There are some problems with the whitelist approach, if you hash the entire Blueray and include a filesize check , thats going to have to be computed every time one of those games is started. Thats going to suck, essentially the entire disk has to be read and the hash of a 5-50 GB file has to be computed every time. You could also check the disc as each bit was loaded, essentially slowing the game down constantly instead of once at start up. Depending on the BD architecture and how it communicates with the PS3 either of these could potentially be bypassed (eg the swapping the disc after the calculation, if its done at startup, if the PS3 doesn't have a sophisticated detection method for such, which it probably does).
The DSi method doesn't do that but its got its flaw anyway since its possible for flash cards to duplicate the part of the cart that is checked (which is how they bypass it)
You can hash a variety of small parts of a file and check them at random too (but that still leaves you open, just with a non-100% success rate). It also means your whitelist is going to be enormous if you have to calculate the hash for 1000 different 10 MB chunks of every PS3 piece of executable code out there (in order to keep the success rate low).
Essentially sure a whitelist method can work but the more secure it is, the more likely they are going to get themselves crucified for giving every PS3 application a loading time thats more associated with installing a 2+ DVD game on a PC.
(Its also not going to realistic help against anyone who knows about this, they just aren't going to update until such a time as they know its not going to break anything and its going to be really obvious if it does (the next PUP out isn't going to work on older firmwares without an in between update if they change the PUP key, and disabling service mode is equally trivial to spot))
Essentially whether or not its worth it for anything currently out there is debatable (one of the things in a talk is that its going to be possible to redowngrade the loaders using a mod chip essentially for everything out there now , even if they fix the firmware). And once people can install "valid" firmwares from "valid" PUPs they can essentially update every time Sony does just with the revocation lists zeroed out or bypassed.
They could lock it down pretty nicely on new systems (and if they kept the white-list only on new systems people wouldn't have a "Guide to what you need to impersonate to pass" but that requires releasing seperate PUPs for both systems).
Essentially no matter what they do, its going to hurt them. They really don't have a good choice.
They'll probably try something though even on the systems out there now (via a firmware update), they probably have obligations to do so even if its essentially utterly pointless (and you don't even have to make it "hard" just "non-trivial" to discourage a certain subset of people, an $X0 modchip + $X0 installation fee, will slow a bunch of people down).
Probably a whitelist thats based on reading and calculating only some subset of the data (maybe selected "randomly" from a list) combined with a file size check it'd probably work passably well for a while. Of course they'll also have to kill service mode (in some way) to stop people downgrading (and then reinstalling a "valid" PUP, since alternative l2diag files could now be signed, since dongles are getting pretty cheap.
Its going to be interesting watching what the reaction actually is.
Sidenote: A remote system (the PSN) cannot "scan" your PS3, a "scan" by a remote system is essentially the same as requesting your system to send things to it. If your system is compromised it (the remote system) can't trust the results of the scan, because a compromised system can transmit a bald-faced lie (and should be assumed to do so whenever such is advantageous). If you play online maybe it could scan the data you transmit to the server for irregularities (since sending completely fake data to a server in an online game is silly) which gives avenues for catching cheaters but thats about it.
The DSi method doesn't do that but its got its flaw anyway since its possible for flash cards to duplicate the part of the cart that is checked (which is how they bypass it)
You can hash a variety of small parts of a file and check them at random too (but that still leaves you open, just with a non-100% success rate). It also means your whitelist is going to be enormous if you have to calculate the hash for 1000 different 10 MB chunks of every PS3 piece of executable code out there (in order to keep the success rate low).
Essentially sure a whitelist method can work but the more secure it is, the more likely they are going to get themselves crucified for giving every PS3 application a loading time thats more associated with installing a 2+ DVD game on a PC.
(Its also not going to realistic help against anyone who knows about this, they just aren't going to update until such a time as they know its not going to break anything and its going to be really obvious if it does (the next PUP out isn't going to work on older firmwares without an in between update if they change the PUP key, and disabling service mode is equally trivial to spot))
Essentially whether or not its worth it for anything currently out there is debatable (one of the things in a talk is that its going to be possible to redowngrade the loaders using a mod chip essentially for everything out there now , even if they fix the firmware). And once people can install "valid" firmwares from "valid" PUPs they can essentially update every time Sony does just with the revocation lists zeroed out or bypassed.
They could lock it down pretty nicely on new systems (and if they kept the white-list only on new systems people wouldn't have a "Guide to what you need to impersonate to pass" but that requires releasing seperate PUPs for both systems).
Essentially no matter what they do, its going to hurt them. They really don't have a good choice.
They'll probably try something though even on the systems out there now (via a firmware update), they probably have obligations to do so even if its essentially utterly pointless (and you don't even have to make it "hard" just "non-trivial" to discourage a certain subset of people, an $X0 modchip + $X0 installation fee, will slow a bunch of people down).
Probably a whitelist thats based on reading and calculating only some subset of the data (maybe selected "randomly" from a list) combined with a file size check it'd probably work passably well for a while. Of course they'll also have to kill service mode (in some way) to stop people downgrading (and then reinstalling a "valid" PUP, since alternative l2diag files could now be signed, since dongles are getting pretty cheap.
Its going to be interesting watching what the reaction actually is.
Sidenote: A remote system (the PSN) cannot "scan" your PS3, a "scan" by a remote system is essentially the same as requesting your system to send things to it. If your system is compromised it (the remote system) can't trust the results of the scan, because a compromised system can transmit a bald-faced lie (and should be assumed to do so whenever such is advantageous). If you play online maybe it could scan the data you transmit to the server for irregularities (since sending completely fake data to a server in an online game is silly) which gives avenues for catching cheaters but thats about it.
