http://www.ktemkin.com/faq-fusee-gelee/

Kate has collected and answered the most common questions she's gotten regarding Fusée Gelée. Most notably she explains the three "types" of FG hacks, software, hardware (temporary) and hardware (permanent).

Enjoy!

Kate herself responded to this thread on page 26, thanks Kate!

There's a lot more here than I can easily respond to, so apologies if I miss posts or gloss over points.



This is correct-- while there likely will be software chains around for these things in the future, I don't see them as coming along as quickly as f-g. We don't have a non-coldboot exploit chain at all for 5.0.0-- and we haven't looked yet, as we've had other things to focus on and coldboot works. We do have one for 4.1.0, but it's centered around a couple of exploits that we don't want to burn-- we're hoping to use them to get an opportunity to poke around inside T214/Mariko.



I don't view you as particularly hostile, no. I don't know if challenge is generally a good thing-- sometimes you do have to accept that other people have different ethics or viewpoints from yourself and let that pass, especially if they're just doing stuff for fun-- but I don't view your post as hostile.



Jamais Vu (1.0.0 TrustZone hack) isn't my bug, but has been written up, and is just awaiting someone with the skills to have time to do a public interpretation. Déjà Vu is currently centered around the exploit I mentioned above, and we definitely want to hold onto that for as long as it's applicable. It's entirely a Switch bug, too, so I don't see it as being something that needs responsible disclosure.



For Déjà Vu, absolutely. (explained in last quote)



I don't agree that things like tweeting are ego. This is something I work on because I find it a lot of fun to hack on things, and there's definitely an aspect in which it makes me happy when seeing the results of things makes other people happy. There's also an aspect in which I hope that showing these things are possible inspires people to want to learn e.g. reverse engineering. This stuff is cool; and I want to share the excitement with others and lift them up as much as I can.

You don't have to believe me on that or like that that's my goal. I won't hold it against you if you don't.



I honestly support people updating when it makes sense; and I recognize that there's a conflict between holding back information and enabling others to make reasonable decisions about that. I don't like or feel good about secrecy, and I know it has implications. I've tried to be as clear as I can about the costs regarding updating without crossing the line into giving things away.



I think we've been pretty clear that 4.1.0 will eventually see a non-coldboot, software-only exploit with the same level of power. That's actually been posted on the ReSwitched Discord's FAQ for months, but I know the message gets skewed as its gets communicated over to other places. That's part of why I'm here, now-- I want to help clear things up.

The interactions between the operating system and the bootloader-- say on reboot-- are actually fairly limited; and knowing what any of them are is enough to point people at the particular section of bootrom that's vulnerable. That's why I'm not commenting on Fusée Gelée and how it relates to software-only solutions right now. I have said e.g. above that since there's no public way of getting the privileges necessary to run things, 4.1.0 isn't going to see a pure software solution that the public can use at the time that f-g is released. Software exploits will likely come in time; and it's possible we'll come up with things that are even easier than f-g.



I'm not sure if they'll take it seriously enough. I don't know how they are internally-- but I can't just assume they'll fail to do anything and skip disclosure. Honestly, I don't think a "security advisory" is really a bad thing, either-- there are definitely applications of Tegra chips that I and/or the public don't know about. If giving NVIDIA notice gives them time to explain exactly what's dangerous and allow their customers to remove and replace units from places where the vulnerability can cause harm, I consider that a win, and well worth delaying some public switch hacks by a few months.

I'll also say that my fear that vendors won't take the vulnerability seriously is a huge reason I'm so keen to get things out there-- and why I provided a date after which I'll tell the public what's going on that I've said was non-negotiable. I want to make sure this doesn't get hidden, and that people understand exactly what f-g can and can't accomplish, to minimize FUD while also letting people understand the actual risks are associated with using a vulnerable device.



It changes this from an exploit that's going to be usable before the affected people know it's a thing to something that people may have a chance to react to. Making the vulnerability public without disclosure really increases the odds someone is capable of using it to do bad.

I didn't really give NVIDIA a chance to sell-off stock; though. I've said publicly multiple times that there are bugs in Tegra processors well before NVIDIA reached out to me seeking disclosure. If anything, I think telling the public that these vulnerabilities exist while pursuing disclosure helps developers interested in using Tegra chips in the future ask the right question.



I've already said that while pure-software stuff is doable on 4.1.0; it'll be a wait. As far as I'm remembering, the only part of the chain that could require multiple tries to work is PegaSwitch, which is our browser-based entry point, and I haven't even tried the browser entry point that'll eventually be public to see how reliable it is. SciresM did the work to get our non-coldboot exploit working on 4.1.0; not me.



Yeah, that's hard-- especially as everyone has a different view as to how inconvenient things are. I don't know of a way to communicate this better without more details.

Incidentally, the 'inconvenience' verbiage came from SciresM and I discussing our respective views on updating. I think SciresM is more towards the opinion that people should hold back more often, where I'm more of the opinion that updating can be a good and reasonable option sometimes. The way we wound up phrasing things is a compromise between views.



(I'm going to assume this meant "on the hacking side". If not I'm not sure what hacking site you're referring to.)

Updating to latest just closes the possibility of using software exploits launched from Horizon, which can make setup more difficult. I know you'd like to know how much, but I unfortunately don't have a good way of qualifying that. As I've mentioned, if you're suffering from not being able to use your 3.0.1+ Switch, you probably do want to upgrade and just risk things being more inconvenient in the future. Worst comes to worst, if you decide you can't tolerate the inconvenience, you upgrade and then wind up having to figure out a modchip.

The downgrade protection fuses literally mean nothing to a system with f-g, which can entirely skip the downgrade check. Incidentally, SciresM actually accidentally bricked one of his systems in a way such that it was always failing the downgrade checks, and he's been able to use f-g to get that system up and running again.



