Exactly. People were making supercomputers and computing clusters with PS3 when it was possible to install Linux on them. It was at least partly because it was cheaper than paying for full-priced hardware.

http://phys.org/news/2010-12-air-playstation-3s-supercompute...

Wasn't the PS3 originally sold at less than material cost which made this very economical for that kind of use case?

Also means it was in Sony's interest to sell many more games/accessories/licences/however else they make money with the PlayStation ecosystem than consoles.

Interestingly enough, none of the consoles in the most recent generation (PS4 / Xbone / WiiU) were ever sold at a loss leader price. They were all profitable at their release prices (400 / 500 / 300) from the get go.

Source? I seem to recall that the WiiU was sold at a loss from the get-go, but I may be confusing that from around a year later when they cut the price down to $250.

The hardware cost less than the retail price, but they had to recoup development costs. They claimed that the purchase of just one game was enough to make the console purchase profitable.

The WiiU hardware is previous generation class of hardware and nothing it uses would cost the price they sell it for. Same thing for the Wii at the time, it was never sold at loss.

> it was never sold at loss.

That is incorrect: http://www.theverge.com/2012/10/25/3552686/nintendo-wii-u-lo...

The PS4 hardware became profitable after about 6 months, at launch it was described roughly as a loss that'd be offset by the buyer also getting a PS Plus subscription.

> They don't do it initially to lock the purchases so much so as to ensure people aren't getting free hardware.

This is an interesting thought I hadn't considered until now.

This is why console development is expensive.

You have to rent your dev kit and you pay per update. This ensures the hardware is "below cost"

And second, open hardware means games will be pirated quickly after release. So again, less game sales and less support from game makers.

I'm not in the business, but I'm sure that the console makers, since they sell someone else's software, must probably take all measures to protect intellectual property. They must probably be able to demonstrate that to lawyers (and the lawyers for Electronic Arts may probably be of the most convincing type. )

What would make an "Other OS" feature enable piracy? Especially nowadays where the online service component is manufacturer hosted and controlled and we have access to relatively hard TPMs.

Sure, the hypothetical pirater now has access to device drivers and an open OS environment, but why wouldn't something like SecureBoot work to ensure that if you want to connect to the multiplayer / social network then you have to have loaded an unmodified OS as verified by the TPM.

No one said SecureBoot was a terrible idea technically, only that MS (and ARM/Android) were telling half-lies about a strong commitment to customers being able to make another OS choice, if they so choose.

>What would make an "Other OS" feature enable piracy?

It was an attack vector and it allowed the initial hypervisor dump[1], which led to the PS3 getting hacked.

1. https://en.wikipedia.org/wiki/George_Hotz#PlayStation_3_secu...

That's the security through obscurity model though. As fail0verflow continually notes in their blogs [1], piracy is the least interesting use case of exploits for them.

Yes, the additional attack surface available when loading a user-controlled OS is helpful in writing exploits. But Sony bungling the PS3's PRNG for code signing would have still been broken even without Other OS.

[1] https://fail0verflow.com/blog/2016/console-hacking-2016-post...

>That's the security through obscurity model though.

Not quite. "Security through obscurity" refers to obscurity being the only layer of security. PS3 still had encryption and in ideal world, if the software was completely exploit free then it would not be an issue. However, all real software has bugs, which could be exploited. Not making it easy for an attacker to find these bugs is the Security 101.

Do you open file system on your servers for read to everyone? Do you enable guest accounts on your systems? If you don't you are also practicing "security through obscurity".

>As fail0verflow continually notes in their blogs [1], piracy is the least interesting use case of exploits for them.

A search for e.g. "CFW PS3" will reveal a lot of people who are quite of opposite opinion.

You're being pedantic. Enabling or disabling another OS (while having the ability as the manufacturer to add hardware security mechanisms) is not STO in the same way that a guest account is. And furthermore, if my OS of choice has a security model that's so fragile that I don't trust guest accounts not to escalate then I've probably got larger problems.

Like most of HN, I'm familiar with the definition.

As to the group's feelings, I'll quote them, "On the PS3, we tried releasing the exploits and letting others sort out the community. The result was that, for all practical purposes, the only users were those interested in piracy." https://fail0verflow.com/blog/2015/console-hacking-2015-line...

