Time to boycott Sony, they deserve no money from anyone, and I meant anyone.

They're just f*ing with people without getting anyone good stuff.

Suppose they're doing this for copyright, it's not like the pirates would be stopped by a mere DNS block rule set anyway.

> Time to boycott Sony, they deserve no money from anyone, and I meant anyone.

Because when they installed rootkits on user's machines wasn't that time?

Because when they removed content users purchased from their machines wasn't that time?

Because when they spy on what users watch on their TVs in the privacy of their home wasn't that time?

Sony is like a tree. The best time to boycott Sony was decades ago. The second best time is today.

Sony copyright-striking pianists performing public domain music and uploading their own performances on YouTube wasn't that time?

Why are so many comments talking about Sony? The case was brought by beIN Sports.

Because Sony was mentioned once in the article in reference to a different earlier case and people seem to have stopped reading there to come here and immediately complain about Sony.

Yes, but in this case the plaintiff is beIN SPORTS France.

Read the article, it’s not Sony it’s Bein the ones who have the soccer broadcast rights.

IMO, Nintendo deserves stronger backlash just like Sony. Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.

I sure looking forward for more people hopping on the AI hacking trend to bring them down.

They are tradeable and resellable which is a very important property for poorer gamers instead of rich collectors like us.

Edit: Switch 2 is also biggest proponent of SD Express. Any supporter of SD cards coming back to phones and other devices should appreciate the stance taken here. Nintendo could've gone the Google/Apple route and just sold 512GB and 1TB models. Instead this effort, like Sony's Xperia phones, are completely unrecognized.

I wonder if the SD Express will be taken advantage of in the switch 2 homebrew scene which seems inevitable now.

SD Express is PCIe express after all (also a possible attack vector in itself, see DaMAgeCard). With nvidia drivers for Ampere already on board maybe someone will get an RTX 3090 running on a switch 2.

If you get banned from online, all of your keycard games are bricked

No, because I can sell the games.

On the other hand, the Orange Box I bought from 2007 cannot be transferred in any way, even though the disc is in my hand and my account is in good standing. I think you guys have your priorities messed up.

No because they don't use the eShop infrastructure.

I doubt they have a second set of download servers just for the key cards. When my switch original was banned I couldn’t download updates for physical game cards. The whole download and update service was blocked.

GKCs aren't perfect, but both PS5 and Xbox Series consoles have had games where the disc is near useless too, either with only part of the game on the disc (e.g., Oblivion Remastered) or virtually none of the game on the disc (Indiana Jones). GKCs are at least upfront and clear on the packaging. I wish they had banned the practice of codes in a box. THOSE SUCK.

And just yesterday I had to use my modded 3DS to rescue a physical 3DS cart that wasn't booting. Luckily I was able to but there's no guarantee a physical game will last forever either.

yes at least with GKC I immediately know that game is not playable offline instead of needing to go to https://www.doesitplay.org and hope that someone already documented the game I am looking at, which is the case with PS5

After the initial download, it doesn't need to do any online checks if you have the key card inserted. That's kind of the whole, the card is the key.

Game key cards are cheaper to make because normal cartridges with the full game cost a fortune right now. And guess why? AI data centers buying up all the memory chips.

On the physical games part, Nintendo still puts their own games on full cartridges, so I don't think they're the ones that deserve the backlash here.

options for switch1, ps5, xbox: Disc or code in box.

options for switch 2: Full game on cartridge, switch 2 edition (including switch 1 support), Game Key Card (half physical), Code in the box.

I don't see why should nintendo be blamed for providing more options. if anythng you should blame the publishers for chosing "Code in the box" (looking at you diablo) when GKC would do. or GKC when full cartridge would do.

The Nintendo cartridges contain the full playable version of the game.

Third party publishers often just put the key on it. So blame them for that

> Game keycards keep the appearance of physical ownership without delivering what people expect from a cartridge.

How's that? Can't you buy & resell them on the used market? That seems like the only thing a physical cartridge gets you, and not shipping the outdated-on-day-one bits on the cart saves some money, too. Seems like win-win?

- You can't download the game without internet, including re-downloading because you had to free up space

- You can't download the game after they have retired their servers (or if their servers are down / having issues)

- The game ends up taking a lot more storage space as updates are usually tiny when compared to the base game. For reference, the Switch 1 version of Zelda Tears Of the Kingdom takes 16 GB while the latest update takes only 500 MB.