I don't think that's clear at all, nor do I want to confirm or deny this. Sorry.



I think you're making a bunch of assumptions here, and that's maybe not a great idea. I'm not saying you're necessarily right or wrong; just that I don't think your assumptions are founded.



I don't think this contradicts. This is talking about vulnerabilities that aren't f-g; not because f-g doesn't work on 4.1.0, but because it's possible we may come up with vulnerabilities that are even nicer on 4.1.0 in the future.



I'm being as clear as I feel I can, and adding clarifications e.g. here where I think it helps. There will be different names for the the ways you can use f-g eventually; and I'll be fully open about everything once the summer rolls around and I'm not putting the disclosure timeline in jeopardy.



I know and have said about that this "bring your own exploit" business makes development exclusive, and that's exclusionary and I really don't like it-- I just don't see a way around it. I would love to get more developers and more perspective, and that's why my release date for f-g is tied to my disclosure timeline and not in particular to Atmosphère's release.




I've tried to point out approximately what the difficulty would be for some of the options to kind of provide this, but this is a hard thing to accomplish. In this case, providing details that are more specific really points a finger at vulnerability details, so there's not much I'm comfortable sharing. I've shared what I could-- as a data point, some of the other teams have outright stated that they think I've shared too much already and made things obvious. I don't agree or necessarily care about their opinons, but c'est la vie.



Well, this isn't the case. This has been disclosed to Nintendo, too-- as NVIDIA shares their vulnerability findings with downstream customers. It's more general malicious actors that I'd be worried about.



See above-- but I don't think I'd advise specifically updating to 4.1.0 unless that gives you enough access to the games you want.



I'm also super glad that we can do a lot of our work in the open. I hope there's a lot more of it in the future-- and I'd love to stream some of it.



I find the requirement disheartening as well, but I think this is the right way to do things, for now. I've explained my rationale above; feel free to ask questions.



I'm not sure why people are against communication, here. There were definite benefits to talking about f-g in the first place; including that it demonstrates that Tegra chips are vulnerable-- which hopefully influences buying decisions in the future and puts pressure on NVIDIA to seek as much of a fix as they can. After that there seemed to be definitely benefits to talking about more details, even in the limited sense that I'm able to. I've tried to give people more information than the nothing they would have had so they could have more of an idea whether it's be a good idea to e.g. pre-order a modchip or update their system. I know it can be frustrating to not get full disclosure, and that more information would help people to make a better or more conclusive decision, but full disclosure isn't an option until this summer. I don't think that's a reason to hold back information.



I don't have specific answers to your questions, unfortunately-- but I think it sounds like the main purpose of this Switch is as a gaming device and maybe you should upgrade and enjoy playing games with your son.



I don't think that asking for clarification is criticism. It might be rude to push me to answer something I said I wouldn't, but I don't think there's harm in answer.



I don't think I've said anything about opening the console or not. See above for my views on updating?



I'm not sure where you got this impression, or why you're confident about things enough to claim you know about the internal values or working of ReSwitched. This is also easily disprovable just from public information--Hedgeberg has tested out f-g on stream. I don't see it as great opsec to enumerate how many people have access to the vulnerability, but we've long had a policy of only giving exploit details to those who actually want to know them and are in a position where they can use them to help. This is a basic security precaution and not about trust.

I'm actually not sure how this is relevant to the broader discussion. Based on your post history, I can tell that you strongly support TX and the option they're providing, and you're welcome to that, but I think throwing around generic unfounded criticism of RS doesn't do much good and distracts from me answering community questions.



I don't think they're obviously more convenient, as they exist right now. They're both inherently however-tethered-you-consider-PegaSwitch, take a bunch of time to run, and rely on a pegaswitch entry point.



That's not correct-- everyone on a current hardware revision will be able to install and use CFW the day it's released, if they're willing to put in the effort and potentially take on some minor risk.



I'm actually not sure what you mean by this entire post? Sorry about that-- I'd love to address your ideas, but unfortunately I can't figure out your meaning.



That was about me having fun by trying to see if a DIY, cheap modchip option is reasonable. It turns out it is. As you've noted, it's not necessary on any firmware. I just really like the idea that the open exchange of knowledge -- especially when profit's not a motive -- can result in creation of neat options for the community. ^-^



Yep; that's exactly what it means.



I don't think this has been at all implied-- and you'd be hard pressed to find a way to make a solder-less Arduino option that even remotely fits in the Switch case.

I should also clarify that the DIY option isn't solderless.

If you have or are going to get the game anyway, you can. Those versions are pretty much interchangeable in the long-term.



Yep-- and it's possible at some point that we'll allow you to install Fake News without Puyo using f-g/Atmosphère. The original plan was to release Atmosphère for 1.0.0 first while we tried to figure out how to deal with Fusée Gelée, but we actually wound up with a disclosure schedule that was faster than we'd thought.

 

[notimp]

No issues with responsible disclosure.
No issues with the exploits not being released asap.

Issues, with claiming moral superiority, over people who might sell a zero day without proper disclosure - IF (as in this case) no personal data is likely to be affected, and immediate threats to life or health are only theoretically implied, or dare I say imagined. The argument here, is that there are several, much more pressing, open prior zero day exploit targets out there - unpatched, where a three to six month responsible disclosure period made no difference - and the strong suspicion, that it will make no difference on the Switch (and other NVIDIA devices) either.

