http://www.ktemkin.com/faq-fusee-gelee/

Kate has collected and answered the most common questions she's gotten regarding Fusée Gelée. Most notably she explains the three "types" of FG hacks, software, hardware (temporary) and hardware (permanent).

Enjoy!

Kate herself responded to this thread on page 26, thanks Kate!

There's a lot more here than I can easily respond to, so apologies if I miss posts or gloss over points.



This is correct-- while there likely will be software chains around for these things in the future, I don't see them as coming along as quickly as f-g. We don't have a non-coldboot exploit chain at all for 5.0.0-- and we haven't looked yet, as we've had other things to focus on and coldboot works. We do have one for 4.1.0, but it's centered around a couple of exploits that we don't want to burn-- we're hoping to use them to get an opportunity to poke around inside T214/Mariko.



I don't view you as particularly hostile, no. I don't know if challenge is generally a good thing-- sometimes you do have to accept that other people have different ethics or viewpoints from yourself and let that pass, especially if they're just doing stuff for fun-- but I don't view your post as hostile.



Jamais Vu (1.0.0 TrustZone hack) isn't my bug, but has been written up, and is just awaiting someone with the skills to have time to do a public interpretation. Déjà Vu is currently centered around the exploit I mentioned above, and we definitely want to hold onto that for as long as it's applicable. It's entirely a Switch bug, too, so I don't see it as being something that needs responsible disclosure.



For Déjà Vu, absolutely. (explained in last quote)



I don't agree that things like tweeting are ego. This is something I work on because I find it a lot of fun to hack on things, and there's definitely an aspect in which it makes me happy when seeing the results of things makes other people happy. There's also an aspect in which I hope that showing these things are possible inspires people to want to learn e.g. reverse engineering. This stuff is cool; and I want to share the excitement with others and lift them up as much as I can.

You don't have to believe me on that or like that that's my goal. I won't hold it against you if you don't.



I honestly support people updating when it makes sense; and I recognize that there's a conflict between holding back information and enabling others to make reasonable decisions about that. I don't like or feel good about secrecy, and I know it has implications. I've tried to be as clear as I can about the costs regarding updating without crossing the line into giving things away.



I think we've been pretty clear that 4.1.0 will eventually see a non-coldboot, software-only exploit with the same level of power. That's actually been posted on the ReSwitched Discord's FAQ for months, but I know the message gets skewed as its gets communicated over to other places. That's part of why I'm here, now-- I want to help clear things up.

The interactions between the operating system and the bootloader-- say on reboot-- are actually fairly limited; and knowing what any of them are is enough to point people at the particular section of bootrom that's vulnerable. That's why I'm not commenting on Fusée Gelée and how it relates to software-only solutions right now. I have said e.g. above that since there's no public way of getting the privileges necessary to run things, 4.1.0 isn't going to see a pure software solution that the public can use at the time that f-g is released. Software exploits will likely come in time; and it's possible we'll come up with things that are even easier than f-g.



I'm not sure if they'll take it seriously enough. I don't know how they are internally-- but I can't just assume they'll fail to do anything and skip disclosure. Honestly, I don't think a "security advisory" is really a bad thing, either-- there are definitely applications of Tegra chips that I and/or the public don't know about. If giving NVIDIA notice gives them time to explain exactly what's dangerous and allow their customers to remove and replace units from places where the vulnerability can cause harm, I consider that a win, and well worth delaying some public switch hacks by a few months.

I'll also say that my fear that vendors won't take the vulnerability seriously is a huge reason I'm so keen to get things out there-- and why I provided a date after which I'll tell the public what's going on that I've said was non-negotiable. I want to make sure this doesn't get hidden, and that people understand exactly what f-g can and can't accomplish, to minimize FUD while also letting people understand the actual risks are associated with using a vulnerable device.



It changes this from an exploit that's going to be usable before the affected people know it's a thing to something that people may have a chance to react to. Making the vulnerability public without disclosure really increases the odds someone is capable of using it to do bad.

I didn't really give NVIDIA a chance to sell-off stock; though. I've said publicly multiple times that there are bugs in Tegra processors well before NVIDIA reached out to me seeking disclosure. If anything, I think telling the public that these vulnerabilities exist while pursuing disclosure helps developers interested in using Tegra chips in the future ask the right question.



I've already said that while pure-software stuff is doable on 4.1.0; it'll be a wait. As far as I'm remembering, the only part of the chain that could require multiple tries to work is PegaSwitch, which is our browser-based entry point, and I haven't even tried the browser entry point that'll eventually be public to see how reliable it is. SciresM did the work to get our non-coldboot exploit working on 4.1.0; not me.



