do with publishing keys or game piracy. They want the people who watched him load his own program into the PS3.
As for "Google standing up to them" well, if they get a subpoena, they have to hand over the IPs or risk being in contempt of court. However, no subpoenas have been issued yet. Sony is asking the judge to issue them.
It's not really. The alleged "crime" never happened in California. The video that set this all off was recorded in New Jersey. The 9th Circuit is really friendly to these kind of cases.
9th Circuit (where California resides) is also the most overturned all the courts.
It is also the biggest.
There is hearing tomorrow that was granted by request of Hotz himself. He is going to try and stop the restraining order before having to go dead silent before March.
What is different now than when Codemasters were producing unlicensed games for the NES?
I made a game, it has penguins in it. It's pay what you like on Gumroad.
Currently Ebaying Nothing at all but I might do in the future.
People's willingness to sue? The DMCA? The fact Sony plans to milk the PS3 for decades?
2) The lack of alternative revenue channels (Codemasters in the day made most of their money on Spectrum/C64 games, and Nintendo was an emerging market: if their NES game flopped, they still had income)
3) The degree of investment required in an individual game (much more risk-averse: if they make a game they can't find vendors for, that's disastrous now)
4) The relative entrenchment of the licensing model (Nintendo's licensing model was novel and not universally appreciated: now it's much more the status quo and therefore supported by retail)
5) The influence of licensors on retail - pissing off Sony now is much worse than pissing off Nintendo then
Those are all good responses, I too don't think anyone is going to release professional software on the PS3 but I have been slightly annoyed at the way it's been stated as if it is a completely unbelievable happening with absolutely no precedent.
I made a game, it has penguins in it. It's pay what you like on Gumroad.
Currently Ebaying Nothing at all but I might do in the future.
I can see it happening somewhat for the PS3, but certainly not by anyone who would be able to release licensed games.
Everything. I don't get how you could even ask this question seriously. The entire industry and its internal relationships evolved and changed, the costs and revenues are orders of magnitude bigger, the legislation and courts have changed too.
It's like asking what's the difference between a chariot race in ancient Rome and a Formula 1 GP.
Edit: BTW, I was clearly and obviously referring to the big, relevant publishers the whole time, and I was clearly and obviously referring to the PRESENT moment the whole time.
Of course chinese shovelware sweatshops are gonna pump a lot of shit, and there's gonna be homebrew and so on.
"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety."
I don't give a shit that this hack opens avenues for thieves & cheaters, and neither should you, because that's always going to be a symptom when you open avenues for everyone. Sony is engaging in this lawsuit in the interest of establishing a business monopoly, full stop (and leveraging a monopoly in order to undermine fair business practice & competition in a free market is just as illegal as any act of software piracy). The invocation of the DMCA as a means of pre-emptively browbeating anyone or anything that might possibly be used to infringe upon copyright is ludicrous.
As an extreme example, imagine if the next version of Windows only allowed you to ever install certified Microsoft products, and also disallowed you from uninstalling Windows - and if you altered your system so that you could bypass the protection, Microsoft took you to court. As a more plausible example, imagine if a future version of Windows totally prohibited the user from making use of .torrent files. Everyone knows that there are large websites dedicated to using torrents as a means of distributing pirated materials at unprecedented volumes - but that would, again, be a symptom of the functionality of .torrent file sharing, which is an excellent way of sharing large file archives and protecting / backing-up documents (I'm quite proud of my personal collection of unpopular political documents, ranging from the writings of David Irving to the recent leaks by Julian Assange, that are torrented to many thousands of users. Uncensorable, non-erasable; large scale file sharing has effectively rendered it impossible to hide the stains of our past transgressions, and that's worth the cost of any number of stolen video games - contrary to what a mogul like Kotick might tell you). If Microsoft starting to take anyone who published ways of getting around these restrictions to court, would you side with Microsoft because, "Damn those pirates!"?
I sure hope not, or the Internet's future as a medium for open discourse probably won't have as long a shelf life as I'd like to imagine.
Well, the trial went OK today. Of course the case was not dismissed (It was worth a shot), however Sony's attempt to subpoena the world was shot down. Hotz still has to turn over his computers but only so much as to the tools that were used to unlock the PS3. No personal information and no razing the internet for IP address and personal information.
Sony's not very pleased. In their filing to ask the Court turn down Hotz's request to narrow discovery, they had this to say.
Drama much Sony?
Currently playing: GW2 and TSW
This is a stand alone PS3 booting Linux from from the hard drive. There are no dongles, no keys or anything else plugged into the system. The Hard drive carries normal non-PS3 partitions. The GameOS has been wiped with none of Sony's code on the system anymore.
Booting Linux now simply works
Now, I ask... How is this supposed to be an illegal action? How is this even copyright infringement? Can you tell me what illegal act this guy is doing?
http://www.youtube.com/watch?v=gItOpt81UnI
What's wrong with a hash table signed with a new key?