In simpler terms, you usually insist on those few months of prior disclosure out of a hope, that the company will be able to fix the issue - in many devices, before what you publish hits. This is not the case here, there is no likely patch. If you shift the argument towards "you will allow the company to replace effected devices in high security areas" - this also very likely isn't going to happen. (Company internal logic - no one props up replacement programs for potential risk reasons that arent well publicized - )

So the entire argument, why in this case, responsible disclosure was needed, and the chinese guys from the modchip fraction, were so unbelievable irresponsible - walks itself out of the door.

Also - for the scenario described - simply disclosing the severity of the issue (Remotely exploitable? Survives a boot?) would be enough to reach the same effect - if someone at that company - for some reason would monitor this closely for security of life and health reasons. So what are you exactly giving them those months for? They certainly arent working on a fix - because they can't.

Stop believing in concepts, that don't do anything here.

Now - I absolutely understand, why a person identifying herself by their full name and social presence, would insist on responsible disclosure in that case. If you get stuck with the responsibility of the disclosure attached to your name, heck even I'll do everything to make sure someone else gets that burden. But thats also a thing that security researchers sometimes break, and rightly so - for example if companies don't react in a sensible timeframe.

In the current case - the company gladly takes the three to six months of additional time, before the issue hits, because its a marketable advantage - in case the bug is really publicaly talked about, or heavily used in other contexts. But there are little to no benefits for users, as we cant expect patches. Nor are there immediate striking dangers, that would make this the "moral obligation" that its played up to be (that I know of).

 

[TotalInsanity4]

The argument here, is that there are several, much more pressing, open prior zero day exploit targets out there - unpatched, where a three to six month responsible disclosure period made no difference - and the strong suspicion, that it will make no difference on the Switch (and other NVIDIA devices) either.

So because it hasn't made a difference in the past, they should abandon their personal morals and not even try in the present?...

 

[Kioku]

So because it hasn't made a difference in the past, they should abandon their personal morals and not even try in the present?...

If we followed what he said, explicitly. There'd be no announcements. No publicly known releases. No dev chatter. There'd be massive walls of text that have little relevance to what is being discussed, just to stroke our own egos. Sometimes he's right, most of the time he's just.. Off...

 

[notimp]

But this is not "risk assessing" - this is guessing and hoping mixed with established practices, then hand over the burden of responsibility.

And while I probably would act the same in that case ("just to be sure") the moral superiority of that action feels constructed.

I have no problems with Temkins actions, as long as she isn't using them to "advertise" their approach. In this limited case.
F.e. if there was the direct risk of even even a remotely large data breach, I would absolutely insist - that you have to stick to responsible disclosure. Logic.. Sometimes, it even kills me...

--------------------- MERGED ---------------------------

Here is the reason I'm bringing it up.

Platforms like wololo have run with "the moral superiority" of Kate Tempkins approach as the boxquote for the news of the FAQ release.

See:
http://wololo.net/2018/04/09/switch-hacker-kate-temkin-shares-faq-upcoming-fusee-gelee-release/

And its simply not true.

If you think this is just a detail, that no one should be allowed to talk about, or you absolutely feel the need to make this personal, because you wan't me to bow under social pressures - finally, just once. Please say so clearly.

I don't think, that this argument can be used as a differentiating factor, in the way that it was - very publicly - used.

If people get lied to - and I catch it, expect to hear from me. Its just part of the ethos I'm following.

Another part is to only bow to arguments, and not to social pressure, thats not even very well set up or applied. Or argued.
Now you have my motivation - do (*stuff*) with it as you please..

 

[naddel81]

That is correct, and this is the standard for high wattage devices like this. It blows my mind that people blow their Switch up with cheap cables and unofficial docks and then have the audacity to blame NINTENDO for not following a standard

just use them on an old usb2 port and be happy.

 

[reminon]

No issues with responsible disclosure.
No issues with the exploits not being released asap.

Issues, with claiming moral superiority, over people who might sell a zero day without proper disclosure - IF (as in this case) no personal data is likely to be affected, and immediate threats to life or health are only theoretically implied, or dare I say imagined. The argument here, is that there are several, much more pressing, open prior zero day exploit targets out there - unpatched, where a three to six month responsible disclosure period made no difference - and the strong suspicion, that it will make no difference on the Switch (and other NVIDIA devices) either.

In simpler terms, you usually insist on those few months of prior disclosure out of a hope, that the company will be able to fix the issue - in many devices, before what you publish hits. This is not the case here, there is no likely patch. If you shift the argument towards "you will allow the company to replace effected devices in high security areas" - this also very likely isn't going to happen. (Company internal logic - no one props up replacement programs for potential risk reasons that arent well publicized - )

So the entire argument, why in this case, responsible disclosure was needed, and the chinese guys from the modchip fraction, were so unbelievable irresponsible - walks itself out of the door.

Also - for the scenario described - simply disclosing the severity of the issue (Remotely exploitable? Survives a boot?) would be enough to reach the same effect - if someone at that company - for some reason would monitor this closely for security of life and health reasons. So what are you exactly giving them those months for? They certainly arent working on a fix - because they can't.

Stop believing in concepts, that don't do anything here.

Now - I absolutely understand, why a person identifying herself by their full name and social presence, would insist on responsible disclosure in that case. If you get stuck with the responsibility of the disclosure attached to your name, heck even I'll do everything to make sure someone else gets that burden. But thats also a thing that security researchers sometimes break, and rightly so - for example if companies don't react in a sensible timeframe.

In the current case - the company gladly takes the three to six months of additional time, before the issue hits, because its a marketable advantage - in case the bug is really publicaly talked about, or heavily used in other contexts. But there are little to no benefits for users, as we cant expect patches. Nor are there immediate striking dangers, that would make this the "moral obligation" that its played up to be (that I know of).

Regardless, she has the keys to the car, she feels that disclosure is necessary, she has her mind set to that, and there's nothing that we can do.

