Sony Suffers Yet More Security Breaches

Oldcynic writes "As Sony struggles to restore the Playstation Network we receive news today of another breach, this time at Sony Ericsson in Canada. 'Sony Corp. spokesman Atsuo Omagari said Wednesday that names, email and encrypted passwords may have been stolen from the Sony Ericsson Canada website, but no credit card information was taken.' Another group managed to penetrate Sony Entertainment Japan yesterday as well. I almost feel bad for them.

Comments

Was it really worth it, Sony?

[elrous0]

I've always said that Sony is the most control-freak tech company in the world (making even Nintendo and Apple look sedate by comparison), a company that would happily shoot itself in the foot rather than lose even an *inch* of control of it's media, it's IT, or its technology.

From the rootkit fiasco, their obsessive lockdown of blu-ray (which of course, was cracked), and (many) assorted other lawsuits--Sony has established itself as the kind of company who would happily put a spycamera in everyone's home to make sure that no one is watching a pirated copy of Spiderman 3 (though why anyone would want to watch even a free version of that or just about any other Sony movie is beyond me).

But now they've removed a little-used and fairly innocuous Linux feature from the PS3, and then busted a guy who jailbroke the machine in response. Not only did they send in thugs to kick his door down and take all his shit (then strongarm him into admitting guilt to something that, before the DMCA, wouldn't even be considered a crime), but they even went as far as to try to force ISP's to hand over the identities of everyone who even DISCUSSED the hack on his website or blog.

Well, was it worth it, Sony?

Re:Was it really worth it, Sony?

[Anonymous Coward]

If someone could resurrect the innovative Sony of the mid-to-late '70s, I might start liking them again.

Re:Was it really worth it, Sony?

[Anonymous Coward]

... and then busted a guy who jailbroke the machine in response. Not only did they send in thugs to kick his door down and take all his shit (then strongarm him into admitting guilt to something that, before the DMCA, wouldn't even be considered a crime), but they even went as far as to try to force ISP's to hand over the identities of everyone who even DISCUSSED the hack on his website or blog.

Kinda makes you wonder if all these security breaches are retaliation from the general hacker masses, doesn't it?

Re:Was it really worth it, Sony?

[somaTh]

Sony has established itself as the kind of company who would happily put a spycamera in everyone's home

So THAT's what the PlayStation Eye is for!

Re:Was it really worth it, Sony?

[Anonymous Coward]

Because Sony execs are assholes, customers who just want to play a video game should have their credit card data stolen.

Really?

Re:Was it really worth it, Sony?

[rotide]

I wouldn't call it retaliation, per se. I'd more be inclined to describe it as a company that everyone who likes to "penetration test" sees as a fun target now. They pissed certain people off and made a certain amount of headlines and eventually they hit "critical mass" with the "hacker community". Sony keeps fixing things and the "testers" are having a good time showing the world that they are still vulnerable.

Sony is being forced to play a game where the other side has the better toolset.

Re:Was it really worth it, Sony?

[somersault]

now they've removed a little-used and fairly innocuous Linux feature from the PS3, and then busted a guy who jailbroke the machine in response

They actually removed that feature as a response to GeoHot announcing he was going to crack the PS3. But the end result is the same.

Re:Was it really worth it, Sony?

[malacandrian]

...admitting guilt to something that, before the DMCA, wouldn't even be considered a crime...

There are indeed many things in life that were not illegal until they were.

Re:Was it really worth it, Sony?

[bluechipps]

If someone could resurrect the innovative Sony of the mid-to-late '70s, I might start liking them again.

Good luck with that, calling any corporation "innovative" is blasphemous these days.

Re:Was it really worth it, Sony?

[TheGratefulNet]

but you have to realize: in a war, 'precise bombing' is not always possible.

if the hackers that are pissed off are just attacking sony any way they can, its not hard to imagine that others who 'touch' sony will also get hurt. ie, their users and customers.

I long ago stopped buying and supporting sony things. my way to fight back is to just stop buying. but kids today who think that sony is 'evil' in the most literal sense of the word might go to any lengths to seek revenge.

there IS a lesson here. the teenager who gets pissed off at the world and wants to seek revenge is not something you can directly fix. the way to fix the problem is stop pissing off your customers in the first place.

sony, culturally, probably won't understand a word of this. I expect the 'war' to continue for quite a while.

gee, just like the 'grownups' kind of wars. just like it.

Re:Was it really worth it, Sony?

[Bing Tsher E]

Sony has always just been the 'reliable brandname' on equipment from a company big and powerful enough to roll in the innovations that other entities have pioneered in. Sony hasn't been innovative since the very early days. Except in the same way that other big borglike entities like Microsoft and Apple can be considered innovative.

Re:Was it really worth it, Sony?

[_Sprocket_]

...admitting guilt to something that, before the DMCA, wouldn't even be considered a crime...

There are indeed many things in life that were not illegal until they were.

That is actually a fundamental concept in law - whether one has inherent rights and law adds restrictions or whether one's rights are expressly granted by law.

Re:Was it really worth it, Sony?

[Anonymous Coward]

I would love to believe that Sony was hacked because of their bad actions. However, I believe that Sony was just an easy target (and, once it was known that their security stinks, other hackers took the low hanging fruits of all the other incompetent Sony sites).

Re:Was it really worth it, Sony?

[softWare3ngineer]

I've always said that Sony is the most control-freak tech company in the world (making even Nintendo and Apple look sedate by comparison)

I think that could be part of their problem. if the company is a control freak towards their employee's time, then their employees aren't very likely to be spending a lot of time working on stuff that isn't directly brining in revenue(like security, maintenance, or improving business processes). the management probably just expects it, without any impact on time of development or extra maintenance.

Re:Was it really worth it, Sony?

[DurendalMac]

Yeah, but it's just getting excessive now. When Moe pokes Curly in the eyes, it's funny. When Moe beats Curly to death with a lug wrench and then dismembers him with a chainsaw, then...well, actually, it's still funny.

Carry on.

Re:Was it really worth it, Sony?

[InsaneProcessor]

I am so glad I had taken the same view of "voting with my feet" and not buying any sony products or services. Now, I am not collateral damage!

Re:Was it really worth it, Sony?

[unimacs]

War? Sounds like some people have a very distorted sense of what's important.

Re:Was it really worth it, Sony?

[Duradin]

"The Doctor: People assume that time is a strict progression of cause to effect, but actually, from a non-linear non-subjective viewpoint, it's more like a big bowl of wibbly wobbly timey wimey... stuff. "

Understand that and you'll understand the Church of St. George and save yourself a bunch of karma.

Re:Was it really worth it, Sony?

[dcollins]

Yeah, it was a good bit when that happened in Sensational She-Hulk #5.

Re:Was it really worth it, Sony?

[Anonymous Coward]

Hate to say this, but Apple is the new Sony. Steve jobs will as much as admit it. He loved Sony like we all did back in the day of Trinitrons and Walkmans. They made GORGEOUS hardware.

Re:Was it really worth it, Sony?

[zaxus]

...sock puppet in prison...

I don't think they can use Slashdot from prison, no matter how many accounts they have...

Re:Was it really worth it, Sony?

[the_hellspawn]

You are a Sony rep ain't you?... Post yourself foool before I break ya!

Re:Was it really worth it, Sony?

[Omnifarious]

Really, control over the stuff you have in your own house isn't an important issue?

Re:Was it really worth it, Sony?

[vlm]

Sony is being forced to play a game where the other side has the better toolset.

Kinda like a Sony memory stick vs industry standard SD card?

Re:Was it really worth it, Sony?

[Anonymous Coward]

The idea may be to bring the dark side of Sony to the popular consciousness: that they don't care about customers' private data. That Sony is not, actually, reliable from customers' point of view.

While the breaches won't cost Sony directly very much, let's hope the lost sales will make them notice that playing it loose with customers' data does, indeed, harm the bottom line.

Re:Was it really worth it, Sony?

[cpu6502]

>>>>>If someone could resurrect the innovative Sony of the mid-to-late '70s
>>
>>Sony has always just been the 'reliable brandname' on equipment from a company big and powerful enough to roll in the innovations that other entities have pioneered in.

I believe you're mistaken.
Sony is the company that invented videocassettes (Umatic and Betamax). Sony is the company that invented Betacam. The 3.5 inch floppy. The Compact Disc. Rewritable magneto-optical discs. THAT'S the company the grandparent poster was talking about when he said "innovative".

Re:Was it really worth it, Sony?

[Anonymous Coward]

Sony owns everyones ps3. And everyone else owns sonys servers.

I don't care where you're from.... That's funny right there.

Re:Was it really worth it, Sony?

[h4rr4r]

So instead of fixing their security issue they decided to steal value from consumers. What a wonderful company.

Re:Was it really worth it, Sony?

[Anonymous Coward]

it's media, it's IT, or its technology.

If you're gonna be wrong, at least be consistent.

Re:Was it really worth it, Sony?

[CharlyFoxtrot]

Hate to say this, but Apple is the new Sony. Steve jobs will as much as admit it. He loved Sony like we all did back in the day of Trinitrons and Walkmans. They made GORGEOUS hardware.

Great article discussing just that here.

"Alan Deutschman, Reynolds professor of business journalism at University of Nevada-Reno and author of "The Second Coming of Steve Jobs" -- the definitive unauthorized biography of the Apple CEO -- notes that from his early twenties on, Jobs had a fascination with Sony that bordered on obsession.
[...]
"At the time, Sony was committed to not releasing a crappy product just because the market was there; they waited until they had a truly revolutionary innovation, combined it with great design and then profited from it for long, long time," says Deutschman."

Re:Was it really worth it, Sony?

[mrrudge]

Yes. But it's not a war. The subtle difference is that one is some functionality removed from a home appliance, and the other is your parents being blown to bloody shreds in front of you, and your children.

Re:Was it really worth it, Sony?

[Tanktalus]

Well, yes and no. You see, there are two lists going on here. The first list is "stuff that's important." On this list you'll find things like "peace in the Middle East" and "harmony among the planet's many ethnicities". Or things like "democracy in every country" (which may include the U.S. depending on your perspective).

On the second list, there is "stuff that is important but that I can actually do something about right now." Unless you live in Libya or another country currently undergoing a rebellion to institute some form of democracy, we have to go waaaay down on that first list to find anything from the second.

Re:Was it really worth it, Sony?

[Kyusaku Natsume]

At this point, I expect that the computer crimes units of the respective countries will find the criminal assholes that are doing this and put them in prison where they belong. They are not doing this because they are fighting "The Man", they are doing this because they want to defraud and steal the money that other people have earned by an honest work. From your line of thought, you could also say that is no problem that death squads kill addicts in rehabilitation centers since the drug lords wouldn't have earned any money if not for those addicts.

Re:Was it really worth it, Sony?

[unimacs]

Just because it's in your house/on your property doesn't mean you have absolute control over it. This is nothing new. Want to build an addition? You need a plan, - which has to be approved and will probably require multiple permits and their corresponding inspections. You can't just do what ever the hell you want even though you own it. If you live in a townhome and have a homeowners association, you have even less say over what you can do. You probably can't even paint it a different color. You don't like the rules? Move someplace else. You don't vandalize the whole complex.

Think you can make whatever mods you want to your car? Guess again. There are plenty that will run you afoul of the law.

Since these boxes of Sony's are connecting to their network with the power to negatively impact their other customers, they damn well better restrict the types of mods that can be made.

Re:Was it really worth it, Sony?

[Teknikal69]

I actually think Samsung is the new Sony if you are talking about the old Sony who actually made high quality hardware I still have an old Sony walkman that looks like new and is barely larger than a cassette tape that was quality. I think Apple is starting to be more like the evil Sony we have all seen a lot of as late I suspect it's the music/movie industry that's dragging these companys down that road and slowly killing them as well.

The really annoying thing is I used to like Sony a lot and I still want the next gen portable it actually looks like they have made all the right decisions on that one, but If that is ever going to happen they are going to have to seriously change their attitude to their own customers and stop trying to lock everyone into their drm crazy formats.

Re:Was it really worth it, Sony?

[somersault]

There "security issue" to get into the system wasn't known at that point, nor is there any way to realistically stop someone cracking DRM on any system in the long run. They just wanted to make it harder for him to do so. The types of managerial doofuses that pulled it probably even believed that they would stop him by doing so. I'm not saying that Sony is wonderful, I was just correcting the facts.

Re:Was it really worth it, Sony?

[DarkOx]

I still have not seen any shred of evidence that any of these attacks are in response to the removal of the other OS feature or the lawsuit against Geh0t(or whatever his handle was). I think if these attacks were retaliatory the people behind them would find some way of making that publicly and certainly known. It would do more for their cause.

Its just as likely possibly more likely that the first big attack on PSN was entirely opportunistic somebody spotted a hole and figured it was good change to get hold of some info to use for spaming or ID theft. The rest of the attacks might be being done by others for the same reasons now that its clear that Sony corporate does not have a strong security team doing any real policy enforcement across the org, so other Sony targets are likely to be soft.

Re:Was it really worth it, Sony?

[DarkOx]

You know I can't say I am really bothered by these cyber-criminals. Its fun to have an Internet based on mob rule and vigilante justice. Keep some perspective, its only computer nobody really gets hurt.

Re:Was it really worth it, Sony?

[mrchaotica]

On the contrary, the subtle difference is that one is merely individuals being injured or killed, while the other is the irrevocable destruction of the principle on which our society is based (i.e., sovereignty over personal property).

Re:Was it really worth it, Sony?

[Anonymous Coward]

If an architect, years after, decides to physically remove a room from every house he designed, you might expect the home owners to have less than friendly feelings for said architect.