The PS3 piracy script kiddies you highlight are exactly my point. Peek in on any of those communities and you'll be hard-pressed to find the caliber of technical skill required to engineer actual exploits. Hell, if it's not in (1) click this, (2) copy exactly this text, (3) ... form then you still see people bricking their hardware.

Remove the necessity of an exploit for running the interesting use cases (even an "Hardware will be opened up after 1 year of sales" promise as suggested), and suddenly the actually talented people are doing more interesting things than trying to assault your security model.

So you do keep guest accounts? In this case your security advice is appreciated but, I am afraid, is going to be ignored :)

> Peek in on any of those communities and you'll be hard-pressed to find the caliber of technical skill required to engineer actual exploits.

I am curious: so who, in your opinion, has been making all the CFWs for Xbox, Xbox 360, PS3, PSP, Vita, 3DS etc? Who made modchips, dongles and flashcarts for other systems? Who cracks PC releases? Space aliens? People eager to run Linux inside Call of Duty? People who need to run their website off a 3DS?

Most piracy users are dumb kids but it does not mean all people in the scene are. You only need one person to exploit the system and then the whole world can just copy the method.

>Remove the necessity of an exploit for running the interesting use cases (even an "Hardware will be opened up after 1 year of sales" promise as suggested), and suddenly the actually talented people are doing more interesting things than trying to assault your security model.

Why should anyone believe this? Do you have anything to support this claim? Here is an idea: if you are really running systems with enabled guest accounts as you implied - tell the board where they could be found. I am sure nothing bad is going to happen :)

You might want to drop the sarcastic smilies and "ip or it didn't happen" challenges if you're not trying to troll.

I told you I felt like a properly implemented OS validation/segregation model on custom hardware wasn't analogous to a guest account in terms of STO. You evidently feel differently, but haven't offered your reasoning. I'd be interested to hear it if you disagree that strongly.

As for piracy, the majority of the dongles, modchips, flashcarts, etc I've seen tend to be "take an existing POC exploit, package it up, put a logo and snazzy name on it, and try to make a quick buck off of someone else's work." See: https://m.youtube.com/watch?v=C4lJEOEd-_g&t=1m42s .

That seems like a biased presentation, but statistically speaking I feel like "most of those who can technically originate hacks have better things to do with their time than enable game piracy" is a pretty strong statement. Sure some will focus on that, and kudos to them for pursuing their dream. But if you enable interesting use cases by default then there are that many fewer people trying to break the security system to do something that could have been allowed in the first place.

Admittedly, I could be off base, so I'd be interested in any numbers or links you can offer in terms of piracy-first groups pioneering console hacks.

I repeat again, you misunderstand the whole concept of STO. Limiting the ways the system could be attacked is not STO but the mainstream approach to security. Neither disabling guest accounts on a private system nor disabling guest OS on a game console is STO by any definition. It's a sane approach to securing system and Sony was stupid enabling the guest OS in the first place. They seem to have learned their lesson, PS4 does not come with one any more (and the man behind the whole idea of turning the Playstation into a general purpose computer had been removed from the power).

As for piracy, I don't get your point. While I agree that most pirates do not discover exploits themselves, somebody had to do it first. You cannot copy something that does not exists. And, seeing how most CFWs do not run Linux, I ask again, who in your opinion developed the original exploits? I get it that most people copy them. Who wrote the original ones?

>That seems like a biased presentation, but statistically speaking I feel like "most of those who can technically originate hacks have better things to do with their time than enable game piracy" is a pretty strong statement.

I agree that most people capable of cracking a game console do not care about it in the first place. However, most people in console scene only care about piracy. Take a look on http://psx-scene.com/ for example. See many Linux enthusiasts swapping tips on configuring their distros? People do not spend years cracking consoles because they desperately need to run Linux but have no hardware available.

I just wanted to emphasize that the console maker, somehow, has to to demonstrate it takes appropriate measures to protect intellectual property. If the lawyers of the game publisher can prove that they are legally forced to use all measures technically available, then they will comply.

The fact that there exists other, less or more secure, operating system is not a question here. It's just the relationship between, say, EA FIFA 17 legal team and Microsoft game distribution team.

And since so many games have a multi-player component, they also have to protect the integrity of online play.

I'd buy a console if one of the companies makes a commitment to open it up after X amount of sales. They can keep that number as high as they want, but I'm sure lots of folks would be interested in such a promise.