 

[notimp]

You guys really are all results orientated, aren't you? If someone maybe doesn't tell you the exact truth, you dont care -a s long as you get your "free stuff" in the end...

Again - I promise you, I'll not take that thing you want in the end, away from you. I'll just make sure a few people interested, get some pseudointellectual/critical/pseudophilosophical backchatter.

Also known as "the thing you don't get on facebook anymore". I hope, you can live with it. Maybe in some very limited cases, even learn from it.

I'm not mounting a revolution by any stretch of the imagination - i'm playing "family" where different ideological positions are allowed.


If all you ever do is to loop back to "yes - but actually we would like to have a unified opinion, and we'll go with whoever gives us the most free stuff", I've lost.

Heck, half of the time - I'm not even willing to answer the same question for the the twelfth time, without sounding annoyed..

Also, for the record, - you all are against fake news (as am I), but if someone brings up an actual example (arguably), you all are suddenly more concerned about car keys you don't own - for some reason...

 

[Fluffball]

Atmosphere isn't ready anyway so what's the big deal about the delay.

All the homebrew that is in the works at the moment are mostly in the early stages.

 

[BL4Z3D247]

Atmosphere isn't ready anyway so what's the big deal about the delay.

All the homebrew that is in the works at the moment are mostly in the early stages.

There really isn't a "delay" since there was no release date given(other than sometime this summer). But I agree, there's nothing we can do as of right this second with Fusée Gelée and any homebrew released up to now can be launched in userland using the HBL.

What is everyone itching to do with Fusée Gelée if it was available right now without CFW?

 

[TotalInsanity4]

You guys really are all results orientated, aren't you? If someone maybe doesn't tell you the exact truth, you dont care -a s long as you get your "free stuff" in the end...

Again - I promise you, I'll not take that thing you want in the end, away from you. I'll just make sure a few people interested, get some pseudointellectual/critical/pseudophilosophical backchatter.

Also known as "the thing you don't get on facebook anymore". I hope, you can live with it. Maybe in some very limited cases, even learn from it.

I'm not mounting a revolution by any stretch of the imagination - i'm playing "family" where different ideological positions are allowed.


If all you ever do is to loop back to "yes - but actually we would like to have a unified opinion, and we'll go with whoever gives us the most free stuff", I've lost.

Heck, half of the time - I'm not even willing to answer the same question for the the twelfth time, without sounding annoyed..

Also, for the record, - you all are against fake news (as am I), but if someone brings up an actual example (arguably), you all are suddenly more concerned about car keys you don't own - for some reason...

... what the hell are you talking about?... Like, I'm not being facetious, I actually can't follow your argument

 

[Viri]

... what the hell are you talking about?... Like, I'm not being facetious, I actually can't follow your argument

Hell if I know. I stopped reading his post like 20 posts ago.

 

[Risingdawn]

...I'll just make sure a few people interested, get some pseudointellectual/critical/pseudophilosophical backchatter...

You realise a prefix of 'pseudo' is not a good thing right?

I mean you've used it in the right context, being as it means 'False' and 'Pretentious'; which your 'intellect' certainly is, I'm just fairly certain that's not what you meant!

Although I can't be that certain, seeing as you generally don't make any sense.

 

[reminon]

You realise a prefix of 'pseudo' is not a good thing right?

I mean you've used it in the right context, being as it means 'False' and 'Pretentious'; which your 'intellect' certainly is, I'm just fairly certain that's not what you meant!

Although I can't be that certain, seeing as you generally don't make any sense.

I can't tell if it's a different person posting for him lately, or if he's just spiralling into madness.

 

[salamandrusker]

You guys really are all results orientated, aren't you? If someone maybe doesn't tell you the exact truth, you dont care -a s long as you get your "free stuff" in the end...

Again - I promise you, I'll not take that thing you want in the end, away from you. I'll just make sure a few people interested, get some pseudointellectual/critical/pseudophilosophical backchatter.

Also known as "the thing you don't get on facebook anymore". I hope, you can live with it. Maybe in some very limited cases, even learn from it.

I'm not mounting a revolution by any stretch of the imagination - i'm playing "family" where different ideological positions are allowed.


If all you ever do is to loop back to "yes - but actually we would like to have a unified opinion, and we'll go with whoever gives us the most free stuff", I've lost.

Heck, half of the time - I'm not even willing to answer the same question for the the twelfth time, without sounding annoyed..

Also, for the record, - you all are against fake news (as am I), but if someone brings up an actual example (arguably), you all are suddenly more concerned about car keys you don't own - for some reason...

keys? we do not need keys, instead a start button to feel the wind in the face of the hand of atmosphere or fuse gele, I hate cryptology and I hate nintendo for implementing it makes the device slow. for that reason it is necessary to eliminate the keys and that the car works without them that if it would be great: D

 

[Kerbangman]

... what the hell are you talking about?... Like, I'm not being facetious, I actually can't follow your argument

Translation issue. You have to filter it a bit.
Try using google to translate to japanese then translate it back and you'll see what I mean

 

[ktemkin]

Thanks Kate for your Will and Time to give Infos and answer for our Questions, i really appreciate that! *thumbsup*
Please mention that you are binding a essential ressource (Kates Time) with this thread.

I appreciate the concern, but I don't think people need to worry that much about asking me questions in good faith. I don't mind replying to folks questions'-- or mind passing over them if I don't have the time to.

I was curious as to what the next lineup of projects you personally will pursue.