Sony removed a substantial piece of functionality from a product that was paid in full. They should not be able to do that, in my opinion. I am not the least surprised that some people got really upset about this. And as they are finding out, upsetting people who can eat your crappy security for breakfast is not a smart move.

I, for one, think this is only the beginning. A warming up, so to say. Sony is bound to piss off more customers by implementing more draconian lock-downs, thereby upping the ante for every competent hacker out there. Not to mention the untold masses of script kiddies that are harmless on their own but can wreak havoc in large masses.

Re:Was it really worth it, Sony?

[Lumpy]

Nope.

Samsung TV's... garbage. their Serial control protocol was written by idiots. Oh and reliability is in the toilet.
Samsung Digital cameras - Garbage, low end garbage.
Samsung Blu Ray players - rebadged LG.
Samsung Phones... can we make a flip phone that does not have connection ribbon problems please?

From my experience, Samsung is lower in quality than LG, that company that used to be Goldstar.

Re:Was it really worth it, Sony?

[Lumpy]

Yes It's important to me that is why I make INFORMED decisions on buying things instead of being the typical consumer idiot that listens to what the sales guy at Best Buy says. It's why I dont have a bluray player at all. I rip blurays on my computer and play them from a XBMC PC.

Re:Was it really worth it, Sony?

[Anonymous Coward]

Just because it's in your house/on your property doesn't mean you have absolute control over it.

It's telling that you say "in your house", falsely implying that it's not actually yours but just happens to be in your home. You did that on purpose, of course.

Want to build an addition? You need a plan, - which has to be approved and will probably require multiple permits and their corresponding inspections.

Because there are physical safety concerns, which is not the case with modding a game console.

f you live in a townhome and have a homeowners association, you have even less say over what you can do. You probably can't even paint it a different color.

Because you explicitly agreed to operate under those rules before you purchased the property, which is not the case with buying a game console.

Think you can make whatever mods you want to your car? Guess again. There are plenty that will run you afoul of the law.

Yes, you CAN make whatever mods you want to your car. What may be illegal is driving on public roads with said mods.

Since these boxes of Sony's are connecting to their network with the power to negatively impact their other customers, they damn well better restrict the types of mods that can be made.

They are NOT "boxes of Sony's". They are boxes of whatever customers bought (and therefore entirely own) them, and you know it. Therefore, no, Sony damn well better not restrict the types of mods that can be made. What they can and should restrict is what their network allows to connect to it. Nothing else.

Re:Was it really worth it, Sony?

[Teknikal69]

I've never bought a bad Samsung product to be honest and lately that is all I have been buying. To be fair I do tend to go for their top of the line stuff and I've yet to have anything let me down I'd actually say their my favourite brand at the minute I think their pushing technology faster than anyone else and let's face it most apple devices are just recased Samsung chips.

Just my opinion of course but I really believe they are heading in the right direction lately.

Re:Was it really worth it, Sony?

[unimacs]

And an appropriate response for an upset homeowner is to remove another room from all the other houses built by the same architect?

Re:Was it really worth it, Sony?

[Legion303]

"They actually removed that feature as a response to GeoHot announcing he was going to crack the PS3."

They actually have never said anything of the sort. And let's be clear about what Geohot actually said, while we're at it: he wanted to modify OtherOS to take full advantage of the PS3's hardware rather than the limited set it could use as released. So Sony *may* have removed OtherOS as a response to someone uncrippling it and making it somewhat useful, but there is zero evidence for this theory.

Re:Was it really worth it, Sony?

[ratzetob]

And also they've invented the walkman in the end of the 70s http://www.retrothing.com/2005/12/introducing_the.html ...

Re:Was it really worth it, Sony?

[elrous0]

In every post I like to put in at least a little bait for autistic grammar nazis. It's how I trap you--so I can use your obsessive attention to trivial detail to power my secret island compound.

Look behind you. I think you'll find escape is impossible.

Re:Was it really worth it, Sony?

[unimacs]

Just like you agree to the rules of a homeowner's association, you agree to abide by the software agreement before you first use the console. And just like the software agreement, the rules of the homeowner's association can change. They may want to put new vinyl siding on. Guess what? Even if you don't like you'll probably have to pay for at least some of it. Don't like it? Move out. Sony wasn't forcing anybody to upgrade were they? If you don't upgrade, you may not get access to all the services anymore, but you don't own the service, you're right to use it is conditional. Was the ability to run linux an advertised feature of the PS/3? I bet not. It sounds like all they were trying to do WAS restrict what was allowed to connect to their network. And that should include a PS/3 that's been modified to have much more capability and potentially be much more of a security threat than an unmodified PS/3.

Re:Was it really worth it, Sony?

[unimacs]

Let's be clear though. The substantial piece of functionality was not an advertised feature, just a side effect of how it was built. It's more like an architect removing a large unused hidden space between the walls that 98% of the home buyers didn't know even existed. Then because some fraction of a percent of the home buyers was pissed off, they decided to destroy the air conditioners on all the other homes. It's juvenile.

Re:Was it really worth it, Sony?

[somersault]

Zero evidence?. It's not a 100% guaranteed link I suppose, but the timing and Sony's actions since make it 99.9999999999999% likely that was the reason.

Re:Was it really worth it, Sony?

[sznupi]

Ah yes. The mythical times when rulers were noble, costs of life reasonable and children respected their elders. Always in the youth of the storyteller, since the dawn of recorded history.

(vs. obviously less remarkable recent times; who cares about MD, miniDV, DVD, DVcam, HDV or Bluray)

Re:Was it really worth it, Sony?

[Anonymous Coward]

I'm not sure why you say the "Other OS" feature wasn't advertised, as it most certainly was when the PS3 was first introduced. I remember, because that feature alone almost made me buy one.

You are right that most buyers (perhaps even more than 98%) were blissfully unaware of the feature and couldn't care less about its removal. However, a small percentage was aware of it and did mind getting a feature removed they paid for and were perhaps even using.

And guess what, that small percentage are precisely the ones that have a, well, 'hacker ethic', for lack of a better term. They minded, and some of them probably decided action was justified.

I'm not saying anyone deserved getting their creditcard data stolen, of course not. But having Sony's cage rattled a bit, that's all fine by me.

Re:Was it really worth it, Sony?

[Anonymous Coward]

Just like you agree to the rules of a homeowner's association, you agree to abide by the software agreement before you first use the console.

I agree to nothing of the sort. I didn't sign any contracts when hooking up my consoles. And no, there wasn't a EULA when I turned it on, nor would it be binding if there had been. I didn't license the damn thing, I took ownership of it.

And just like the software agreement, the rules of the homeowner's association can change. They may want to put new vinyl siding on. Guess what? Even if you don't like you'll probably have to pay for at least some of it. Don't like it? Move out.

Again, though, you have to explicitly agree to abide by the HOA's rules for them to apply. This did not happen with the game console.

Sony wasn't forcing anybody to upgrade were they?

Actually, they kinda did. The update happened in the background, automatically, with no notification to the user, and no way to allow them to review what changes would be made before deciding whether or not to apply it.

If you don't upgrade, you may not get access to all the services anymore, but you don't own the service, you're right to use it is conditional.

Your right to use the SERVICE is conditional. Your right to use your console, and to do whatever you like with it, is not.

Was the ability to run linux an advertised feature of the PS/3? I bet not.

Even if it wasn't, why would that make a difference? My car wasn't "advertised" as having a radio antenna, would that make it all right if GM sent someone to break it off? Even if I never used it, the answer is no.

It sounds like all they were trying to do WAS restrict what was allowed to connect to their network.

It only sounds like that if you ignore the facts. Sony sued Geohot for hacking his OWN console (not their service) and telling other people how they could do the same.

Re:Was it really worth it, Sony?

[Anonymous Coward]

Reminds me of this

https://secure.wikimedia.org/wikipedia/en/wiki/No_U-turn_syndrome

Re:Was it really worth it, Sony?

[mrrudge]

Let me get this straight. You think a slow erosion of the consumer rights of a society is more important than an attempted violent destruction of the entire society ?

Re:Was it really worth it, Sony?

[Omnifarious]

I don't see anybody who is attacking Sony going around damaging people's consoles. If damage to Sony's services had the side-effect of disabling consoles, maybe those people should've made buying choices that placed their freedom as a higher priority than their convenience.

Re:Was it really worth it, Sony?

[sznupi]

I long ago stopped buying and supporting sony things. my way to fight back is to just stop buying

I wonder, do you boycott manufacturers using Sony manufacturing robots? (they're big here) Do you make sure you don't end up with a Sony CCD sensor or LCD panel, mobile or "big"? (also large chunks; generally semiconductors, batteries, chemicals, electronic components, OEM optical drives, ... ; yes, being "tricked" into giving them money and solidifying their tech lead in some areas, the horror)

Even with professional / industrial markets, and the world or electronics extending beyond Best Buy - once there, do you avoid equipment with S/PDIF? (guess what "S" means) Content which could pass through FDD, CD, Betacam, DAT, Video8/Hi8, DVD, miniDV, HDV, Bluray? And what about all the films and music from Sony studios? Also some TV stations of their own (NVM tons which use Sony equipment). Hm, avoid dealing with any entities which use Sony banking / financial services?


PS. Kids don't seem to realize something, too. Many (most?) consumers despise those who are behind the attacks.
Also, "hate" directed at some company is...not even wrong, they way I look at it. Especially with a consortium, very far from monolithic; even with divisions "infighting" in a way, as far as things for which people fight Sony go. A consortium with one of the most open ebook ecosystems or DAP lines; providing large chunk of CCDs and a NLE with fantastic bang-for-buck - both very useful to indies, both a "competition" to Sony Pictures, I guess... how the evil Sony could do that?
(NVM singling them out for bashing contest, ignoring many formats they did introduce succesfully / remembering only failures - which appear relatively numerous, simply because Sony does a lot, introduced a lot, plus a cognitive bias of associating any company more with their exclusive formats... which is simply kinda the definition of "not adopted by others")

Re:Was it really worth it, Sony?

[unimacs]

PS/3 users have been denied access to the Sony gaming network limiting the functionality of other people's PS3s in a significant way. It's also not clear what private information may have been stolen. I'd say this has been damaging to other PS3 owners don't you think?

And your response is that it's their fault for buying a PS3? Nice.

The vast majority of them had no idea that it was ever an option to run linux, nor did they care. You really think they stood there in the store in front of the display debating whether or not they should "give up their freedom" by buying the PS3?

It's not a war. It's a product you can buy or not, continue to use or not, keep or sell. There are countless other options for running linux.

Get mad at Sony. Quit buying their stuff. Write letters. Dis them on blogs and gaming forums.

Do you think hacking their network makes them sorry for taking the feature away? That they'll recognize the error of their ways and bring it back? More likely it just makes them sorry for ever including it in the first place and you will never see it in another Sony product. Not only that but anyone else considering offering the option of running another OS on their console is probably thinking twice.

Re:Was it really worth it, Sony?

[hawkinspeter]

The OtherOS option was most definitely advertised as a feature on their website.

Sony more or less forced me to upgrade as some of the games I'd already bought require access to the playstation network. I paid for a games console that also had the OtherOS feature, but now all I've got is a games console.

Guess which company will never get any of my custom again?

Re:Was it really worth it, Sony?

[LanMan04]

Oblig Penny Arcade:

http://www.penny-arcade.com/comic/2007/5/2/

Re:Was it really worth it, Sony?

[hawkinspeter]

It was definitely advertised. There's a slightly modified version of the original page at http://www.playstation.com/ps3-openplatform/index.html

Re:Was it really worth it, Sony?

[unimacs]

And I agree that people have a right to be angry, just like when the people in a home owner's association no longer get their driveways plowed even though that was part of the deal when they first moved in.

I'll even grant this this is worse given that the people in a homeowner's association have some say over who runs it.

But Sony decided that it was a security risk, that not all people who want to run linux have pure motives (which is apparently true) and so they took it away knowing that it would anger a small fraction of their customers. Could they have done it a better way? Was there another alternative? Sure. They didn't handle this well, but that doesn't even close to justify what's been happening.

Re:Was it really worth it, Sony?

[Omnifarious]

PS/3 users have been denied access to the Sony gaming network limiting the functionality of other people's PS3s in a significant way. It's also not clear what private information may have been stolen. I'd say this has been damaging to other PS3 owners don't you think?

And your response is that it's their fault for buying a PS3? Nice.

I'm one of those users. I never used the OtherOS option, and while I was very happy it existed, I didn't plan to use it. And it is my fault for buying a PS/3. I was making a convenience vs. freedom tradeoff, and I lost. I'm happy with that result. I deserve that result. And so does everybody else who made that tradeoff.

By making that tradeoff you are implicitly supporting a system that forces you to be dependent. And when that dependence turns out to hurt you because the entity you depended upon is having problems, you only have yourself to blame.

Maybe people will learn that just because the cage is comfortable, it isn't any less of a cage. It's a lesson people seem to need to be taught pretty often.

Re:Was it really worth it, Sony?

[Agent0013]

Because Sony execs are assholes, customers who just want to play a video game should have their credit card data stolen.

Really?

And the folks building the Death Star were just inoccent contractors who didn't deserve to die.

If you are going to help feed the beast, then don't be surprised when you are targeted by the hunters also.

Re:Was it really worth it, Sony?

[mrchaotica]

First of all, you only mentioned some sensationally graphic drivel about parents an children, not anything about any "entire society." It makes no real difference to your argument, but I'd thank you not to try to put words in my mouth.

Secondly, most emphatically YES I do think slow erosion of fundamental property rights is more important! In a war, the enemy is well-defined and easy to fight. A slow erosion, in contrast, is insidious, and much more dangerous to my rights and freedoms in the long run.