Yeah, that's hard-- especially as everyone has a different view as to how inconvenient things are. I don't know of a way to communicate this better without more details.

Incidentally, the 'inconvenience' verbiage came from SciresM and I discussing our respective views on updating. I think SciresM is more towards the opinion that people should hold back more often, where I'm more of the opinion that updating can be a good and reasonable option sometimes. The way we wound up phrasing things is a compromise between views.



(I'm going to assume this meant "on the hacking side". If not I'm not sure what hacking site you're referring to.)

Updating to latest just closes the possibility of using software exploits launched from Horizon, which can make setup more difficult. I know you'd like to know how much, but I unfortunately don't have a good way of qualifying that. As I've mentioned, if you're suffering from not being able to use your 3.0.1+ Switch, you probably do want to upgrade and just risk things being more inconvenient in the future. Worst comes to worst, if you decide you can't tolerate the inconvenience, you upgrade and then wind up having to figure out a modchip.

The downgrade protection fuses literally mean nothing to a system with f-g, which can entirely skip the downgrade check. Incidentally, SciresM actually accidentally bricked one of his systems in a way such that it was always failing the downgrade checks, and he's been able to use f-g to get that system up and running again.



I don't think that's clear at all, nor do I want to confirm or deny this. Sorry.



I think you're making a bunch of assumptions here, and that's maybe not a great idea. I'm not saying you're necessarily right or wrong; just that I don't think your assumptions are founded.



I don't think this contradicts. This is talking about vulnerabilities that aren't f-g; not because f-g doesn't work on 4.1.0, but because it's possible we may come up with vulnerabilities that are even nicer on 4.1.0 in the future.



I'm being as clear as I feel I can, and adding clarifications e.g. here where I think it helps. There will be different names for the the ways you can use f-g eventually; and I'll be fully open about everything once the summer rolls around and I'm not putting the disclosure timeline in jeopardy.



I know and have said about that this "bring your own exploit" business makes development exclusive, and that's exclusionary and I really don't like it-- I just don't see a way around it. I would love to get more developers and more perspective, and that's why my release date for f-g is tied to my disclosure timeline and not in particular to Atmosphère's release.




I've tried to point out approximately what the difficulty would be for some of the options to kind of provide this, but this is a hard thing to accomplish. In this case, providing details that are more specific really points a finger at vulnerability details, so there's not much I'm comfortable sharing. I've shared what I could-- as a data point, some of the other teams have outright stated that they think I've shared too much already and made things obvious. I don't agree or necessarily care about their opinons, but c'est la vie.



Well, this isn't the case. This has been disclosed to Nintendo, too-- as NVIDIA shares their vulnerability findings with downstream customers. It's more general malicious actors that I'd be worried about.



See above-- but I don't think I'd advise specifically updating to 4.1.0 unless that gives you enough access to the games you want.



I'm also super glad that we can do a lot of our work in the open. I hope there's a lot more of it in the future-- and I'd love to stream some of it.



I find the requirement disheartening as well, but I think this is the right way to do things, for now. I've explained my rationale above; feel free to ask questions.



I'm not sure why people are against communication, here. There were definite benefits to talking about f-g in the first place; including that it demonstrates that Tegra chips are vulnerable-- which hopefully influences buying decisions in the future and puts pressure on NVIDIA to seek as much of a fix as they can. After that there seemed to be definitely benefits to talking about more details, even in the limited sense that I'm able to. I've tried to give people more information than the nothing they would have had so they could have more of an idea whether it's be a good idea to e.g. pre-order a modchip or update their system. I know it can be frustrating to not get full disclosure, and that more information would help people to make a better or more conclusive decision, but full disclosure isn't an option until this summer. I don't think that's a reason to hold back information.



I don't have specific answers to your questions, unfortunately-- but I think it sounds like the main purpose of this Switch is as a gaming device and maybe you should upgrade and enjoy playing games with your son.



I don't think that asking for clarification is criticism. It might be rude to push me to answer something I said I wouldn't, but I don't think there's harm in answer.



I don't think I've said anything about opening the console or not. See above for my views on updating?



I'm not sure where you got this impression, or why you're confident about things enough to claim you know about the internal values or working of ReSwitched. This is also easily disprovable just from public information--Hedgeberg has tested out f-g on stream. I don't see it as great opsec to enumerate how many people have access to the vulnerability, but we've long had a policy of only giving exploit details to those who actually want to know them and are in a position where they can use them to help. This is a basic security precaution and not about trust.