My immediate future projects are:

• Guides and some expansion of Fusée Gelée in preparation for release
• Thermosphère, the Atmosphère hypervisor for the Switch (which will enable emuNAND, kernel debugging, and some neat features for hacking on the Switch's OS).
• Trying to break into the T214 (Mariko) and/or T186 (X2) bootroms.
• A bunch of work on my unrelated hardware-hacking tools and my USB-hacking training class
• Continuing to figure out how to stream reverse engineering things when I can

This is a fundamental misunderstanding on how responsible disclosure works "process wise". It takes a concession made on part of the public interest (we dont necessarily get a benefit if the flaw is not patchable), and turns it into a virtue.

I don't really understand your argument-- but I know there are a lot of different opinions out there on responsible disclosure. I've been in InfoSec for more or less ten years, and one of the things I do for a living is traveling the conference circuit. I've heard a lot of different views.

There are a few things I think you're missing, here:

• This vulnerability's only unpatchable on existing devices. If NVIDIA or downstream vendors still have stock of e.g. Tegra X1s, they can update their factory process to burn a new set of patches into the device's fuses, actively mitigating the exploit. At this point, given disclosure, they can and should be working to ensure they don't produce more vulnerable devices.
• Responsible disclosure is about minimizing harm. The whole point here is to allow vendors a chance to assess damage and see if there are solutions they can apply. I don't have the capability to do that, because I don't know the history of all the Tegra SoCs NVIDIA has sold. I'm not in a position to do so, so I kind of have to pass this on and hope they take the impetus.
• There's value too in NVIDIA being able to warn their customers before a major bug like this is released into the wild. You seem to think that "unpatchable in existing devices" means there's no corrective action that can be taken, and that's not true. Some systems can likely be moved from places that give easy physical access and physically secured. Some devices can be modified to make it harder to apply the 'stimulus' that leads to the hack. Devices can be taken out of production or out of use where the vulnerability exists.

There's a lot of value to the end-users, here-- and the cost is only waiting for the short disclosure window I decided on.

Also - my argument isn't based on theory - but on current practices in the field. If you know how many unpatched vulnerabilities in the "disclosed zero days" category are out there even in SCADA networks, being accessible over the open internet - the notion that those months in which - effectively - no exchange programs will happen (because no one cares about prevention, and everyone cares about mitigation) are given because of a moral virtue - is from my point of view pretty fundamentally wrong. As in more necessary "for the interaction with the company facing an issue" - than for their efforts to prevent harm. It also serves a "delegation of responsibility" purpose which is actually pretty healthy for the community of hardware hackers.

You seem to think I'm new to security-- I can assure you that I've been around for a bit. I'm familiar with both the successes and failures of responsible disclosure, and I've seen some very successful mitigations come from it, even if sometimes things go less smoothly. It definitely helps when the vulnerability's known but embargoed-- there's a lot of pressure on the company to come up with a good response.

And while this is a valuable position to hold (- especially if you put your clear name out there, but no - in general.. ), this was not what was criticised. What was criticised was a form of "virtue stacking" that was actively used to promote your efforts over those of companies that would use undisclosed zero days for commercial reasons.

I'm not sure what you mean by "virtue stacking". Are you perhaps suggesting I'm "virtue signaling"? If so, trust me-- it's not that I'm trying to signal that I'm particularly virtuous, but rather that I really don't like some of the unethical practices I've observed around the commercial section that targets the community.

I'm not keen on the idea of someone releasing a vulnerability for money in general; but I really don't like the idea of someone releasing a mod-chip that will lead any skilled reverse engineer to the source of their vulnerability. That inherently creates a situation where anyone with the right motive can determine vulnerability specifics and then use them to attack the public.

In this specific case - where no sensitive data is in danger from the immediate application of the hack, which is more than you could say about commercial companies, that sell nation states access to peoples personal data in encrypted iPhones (highly regarded members of our society - of course) - the moral argument is inferred, and was not necessarily striking.

I'm really not sure why you say that no sensitive data is in danger. I can assure you there are attack vectors for this that put sensitive and personal at risk. I'm not going to go into the worst of them, because I think it points too much to the vulnerability itself, but I will suggest one danger that's present if a bootrom attack is launched against any older Tegras.

Think about it like the master keys that have been leaked from the Switch-- folks were were able to break one crypto-scheme just by accessing secrets that were supposed to only be accessible to the bootrom, and never to any kind of "user" software. There are plenty of existing Tegras that can have equivalent keys extracted, and in many circumstances-- especially on older Tegras-- extraction of these keys is sufficient to allow exfiltration of user data from other instances of the same device non-intrusively. And there's much worse things you can do if you have bootrom access...

Dont engage in virtue stacking, when all the immediate effects of your need to engage in responsible disclosure actually hurt the public at large (mostly in "prolonged use" and "ease of use" terms) is the main message here. What you are doing is good and rectifiable, but not when used in a "and we have this over our competitors as well" marketing message in a public form.

I don't see how any of this is hurting anyone, besides maybe making it so people have to wait a little while longer. If you have any rationale as to how this could hurt anyone, I'd be really interested in hearing it.

I also don't think this is really "marketing". I could maybe see using a word like "outreach"-- but I don't have a product or anything I'm trying to sell. I am literally building things that will be open source and putting them online for free in the hopes that they'll be nice things that other people can use. I don't have a market or anything to sell.

@ktemkin just to make sure: are you or anyone from reswitched save from any legal danger? I mean it wouldn't be the fist time a hacker gets silenced before releasing their work.

I don't know if it's entirely possible to be safe from legal danger, but I've definitely made sure that everything I've been doing is as safe as I can from a purely legal standpoint. I don't plan on infringing on anyone's copyrights or distributing restricted information.

At this point, considering the working relationship I have with both Nintendo and NVIDIA re: the disclosure of this bug, I think it'd be pretty unusually underhanded for them to try intimidation tactics.