Re:Was it really worth it, Sony?

[somaTh]

Would you believe I was thinking of this when I posted? Since I've clearly already posted, all I can really do is say kudos for doing the legwork.

Re:Was it really worth it, Sony?

[marcosdumay]

The hackers are not right. But you must admit that if Sonny didn't do some evil things, those hackers would be trying to invade other companies, and Sonny would be spared (of at least most of them).

Re:Was it really worth it, Sony?

[Golddess]

I think the analogy is kinda breaking down at this point, but the closest I can think of is it would be like the hackers gaining access to the architect's house, the architect locking everyone out of his house, and that somehow impacting all other owners of houses designed by that architect.

Re:Was it really worth it, Sony?

[mrrudge]

Wow. So property rights are more important than, say, the people who lost their lives in NY on 9/11 ? 'Merely individuals being injured or killed' by a 'well-defined and easy to fight' enemy ?

Re:Was it really worth it, Sony?

[lidocaineus]

Uh, minidv? For real? You do know that minidv, though not SUPER popular, was by no means a niche product. It also introduced a whole generation of filmmakers to DIY filmmaking.

Not that I like the Sony of 2000s on or so, but come on now, give credit where credit's due.

Re:Was it really worth it, Sony?

[sznupi]

Whoooosh...

(you've found "problem" only with miniDV?)

Re:Was it really worth it, Sony?

[lidocaineus]

Well yes - your other mentioned products where pretty much the definition of niche. You could make an argument for MD maybe, but everything else didn't nearly hit the level of minidv. DVD and Bluray are way more of a group effort as well.

Re:Was it really worth it, Sony?

[sznupi]

Parent poster mentioned Umatic, Betamax, Betacam, MO discs as, clearly, examples of pushing the tech, etc. Not of winning mass market.

Re:Was it really worth it, Sony?

[lidocaineus]

Pedantic. Ignoring.

Re:Was it really worth it, Sony?

[Anonymous Coward]

Don't forget they put Lik-Sang, a perfectly legal import company that I myself used several times, out of business via legal prosecution. Absolutely nobody should feel sorry for Sony at this point.

Re:Was it really worth it, Sony?

[sznupi]

Pedantic. Ignoring.

And that tells somebody whooshed... (nvm role of context in "discussions")

Re:Was it really worth it, Sony?

[lidocaineus]

The ironing is delicious.

Re:Was it really worth it, Sony?

[sznupi]

Yes, it's kinda the point of whoooshes.

Re:Was it really worth it, Sony?

[lidocaineus]

Let me join in:

Yes. I get the whoosh.
Yes. I get the irony.
Yes. I get the meta.

You do not.

Re:Was it really worth it, Sony?

[sznupi]

Yet you start by missing why miniDV was listed... hey, more rose-coloured past (uberrecent even) / more power to you, if you need it for some reason.

Re:Was it really worth it, Sony?

[psiclops]

Yes - Exactly: the rights of everyone is more important than the lives of a few.

This is why people voluntarily join armies and go fight wars.

Re:Was it really worth it, Sony?

[RadiantPhoenix]

Much as I love to support freedom, whether on the Internet or elsewhere, I have to disagree; people could really get hurt by this; if sensible precautions are taken they probably won't be, but then again, if Sony had taken sensible precautions they probably wouldn't have had this problem in the first place.

Re:Was it really worth it, Sony?

[lidocaineus]

It's kind of amazing how over your head this conversation is.

Re:Was it really worth it, Sony?

[dontbgay]

Let me be the first to say: Huh? Seriously, make the distinction here. They're both bad. One you can fight, because you know it's coming. The other one is like the frog in the frying pan. The bad you can see coming, you can fight... which makes it less bad.

Re:Was it really worth it, Sony?

[mrrudge]

For general human rights I'm right with you. I also agree that it's very important that property rights are maintained, but I believe property rights to be a subset of human rights.

There is also an insidious creep in the reasoning for war, and in the acceptance of collateral damage ( people who have had their human rights denied in the most permanent way ).

War over human rights, war over oil, war on inanimate objects ( drugs ). You're defending the idea of war over functionality in a games console ?

I think this is worse, as it denies both human rights and property rights.

Also. As this is purportedly a science based site, the only way to keep a frog in a slowly heated pan of water is to take it's brain out first. Maybe you could use this as an analogy for your slow decent into believing war is a suitable solution to every problem.

http://en.wikipedia.org/wiki/Boiling_frog

Re:Was it really worth it, Sony?

[cpu6502]

>>>less remarkable recent times; who cares about MD, miniDV, DVD, DVcam, HDV or Bluray)

Every product you list came from 70s or 80s Sony, thus proving the point that Sony was more innovative in the past than the present.

The only recent product is Bluray, which isn't really "innovative". It's just a DVD with more tightly-packed tracks. It's late 80s/early 90s tech that Sony updated and gave a new name.

Re:Was it really worth it, Sony?

[fremean]

Given that more people lost their lives in gun related violence, medical accidents OR motor vehicle accidents (individually, not combined) in that same year (and every year since then) then were lost in combined incidents that made up 9/11... Given the number of civilians the US has killed in the process of retaliating... Given the steps backwards the US has taken in it's other freedoms and rights in fear and retaliation...

Yeh I actually believe the long term issues stemming from rights erosion (some of which people have fought and died for too don't forget) is at least as significant... if not more insidious because you don't even seem to notice it - or care... until one day your door won't unlock for you because a server somewhere has deemed your key invalid.

Re:Was it really worth it, Sony?

[fremean]

Your box might be connecting to Sony's network, mine would have a rather hard time given that it's not attached to the lan and the firewall still contains rules expressly forbidding it's access to the internet from the days that it was.

I didn't pay $700 for a box I can't pull apart and put back together to whistle dixie if I so choose - I can pull apart a $200 electric projection screen controller and place a new chip in it overriding the functions of the original design and manufacture (as well as significantly increasing it's feature set - I know you ask "what more can a screen do but go up and down?"... I answer "usb & exact positioning"), why the hell can't I do the same with my $700 PS3?

If Sony wanted me to give them control over their device they should have had me lease it... or at the very least presented a contract at the time I was presenting money - not once the sale had taken place.

Re:Was it really worth it, Sony?

[cheekyjohnson]

They didn't handle this well, but that doesn't even close to justify what's been happening.

According to who? Is justification really needed when morals are likely merely opinions in the first place?

Re:Was it really worth it, Sony?

[Runaway1956]

they hit "critical mass" with the "hacker communities".

That simple change - communities, plural - puts me in agreement with you. Gotta realize that there are many "hacker communities" out there. Some of them are unethical, immoral, lowlife SOB's, while others are just regular people having fun, some are associated with Anonymous, some are in it for the money, etc ad nauseum.

Re:Was it really worth it, Sony?

[Runaway1956]

Actually - because Sony execs are assholes, all the chumps who blindly trusted those assholes do kinda deserve to get burnt. The burning will be limited, it's not like anyone is going to lose their life savings or anything like that.

Re:Was it really worth it, Sony?

[Runaway1956]

Your "analogy" has really begun to suffer from terminal idiocy. First - there are a whole bunch of hackers. Some are pissed at Sony, for legitimate reasons. Anonymous ranks among them. Then, there are a bunch of criminals who are taking advantage of the chaos. I sympathize and support the former, and I would like to see the latter brought to justice.

So, that mythical architect pissed off a bunch of homeowners when he removed portions of thier homes, those homeowners made life hard on the architect, and while they kept the architect busy, an unrelated gang went in the back door to steal everything they could find. And, that gang doesn't care WHO owns ANY of the goodies.

There is no unified hacker front hammering on Sony - there are several groups, each intent on their own goals.

Re:Was it really worth it, Sony?

[Anonymous Coward]

Yet Sony is one of the few studios to release every Bluray they make as region-free (contrast with others who region-lock all their Blurays).

Re:Was it really worth it, Sony?

[mrchaotica]

For general human rights I'm right with you. I also agree that it's very important that property rights are maintained, but I believe property rights to be a subset of human rights.

Property rights are the difference between free people and serfs or slaves. What Sony, along with the rest of the content industry, is trying to do is to quite literally turn us all into "digital serfs!"

There is also an insidious creep in the reasoning for war, and in the acceptance of collateral damage ( people who have had their human rights denied in the most permanent way ).

If you wish to trivialize the rationale behind this "war on Sony," then the collateral damage (Sony patrons' loss of use of the Playstation network and leaking of personal info) must be considered similarly trivial. The hackers aren't killing anybody, despite you trying to conflate it as such!

War over human rights, war over oil, war on inanimate objects ( drugs ). You're defending the idea of war over functionality in a games console ?

No, you're defending the absurd idea that hacking Sony's website is somehow equivalent to calling in the damn Marines!

Re:Was it really worth it, Sony?

[unimacs]

Sony may have very legitimate reasons for deciding that "other OS" was too risky a feature to maintain going forward. Where I fault them is not being clear to their user base. They should have come out and said: "There's an upgrade coming that will disable this feature. If having that feature is important to you, then don't upgrade, but this will mean limited access to PSN". And rather than sneak the upgrade through, which is what it sounds like they did, there should have been an easy and clear way to opt out. Do you really think Sony would care or have any legal grounds to prevent somebody from turning a PS3 into an alarm clock with a remote or a fish tank? As long it's not trying to connect to the PSN network and present itself as a PS3 running an unaltered and legitimate version of the firmware, no one would care. Unless of course the mods circumvented content protection (whether you agree with current laws or not, they're still laws).

Can you take a firearm you own and modify it anyway you want? File off the S/N because it ruins the aesthetic? Of course not. Certain mods lend themselves to criminal activity. Your rights end when the safety of others start to come into play. And yes, a PS3 deliberately modified to enable a feature deemed as a risk to security is a safety issue for other PSN users.

Re:Was it really worth it, Sony?

[Anonymous Coward]

Sony may have very legitimate reasons for deciding that "other OS" was too risky a feature to maintain going forward

They didn't simply stop "maintaining" it, they actively sought out and destroyed it. There can be absolutely no valid reason of any kind for that.

Do you really think Sony would care or have any legal grounds to prevent somebody from turning a PS3 into an alarm clock with a remote or a fish tank? As long it's not trying to connect to the PSN network and present itself as a PS3 running an unaltered and legitimate version of the firmware, no one would care

They cared to prevent somebody from turning a PS3 into a PS3 with Linux. Not, mind you, for connecting that modded box to PSN (which he didn't do). Just for the mod in and of itself. You have already been made aware of this fact, so there is no possibility that you are merely misinformed. Therefore, you can only be lying. Your use of a strawman only serves to further confirm that.

Can you take a firearm you own and modify it anyway you want? File off the S/N because it ruins the aesthetic? Of course not. Certain mods lend themselves to criminal activity. Your rights end when the safety of others start to come into play. And yes, a PS3 deliberately modified to enable a feature deemed as a risk to security is a safety issue for other PSN users.

No, it isn't. There is not and cannot be a "safety" issue, . It is utterly impossible to harm somebody with a modified PS3 (unless you hit them over the head with it, in which case the only mod that would make it more dangerous is filling it with cement). You admitted this by not even trying to present such an issue for consideration.

That aside, Sony does have the right to keep modded consoles off of their network, and it is the right thing for them to do. But that is all. Any attempt to forcibly prevent people from modding their own consoles is in violation of their property rights. Any attempt to stifle discussion between people of how to mod their own consoles is in violation of their free speech rights. Sony did both of these things, and they are absolutely impossible to justify in any way. Sony is guilty of outright thuggery, not the minor customer-service oopsie your apologism is trying to paint it as.

Re:Was it really worth it, Sony?

[Legion303]

"Zero evidence?"

Yes.

Even the link you provided admits that Sony had already removed OtherOS from slims (as graf_chokolo showed, there is no technical reason for this as it runs just fine on the slims). Sony announcing the removal from future firmware updates 2 months after geohot's announcement of a successful hack (and 3 months after he announced he was trying) is nothing more than coincidence; we've seen how fast they will release new firmware (3.60) when in crisis mode.

Re:Was it really worth it, Sony?

[Xest]

If you enjoy seeing Sony suffer, because like me, you recognise the world would be a better place without it due to the fact that it's a leading figure in artificial digital restrictions that remove long established rights from consumers as well as being a leading member of the RIAA and one of the largest proponents of net restrictions to fulfil it's anti-piracy dreams at the expense of fundamentally important tenets of anonymity, openess and freedom the internet has historically offered. Whilst also being one of the worst offenders at trying to stamp out your right to tinker with something you've bought, then, well, this might make you chuckle even more:

http://www.bbc.co.uk/news/business-13557431

I only hope the prediction they'll return to profit later this year is wrong. The world would be a better place without Sony, it's too big, too evil and has the ear of too many governments.

Re:Was it really worth it, Sony?

[elsurexiste]

their obsessive lockdown of blu-ray (which of course, was cracked)...

Here is the link to the full "obsessive lock-down technology" standard that Sony employs. Look at THAT, Sony is not the only company promoting it! Even more, if you understood the tiniest bit about the system, you would know that it's expected to be cracked: that's part of its strength.

But now they've removed a little-used and fairly innocuous Linux feature from the PS3...

They removed for obvious reasons: Geoh0t announced that he was going to crack the PS3, you can also say people were using subsidized hardware and weren't buying games... they tried to protect their cake, don't minimize the impact of the "tiny feature they removed".

I agree with the rest, though, Sony had it coming.

Re:Was it really worth it, Sony?

[Coren22]

Samsung TVs are wonderful products (and the TV does not posses Samsung, it is a plural which doesn't require an apostrophe) I am not sure what TVs you would be talking about that suck. I also have a Samsung Blu Ray player and have never had a complaint, except that I bought one that is missing features I would have liked to have, such as, Netflix, Pandora, WiFi, but it was cheap.