I'm actually not sure how this is relevant to the broader discussion. Based on your post history, I can tell that you strongly support TX and the option they're providing, and you're welcome to that, but I think throwing around generic unfounded criticism of RS doesn't do much good and distracts from me answering community questions.



I don't think they're obviously more convenient, as they exist right now. They're both inherently however-tethered-you-consider-PegaSwitch, take a bunch of time to run, and rely on a pegaswitch entry point.



That's not correct-- everyone on a current hardware revision will be able to install and use CFW the day it's released, if they're willing to put in the effort and potentially take on some minor risk.



I'm actually not sure what you mean by this entire post? Sorry about that-- I'd love to address your ideas, but unfortunately I can't figure out your meaning.



That was about me having fun by trying to see if a DIY, cheap modchip option is reasonable. It turns out it is. As you've noted, it's not necessary on any firmware. I just really like the idea that the open exchange of knowledge -- especially when profit's not a motive -- can result in creation of neat options for the community. ^-^



Yep; that's exactly what it means.



I don't think this has been at all implied-- and you'd be hard pressed to find a way to make a solder-less Arduino option that even remotely fits in the Switch case.

I should also clarify that the DIY option isn't solderless.

If you have or are going to get the game anyway, you can. Those versions are pretty much interchangeable in the long-term.



Yep-- and it's possible at some point that we'll allow you to install Fake News without Puyo using f-g/Atmosphère. The original plan was to release Atmosphère for 1.0.0 first while we tried to figure out how to deal with Fusée Gelée, but we actually wound up with a disclosure schedule that was faster than we'd thought.

 

[brickmii82]

If you have or are going to get the game anyway, you can. Those versions are pretty much interchangeable in the long-term.



Yep-- and it's possible at some point that we'll allow you to install Fake News without Puyo using f-g/Atmosphère. The original plan was to release Atmosphère for 1.0.0 first while we tried to figure out how to deal with Fusée Gelée, but we actually wound up with a disclosure schedule that was faster than we'd thought.

I was curious as to what the next lineup of projects you personally will pursue. The team as well, but I’m more interested in what you’re doing since you’re so .... open lol. At least here. It’s quite refreshing imo.

 

[subcon959]

Well, I think everyone should finally have enough of a handle on things now to be able to decide whether to update or wait.

 

[Risingdawn]

I hope people are appreciative of the time she's taken to answer your crap!

Ain't no way I'd be getting dragged into a conversation with opinionated little entitled keyboard warriors so you should be thankful; and leave it there.

 

[subcon959]

you should be thankful; and leave it there.

Kinda amusing that she is happy to answer questions and clarify things and non-devs have this sort of attitude (which btw is very keyboard warrior-y)

 

[Risingdawn]

Kinda amusing that she is happy to answer questions and clarify things and non-devs have this sort of attitude (which btw is very keyboard warrior-y)

I never excluded myself from that demographic

 

[notimp]

If giving NVIDIA notice gives them time to explain exactly what's dangerous and allow their customers to remove and replace units from places where the vulnerability can cause harm, I consider that a win, and well worth delaying some public switch hacks by a few months.

This is a fundamental misunderstanding on how responsible disclosure works "process wise". It takes a concession made on part of the public interest (we dont necessarily get a benefit if the flaw is not patchable), and turns it into a virtue.

To again make visible how large of a gap there is to be jumped, it deprives further use - out of a suggestion of "loss of life" or "imminent danger" - and both are concepts that dont drive corporate decision making in any direct way.

This is indeed a case where one party uses an "imminent danger" motive thats "conceptual" and unargued - and buys the company time to do development for future product cycles not the current one.

Also - my argument isn't based on theory - but on current practices in the field. If you know how many unpatched vulnerabilities in the "disclosed zero days" category are out there even in SCADA networks, being accessible over the open internet - the notion that those months in which - effectively - no exchange programs will happen (because no one cares about prevention, and everyone cares about mitigation) are given because of a moral virtue - is from my point of view pretty fundamentally wrong. As in more necessary "for the interaction with the company facing an issue" - than for their efforts to prevent harm. It also serves a "delegation of responsibility" purpose which is actually pretty healthy for the community of hardware hackers.

I'll also say that my fear that vendors won't take the vulnerability seriously is a huge reason I'm so keen to get things out there-- and why I provided a date after which I'll tell the public what's going on that I've said was non-negotiable.

And while this is a valuable position to hold (- especially if you put your clear name out there, but no - in general.. ), this was not what was criticised. What was criticised was a form of "virtue stacking" that was actively used to promote your efforts over those of companies that would use undisclosed zero days for commercial reasons.