I think most of that is true for games shipped on cart, too. Games often ship broken or missing features which are patched in at launch. Official physical media has not been a reliable method for future accessibility for at least a decade now. It's way past time to start using other methods of preservation.

I think the point is that X years from now, when the servers are turned off, you don’t actually have the game.

I believe that is largely true even if they shipped a game on the cart. Many games ship broken, and they also change many times over the course of their life. I don't think official media can be considered any part of a future accessibility strategy for at least a decade now. Game keycards don't change that fact in any way.

It can be a part.

Games shipping broken and needing day-1 updates is a consequence of our indifference towards physical media dying.

On the Switch and the Switch 2, I’ve never had a physical game that didn’t let me skip updates and play offline.

Probably due to a mix of Nintendo actually reviewing retail releases before they are “pressed”, and due to the fact that these are portable devices with no cellular.

I have no means to verify this, but I believe updates for Switch carts are saved to the cards rather than in the system NAND. And this makes me think, Nintendo's mistake in allowing the key cards was that it did not allow the same with the key cards that customers would still hold the physical static electricity in the card so long that the card was used at least once.

They are definitely saved to the system NAND and the carts are immutable.

I don’t understand the second part. Game key carts physically cannot fit the game or its updates, that is the entire point of their existence (storage is expensive, keys are tiny).

That's true, but Nintendo has been good about this. You can still download your digital purchases from the Wii, Wii U and 3DS stores just fine.

I actually find great satisfaction and closure in knowing it is an ephemeral experience.

Experience the game, move on.

Of course, just my own preference, not saying others need to follow it.

I liked buying used games as a poor teenager and even poorer young adult, the only way I could afford it (and selling them once I was done).

I believe it's legal to binary dump games that you own. GKC does not allow this.

I do agree, in the world of day one patches its not a given having the full, actually playable game on the cart itself isn't a given. We're already largely at the point where game discs and carts are really just license keys, this is just saving some money on the storage.

But it sure was nice when you had the whole game sitting there, without having to rely on some download server still being around. I'm able to go grab a used GameBoy game off the shelf at the used game store, stick it in an old GameBoy, and outside of some games with batteries in them (repairable fwiw) it just works. This has been great for my little kids, as I trust them a lot more with a cheap GBA SP than I do the Switch when going out places. Way more pocketable, way less fragile, and the replacement cost (and repairability) is a lot better.

If I grabbed an old Switch off the shelf in 30 years, popped in a game key card, would I actually be able to play anything? Probably not. There's a good chance most of this Switch 2 will be useless in 30 years time.

Well then the cost of physical has to go up. We can guess what your opinion on that is.

I mean the GKC is a compromise considering the high cost of larger storage capacities for carts, driven especially by AI. They're just upfront about it. Sony and MS have been doing "game key discs" for years now but didn't provide a clear label for it.

It's mostly stolen goods anyway, who are they to complain about "distillation"?

Use a standalone app to scan it, inspect the URL before open, easy as that.

But you see how that sucks, right?

I tried to get myself a custom "Brave Origin" some time ago, but just like upstream Chromium, some related code are just poorly guarded, it's not really trivial to do it and keep it up with upstream.

Ah interesting, I didn't know Brave Origin even existed.

It's not something I'd pay for though. I'd pay for firefox but not another chromium browser.

> I know it is easy to just take and hack

No you don't, otherwise we wouldn't have banking apps on it.

It is a bit different. My app doesn't rely on 3rd party services at all. It just provides functionality. It is not about breaking into someones account.

I just know that the app can just be cracked - there are plenty of sites that do that for android. Because you can't just load your app on iOS - this is just not possible (well perhaps there are a few percent of some jailbroken iPhones, but that is neglibile).

On Android though, you can soon see such app stolen and on some of the apk warez sites. It just breaks the model.

The only difference between iOS and Android when it comes to loading code onto your device is that, on iOS:

- You have to setup a developer account with Apple first, and dev-signed apps can only be installed onto specific provisioned devices only[0]

- The free tier of that developer account is inconvenient for actually using dev-signed apps as a daily-driver, and won't let you use certain entitlements

- Apple's dev tooling is designed to make it feel like you can only sign code you're compiling yourself

On the surface level, this might seem like a big difference, because Android has a command that lets you load arbitrary APKs with no particular fanfare or ceremony, while Apple's dev signer is buried inside of a compiler/IDE suite. But people have built tools to make it easy to take an arbitrary .ipa, sign it using your dev account, and resign it once the free tier's 7 day limit expires.