Take the responsible disclosure thing for example. I'm of the belief that if your motives are truly altruistic then you do much more by releasing the information quickly and putting pressure on corporations to do something about it. I really don't want to beat that dead horse anymore though so meh.

I agree with the first sentence, here-- though I do think there should be a stage where companies are allowed to react to protect their customers before the bug reaches the public.

The hard part is deciding what that disclosure deadline should _be_. I chose a time I thought was not unreasonable (less than 90 days), and then submitted things to NVIDIA with a paragraph that stated when I planned on releasing the bug to the public. I think that's the best balance I was able to figure out between making sure the public gets the information quickly and giving NVIDIA a chance to fix their mistakes before the public gets hurt.

Whether I chose the disclosure period appropriate or not, that's what I thought was right given the information I had, and that's what's setting the timeline.

It's also bullshit that TX know and understand how dangerous the exploit is, yet they give no disclosure just to retain profit.

I agree. I also think that there's a lot of things regarding TX's product that go against the ethos I'd like to see in the community. I really don't like the idea of someone reverse engineering a system or discovering a software bug and keeping all the information then have about the system hidden. I don't like the idea of people coming up with exploits that don't necessarily need modchips and then only offering the public their modchip as an option.

I don't like the creation of situations that encourage hiding information about the systems we're reverse engineering for any longer than is absolutely necessary. I like the idea of building pools of knowledge about the system together, so we can all understand and all build cool things.

No issues with responsible disclosure.
Issues, with claiming moral superiority, over people who might sell a zero day without proper disclosure - IF (as in this case) no personal data is likely to be affected, and immediate threats to life or health are only theoretically implied, or dare I say imagined. The argument here, is that there are several, much more pressing, open prior zero day exploit targets out there - unpatched, where a three to six month responsible disclosure period made no difference - and the strong suspicion, that it will make no difference on the Switch (and other NVIDIA devices) either.
<snip>

I'm lumping all of your remaining replies together here, because I basically have one response to all of it: I've outlined my reasons for doing disclosure as I have above. I'm not trying to manipulate you, or "virtue signal", or sell you anything. I want to help the console hacking community become an awesome place, and to me that means encouraging an ethos of open sharing wherever we can, and discouraging and speaking out against those who are bad for the community. I don't consider myself someone with especially superior moral-- I just speak out against things that seem bad to me when I see them.

just use them on an old usb2 port and be happy.

This is actually not really a solution. You're less likely to damage your host because compliant USB2 ports are more careful about inrush current, but a lot of machines aren't great about complying with this. If the cable advertises that it's a charger that provide 3W, you really don't it plugged into a port that can provide less. It can, surprisingly, damage both sides of the connection, and it's not worth risking that for a cable.

Also, for the record, - you all are against fake news (as am I)

For the record, I am totally for the Fake News entry point-- it's much more convenient than starting up Puyo Puyo Tetris.

keys? we do not need keys, instead a start button to feel the wind in the face of the hand of atmosphere or fuse gele, I hate cryptology and I hate nintendo for implementing it makes the device slow. for that reason it is necessary to eliminate the keys and that the car works without them that if it would be great: D

The crypto Nintendo uses is actually hardware-accelerated, so there's really not too much slowdown to it. It might consume a trivial amount more power, but it's kind of an ingrained thing and not easy to rip out of the system.

 

[brickmii82]

I appreciate the concern, but I don't think people need to worry that much about asking me questions in good faith. I don't mind replying to folks questions'-- or mind passing over them if I don't have the time to.



My immediate future projects are:

• Guides and some expansion of Fusée Gelée in preparation for release
• Thermosphère, the Atmosphère hypervisor for the Switch (which will enable emuNAND, kernel debugging, and some neat features for hacking on the Switch's OS).
• Trying to break into the T214 (Mariko) and/or T186 (X2) bootroms.
• A bunch of work on my unrelated hardware-hacking tools and my USB-hacking training class
• Continuing to figure out how to stream reverse engineering things when I can

I don't really understand your argument-- but I know there are a lot of different opinions out there on responsible disclosure. I've been in InfoSec for more or less ten years, and one of the things I do for a living is traveling the conference circuit. I've heard a lot of different views.

There are a few things I think you're missing, here:

• This vulnerability's only unpatchable on existing devices. If NVIDIA or downstream vendors still have stock of e.g. Tegra X1s, they can update their factory process to burn a new set of patches into the device's fuses, actively mitigating the exploit. At this point, given disclosure, they can and should be working to ensure they don't produce more vulnerable devices.
• Responsible disclosure is about minimizing harm. The whole point here is to allow vendors a chance to assess damage and see if there are solutions they can apply. I don't have the capability to do that, because I don't know the history of all the Tegra SoCs NVIDIA has sold. I'm not in a position to do so, so I kind of have to pass this on and hope they take the impetus.
• There's value too in NVIDIA being able to warn their customers before a major bug like this is released into the wild. You seem to think that "unpatchable in existing devices" means there's no corrective action that can be taken, and that's not true. Some systems can likely be moved from places that give easy physical access and physically secured. Some devices can be modified to make it harder to apply the 'stimulus' that leads to the hack. Devices can be taken out of production or out of use where the vulnerability exists.

There's a lot of value to the end-users, here-- and the cost is only waiting for the short disclosure window I decided on.



You seem to think I'm new to security-- I can assure you that I've been around for a bit. I'm familiar with both the successes and failures of responsible disclosure, and I've seen some very successful mitigations come from it, even if sometimes things go less smoothly. It definitely helps when the vulnerability's known but embargoed-- there's a lot of pressure on the company to come up with a good response.



I'm not sure what you mean by "virtue stacking". Are you perhaps suggesting I'm "virtue signaling"? If so, trust me-- it's not that I'm trying to signal that I'm particularly virtuous, but rather that I really don't like some of the unethical practices I've observed around the commercial section that targets the community.

