You're being pedantic. Enabling or disabling another OS (while having the ability as the manufacturer to add hardware security mechanisms) is not STO in the same way that a guest account is. And furthermore, if my OS of choice has a security model that's so fragile that I don't trust guest accounts not to escalate then I've probably got larger problems.
Like most of HN, I'm familiar with the definition.
As to the group's feelings, I'll quote them, "On the PS3, we tried releasing the exploits and letting others sort out the community. The result was that, for all practical purposes, the only users were those interested in piracy."https://fail0verflow.com/blog/2015/console-hacking-2015-line...
The PS3 piracy script kiddies you highlight are exactly my point. Peek in on any of those communities and you'll be hard-pressed to find the caliber of technical skill required to engineer actual exploits. Hell, if it's not in (1) click this, (2) copy exactly this text, (3) ... form then you still see people bricking their hardware.
Remove the necessity of an exploit for running the interesting use cases (even an "Hardware will be opened up after 1 year of sales" promise as suggested), and suddenly the actually talented people are doing more interesting things than trying to assault your security model.
So you do keep guest accounts? In this case your security advice is appreciated but, I am afraid, is going to be ignored :)
> Peek in on any of those communities and you'll be hard-pressed to find the caliber of technical skill required to engineer actual exploits.
I am curious: so who, in your opinion, has been making all the CFWs for Xbox, Xbox 360, PS3, PSP, Vita, 3DS etc? Who made modchips, dongles and flashcarts for other systems? Who cracks PC releases? Space aliens? People eager to run Linux inside Call of Duty? People who need to run their website off a 3DS?
Most piracy users are dumb kids but it does not mean all people in the scene are. You only need one person to exploit the system and then the whole world can just copy the method.
>Remove the necessity of an exploit for running the interesting use cases (even an "Hardware will be opened up after 1 year of sales" promise as suggested), and suddenly the actually talented people are doing more interesting things than trying to assault your security model.
Why should anyone believe this? Do you have anything to support this claim? Here is an idea: if you are really running systems with enabled guest accounts as you implied - tell the board where they could be found. I am sure nothing bad is going to happen :)
You might want to drop the sarcastic smilies and "ip or it didn't happen" challenges if you're not trying to troll.
I told you I felt like a properly implemented OS validation/segregation model on custom hardware wasn't analogous to a guest account in terms of STO. You evidently feel differently, but haven't offered your reasoning. I'd be interested to hear it if you disagree that strongly.
As for piracy, the majority of the dongles, modchips, flashcarts, etc I've seen tend to be "take an existing POC exploit, package it up, put a logo and snazzy name on it, and try to make a quick buck off of someone else's work." See: https://m.youtube.com/watch?v=C4lJEOEd-_g&t=1m42s .
That seems like a biased presentation, but statistically speaking I feel like "most of those who can technically originate hacks have better things to do with their time than enable game piracy" is a pretty strong statement. Sure some will focus on that, and kudos to them for pursuing their dream. But if you enable interesting use cases by default then there are that many fewer people trying to break the security system to do something that could have been allowed in the first place.
Admittedly, I could be off base, so I'd be interested in any numbers or links you can offer in terms of piracy-first groups pioneering console hacks.
I repeat again, you misunderstand the whole concept of STO. Limiting the ways the system could be attacked is not STO but the mainstream approach to security. Neither disabling guest accounts on a private system nor disabling guest OS on a game console is STO by any definition. It's a sane approach to securing system and Sony was stupid enabling the guest OS in the first place. They seem to have learned their lesson, PS4 does not come with one any more (and the man behind the whole idea of turning the Playstation into a general purpose computer had been removed from the power).
As for piracy, I don't get your point. While I agree that most pirates do not discover exploits themselves, somebody had to do it first. You cannot copy something that does not exists. And, seeing how most CFWs do not run Linux, I ask again, who in your opinion developed the original exploits? I get it that most people copy them. Who wrote the original ones?
>That seems like a biased presentation, but statistically speaking I feel like "most of those who can technically originate hacks have better things to do with their time than enable game piracy" is a pretty strong statement.
I agree that most people capable of cracking a game console do not care about it in the first place. However, most people in console scene only care about piracy. Take a look on http://psx-scene.com/ for example. See many Linux enthusiasts swapping tips on configuring their distros? People do not spend years cracking consoles because they desperately need to run Linux but have no hardware available.
Like most of HN, I'm familiar with the definition.
As to the group's feelings, I'll quote them, "On the PS3, we tried releasing the exploits and letting others sort out the community. The result was that, for all practical purposes, the only users were those interested in piracy." https://fail0verflow.com/blog/2015/console-hacking-2015-line...
The PS3 piracy script kiddies you highlight are exactly my point. Peek in on any of those communities and you'll be hard-pressed to find the caliber of technical skill required to engineer actual exploits. Hell, if it's not in (1) click this, (2) copy exactly this text, (3) ... form then you still see people bricking their hardware.
Remove the necessity of an exploit for running the interesting use cases (even an "Hardware will be opened up after 1 year of sales" promise as suggested), and suddenly the actually talented people are doing more interesting things than trying to assault your security model.