In this specific case - where no sensitive data is in danger from the immediate application of the hack, which is more than you could say about commercial companies, that sell nation states access to peoples personal data in encrypted iPhones (highly regarded members of our society - of course) - the moral argument is inferred, and was not necessarily striking.

Dont engage in virtue stacking, when all the immediate effects of your need to engage in responsible disclosure actually hurt the public at large (mostly in "prolonged use" and "ease of use" terms) is the main message here. What you are doing is good and rectifiable, but not when used in a "and we have this over our competitors as well" marketing message in a public form.

Of course this is very specific arguing in this case - and should not be used as a shorthand for decisions in the future. Risk/benefit analysis always has to be done on a case by case basis. (And then mostly no one looks at it until something "big" happens...)

Also - because you touched on shorting stock options - also, not a moral no go by any consideration. I've heard journalists argue that "security research has to be payed for somehow" and "since its almost never publically financed..." - it would be the something of a "lesser evil" to break "trading rules that arent ever enforceable..." There, more moral ambiguity for your "we hope we can inspire future generations" part of the talk..

 

[Deleted User]

Why are you guys spouting all this garbage to Kate? As insightful as you believe you are, it's not doing anyone any good.

Aslo - because you touched on shorting stock options - also, not a moral no go by any consideration. I've heard journalists argue that "security research has to be payed for somehow" and "since its almost never publically financed..." - it would be the something of a "lesser evil" to break "trading rules that arent ever enforceable..." There, more moral ambiguity for your "we hope we can inspire future generations" part of the talk..

Really? You heard journalists argue over security research? Wow what a credible source (/s)

Just be glad with the answers you got, don't provoke a long back and forth with one of the key figures because not only will it change nothing for the better, it will waste everybody's time.

 

[notimp]

I believe this is "doing good".

I also don't believe that "that garbage you spew" and "as insightful as you may be" - can consist in the same message, without trying to f+ck over its general perception.

I also don't believe in weighing sentiments based on likes. If you dont have a process where you inform the public at large about concepts, and let democracy "take place" first. (If you dont know what you are putting your voice behind, you arent voting.)

I also don't believe that "why are you doing this to this poor woman", is the right sentiment this conversation should take.

 

[isoboy]

I believe this is "doing good".

I also don't believe that "that garbage you spew" and "as insightful as you may be" - can consist in the same message, without trying to f+ck over its general perception.

I also don't believe in weighing sentiments based on likes. If you dont have a process where you inform the public at large about concepts, and let democracy "take place" first.

I also don't believe that "why are you doing this to this poor woman", is the right sentiment this conversation should take.

"Conversation"? What, on this forum?

 

[notimp]

Eh, we try...

I believe the intent of Mrs Temkin to engage in direct conversation with this community was exactly that. To open a direct conversation channel.

And to be frank, we need that. (Or to be more specific, the opportunity to ask follow up questions, regardless of the platform. The "lets hear it from lurkers on their social" grapewine concept is not always working.. )

 

[subcon959]

Why are you guys spouting all this garbage to Kate? As insightful as you believe you are, it's not doing anyone any good.

Just be glad with the answers you got, don't provoke a long back and forth with one of the key figures because not only will it change nothing for the better, it will waste everybody's time.

One might also wonder what your motives could be to try to shutdown such discourse?

 

[Risingdawn]

One might also wonder what your motives could be to try to shutdown such discourse?

Probably he just understands how irritating it is, especially when 85% is just nonsensical "garbage".

All I see is:
"Mummy I want the cookie"
"soon dear"
"but I want it now!"
"Just wait dear"
"But what flavour is it? does it have chocoate, is it vanilla, does it have sugar icing..."
"You'll find out soon, now go play before you go on the naughty step"

 

[subcon959]

Probably he just understands how irritating it is, especially when 85% is just nonsensical "garbage".

All I see is:
"Mummy I want the cookie"
"soon dear"
"but I want it now!"
"Just wait dear"
"But what flavour is it? does it have chocoate, is it vanilla, does it have sugar icing..."
"You'll find out soon, now go play before you go on the naughty step"

But surely you understand the point I'm trying to make, it's not about whether a third party feels two people are having a worthwhile conversation. There is this drive lately to shutdown dialogue in general about important causes (not saying this is one of those, just trying to make a point) and it seems very strange. Is it because people are so used to be on the internet that they feel it is somehow their own personal space, and therefore even if someone else is having a conversation they feel the need to exert some sort of control on it?