XBL Michael Spencer || Wii 6007 6812 1605 7315 || PSN MichaelSpencerJr || Steam Michael_Spencer || Ham NOØK
QRZ || My last known GPS coordinates: FindU or APRS.fi (Car antenna feed line busted -- no ham radio for me X__X )
Sony can and will create updates that use new keys, it's just theat to use new keys there would need to be two update: the first update would only function to revoke old keys and install new keys, then a second update that is signed with the new keys be run. The problem with that is that the first update can be cracked and the new keys are revealed.
Sony can release a new version of the console that fixes this vulnerability.
They cannot patch existing consoles to fix the vulnerability, for the reason you described.
A new version of the console can have a new, uncracked key, and a signed hash table indicating which previous-key signatures are genuine and should be honored.
This would allow all old AND new consoles to run all old AND new content, leaves the old vulnerable consoles vulnerable, but fixes the vulnerability on new consoles. Kinda like what Nintendo did.
XBL Michael Spencer || Wii 6007 6812 1605 7315 || PSN MichaelSpencerJr || Steam Michael_Spencer || Ham NOØK
QRZ || My last known GPS coordinates: FindU or APRS.fi (Car antenna feed line busted -- no ham radio for me X__X )
Yeah but if you can sign code with the old keys, how is that going to prevent you from running it on a new console?
Or am I missing something?
Sony is really screwed here.
It's the second half of what mspencer said, which isn't an inherent property of code signing: the hash table of valid signatures. Basically, you whitelist by explicitly identifying every bit of software signed with the old key (and then cryptographically signing the list, so it can't be altered).
So what the new firmware would have is a new public key that the private key was used to sign all software going forward from some point in time. It would also have a list of all legitimate software made previously that was signed with the old key and the calculated hashes of each, so that you can't substitute something on the list with another.
It's not quite that simple, as the implementation of the old consoles will probably mean that they are always vulnerable, even if they're updated with firmware that contains the new signing key and the whitelist. But, Sony being arrogant bastards, will probably screw up the implementation again, and since they've pretty much pissed off every hobbist who's capable of taking their DRM protections apart, it'll probably get more intense scrutiny and effort (And fail faster) than Enigma did during WWII.
And probably for much of the same reasons, come to think of it...
Not yet. The Enigma was cracked by the Allies!
The problem is that a PS3 can not determine if a key has been signed by Sony or not as both generated keys are valid based on the master key. If you invalidate the master key, both Sony and non-Sony software will not authenticate any more.
If they make a new key, they still have to allow the old key so the old software will still work and we are still stuck with not being able to tell which software packages are non-Sony.
Keeping a table to "pre-authenticated" software is not the answer as the table can be patched now. Also. That would be a huge table. Every firmware package, every SFO, every game, every demo, would have to be checked against every single time a program is ran...
The other issue is that Sony is suing for simply running legitimate software that they don't want on the system anymore (Linux). That's the bigger issue
When you talk about a table that can be patched now, you're right in the sense that you cannot fix the existing PS3 consoles' vulnerability using this method. You CAN, however, create a new version of a PS3 with a different, uncracked key, and protect the contents of an valid-old-key-signatures hash table using that key.
The hash table solution may be invalid or insecure for other reasons, but not for the reasons you've suggested. Yes the hash table would need to contain an entry for every signed piece of content ever released. Yes that could very well be two or three million bytes worth of hash table data, retrieved in O(log n) time, and would conceivably add as much as a whole millisecond to the execution of a new program.
I think it's quite informative, and not at all misleading, to tell people to expect a new PS3 hardware revision where Sony does something like what Nintendo did.
XBL Michael Spencer || Wii 6007 6812 1605 7315 || PSN MichaelSpencerJr || Steam Michael_Spencer || Ham NOØK
QRZ || My last known GPS coordinates: FindU or APRS.fi (Car antenna feed line busted -- no ham radio for me X__X )
Seems like that's going to be a pretty hard sell to a courtroom, especially considering that Linux support was originally included in the PS3. We all know it (along with the PS2's Linux Kit) was just a classification/tax ploy, but still.
I think the reintroduction of Linux will be pretty interesting, since it will mean you will be able to pick up what will essentially be a silent, tiny, blu-ray capable, bluetooth and wifi supported, multi-core media center PC for $300 that also just so happens to play PS1 and PS3 games, among others.
On a side note, I really hope someone can release software that will let me use Remote Play... remotely without signing my PS3 onto the PSN. It would be nice to have access to my music collection on my PS3 while I'm at work without having to eat up space on my Go, and since I'm sticking with 3.55 for the time being (in anticipation of Linux, an NTFS/multi-codec capable media player, and a better web browser) I can't do that.