Re:Was it really worth it, Sony?

[cffrost]

[F]ind the criminal assholes that are doing this and put them in prison where they belong.

The criminal assholes aren't hard to find; they're in their offices at various Sony regional headquarters.

Re:Was it really worth it, Sony?

[sznupi]

Whatever makes you tick :) (though you have one thing going for you - trying to "reverse" a simple whoosh is... not exactly common and charming / cute in a peculiar way)

Re:Was it really worth it, Sony?

[sznupi]

...and 90s. And a product which isn't really "innovative" depending, also, on IC, optics (of various kinds), chemical and also manufacturing advances, I'm sure; all of which Sony does (sure, their manufacturing robots used by "everybody" aren't exactly visible, but...). The brand on tons of, greatly advancing over the decade, CCDs in "everything" around is also easily ignored; and Cell should be on the list. And I'm sure I miss some.

It's easy to look at the past through rose coloured glasses, of one type or another.

Again?

[Catnaps]

Somewhere out there, there's a hacker with a world map and a bunch of pins. Also, an intense dislike of Sony.

Re:Again?

[Anonymous Coward]

Hackers, plural. And lots of 'em.

Re:Again?

[somersault]

More likely a lot of separate individuals/groups who want to join in on the Sony bashing trend.

Re:Again?

[Ironhandx]

Somewhere out there, there's an army of hackers with a world map and a bunch of pins. Also, an intense dislike of Sony.

FTFY.

Sony pissed off exactly the wrong people. Many many many times over. They've had this coming for awhile.

Disclaimer: I am in no way affiliated with any said army. I am simply surmising based on the massive and intense hatred of sony amongst groups of people among whom I have several acquaintances. All for similar reasons, each with his/her own particular straw that broke the camels back. Recent events are really just fanning the flames of a fire sony had already started.

Re:Again?

[socsoc]

Good thing you posted a disclaimer.

Disclaimer: I in no way agree with parent and fully support Sony with my money and first born child.

Re:Again?

[Allicorn]

Why extract the database of users' information if your goal is only to give a slap in the face to the evil corporation?

It's almost as if the goal of this criminal activity wasn't heroic anti-corporatist hactivism at all...

Re:Again?

[Ironhandx]

Of course it isn't. That is one of the reasons that Sony in particular is being targeted however.

From what I can gather of the situation people that may not want to be involved in criminal activity are pissed off enough to help those that have no such qualms in some easily-denied way.

Basically, Sony has pissed off enough people that it has painted a large target on its back saying "Come get me". This has an effect of making Sony the largest path of least resistance for anyone with questionable morals.

Re:Again?

[Anonymous Coward]

Why extract the database of users' information if your goal is only to give a slap in the face to the evil corporation?

There are legal repercussions for any company that can't maintain the legally required confidentiality of their customers' data. Pretty much worst case scenario would see Sony forbidden from acting as a data controller, which would effectively cripple them in Europe. I can't imagine that every happening though.

That'll do far more damage than outages or "superhaxorz was here" messages on Sony servers.

Re:Again?

[Anonymous Coward]

Why extract the database of users' information if your goal is only to give a slap in the face to the evil corporation?

Because it forces that corporation to make embarrassing public admissions and expensive, time-consuming remedies. If all the hacker(s) did was leave a note saying "haha, I got in" then it could be swept under the rug; extracting user data forces their hand.

Mind you, I'm not condoning the hackers' actions or dismissing the possibility of a more sinister motive. I'm just saying that the act of grabbing the data is not (in and of itself) inconsistent with activist ideals.

Re:Again?

[StikyPad]

I expect it's because simply destroying assets would only garner sympathy for Sony, whilst exposing customer data will undermine their credibility and customer faith, things which can't easily be replaced from backups or by installing new hardware. If attackers are successful in mounting a prolonged attack, breaching Sony's systems on a regular basis, eventually they could erode all customer (and creditor) support, and the company could crumble.

Re:Again?

[drinkypoo]

It's very likely that this is a mix of hacktivism and actual crime. One disguises the other and both sides benefit from the confusion.

It's hard to feel bad for Sony or Sony's customers either way. Sony's customers are funding this kind of crap.

Re:Again?

[Riceballsan]

Hard to tell, there's a ton of ways this could be

1. Greedy thieves hear about anon vs sony, launch an attack to steal valubles, and leave an anon was here note to keep the authorities and sony chasing 13 year old kids instead of coming after them

2. Activists realized actually harming the customers was bad for their message, takes information without using it to force sony to admit and apologize to a breach, without directly harming the users

3. Activists are launching DDOS and other attacks keeping security busy, while simultaneously pointing out flaws in security, criminal hackers are hearing these flaws, noticing security is busy handling DDOSes, and they take advantage of the situation.

Re:Again?

[eepok]

Indeed. People love railing against "The Man", but their lack of perspective as it pertains to the genuine victims (the users) is disgusting and despicable. Sony will come out unharmed (minus a couple million dollars), but there is going to a massive rash of identity theft which will empty private citizens bank accounts, destroy credit, and likely ruin lives.

But these jerks keep on like they're cheering on Robin Hood or something. The rich are well-insulated. The norms of the world will be bearing the real weight of these crimes.

Re:Again?

[shutdown -p now]

Why extract the database of users' information if your goal is only to give a slap in the face to the evil corporation?

Because stealing user information causes a much bigger hit to Sony's reputation among the customers than, say, defacing their website?

Re:Again?

[Nethemas the Great]

This has simply become sport now... one I don't mind spectating.

Re:Again?

[Nethemas the Great]

Nothing destroys a company faster than the mass perception of incompetence in protecting the consumer. It's hurting Sony's share price and head "will" role eventually. I suspect the "me too" phenomenon will start to increase rather rapidly now that this is becoming a sport.

Re:Again?

[Translation Error]

Exactly. This wave of Sony security breaches is probably the result of two things: criminals hearing just how bad Sony's security is and rushing to focus their efforts on them; Sony going over their systems after the massive break-in and finding breaches they might not have noticed otherwise.

And, of course some of these breaches wouldn't have caught the public's attention so strongly before the big break-in.

Re:Again?

[mandelbr0t]

now that this is becoming a sport.

It never should have gotten this easy. Given that every authority responds to the threat of hackers in the same way -- legal persecution -- what's a heroic, anti-corporate hacktivist to do for a living? It's getting to the point now where a scheme has to be both profitable and for the greater good. Thinking big is the only way to go. Of course, if corporations had taken appropriate precautions a decade ago when the problem became blatantly obvious instead of relying on armies of lawyers, we wouldn't be talking about a 10-year-old problem today.

Re:Again?

[Anonymous Coward]

Why? Because the average Joe has no comprehension of rootkits, linux, and lawsuits against hackers. Those issues won't affect his buying decision when he is looking for that new stereo. However, if he keeps hearing in the news 'Sony hacked - credit card details stolen', he might just choose a different brand instead.

Re:Again?

[Forty Two Tenfold]

Too bad you commented as AC. You're exactly right - a job worth doing is worth doing right. That's why they want the whole nine yards.
The publicity is meaningless in case of the blackhat but for Sony it ia a disgrace.

Karma

[what2123]

It's not sad to see this happening considering their reputation for the past 10 years. You cannot continually screw your revenue sources and expect to remain on top of the pyramid. Eventually it will all fallout from underneath you, one way or another.

Re:Karma

[Anonymous Coward]

I hate to say it, being an American myself, but what do you expect from a Japanese company run by an American who was president of CBS?

Re:Karma

[betterunixthanunix]

Unfortunately, their customers are getting hurt in the process, which is what makes this sad. If it were just a matter of Sony getting beat down everywhere they turned, I would have no problem.

Re:Karma

[Anonymous Coward]

Anyone who chose to become a Sony customer in the last decade -- or at least since the rootkit fiasco -- should have known they would get screwed. By Sony, if nobody else.

I'm not saying the hackers are blameless, but is anyone really surprised at this?

Re:Karma

[JustSomeProgrammer]

I'm not surprised it happened after the PSN hack. But I am surprised some people think this is someone with a holy vendetta against Sony and not just a bunch of criminals going after an easy target.

Re:Karma

[kevinNCSU]

Anyone who chose to become a Sony customer in the last decade -- or at least since the rootkit fiasco -- should have known they would get screwed. By Sony, if nobody else.

I'm not saying the hackers are blameless, but is anyone really surprised at this?

Does anyone REALLY believe that even 10% of parents buying a gaming console for their child has any idea WTF the "rootkit fiasco" is? I think saying the average person "should have known" that an obscure event (yes, in the real world the rootkit fiasco is not on par with 9/11) burned into the memories of a small subculture that held onto it for years would eventually come back to hurting customers of that company is a little redic.

Re:Karma

[Lord Juan]

Actually, their customers have been getting hurt by Sony for a long time. What really makes this sad is how many of them don't even realize it and continue giving money to Sony.

Re:Karma

[marcosdumay]

Not realy an easy target, but an interesting one. There are probably other targets that are easier.

Now, the part about they being a bunch of criminals, that is right. Both sides are, just the consumers are not, and those are the most hurt.

There will be no peace.

[Anonymous Coward]

Period.

Re:There will be no peace.

[Score Whore]

You're probably right. After the initial attacks, the investigators have been there collecting evidence. The difference between Sony being the victim of a crime and the hackers committing crimes has significant ramifications. I expect that there will be a number of people who spend some time getting sodomized in federal prisons around the world followed up by the inability to ever hold a job in the IT industry, ever get any credit, ever hold a job of any trust, or ever accumulate any money as anything they earn over a certain bare minimum will be taken by the courts to pay their multi-million dollar fines.

Not to mention the possibility of some back alley arrangements leading to some real bodily harm in countries with less robust legal systems.

Re:There will be no peace.

[NotTheNickIWanted]

Is that a prediction, an aspiration, or a promise?

Re:There will be no peace.

[goose-incarnated]

I expect that there will be a number of people who spend some time getting sodomized in federal prisons around the world followed up by the inability to ever hold a job in the IT industry, ever get any credit, ever hold a job of any trust, or ever

Uh ...

Re:There will be no peace.

[socz]

So i guess we can start looking forward to law enforcement and military using sony-donated equipment??? wink wink?

As an aside, did you ever stop to consider if things got hot, people can do without all you mentioned? I mean, really see the world. You can get by on little, and still enjoy life. But you won't be on the bleeding edge or even close to it with technology.

Re:There will be no peace.

[Anonymous Coward]

TY anon. Carry on, lulz await.

Re:There will be no peace.

[game kid]

Is that a prediction, an aspiration, or a promise?

Yes.

Re:There will be no peace.

[NoOneInParticular]

Well, you got the nice federal prisons in the US, the less nice US federal prison in Cuba, and possibly even a few really dirty ones in Syria and Egypt. Maybe, these US federal prisons in the Arab world are going to be dismantled by the local populace in the near future. Luckily we'll always have Poland.

Re:There will be no peace.

[Anonymous Coward]

We salute you!

Security?

[muffen]

After it was discovered that Sony was installing rootkits on people's machines, Mr Thomas Hesse, president of Sony BMG's global digital business said, "Most people I think don't even know what a rootkit is, so why should they care about it?"

They are just taking the same approach to Security, since they don't know what it is, why care about it?

Re:Security?

[socz]

Maybe they handed out some of those cd's to their employees and someone popped it in a machine or 100. My brother used to get free albums from interscope's office in L.A. because he worked in the same building and made friends with a graphic artist. One of those albums she did artwork for? Snoop Dog's Doggy Style (oh yeah!)

Re:Security?

[Anonymous Coward]

After it was discovered that Sony was installing rootkits on people's machines, Mr Thomas Hesse, president of Sony BMG's global digital business said, "Most people I think don't even know what a rootkit is, so why should they care about it?"

Wait, are you serious? Did he really say that? That's insane.

So, I guess I could ask him: "do you know what an 'orchidectomy' is? If you don't, then you wouldn't mind if I performed that on you, right? Since I'm only going to cut your freaking testicles off!!!"

does this expression require children be involved?

[sgt scrub]

the fucking you get for the fucking you get.

Plain text passwords....

[antifoidulus]

From TFA:

"E-mail, password, and names of thousands of users were exposed via text file"

Why...why...WHY do people still insist on plain text passwords? Have these people ever heard of a hash? There is 0 reason ever to store a plaintext password, end of story. Anyone who designs a system that stores passwords in plain text should be fired on the spot.

Re:Plain text passwords....

[antifoidulus]

Well, it looks like at least some of the passwords were hashed(also, please stop saying "encrypted" passwords, there is a world of difference between encryption and hashing!), but it's not clear that all the passwords were hashed.....

Re:Plain text passwords....

[Anonymous Coward]

Anyone who designs a system that stores passwords in plain text should be fired on the spot.

What? No torturing?

Fine... We'll just fire them out of a cannon into the Sun.

Re:Plain text passwords....

[xaxa]

Anyone who designs a system that stores passwords in plain text should be fired on the spot.

Off-topic: my bank asks for the Lth, Mth and Nth characters of my password, which is better than asking for the whole lot. Is it possible to have a system like that without storing the password encrypted (rather than hashed)?

Re:Plain text passwords....

[Relayman]

No. Any good encryption scheme encrypts your password as a complete character string. The password systems I work with use a one-way encryption method; if you have the encrypted value, you can't decrypt it to get the password. Having just three characters of your password should not be able to determine its validity unless they are decrypting your password (vulnerability) or storing it as plain text (vulnerability). This is an unacceptable method.

Re:Plain text passwords....