I'm not keen on the idea of someone releasing a vulnerability for money in general; but I really don't like the idea of someone releasing a mod-chip that will lead any skilled reverse engineer to the source of their vulnerability. That inherently creates a situation where anyone with the right motive can determine vulnerability specifics and then use them to attack the public.



I'm really not sure why you say that no sensitive data is in danger. I can assure you there are attack vectors for this that put sensitive and personal at risk. I'm not going to go into the worst of them, because I think it points too much to the vulnerability itself, but I will suggest one danger that's present if a bootrom attack is launched against any older Tegras.

Think about it like the master keys that have been leaked from the Switch-- folks were were able to break one crypto-scheme just by accessing secrets that were supposed to only be accessible to the bootrom, and never to any kind of "user" software. There are plenty of existing Tegras that can have equivalent keys extracted, and in many circumstances-- especially on older Tegras-- extraction of these keys is sufficient to allow exfiltration of user data from other instances of the same device non-intrusively. And there's much worse things you can do if you have bootrom access...



I don't see how any of this is hurting anyone, besides maybe making it so people have to wait a little while longer. If you have any rationale as to how this could hurt anyone, I'd be really interested in hearing it.

I also don't think this is really "marketing". I could maybe see using a word like "outreach"-- but I don't have a product or anything I'm trying to sell. I am literally building things that will be open source and putting them online for free in the hopes that they'll be nice things that other people can use. I don't have a market or anything to sell.



I don't know if it's entirely possible to be safe from legal danger, but I've definitely made sure that everything I've been doing is as safe as I can from a purely legal standpoint. I don't plan on infringing on anyone's copyrights or distributing restricted information.

At this point, considering the working relationship I have with both Nintendo and NVIDIA re: the disclosure of this bug, I think it'd be pretty unusually underhanded for them to try intimidation tactics.



I agree with the first sentence, here-- though I do think there should be a stage where companies are allowed to react to protect their customers before the bug reaches the public.

The hard part is deciding what that disclosure deadline should _be_. I chose a time I thought was not unreasonable (less than 90 days), and then submitted things to NVIDIA with a paragraph that stated when I planned on releasing the bug to the public. I think that's the best balance I was able to figure out between making sure the public gets the information quickly and giving NVIDIA a chance to fix their mistakes before the public gets hurt.

Whether I chose the disclosure period appropriate or not, that's what I thought was right given the information I had, and that's what's setting the timeline.



I agree. I also think that there's a lot of things regarding TX's product that go against the ethos I'd like to see in the community. I really don't like the idea of someone reverse engineering a system or discovering a software bug and keeping all the information then have about the system hidden. I don't like the idea of people coming up with exploits that don't necessarily need modchips and then only offering the public their modchip as an option.

I don't like the creation of situations that encourage hiding information about the systems we're reverse engineering for any longer than is absolutely necessary. I like the idea of building pools of knowledge about the system together, so we can all understand and all build cool things.



I'm lumping all of your remaining replies together here, because I basically have one response to all of it: I've outlined my reasons for doing disclosure as I have above. I'm not trying to manipulate you, or "virtue signal", or sell you anything. I want to help the console hacking community become an awesome place, and to me that means encouraging an ethos of open sharing wherever we can, and discouraging and speaking out against those who are bad for the community. I don't consider myself someone with especially superior moral-- I just speak out against things that seem bad to me when I see them.



This is actually not really a solution. You're less likely to damage your host because compliant USB2 ports are more careful about inrush current, but a lot of machines aren't great about complying with this. If the cable advertises that it's a charger that provide 3W, you really don't it plugged into a port that can provide less. It can, surprisingly, damage both sides of the connection, and it's not worth risking that for a cable.



For the record, I am totally for the Fake News entry point-- it's much more convenient than starting up Puyo Puyo Tetris.



The crypto Nintendo uses is actually hardware-accelerated, so there's really not too much slowdown to it. It might consume a trivial amount more power, but it's kind of an ingrained thing and not easy to rip out of the system.

Looking forward to seeing your work, I'm a fan. You've made me a believer.

 

[PCityPaul]

i am wondering what exactly would be inconvenient.
and i did not read too much into all of it, but is staying on 3.0 a good thing?

i updated to it using pokken and i wish someone would buy it off from me, would give it even for 30$ if i found anyone wanting it.

Still have it?

 

[Darksabre72]

I appreciate the concern, but I don't think people need to worry that much about asking me questions in good faith. I don't mind replying to folks questions'-- or mind passing over them if I don't have the time to.



My immediate future projects are:

• Guides and some expansion of Fusée Gelée in preparation for release
• Thermosphère, the Atmosphère hypervisor for the Switch (which will enable emuNAND, kernel debugging, and some neat features for hacking on the Switch's OS).
• Trying to break into the T214 (Mariko) and/or T186 (X2) bootroms.
• A bunch of work on my unrelated hardware-hacking tools and my USB-hacking training class
• Continuing to figure out how to stream reverse engineering things when I can

I don't really understand your argument-- but I know there are a lot of different opinions out there on responsible disclosure. I've been in InfoSec for more or less ten years, and one of the things I do for a living is traveling the conference circuit. I've heard a lot of different views.