 

[Soluble]

All I can say now is thankyou Kate for taking the time to reply to a lot of the questions raised in this thread, and be ready to copy and paste the answers continually for the next 10 pages!

 

[BL4Z3D247]

Yep-- and it's possible at some point that we'll allow you to install Fake News without Puyo using f-g/Atmosphère. The original plan was to release Atmosphère for 1.0.0 first while we tried to figure out how to deal with Fusée Gelée, but we actually wound up with a disclosure schedule that was faster than we'd thought.

This is good to know. I can't see buying a game that I'll never play(let alone read the menu options) just to hack a console(unless it's the only way) when I can update and hack it just as easily with a game I would play.

I'd like to personally extend my gratitude to you, ScriesM and the rest of the ReSwitched team for the hard and time consuming work you guys have done and are doing. Most of us here understand you guys and gals do this for fun and on your own time. I apologize for the others who don't and were rude, devs that do great things for the community don't deserve to be treated like that, especially when I've seen nothing but transparency from you and ScriesM. So thank you!

 

[yardie]

Acting like toddlers won't cause the cfw to release any earlier.

 

[Risingdawn]

But surely you understand the point I'm trying to make, it's not about whether a third party feels two people are having a worthwhile conversation. There is this drive lately to shutdown dialogue in general about important causes (not saying this is one of those, just trying to make a point) and it seems very strange. Is it because people are so used to be on the internet that they feel it is somehow their own personal space, and therefore even if someone else is having a conversation they feel the need to exert some sort of control on it?

I should stress that I'm not directing at you specifically but it looks more like an interview at best, interrogation at worst; rather than a conversation to me!

What Kate is trying to do is cut down on the rampant speculation, misinformation and mindless conjecture by answering some of the technical misconceptions regarding an exploit.

What she doesn't need is half page essays, full of convoluted rubbish about moral ambiguity, or some such nonsense, by users more intent on making themselves sound intelligent, yet failing miserably.

I mean Jesus, have you read some of that crap, it doesn't even make sense unless you paraphrase it and make some mental leaps in logic as to the intended point.

Kate's replies look like a post grad lecturer marking a GCSE paper; tolerant, patient, yet largely bemused and exasperated.

 

[Dan-the-Rebirth]

@ktemkin just to make sure: are you or anyone from reswitched save from any legal danger? I mean it wouldn't be the fist time a hacker gets silenced before releasing their work.

 

[subcon959]

I should stress that I'm not directing at you specifically but it looks more like an interview at best, interrogation at worst; rather than a conversation to me!

What Kate is trying to do is cut down on the rampant speculation, misinformation and mindless conjecture by answering some of the technical misconceptions regarding an exploit.

What she doesn't need is half page essays, full of convoluted rubbish about moral ambiguity, or some such nonsense, by users more intent on making themselves sound intelligent, yet failing miserably.

I mean Jesus, have you read some of that crap, it doesn't even make sense unless you paraphrase it and make some mental leaps in logic as to the intended point.

Kate's replies look like a post grad lecturer marking a GCSE paper; tolerant, patient, yet largely bemused and exasperated.

Yeah, I mean I can't really speak for anyone else but I get that not everyone has the ability to be succinct. You never know when there's a language barrier also. I do think it's worth putting up with that though if there are some valid points buried deep within. Others may not be willing to make the effort to sift through.

Take the responsible disclosure thing for example. I'm of the belief that if your motives are truly altruistic then you do much more by releasing the information quickly and putting pressure on corporations to do something about it. I really don't want to beat that dead horse anymore though so meh.

 

[reminon]

The fact of the matter is: an exploit that affects a multitude of devices was found. We don't know the scope of the affected devices, but an exploit this dangerous can lead to data breaches, and possibly even bodily harm depending on the device.

There's nothing wrong with Kate revealing that she has an exploit, and is even willing to disclose some info about it. There is definitely nothing wrong with a proper disclosure period. This gives nvidia the chance to rectify this mistake, and if they choose not to, then it's on them.

It would do no good to release it quickly. People are just impatient. If Kate were to have released it before disclosure, and hypothetically the flaw affects some medical equipment that causes the deaths of multiple people, while it may not legally be her fault, morally it would be. With a proper disclosure period, she is morally absolved if nvidia chooses to do nothing.

It's bullshit that you people are whining about having to wait, when you clearly don't have the skills to find and utilize the exploits yourself. They have no obligation to spoon feed you hacks.

It's also bullshit that TX know and understand how dangerous the exploit is, yet they give no disclosure just to retain profit.