Of course, this still requires you actually go and obtain an .ipa of the app you want to use, and Apple distributes App Store[1] app binaries[2] encrypted. That part requires actually having a jailbroken device to dump the app binary with. But once the app is cracked anyone can install it.

If you want an actual "uncrackable" app you need to put a critical part of your app's workflow onto a server, and then have your app send an iOS DeviceCheck or Google Play Integrity attestation that the phone is running the actual App Store/Google Play version of your app. But that's also incredibly draconian behavior towards your customers as it basically forces your app to be always-online... which is why a disturbingly high number of games do this.

[0] Yes, I know about Enterprise signing, but Apple specifically forbids distributing Enterprise-signed apps outside of your organization and those apps get revoked all the time. Signing with your own dev account is way more robust and that's what most iOS power users actually use.

[1] I have no clue if FairPlay encryption applies to EU-DMA-compliance signed apps.

[2] ONLY binaries - all your resources are unencrypted and can be downloaded off the App Store CDN and inspected by anyone. Code signing signatures do apply to resources, AFAIK

> On Android though, you can soon see such app stolen and on some of the apk warez sites. It just breaks the model.

Think about Windows and software privacy

Have you tried extracting, decompiling, and modifying someone else's app?

It wasn't hard before LLMs and it's nearly trivial now.

Is that not possible with ios applications?

You can't sideload iOS applications. Meaning there's no point to doing any of the listed things.

Of course you can. How do you think developers test their apps?

Never did iOS development. I always assumed it requires active USB connection with a dev machine or an emulator.

Normal people can't. I'd bet more people run jailbroken than bothering with developer-mode sideload.

You technically can sideload. For 7 days or on TestFlight

This is not a practical way for installing apps though.

The crypographic flow that allows payments to work is straight up pub/priv key encryption with one time use tokens. It's not something you can hack. As soon you see the token it's already been used and thrown away. So whatever nonsense about decompiling literally doesn't matter.

So your professional opinion is that the attack surface of mobile banking apps is limited to tokenized payments? Honestly, I'd be appalled if tokens were routed through my banking app. There is no reason the local client needs that data.

My professional opinion is that APKs can be de-compiled regardless and that has nothing to do with tokenized payments themselves which are like you said handled through server-server communications at the payment processor level. Your phone simply sends a one time use token to authorize the transaction.

You were the one that brought up payments though. Nobody else specified. They just said it could be hacked, which you seem to agree with.

I don't agree that your example makes sense. Don't feel like writing a wall of text. Zero justification for a locked down system.

What exactly was my example? You agreed with me already. Kind of odd to flip around now.

> which are like you said handled

Also, I corrected your misstatement about payments. They have absolutely nothing to do with decomp, and certainly can't be used to dismiss the entire attack surface of a mobile banking app. Your example is complete nonsense.

You are really digging a hole here.

He said his app is a one time payment. Presumably there isn’t a backend and he relies on App Store purchases. I know, it’s shocking an app could just be an actual application rather than a web view.

You can patch out the payment checks if you can decompile it

The payment doesn't happen on the device. It happens at the VISA/Mastercard/AMEX level. So "the app" should be doing the validation upstream on the server side and simply reporting yes/no to the app. If you hack the yes/no okay but most payments are for physical things IRL so the payment gateway that is not on your phone is gonna be like ??? - in other words it's on the app not to trust a raw true/false signal and instead rely on server side checks. This is all irrelevant. I make regular massive purchases on my linux box where I can read the memory. It doesn't change anything.

Ah I see you are focusing on apps that have some web component that would enable ongoing authorization. I was thinking about apps that offer a trial but you can upgrade with an in-app purchase and there is no ongoing service component.

This is one of the most ignorant comment I ever read on Hacker News. Are you from VW?

Obviously VW broke the app for GrapheneOS (or any other custom ROM) on purpose, and ironically, things usually works fine for custom ROMs than some Chinese OEM customized ROMs, and when it works, it means the developer went extra miles to implement workaround to cater the flawed OS.[1]

[1]: ref: Years of Android community experience

Is social media bad for children? yes (heck it's even bad for adults)

Did the UK do this for good cause? absolutely not, they're doing this for the same purpose of all that age-verification bs.

A saying being old doesn’t make it invalid anyway. What’s your point?

My point is that this saying is the tritest of the trite, and therefore not worth being posted.

Friendly reminder: The pennies are going to be used to bring community devs lawsuits.

Legal reminder: it is not allowed to steal someone else's creation and make money from it. Yes, getting money from your Patreon followers to instead of selling directly your Ocarina of Time remake is not allowed.