There are a few things I think you're missing, here:

• This vulnerability's only unpatchable on existing devices. If NVIDIA or downstream vendors still have stock of e.g. Tegra X1s, they can update their factory process to burn a new set of patches into the device's fuses, actively mitigating the exploit. At this point, given disclosure, they can and should be working to ensure they don't produce more vulnerable devices.
• Responsible disclosure is about minimizing harm. The whole point here is to allow vendors a chance to assess damage and see if there are solutions they can apply. I don't have the capability to do that, because I don't know the history of all the Tegra SoCs NVIDIA has sold. I'm not in a position to do so, so I kind of have to pass this on and hope they take the impetus.
• There's value too in NVIDIA being able to warn their customers before a major bug like this is released into the wild. You seem to think that "unpatchable in existing devices" means there's no corrective action that can be taken, and that's not true. Some systems can likely be moved from places that give easy physical access and physically secured. Some devices can be modified to make it harder to apply the 'stimulus' that leads to the hack. Devices can be taken out of production or out of use where the vulnerability exists.

There's a lot of value to the end-users, here-- and the cost is only waiting for the short disclosure window I decided on.



You seem to think I'm new to security-- I can assure you that I've been around for a bit. I'm familiar with both the successes and failures of responsible disclosure, and I've seen some very successful mitigations come from it, even if sometimes things go less smoothly. It definitely helps when the vulnerability's known but embargoed-- there's a lot of pressure on the company to come up with a good response.



I'm not sure what you mean by "virtue stacking". Are you perhaps suggesting I'm "virtue signaling"? If so, trust me-- it's not that I'm trying to signal that I'm particularly virtuous, but rather that I really don't like some of the unethical practices I've observed around the commercial section that targets the community.

I'm not keen on the idea of someone releasing a vulnerability for money in general; but I really don't like the idea of someone releasing a mod-chip that will lead any skilled reverse engineer to the source of their vulnerability. That inherently creates a situation where anyone with the right motive can determine vulnerability specifics and then use them to attack the public.



I'm really not sure why you say that no sensitive data is in danger. I can assure you there are attack vectors for this that put sensitive and personal at risk. I'm not going to go into the worst of them, because I think it points too much to the vulnerability itself, but I will suggest one danger that's present if a bootrom attack is launched against any older Tegras.

Think about it like the master keys that have been leaked from the Switch-- folks were were able to break one crypto-scheme just by accessing secrets that were supposed to only be accessible to the bootrom, and never to any kind of "user" software. There are plenty of existing Tegras that can have equivalent keys extracted, and in many circumstances-- especially on older Tegras-- extraction of these keys is sufficient to allow exfiltration of user data from other instances of the same device non-intrusively. And there's much worse things you can do if you have bootrom access...



I don't see how any of this is hurting anyone, besides maybe making it so people have to wait a little while longer. If you have any rationale as to how this could hurt anyone, I'd be really interested in hearing it.

I also don't think this is really "marketing". I could maybe see using a word like "outreach"-- but I don't have a product or anything I'm trying to sell. I am literally building things that will be open source and putting them online for free in the hopes that they'll be nice things that other people can use. I don't have a market or anything to sell.



I don't know if it's entirely possible to be safe from legal danger, but I've definitely made sure that everything I've been doing is as safe as I can from a purely legal standpoint. I don't plan on infringing on anyone's copyrights or distributing restricted information.

At this point, considering the working relationship I have with both Nintendo and NVIDIA re: the disclosure of this bug, I think it'd be pretty unusually underhanded for them to try intimidation tactics.



I agree with the first sentence, here-- though I do think there should be a stage where companies are allowed to react to protect their customers before the bug reaches the public.

The hard part is deciding what that disclosure deadline should _be_. I chose a time I thought was not unreasonable (less than 90 days), and then submitted things to NVIDIA with a paragraph that stated when I planned on releasing the bug to the public. I think that's the best balance I was able to figure out between making sure the public gets the information quickly and giving NVIDIA a chance to fix their mistakes before the public gets hurt.

Whether I chose the disclosure period appropriate or not, that's what I thought was right given the information I had, and that's what's setting the timeline.



I agree. I also think that there's a lot of things regarding TX's product that go against the ethos I'd like to see in the community. I really don't like the idea of someone reverse engineering a system or discovering a software bug and keeping all the information then have about the system hidden. I don't like the idea of people coming up with exploits that don't necessarily need modchips and then only offering the public their modchip as an option.

I don't like the creation of situations that encourage hiding information about the systems we're reverse engineering for any longer than is absolutely necessary. I like the idea of building pools of knowledge about the system together, so we can all understand and all build cool things.



I'm lumping all of your remaining replies together here, because I basically have one response to all of it: I've outlined my reasons for doing disclosure as I have above. I'm not trying to manipulate you, or "virtue signal", or sell you anything. I want to help the console hacking community become an awesome place, and to me that means encouraging an ethos of open sharing wherever we can, and discouraging and speaking out against those who are bad for the community. I don't consider myself someone with especially superior moral-- I just speak out against things that seem bad to me when I see them.



This is actually not really a solution. You're less likely to damage your host because compliant USB2 ports are more careful about inrush current, but a lot of machines aren't great about complying with this. If the cable advertises that it's a charger that provide 3W, you really don't it plugged into a port that can provide less. It can, surprisingly, damage both sides of the connection, and it's not worth risking that for a cable.



For the record, I am totally for the Fake News entry point-- it's much more convenient than starting up Puyo Puyo Tetris.



The crypto Nintendo uses is actually hardware-accelerated, so there's really not too much slowdown to it. It might consume a trivial amount more power, but it's kind of an ingrained thing and not easy to rip out of the system.

man this is amazing how you still answer these questions, and not get mad by these people who are too impatient to wait. i see that this can take time so take the time you need to perfect it and hopefully get this working on 5.xx firmware.

 

[Quantumcat]

Looking forward to seeing your work, I'm a fan. You've made me a believer.

What are you a fan of, exactly? The only thing in existence connected to her is Pegaswitch and that was a Reswitched project so the efforts of multiple people. Don't be fooled by noise.