[Anonymous Coward]

Also from TFA, it says the passwords were "encrypted". What wasn't in TFA is the phrase "plain text" - that part YOU added. Way to get worked up over something that you formulated.

Re:Plain text passwords....

[monkeyhybrid]

Hash the individual characters as well as the password in it's entirety? Stupid easy to bruteforce if your salt is known though...

Re:Plain text passwords....

[vlm]

Having just three characters of your password should not be able to determine its validity unless they are decrypting your password (vulnerability) or storing it as plain text (vulnerability).

There's a third possibility, Sony seems to operate at just the right level of clue to store each individual character in a separate column, although each individual character hashed of course for security reasons. (if you're reading this, and don't get the joke, please don't program anything using a password, unless you work at Sony, OK?)

Re:Plain text passwords....

[amorsen]

You cannot encrypt a password both in transfer and on disk (unless you use a separately encrypted channel with separate authentication, but then why do you need a password?). For a lot of things it is more important that you can use the password to establish a secure channel than it is to store the password as a hash.

E.g. with the simple "ask for three specific characters from the password" method you gain almost-one-time-passwords, so a keylogger on a public terminal cannot empty your bank account afterwards. This property is probably worth the risk that someone breaks into the password storage.

Re:Plain text passwords....

[lucian1900]

No. And what they're doing is stupid. You should have a password which you type in AND a memorable info, which you get asked letters of.

Re:Plain text passwords....

[h4rr4r]

You also just reduced the length of the password to 3 chars. Nice and guessable. Even if it changes which three, you are increasing the odds of a collision.

Re:Plain text passwords....

[makomk]

You cannot encrypt a password both in transfer and on disk (unless you use a separately encrypted channel with separate authentication, but then why do you need a password?)

Technically that's not true; take a look at some of the various password-authenticated key agreement schemes out there. Unfortunately it appears to be a bit of a patent minefield...

Re:Plain text passwords....

[Anonymous Coward]

Sony should stop naming their password files "readme.txt"

Re:Plain text passwords....

[canajin56]

Mixed case alphanumeric is 62 characters. So even if nobody uses symbols at all, that "nice and guessable" is one in 238,328. Yeah, so fucking trivial. You can basically get in each time. Well, except that if an IP makes multiple failed attempts it will be locked out. So you'll need several hundred thousand nodes in your botnet. And each individual account will also get locked as its being hammered. So if you have some 80,000 bots odds are even that as you target 80,000 peoples accounts, you'll probably get into one. Then oops, unknown IP address logged in successfully, time to answer the security questions. So that's the case where somebody is breaking in without a keylogger. Basically immune because nobody would use an 80,000 node botnet to have a tiny chance at getting into ONE account. Tiny. The other case is where you have a keylogger. In that case, you have a what, 2% chance of getting in even if you've seen 2 out of 3 characters before? Vs. 100% total access if the bank didn't use this scheme.

Re:Plain text passwords....

[bryan1945]

If they changed which 3 characters for each failed attempt (and even successful attempts), with a timed lock out after X failed attempts, the odds decrease a bit. I'm not doing the math.

Re:Plain text passwords....

[Anonymous Coward]

You could store a separate hash for those characters?

Re:Plain text passwords....

[Anonymous Coward]

It is possible if the n-th letters are stored separately before hashing.

Re:Plain text passwords....

[ShadoHawk]

What? No torturing?

"Send him to Detroit!" --Dr. Klan

Re:Plain text passwords....

[jgtg32a]

To fair I doubt he read the article, come on this is slashdot. This was a rumor that was flying around shortly after the first breach, and IIRC /. was all over it. It was disproved a few days later, but too late.

Re:Plain text passwords....

[Anonymous Coward]

If you think this is a good idea, I'm sorry, you need to read about cryptography. All that does is make a bunch of 3 character passwords, it's NOT a one time pad.

Banks are notoriously bad at some kinds of security, see PINs and ATMs for example (the biggest vendor of the latter is Diebold, their ATMs are just as terrible as their voting machines).

Re:Plain text passwords....

[indeterminator]

Off-topic: my bank asks for the Lth, Mth and Nth characters of my password, which is better than asking for the whole lot. Is it possible to have a system like that without storing the password encrypted (rather than hashed)?

If someone can get in a bank's server to read those passwords, there are probably worse things he could do than just take the passwords...

Re:Plain text passwords....

[rsborg]

Also from TFA, it says the passwords were "encrypted". What wasn't in TFA is the phrase "plain text" - that part YOU added. Way to get worked up over something that you formulated.

If it's reversibly encrypted, that's bad, and all encrpyted data can be exposed by knowing/finding the key. If it's one-way encrypted (ie, hash maybe with salt), then it's a whole lot more secure, but still susceptible to brute-forcing (google: rainbow table).

Re:Plain text passwords....

[mcrbids]

Why...why...WHY do people still insist on plain text passwords? Have these people ever heard of a hash? There is 0 reason ever to store a plaintext password, end of story. Anyone who designs a system that stores passwords in plain text should be fired on the spot.

I agree that saving passwords as hashes presents a much better security model, but you are just wrong to think that there is no reason to keep them in plain text.

The real world isn't quite so black and white!

1) It's "unfriendly" to require users to change their password every time. If the user is able to authenticate themselves sufficiently by other means, it may be perfectly legit to give them their password. Sorry, but real users often have a tough time figuring out how to turn on the computer, let alone remember a 12-digit password made of random letters, numbers, symbols and mixed case.

2) Done right, passwords can be invalidated at any time, forcing end users to re-specify a new password. Sufficient logging can also make it pretty clear if you have a security breach on your hands by noting other details of the login process. (EG: Source IP, etc)

3) Many (most?) breaches nowadays don't consist of somebody knowing the passwords, but in the "lost password" process which presents its own security issues - for example, email is sent in plaintext. Against this type of attack, hashes provide no security benefit whatsoever.

4) Debugging: It's nice when, as a developer, you are given access to real, honest-to-god data so that you can code to what's really happening rather than contrived, artificial data sets. Part of working in this type of environment is to be able to access dev copies of databases as users in question. Yes, you can set the passwords as part of the snapshot/replication process, but that does add overhead.

I guess what I'm saying is that storing hashes is like requiring super-strong passwords so that users end up with their password on a sticky note next to the computer: yes you get theoretically better security but it doesn't always work out that way in practice.

Like many decisions, you really have to evaluate this on a case-by-case basis, and you may offset some of the risk by doing things like enforcing the use of SQL prepared statements, or standardizing your data input validation!

And, in all truth, passwords are a terrible, terrible security tool, they just happen to have a better mix of usability, security, and convenience than anything else that's been developed thus far.

Re:Plain text passwords....

[mlts]

Why can't people who design authentication systems understand this:

Don't store the password.

At the minimum, store a hash where trying to get the password is like trying to run a meat grinder in reverse to get the cow back out.

A better way would be to store a salt, XOR the salt with the password, hash that result and store the hash.

Even better would be to store a salt, then encrypt the salt with the key being a hash of the password (the hash is used to act as a 'bit blender' so the entire keyspace is used, not just the space of letters/numbers). Store the encrypted salt, and the plaintext salt. Add rounds of encryption to help against brute forcing at the expensive of slowing down legit authentication. This way, the password is never stored, even "encrypted".

Re:Plain text passwords....

[marcosdumay]

"For a lot of things it is more important that you can use the password to establish a secure channel than it is to store the password as a hash."

Do you have any idea of what you are sying? If you do, please explain, because it doesn't make any sense. From what I've got, passowrds are used for authentication, for channel security we have cryptography, and a hash can authenticate a password quite well, thank you.

Re:Plain text passwords....

[Anonymous Coward]

Two years ago my SSHd was scanned by a bot net with ~ 150,000 unique IPs. It took about two weeks for it to finish scan me--and I could see the failed usernames roll through my logs in alphabetical and was utterly helpless to stop it. One host. One username. One password. Second host, same username, second password... and so on until it moved onto the hundredth host, second username...

I rather strongly suspect it was scanning many other SSHds as well.

The weird part is as described above--it was clearly synchronous. Somebody had a massive C&C network and or scheduling system.

I wouldn't want to bet on your assumption...ever any more.

I am especially waiting for the first botnet that uses a bluepill to break out of (or back into) virtualized servers and start utilizing their address space for evasive / antiforensic purposes.

Re:Plain text passwords....

[CarlosM7]

... it may be perfectly legit to give them their password...

Or give them an automatically generated random password they would then reset, making the storage of original password unnecessary?

In the immortal words of Radiohead...

[Anonymous Coward]

This is what you get
when you mess with us.

-- Karma Police

Pull the damn cables already!

[AAWood]

Seriously, how long until Sony head office just tells every department to yank their network cables until a full security audit is done? This is just embarrassing at this point.

Re:Pull the damn cables already!

[lennier1]

I get the impression they're not even trying anymore.

Re:Pull the damn cables already!

[Anonymous Coward]

But then, how would they ever tell them, that the audit is done?
Smoke signals?
I'd bet they'd manage to get hacked via those too! ;)

Re:Pull the damn cables already!

[Anonymous Coward]

They weren't really trying in the first place...

Re:Pull the damn cables already!

[Anonymous Coward]

If you check around the world, every company has the same level of security, crappy. They should be embarrassed because they're obviously being specifically targeted and don't seem to be doing anything.

Re:Pull the damn cables already!

[Captain Spam]

Seriously, how long until Sony head office just tells every department to yank their network cables until a full security audit is done? This is just embarrassing at this point.

What costs more, cutting off all online sales and hiring an audit team for X amount of time, or closing your eyes and ears reeeeeeeeeeally tight until everyone forgets about this in a couple months?

Er... hang on, let me clarify: What costs more in the short term, within the attention span of the CEO/CIO a modern multi-bazillion dollar megaconglomerate? Remember to factor in that "admitting we made a mistake" is a near-infinite cost in this case! If you never admit it, it never happened!

Re:Pull the damn cables already!

[Cl1mh4224rd]

I get the impression they're not even trying anymore.

If they were trying in the first place, we probably wouldn't be hearing about all these breaches.

Re:Pull the damn cables already!

[lennier1]

They're probably doing the best they can but their online projects seem to be maintained by descendants of the Keystone Kops.

Re:Pull the damn cables already!

[ghmh]

Your post sounds suspiciously like a slightly sanitised version of the start of Fight Club where the 'narrator' talks about the cost of lawsuits vs the cost of recalls due to failures in vechicles.

Re:Pull the damn cables already!

[Anonymous Coward]

Sony and Tepco...two peas in a pod.

Re:Pull the damn cables already!

[Anonymous Coward]

I have the distinct feeling that SONY is old school Japanese.
If I admit I made a mistake I have to kill myself mentality.
Thats the way it comes across anyway.

Pinkertons

[Gotung]

I wonder if this rise in internet vigilante-ism is going to birth a corporate funded internet version of the Pinkertons. I.E. a group of black hat hackers paid by big corporations to hunt down and ruin groups like Anonymous through less than legal means.

Re:Pinkertons

[Anonymous Coward]

That's already in place.
Multiples even. FBI, DHS to name a few. They slap the cash on the table, the government assigns field agents to investigate. All they have to claim is IP or copyright violations.

Re:Pinkertons

[chemosh6969]

I think it's more of everyone seeing how unsecure Sony is, so they're all trying to get into all the other unsecure systems.

Re:Pinkertons

[Anonymous Coward]

At first I thought you were going to say, "black hat hackers paid by big corporations to hunt down other corporations."

That would awesome btw :).

Re:Pinkertons

[Thruen]

I figured that's what was happening when federal agents became the tools used to investigate and help prosecute people for copyright infringement.

Re:Pinkertons

[wesgray]

It is already here: Remember HB Gary working for the U.S. Chamber of Commerce and Bank of America?

Re:Pinkertons

[RazorSharp]

Or ruin other companies.

It's funny, the first time I read Neuromancer years ago everything in it seemed so far fetched. Sorry Mr. Gibson, it appears you were right on a number of things. Black hats may become a solution for everyone -- vigilantes, interest groups, corporations, criminals, ect. Why rob a bank with guns when you can combine hacking and social engineering to make money appear from nowhere and appear legitimate? If a politician's opponent is raising massive funds with a website, it can be taken down with a DDoS and attributed to 'anonymous' internet users. A competing corporation plans to debut a product online at a certain date? Too easy.

Sony makes things easy on these black hats. They seem to think Sony epitomizes corporate evil (between playing on their XBoxes and dicking around on Windows. . .). What's going to happen when the targets become more controversial and polarize this black hat community? And then another polarizing issue and then another. You can't expect everyone who parades under the banner of Anonymous to be on the same page ideologically. What they're really doing is setting a precedent: if you're willing to skirt the law, black hat solutions are viable for taking down opponents who rely on digital networking.

If one good thing can come of it, I would say it's this: people may start taking anonymity on the internet seriously. The Facebook model of 'privacy shouldn't exist' will be put to the test.

Re:Pinkertons

[Jaysyn]

That worked out real well for them.

Re:Pinkertons

[Anonymous Coward]

Were you asleep during the HB Gary Federal brouhaha?

Re:Pinkertons

[Anonymous Coward]

Neuromancer (and Gibson's work in general) is amazingly foresighted. The only thing that sticks out to me as hokey or old-fashioned when I read his works today is that he uses 'megabytes' instead of 'terabytes/petabytes/etc'.

Re:Pinkertons

[Anonymous Coward]

They're already here. ICE & DHS.

Re:Pinkertons

[Anonymous Coward]

It's already happening, cf Team Themis.

Re:Pinkertons

[Anonymous Coward]

What, like HBGary?

Re:Pinkertons

[rsborg]

I wonder if this rise in internet vigilante-ism is going to birth a corporate funded internet version of the Pinkertons. I.E. a group of black hat hackers paid by big corporations to hunt down and ruin groups like Anonymous through less than legal means.

I wouldn't put it past the entrenched powers to use whatever means necessary to get this done (ie, either digital brown-shirts, or burning down the commons through excessive and unconstitutional legislation that's been "purchased"). I'm guessing it'll be a combination of both, but in the short term, expect more of the "internet death sentence" type of reaction.

I do posit this is going to get much worse. Every day, it feels like the seemingly paranoid rants by RMS seem more like the prophetic prognostications of a Cassandra who's seen the future hoping to help us avoid it.

Re:Pinkertons

[Anonymous Coward]

Well groups like anonymous use less than legal means to hack into networks of Sony and other corporations. So if anonymous gets a taste of their own medicine, I'm not going to silently weep calling the corporation a bully.

Re:Pinkertons

[fulldecent]

Good luck. After the first Anonymous gets taken out, I'll be the next person to join the cause. Chase me through 7 proxies.

Almost feel bad for them

[19thNervousBreakdown]

Feel bad for them? The fuck? "They" are a corporation, whose only reason for existence is to make money. Sure, there might be individuals working there with morals, but the company itself has none at all--regardless of what US law says, it's not a person.

This corporation has spied on, sued, made vulnerable to other attacks, and bullied its customers, potential customers, competitors, and little bald children with cancer who were lying in a bed that Sony had to put its muddy boot up on to tie its laces. And, probably because it thought it could get away with overworking or undertraining its net admins, it cut corners when it came to security. The security of its customers' credit card info. Who, after all the bullshit Sony pulled, still paid for their shit, and put their credit at risk, unlike those who "stole" from Sony, who won't have what they bought taken away at the first whim, who aren't badgered every time they want to watch a movie on a different device, who don't have to sit through unskippable guilt-trips and FBI warnings, and don't have to pay again when the disc gets scratched.

Almost feel bad for them? Ha! I'm not even close to feeling bad for them. There is no possible amount of "suffering" that could make me feel bad for them. Call me when Sony wakes up one morning with a pain in its left arm and is forced to face its own mortality.

Re:Almost feel bad for them

[Culture20]

And, probably because it thought it could get away with overworking or undertraining its net admins, it cut corners when it came to security.

Listen up, HR. Don't skimp on IT salary or benefits. When your IT group thinks it needs more manpower, it needs more manpower. An understaffed/undertrained IT staff is like hiring Barney Fife for your bank guard; a lot of bluster and bravado, but only one bullet kept in his shirt pocket.

Re:Almost feel bad for them

[ddd0004]

You know there are some IT staff with Sony who are getting the double beat down of getting their ass chewed and working an 80+ hour week. Most places I've worked couldn't be bothered to improve security because the people who make decisions are only concerned with ROI as a number and then they attempt to choose the bigger number. It's always foot jammed on the gas pedal on new developments and no concern with of existing infrastructure.

Re:Almost feel bad for them

[RazorSharp]

Did they kick your puppy, too?

Most of the things you mentioned were poor corporate decisions. Nothing I'd consider malicious. Sony employees have demonstrated ineptitude time and time again. I get it. But this attack on Sony is only helping the even more evil corporation over in Redmond.

Sony's not trying to lock governments into their technologies. Almost everything they sell is a consumer device. If you don't like what they do as a company, don't buy their products. I don't have that luxury with Microsoft: I need Windows and Office for work and my tax dollars inevitably go toward putting Windows on government computers.

I don't think you understand the difference between morals and 'don't something you don't like.' Sony makes a lot of dumb decisions, I'll give you that, but they are way down on my list of EVIL CORPORATIONS. Why don't these black hats go after BP for trashing the Gulf of Mexico, or Oracle for ruining Java and buying out all their competitors, or Rupert Murdoch for intentionally spreading misinformation? What happened to the Bradley Manning cause? What about telecommunications companies around the world that willingly hand over information to governments? These kids have a very narrow world view. Real moral issues don't matter to them because Sony won't let them run Linux on their Playstation.

Give me a fucking break. Linux wasn't even useful on the PS3. It was a novelty that didn't do much to increase sales because the people who cared about it were still butt-hurt about the rootkit fiasco.

These morons who are attacking Sony's networks are probably going to be the same ones bitching and moaning when Microsoft has a console monopoly in five years. As of now, they might as well be working for MS. People aren't going to abandon their PS3 for a Wii. Sony's still the lesser of two evils next to Microsoft as far as I'm concerned.

Re:Almost feel bad for them

[Anonymous Coward]

Maybe "Anonymous" is Microsoft.

Re:Almost feel bad for them

[Anonymous Coward]

Feel bad for them? The fuck? "They" are a corporation, whose only reason for existence is to make money. Sure, there might be individuals working there with morals, but the company itself has none at all--regardless of what US law says, it's not a person.

That's wrong. A real person makes decisions on behalf of the company. Blaming a "company" gives that person something to hide behind. If it was Paul Smeller that demanded CDs go out with rootkits, despite many internal protests, don't you think shit like this wouldn't be so common when it comes to light? Sony are a massive company, they have decent engineers and product, ruined by the media side of the business that appears to make all the decisions. Go after names that fsck things up, and don't be fooled into targeting a company.

Re:Almost feel bad for them

[Anonymous Coward]

Someday these 'kids' will grow up*, and they may actually care about issues like Oracle or Wiretapping, etc. Don't give up hope just because there's overkill on a slightly childish target today.

* by which I mean their base and power structure may grow beyond the current Anonymous setup, not that everyone will mature or grow older or anything. A hierarchy would destroy the current objective of 'lulz,' which is why Sony is the target now.

Re:Almost feel bad for them

[19thNervousBreakdown]

That's the entire problem though, and the implicit point of my post, they do have a company to hide behind. What are you going to do? Go curse them out and tell them what a dickhead they are? You can't sue them (and win). They aren't accountable under the law unless they do some Enron-level book doctoring, and even then the only reason they really got into trouble is that they fucked with the money. Regular dishonest stuff is just par for the course, and things that put people's lives at risk are a monetary decision based on how likely the company is to be fined or lose a lawsuit, it never comes back on the actual people making the decisions.

But, it's all just a symptom of the human condition. Warlords and chiefs were replaced by dukes, were replaced by bishops, were replaced by senators, are in the process of being replaced by CEOs. Ain't nothin new under the sun.

Re:Almost feel bad for them

[Anonymous Coward]

"They" are a corporation, whose only reason for existence is to make money.

And this is different from any other corporation how?

and little bald children with cancer

You missed the stomping on kittens.

and don't have to pay again when the disc gets scratched.

Yeah, because when I break something, the people who made it have a moral duty to give me another one free.

Re:Almost feel bad for them

[19thNervousBreakdown]

Did they kick your puppy, too?

Most of the things you mentioned were poor corporate decisions. Nothing I'd consider malicious. Sony employees have demonstrated ineptitude time and time again. I get it. But this attack on Sony is only helping the even more evil corporation over in Redmond.

I consider looking at me and seeing only a wallet and a bunch of strings to pull malicious. There is no other possible outcome of that viewpoint.

Sony's not trying to lock governments into their technologies. Almost everything they sell is a consumer device. If you don't like what they do as a company, don't buy their products. I don't have that luxury with Microsoft: I need Windows and Office for work and my tax dollars inevitably go toward putting Windows on government computers.

That's only a question of the products they make. If Sony made OSs, you'd better believe they'd be trying to lock their profits in. Sony would kill, and I mean that quite literally if they thought they could get away with it, they would flat-out murder to be in Microsoft's position. This isn't a question of degree, where one company is more evil than the other--companies like these are absolutely bereft of any morals whatsoever and the harm they cause is only a question of capability.

I don't think you understand the difference between morals and 'don't something you don't like.' Sony makes a lot of dumb decisions, I'll give you that, but they are way down on my list of EVIL CORPORATIONS. Why don't these black hats go after BP for trashing the Gulf of Mexico, or Oracle for ruining Java and buying out all their competitors, or Rupert Murdoch for intentionally spreading misinformation? What happened to the Bradley Manning cause? What about telecommunications companies around the world that willingly hand over information to governments? These kids have a very narrow world view. Real moral issues don't matter to them because Sony won't let them run Linux on their Playstation.

Give me a fucking break. Linux wasn't even useful on the PS3. It was a novelty that didn't do much to increase sales because the people who cared about it were still butt-hurt about the rootkit fiasco.

These morons who are attacking Sony's networks are probably going to be the same ones bitching and moaning when Microsoft has a console monopoly in five years. As of now, they might as well be working for MS. People aren't going to abandon their PS3 for a Wii. Sony's still the lesser of two evils next to Microsoft as far as I'm concerned.

I don't think you understand just how evil a group of people can be when they're accountable for nothing but profit. Sony is no different than Microsoft, or BP, or Enron, or Global Crossing. If they thought they could be competitive in the mascara business by stealing babies and swabbing eyes with acid, you'd have to put man traps outside your windows to keep them away. They just happen to make playstations. Lucky us.

Re:Almost feel bad for them

[19thNervousBreakdown]

And this is different from any other corporation how?

They aren't.

You missed the stomping on kittens.

It's unprofitable.

Yeah, because when I break something, the people who made it have a moral duty to give me another one free.

They're the ones who decided they have the right to tell you what to do with something after you've paid for it.

King of DRM

[Anonymous Coward]

Sony is more or less the king of DRM. Why not apply some of it to their own servers?

DRM = Digital Rights management

They should keep the Right to screw with their servers to themselves

Will it matter in the long run?

[Anonymous Coward]

Every time there are attacks against those who impede freedom, it's always used as ammo for the corporation to do more or retro-justify their actions. I can't imagine Sony going back on to allowing the "Other OS" option, although not their first act of douchery, it seemed to have ignited this wildfire.

Re:Will it matter in the long run?

[Score Whore]

What amazes me is that people who choose to retaliate with criminal actions, and those who cheer them on, don't seem to be able to anticipate the results of their behavior. Events like this are why network connectivity becomes regulated.

My karma ran over your dogma*

[Anonymous Coward]

*Aibo

Has anything been accomplished?

[meridiangod]

I get it, they've done a ton of unpopular things, but what has all of this hacking done? Do they really think it's made them think twice about potentially unpopular business decisions? Are a ton of other hacker just jumping on a bandwagon because they can? Do you think that losing all that money will inspire them to do good by their consumers? I can only speculate as to the true intentions of the hackers out there, but it kinda bothers me when I get the impression that people are doing this to "get back at them for something they did that I don't like or agree with." If that's really the case, I wish they would just get over it already and move on. I am personally getting sick of reading about Sony.

Re:Has anything been accomplished?

[mehrotra.akash]

Now, when someone goes to buy a Sony product, they will think

This is the same company that installed a virus (rootkit, but since most malicious programs are referred to as viruses, so virus) when I put in a Music CD
This is the company that leaked my friends credit card details
This is the company whose websites have been hacked so many times
This is the company whose game console did not allow them to play multiplayer for a month
This is the company that removed a feature from their Game console after it was released (Again, people may not know what the feature was, but they will still know that something was removed)

Might as well buy the cheaper and almost as good Samsung/LG product. Who knows, next they will copy all the images from my camera to their servers.

(did I forget something?)

Re:Has anything been accomplished?

[Anonymous Coward]

You give people WAYYY too much credit. Citibank tried to steal my parents' house by buying their mortgage with 5 months left on it and then not sending bills (they claimed they didn't have the address?!?). So where does my Dad keep some of the proceeds of the sale? At the local Citibank branch, of course.

At most, you can hope some people will start saying Sony=bad as they drool.

Re:Has anything been accomplished?

[meridiangod]

Yeah, I understand that they've tarnished the Sony brand by exposing customer's information, but you're making it sound like they were handing out that information to anyone who asked. They didn't ask to have someone take customer information or have their online network taken down. And, I'm sorry, taking away a popular feature they no longer wanted to support isn't an invitation either. I wasn't a fan of removing OtherOS but I don't think the appropriate course of action was to steal customer information in order to defame their company.

I don't think most consumers care why they were hacked, just that their service was interrupted. Sure Sony's security sucked, but I think the general public will just hold the hackers responsible for the brunt of the problems down the road once this whole thing passes. In the end, Sony will move on and likely continue to do unpopular things which is why I don't really see anything meaningful being accomplished.

Re:Has anything been accomplished?

[Haedrian]

Rather wishful thinking, It'll go like this I think

"I want to buy a game console, this look cool and has games I want. *PURCHASE*"

Re:Has anything been accomplished?

[Anonymous Coward]

Really that is the true impact of this, regardless of what happens at Sony Corp, they now have a tarnished brand. As anyone knows the most valuable asset to a consumer based company is their brand.

Re:Has anything been accomplished?

[Jaysyn]

A few. Let us recount:

1.) They try to shoehorn their expensive proprietary media formats (MiniDisc, UMD, Memory Stick, Betamax, Blu-Ray) into any product they can.

2.) They ruined Star Wars Galaxies with the "New Game Enhancements" & "Combat Upgrade".

3.) They sued Lik-Sang out of existence for daring to sell Japanese PSPs & games to other countries.

4.) They manufactured exploding batteries & sold them to other laptop vendors.

Re:Has anything been accomplished?

[RazorSharp]

No they won't. The only people who will think that are those who already knew about all that stuff.

The only thing on that list that will be remembered is "This is the company whose game console did not allow them to play multiplayer for a month." Which probably won't affect their phone purchase.

And why would it be better that they buy a cheap Korean-made piece of shit from Samsung or LG? They can bypass Sony without taking that massive step down in quality -- Motorola, Nokia, RIM, Apple. . . What type of cheapskate are you? Almost good enough isn't good enough. Hardware quality aside, the Koreans make the worst software interfaces for the western world.

The Joe Schmoes I know aren't angry at Sony right now, they're angry at hackers and it's only because their PS3 wasn't playing online.

Re:Has anything been accomplished?

[Yetihehe]

I wasn't a fan of removing OtherOS but I don't think the appropriate course of action was to steal customer information in order to defame their company.

How about removing it, restored it themselves, then getting info on everyone who commented on the issue? It's not just about removing some functionality because they don't want to support it. Sony intentionally made steps so that this functionality can't ever be restored in any way.

Re:Has anything been accomplished?

[Yetihehe]

It should be "How about removing it, suing people who restored it themselves, then getting info on everyone who commented on the issue?". Sorry.

Re:Has anything been accomplished?

[cpu6502]

>>>I'm sorry, taking away a popular feature they no longer wanted to support isn't an invitation either.

In Europe it's worse than an invitation. It's a criminal offense, and Sony is required to give PS3 refunds to every customer who asks for one. Sony is guilty of false advertising and misrepresenting a product (claiming it could do OtherOS, and then disabling it). AKA bait and switch.

Sony is also guilty of installing viruses from Music CDs, and then destroying the computer with their removal tool (it made some HDDs unbootable). This hacking is simply a slap on the wrist. Sony deserves to be thrown in jail as far as I am concerned. They are getting off too easy.

Re:Has anything been accomplished?

[meridiangod]

Forgive my generalization on the OtherOS topic, but my point is still valid. Removing functionality from their product, while not a great business tactic, isn't an appropriate excuse to steal a company's customer information thus causing them to take their service down.

If my bank said I could no longer use their online banking I would think that it would not be okay to rob the bank in retaliation. Plus, I would think they would be rightfully upset at anyone who tried to setup their own website to bank online at that same bank.

Re:Has anything been accomplished?

[meridiangod]

Right, I remember reading about this when it happened. I don't know if that trial is still going on, but if it is I hope they're found guilty. I'd be interested to see if they would restore it worldwide or just for European consoles.

I think what they did with their DRM is stupid, and I am most definitely not a fan of DRM. That said, what would stealing Playstation customer information prove to Sony that all of the revenue lost immediately after that whole fiasco didn't? If they wanted to make a point, the hackers did just that. Time to move on if you ask me.

Re:Has anything been accomplished?

[Anonymous Coward]

Of course most of that is assuming that the competition has better security or is less cons against it. Just because a company hasn't publicly admitted they have been hacked means they are in any less danger of leaking your CC details, or for that matter already having done so. Just that either no one's tried, or they were more elegant about it, not going all "bull in a china shop".

In the best case this type of hacktivism (gawds I hate that word) will encourage companies, Sony included, to become more open. On the other hand, it could just as easily reinforce the notion that need to treat the customers as an enemy. There's a line somewhere between making your point, and being the drooling troglodyte on the playground. One month of downtime on a flagship service is a pretty good point. Give them some room to breath, see if they start behaving better. If you don't do that you are getting awfully close to being that guy on the playground.

Re:Has anything been accomplished?

[Rydia]

A bunch of crackers got a hold of boatloads of personal information that they can sell for cash money.

That is what it's done. There may be some sort of vendetta, and there definitely is the feeling that Sony is a personal information pinata, but that's really what it is at its core.

PSN

[Anonymous Coward]

Pretty Shitty Network

they spent all that money on bluray security

[Dan667]

Good to see their failure to correctly prioritize who is important (the actual Customer) is beginning to cause them problems.

Re:they spent all that money on bluray security

[Anonymous Coward]

Good to see their failure to correctly prioritize who is important (the actual Customer) is beginning to cause them problems.

This is a good point. They spent million$$$ to protect their livelihood by making sure that they get every possible dime, yen, euro, coopins,... of your hard money. Once they get your money, they don't give a damn about protecting your livelihood and financial well-being.

Gratz Sony! Someone just sank your battleship.

Re:does this expression require children be involv

[outsider007]

Agree. Sony has screwed more kids than the catholic church.

Most likely that...

[Anonymous Coward]

...some group(s) has been sitting on these security holes for a long ass time now and is only just now taking them out. One after the other, blow after blow, so the world sees them failing constantly.

Re:Most likely that...

[rbarreira]

No, it's quite a lot more likely that Sony has a bunch of easy vulnerabilities that no one cared to probe for before.

Now it's a pile on where Sony's crappy security gets exposed every day...

Re:does this expression require children be involv

[theskipper]

There's something oddly recursive about that statement.

Please subscribe me to your newsletter.

What's with the math?

[shumacher]

Okay, the Ponemon Institute claims the average data breach cost per record in 2010 was $214. Sony exposed 77,000,000 records in the PSN breach. Ponemon has a corporate shill From TFA:

Sony is expecting costs related to its online security woes of 14 billion yen ($173 million), covering customer support, freebie packages, legal costs, lower sales and measures to beef up security.

calc.exe tells me: 173000000/77000000=2.2467532467532467532467532467532 So, how is it that this is costing Sony a little over 1% of Ponemon's estimate?

Re:What's with the math?

[Anonymous Coward]

economy of scale ?

Re:What's with the math?

[Anonymous Coward]

Exactly what I was wondering - $173 million isn't nearly enough for Sony to even care about. Going with the $214/record number would put Sony at $16.5 billion in costs. Maybe that number would help Sony understand that they need to shift their focus from consumer device security to internal security. I can't imagine that any of their anti-piracy schemes or other supposed security mechanisms on consumer devices has actually generated $16.5 billion in profit (or any profit, honestly) for them...

Re:What's with the math?

[bhtooefr]

Sony will need to minimize the apparent impact of this, though, to their shareholders - otherwise, the bleeding gets far, far worse. Hence why Sony would share a much lower number.

Re:What's with the math?

[Noughmad]

1. Sony is covering its losses. Besides it being difficult to measure, would you admit to your shareholders that you lost that much of their money?

2. I'm not really into Pokemon.

Re:Incomplete quotation

[Anonymous Coward]

Let me give you the real quote here: "E-mail, password, and names of thousands of users were exposed via text file on Pastebin.".

Sony bashing time again ?

I almost feel bad for them.

[Anonymous Coward]

I DO feel bad for myself and all PSN users. SONY should have -- and most importantly, could have -- done better.

Re:I almost feel bad for them.

[ddd0004]

Good thing you said almost because that's like feeling bad for the guy mugging you when he trips and falls when running away. You are right. PSN users are the ones who are really losing out on this deal. Any number of people could have access to your data now.

Wow... just wow...

[Hamsterdan]

It's almost eery...

They're either...

1- Very incompetent on the security side
2- Very unlucky
3- Pissed off the wrong people

I think 1 and 3 pretty much covers it...

IMO, I think someone is after blood, and it won't be pretty...

Re:Wow... just wow...

[Anonymous Coward]

Well, hopefully it won't come to blood, but you have to worry a little bit about the 15 year hacker who ends up dead because he ticks off the wrong people at Sony. Hey - I'm not saying that Sony has any Japanese mafia connections, but there is such a thing as the Japanese mafia. From what I understand, they wouldn't think twice about taking somebody out to send a message.

It's probably Apple

[__aasehi2499]

They're going to try and release another game system again, but they need a little less competition. ;-D

Not a Sony fan but...

[GigG]

Let's face it. If it is connected to the internet it can be hacked by outsiders. If it isn't it can be hacked by insiders. It is no different than banks. We hand them our money. It doesn't matter in the least to me if my bank is robbed my money is protected. Obviously we need some similar protection with our data.

Re:Not a Sony fan but...

[bhtooefr]

The difference between money and data is, you never lost your data, it was just copied.

Money, if you lose it due to such an attack, can be replaced via various mechanisms. Personal data, the only way to replace it involves losing your job, all of your friends, and your relatives, and going into a witness protection program.

Feel Bad?

[Anonymous Coward]

I think the apt expression in this case is -

You reap as you sow.

Typo in above.

[shumacher]

Sorry, meant to say:

Ponemon has a corporate shill feel to their research, IMHO, but I can't imagine they're that far off. From TFA:

I guess I should have used the preview button.

Re:does this expression require children be involv

[Securityemo]

The stop condition is "when a fucker that fucks someone that ain't fucked over anyone, in a particularly upsetting manner, in recent memory, gets fucked, the fucker fucking this fucker doesn't deserve to be fucked."

It's simple. A child could understand it.

New Slogan:

[proxy318]

Sony: Where security is our last priority.

Re:Incomplete quotation

[Haedrian]

If the passwords were properly hashed (with a good salt) and were strong enough such that a dictionary attack couldn't break them, you wouldn't have 'thousands' of leaks.

Worthless company

[Anonymous Coward]

I don't feel bad for Sony. They have sued enough people to pay all of these damages and then some. This is the exact reason they are getting attacked. If they weren't jerks to start off then people might have a little respect for them. Since they don't care about people, people don't care about them! That is just the facts.

Re:does this expression require children be involv

[N!k0N]

The stop condition is "when a fucker that fucks someone that ain't fucked over anyone, in a particularly upsetting manner, in recent memory, gets fucked, the fucker fucking this fucker doesn't deserve to be fucked." It's simple. A child could understand it.

Certainly shows the versatility of the word...

Fault

[Anonymous Coward]

Is it ever a woman's fault that she gets raped?

No. Blame rests with the people who perform the illegal action.

What if she dressed provocatively?

Still not her fault.

What if she dressed provocatively and was in a bad part of town late at night?

Still no. There may have been some bad judgement calls on her part, but it's still not her fault.

What if other people warned her that it was the bad part of town and she might be at risk if she went there?

Okay, she was definitely showing bad judgement, but still not her fault.

What if after being told that she went to that part of town, late at night, dressed provocatively, and started slapping anyone she felt "looked like a thug" and dared them to rape her?

Well...

And last week she ran over your dog, and when it looked like he might have gotten off with just a broken leg she put the car in reverse and backed over him again?

Okay, it's never a woman's fault if she gets raped, and you really shouldn't wish it on anyone. But there comes a point where if you take a certain amount of glee in bad things happening to people who've been total asses to you and have been engaging in clearly reckless behavior then i think you can be forgiven for your technically inappropriate response.

its about time this happened

[Anonymous Coward]

no corporation anywhere takes security seriously*. This beat down is hopefully a big enough event to make other companies realize collecting personal information has a liability associated with the revenue stream. I'm not naive enough to hope that corporations will start caring about security. Maybe if the gov gets involved and passes 'lemon laws' for software we can get some quality/security.

*defense contractors are an exception because their revenue, right now, in front of their face, is dependent on security.

Get off your high horse.

[Anonymous Coward]

Okay Sony has done some pretty crappy stuff. But what I can't stand is these people who are saying Sony is getting whats coming to them by being hacked. In case you haven't been reading the Sony hacks are stealing PERSONAL INFORMATION. This isn't about Sony, this isn't about 'Getting even' this is about some jerks with too much free time and too little morals trying to get a quick buck by screwing over Sony's customers. It's like Robin Hood decided to steal from ordinary citizens who payed taxes to the king because they support the king, then buys himself a HDTV.

tldr: Hackers are targeting Sony to steal customer information not to 'get back at Sony'

Re:Get off your high horse.

[Nabeshin99]

Just realized I hadn't made an account so didn't want to be Anonymous Coward anymore.

Hacking Sony is basically a meme now

[rebelwarlock]

Not referencing attacks on Sony, but the actual act of hacking them has become mainstream. I'm sure it's funnier from our side than theirs.

Re:Hacking Sony is basically a meme now

[VortexCortex]

Not referencing attacks on Sony, but the actual act of hacking them has become mainstream. I'm sure it's funnier from our side than theirs.

I can confirm this -- I even hear this at work.

Hey, 'tex, check out this script kiddie trying to get in with ancient Apache server exploits.
Does he think he's trying to hack Sony?!

(P.S. Not that I actively exploit them, but even attack toolkits have known vulnerabilities; Just something for any aspiring script kiddie to think about...)

Is "Suffer" a good word here?

[idontgno]

As much as Sony seems to attract this kind of attention, maybe "secretly enjoy" would be more accurate.

What I'm seeing is a bizarre attention-seeking behavior, playing into a victimization mindset.

IANAPs (I Am Not A Psychiatrist), though. Just reminds me of a lot of dramawhores I've know.

Did they piss anyone off? Yes; Are they dumb? Yep.

[VortexCortex]

The bad guys heard in the news, "Sony hacked -- Cause: Unpatched Apache web servers," and just realized, "Holy shit that's the dumbest thing ever! Sony is totally crackable; Let's go crack the other vulnerable Sony servers -- If they were dumb once, they were likely dumb all over the place!"

Granted, pissing off a bunch of hackers/crackers is not a smart move, but being known for having poor security practices is even worse.

Re:does this expression require children be involv

[VortexCortex]

The stop condition is "when a fucker that fucks someone that ain't fucked over anyone, in a particularly upsetting manner, in recent memory, gets fucked, the fucker fucking this fucker doesn't deserve to be fucked." It's simple. A child could understand it.

I'm glad you like the word "fuck"; However, it has clouded your logic. You just said: When someone who doesn't fuck any others has recently been brutally fucked, the person that fucked the innocent person does not deserve to be fucked.

In short: The Bad guys can hurt innocents, and the bad guys don't deserve any retaliation. I don't think that's anywhere close to a stop condition. I think that spawns a new train of fuckers fucking, or at least one new fucker, due to the revenge said innocent is likely to seek, and or promote others to seek on the Innocent's behalf.

I suggest using less expletives; It may help you express yourself more clearly.

Corporate Culture and Security

[Anonymous Coward]

As someone who's worked inside a high tech multi-billion dollar company's security team, let me share with the company psychology when breached. The first hole found in the infrastructure that it used to penetrate causes mayhem. It is all hands on deck. Then someone finds another hole with similar severity. More mayhem. More hands on deck. As more holes are found, indifference sets in because at that point IT knows the problem is systemic and would require senior execs to admit incompetence. So IT tells business, this is a long term project (read, cannot be fixed) and they just have to suck it up. Some band-aids are applied, a multi-million dollar project is spun up, more employees are hired (under the same incompetent bosses) and everyone lives happily ever after.

Consoles suck. PC's rule!

[Anti Cheat]

This makes me want to return to the old days. You know... A time when some people setup or rented a game server out of their own pocket so everyone could have fun. The only thing you had to worry about back then was if an admin kicked you off for acting like a fool or you got caught cheating and you got banned. They didn't even know who you were.

Thanks to Sony and some of the other game companies, they saw profit in that free online play and killed off the game communities by removing the server code or crippling it so badly it wasn't fun anymore. They got rid of the game communities that cared about fun and not profit.

So now when you play online you have to worry about identity theft and your credit card number being stolen. Gee that's great. But if you think for a moment that this is only a Sony issue, you are fooling yourself. Sony is just a public target at the moment to get people to rethink doing business with Sony. So what about the others? Who is out there not looking for publicity? Just someone looking to get into your wallet. But most people are sheep and as soon as the press loses interest they will still give Sony whatever Sony wants, just like they will trust EA, AcT ans all the others.

Those free servers we all used in the old days don't look so bad now. All they recorded was your GUID, an IP and your NIC. Makes whining about privacy invasion because someone could look at your stupid dynamic IP and your handle seem rather lame now. Those same idiots bought consoles. Gotta love those consoles. Good choice... Pffft

Again??

[Anonymous Coward]

If it kept on, /. will have to create a "Sony hack of the week" section

Cyber Terrorism?

[Techogeek]

Sony may not be a pristine white angel, used excessive measures for protecting their intellectual property, and retracted a few features that made their products more appealing to the geeky part of prospective customers. But this, this is going way way too far. What would we do without Sony if they were to wither and die under all these attacks? Whoever is behind this obviously is no longer trying to hurt Sony, but crush them while they are down licking their wounds.

Re:Cyber Terrorism?

[Anonymous Coward]

Could be. There has got to be more than a single entity at work doing this. I not sure who I feel more sorry for, Sony, or their customers. I'm leaning more towards their customers though.

Re:Cyber Terrorism?

[Anonymous Coward]

Four questions for you.

Yeah? And? So? What?

Fuck Sony. And fuck you, incidentally, for trying to compare a murderous act like terrorism to some jokers taking down a few servers that weren't patched. I don't see anyone dying, I don't see anyone hiding in their homes for fear of being blown up in a public marketplace. Only an American would be so ignorant.

Re:Cyber Terrorism?

[Anonymous Coward]

What a troll. Who pissed in your Cheerios this morning?

Re:Cyber Terrorism?

[Techogeek]

OK, Mr. Anonymous Coward. Why don't you re-post that with your /. nick instead of spewing slander under anonymity? Your comment was not only rude and vulgar, it was also very much racist. And, FYI, I am NOT an American you tool!

Re:Cyber Terrorism?

[command_override]

Four questions for you.

Yeah? And? So? What?

Fuck Sony. And fuck you, incidentally, for trying to compare a murderous act like terrorism to some jokers taking down a few servers that weren't patched. I don't see anyone dying, I don't see anyone hiding in their homes for fear of being blown up in a public marketplace. Only an American would be so ignorant.

Before you trash talk someone you might want to get your facts straight. Cyber Terrorism, go look it up. http://en.wikipedia.org/wiki/Cyber_terrorism It has nothing to do with murder at all. Someone mod this post as flamebait please and mod the parent up for an insightful comment.

Maybe it's time for a new template?

[socz]

here's my 1/2 assed attempt at the legendary template:
(BTW - the filter almost prohibited me from posting this!)

(Inevitably, in every thread about Sony, someone proposes a reason with one or more flaws. This is a handy form that passes the lameness filter and that can be reused for all such posts to save time! It does not specifically address all possible flaws and may be expanded in future versions.)

Your post advocates a

( ) technical ( ) legislative ( ) market-based ( ) vigilante

approach to arguing for/against Sony. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which vary from state to state.)

( ) Sony is a corporation that has no heart, and apparently no head/brains either.

( ) Sony is a entity that exists all over the world in every country.

( ) As noted above, also have far reaching arms of the law.

( ) Is known to haplessly sue any individual/website/company that may violate its opinion of use of their products.

( ) Organizations such as Anonymous will only enable further actions

( ) Organizations such as Anonymous will be used as a scapegoat for attacks

( ) Grey hats will test their network, upon finding quantity of holes will become blackhats and obtain more money from those interested in users data.

( ) Users of PS3s will not put up with it

( ) Users of PSPs will not put up with it

( ) Users of PCs will not put up with it

( ) Requires too much cooperation from law enforcement

( ) Requires cooperation from too many of your friends and is counterintuitive

( ) Requires immediate total cooperation from everybody at once

( ) Anyone could anonymously destroy anyone else's career or business

( ) Ideas similar to yours are easy to come up with, yet none have ever worked

( ) Other:

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it

( ) Legal precedence in previous court actions

( ) Lack of centrally controlling authority for Sony

( ) Open relays in foreign countries

( ) Asshats.

( ) Jurisdictional problems

( ) Unpopularity of weird new taxes

( ) Public reluctance to accept weird new forms of money

( ) Huge existing software investment

( ) Susceptibility of protocols other than * to attack

( ) Willingness of users to install OS patches received by Sony

( ) Armies of worm riddled broadband-connected PS3 Consoles

( ) Eternal arms race involved in all filtering approaches

( ) Extreme profitability of break-ins

( ) Joe jobs and/or identity theft

( ) Technically illiterate politicians

( ) Extreme stupidity on the part of people who do business with spammers

( ) Dishonesty on the part of crackers themselves

( ) Bandwidth costs that are unaffected by client filtering

( ) Outlook.

( ) Other:.

and the following philosophical objections may also apply:

( ) Any scheme based on opt-out is unacceptable

( ) Hardware should not be the subject of legislation

( ) Blacklists suck

( ) Whitelists suck

( ) Plaintext Databases suck

( ) We should be able to talk about Viagra without being censored

( ) Countermeasures cannot involve wire fraud or credit card fraud

( ) Countermeasures cannot involve sabotage of public networks

( ) Why should we have to trust you and your servers?

( ) Incompatiblity with open source or open source licenses

( ) Feel-good measures do nothing to solve the problem

( ) Temporary/one-time email addresses are cumbersome

( ) I don't want the government reading my game stats

( ) Killing them that way is not slow and painful enough

( ) Other:

My past experience with Sony items marked below are partially/entirely the basis for my reasoning:

( ) betamax tapes

( ) walkman

( ) discman

( ) radios

( ) stereos

( )

So, ready for FOSS games?

[marcosdumay]

You know, there is a class of software were YOU have control of what feature goes in or out of.

(And that isn't a Soviet Russia joke, altought "In Soviet Russia your software controls YOU!" is quite interesting.)

It's Howard Stringer's fault

[Anonymous Coward]

They didn't have these problems before Howard Stringer took the helm. Sony might be doing okay in the area that's his specialty: recorded entertainment, but it's been gasping technology-wise. Dump him.

I love my Sony Playstation 3 (tm)!

[AbRASiON]

I am a PS3 fan, I love the games, I was wary of Microsoft and the 360 after them completely disowning the Xbox 1.
I own over 20 legitimate games for my PS3, I own several PSN games.

Fuck Sony, they pushed and they pushed and they took things away, they litigated the shit out of Geohot (who was a scapegoat, a group of hackers had a 90 minute video on how to hack the PS3 weeks before Geohot released the code)

They deserve all the shit they get, they continue to piss on the community. ALL I wanted was XBMC for my PS3, it's all I ever wanted but they took away the linux loophole (2 years ago) they took away linux (6 months ago) their attitude stinks and they deserve all the shit they get.
Don't antagonise the hackers, these idiots basically put a stick in the beesnest and wondered why they got stung.

SRP protocol

[mmogilvi]

If you can pick or control the overall authentication protocol, it would be even better to only store the s and v parameters from the Secure Remote Password (SRP) protocol. Pick a good underlying hash function H(), such as in the parent post. SRP uses some fancy zero-knowledge proof / public key algorithms (fairly interesting if you study it) to significantly reduce attack cross-sections for a much wider range of attack scenarios than just a hashed password, even when the password is weak.

Unfortunately, the most common situation is a web browser using http or https, and I don't know any way to use SRP properly in that context. Perhaps implement a secure tunnel on top of http in javascript and send all data through that - but that is totally tedious and impractical, probably can't work with images, and doesn't prevent MITM (man-in-the-middle) attacker from replacing the javascript in a way nearly impossible for either end to detect.

Someone ought to define a way to delegate a web apps' password validation to the SSL layer of the https connection, which would then use SRP to do the validation. Find ways to make it hard for attacker to force a downgrade to less secure authentication, for example by making the browser remember what web sites have used SRP in the past, and refusing to use weaker authentication protocols for them ever again. Done well, this would also reduce vulnerability to should-not-have-been-signed fraudulent certificates.

HHIEP 2010-2020 Anonymous the precursor

[Anonymous Coward]

The problem you're describing stems purely from your misuse of the concept "community" where it's inappropriate as well as the similar wrongful misidentification of and inclusion of Anonymous.

Many including anyone who is a "blackhat" knows that the group classification "blackhats" (plural) is nothing but separate "individual" points of interest sharing nothing but their (non-)ethical stance on use of (information technology) tools and methodology.

There is no community. There might be, at most, accidental collaboration, intentional trade, and business networking, but these things do not make a community except to lazy minds.

As to Anonymous it is nothing so simple as "blackhat" or "whitehat" or even "greyhat". Nor is Anonymous a community in the sense that a community is a stable group of likeminded codependent cosupportive individuals. Anyone who has been up and close with Anonymous and experienced the torrent of seemingly brownian motion of signal and noise that makes its "body politic" should understand that these things are antitheses to what Anonymous is.

Anonymous is a meta-attack and a meta-defense, a proto-hive, a hyper-consciousness, a mind-meld: Anonymous includes everything and the "strongest" most atomically approved of and supported "thoughts" direct it. Anonymous is will.

The "actions" of Anonymous are nothing but wave-tops in fluid refraction patterns of "thoughts" where every individual and resource makes the sea.

That's why you are Anonymous if you wish. That's why Anonymous must be legion. That's why Anonymous can't ever forget.

Anonymous is a nothing enabling anything, an anti-structure, and if one understands this one will also understand that Anonymous is both always and never misused. If it makes it easier feel free to think of Anonymous as an unlimited magic eightball that anyone and everyone can add notions to and continually shake as much as they want and obey as they wish when they wish. And sometimes that gives effects, i.e. it "works".

Anything Anonymous has ever done has been polarizing: one either supports it or opposes it, anything that ever has merit or a lack of merit is polarizing, any Anonymous channel is polarizing, both signal and noise is polarizing, everything in Anonymous is a splinter, is a fracture, and it is supposed to be that way. But if you seek out Anonymous, even if you are only lurking or taking notes for others then you have become a tiny part of it, adding to the mass of the sea.

If one wanted to try to destroy Anonymous one would have to structure it, order it, smooth out the creases, regiment it. And even then one would have to do it completely and without failure in a very short amount of time in order to "crystallize" it or one would fail. Noise can be signal, "signal" and "noise" only depends on what you are interested in hearing, it is not intrinsic but subjective.

Anonymous had to happen sooner or later, it is part of our "technologically evolutionary" pathway.

Expect us, after all you are already here :)

How many universes of computers do you have?

[Anonymous Coward]

Not very likely except as mere tokens of evolutionary selection and pressure. There has so far been exactly 2 trials of suspected Anonymous participants despite the private and public availability of many thousands of IP-addresses and neither verdict was directly related to Anonymous participation but instead to botnets. Everything else is just soup and cold increasingly irrelevant, silently degrading, and meaningless data of the "because we say so" kind that is at best circumstantial evidence to a good lawyer and a direct insult to any technologically savvy judge and jury.

By the way those two verdicts did not truly result in any significantly detrimental effects to the accused; a slap on the wrist and a legal ruling saying that in their jurisdiction DDoSing is not criminal...

You don't think there are countries supporting the attack on Sony, countries looking the other way, countries in effect ignoring any Sony request, and countries without any ability to meet any Sony requests?

It's not like we're talking about spam-king creeps where the mail server has to be backtraceable and more not to automatically be classified as spam.

There are about 200 countries in the world and millions of nodes. If you do things right over 9000 hops is no problem and you can have the payload change appropriately at each hop to even defeat a hypothetical internet-wide simultaneous packet inspection, protocol limitations are easily avoided, there is no reason not to establish private gateways, no reason not to use protocol translation or subvert others to automatically do it for you without human intervention, no reason not to use and loop through all kinds of networks and transient nodes, no reason not to use innocent public facilities as one-to-many or many-to-one triggers and sub-node redirection points.

Good luck unwinding that!

Keep it up kiddies

[ThatsNotPudding]

and we'll end up with as much on-line privacy as one taking a dump in a transparent toilet in Times Square. Anonymity will be a felony and all our traffic will be routed through Morality Police / Think of the Children Central.

Re:does this expression require children be involv

[shentino]

The moment the innocent seeks revenge, he ceases to be innocent.