Sony's network security woes continued over the weekend, and the light at the end of the tunnel still seems like a distant pin prick for the embattled gaming giant and its displaced customers. Bloomberg reports that Sony spokesman Shigenori Yoshida indicated the company plans to restart Playstation Network services by May 31st, which would bring the total downtime to a whopping 41 days.
Nick Caplin, head of communications for Sony Computer Entertainment Europe, posted an update to the European PlayStation blog hinting at the reasons for a longer delay. "We expected to have the services online within a week. We were unaware of the extent of the attack on Sony Online Entertainment servers, and we are taking this opportunity to conduct further testing of the incredibly complex system," he wrote.
While the PS3 versions of both Free Realms and DC Universe Online fall under the PSN umbrella, no word has been forthcoming as to a restart date for the rest of SOE's MMO stable, which includes the PC versions of the aforementioned titles as well as EverQuest and EverQuest II.
[Update: CNET is reporting that Sony is considering a reward for information leading to the capture of the hackers. Meanwhile, Sony is apparently contesting reports about the May 31st date, suggesting no such hard deadline for PSN resumption exists.]
Reader Comments (48)
Posted: May 9th 2011 10:03AM EndDream said
wow......
Posted: May 9th 2011 10:07AM Yellowdancer said
They don't want to be in business anymore, I guess.
But it takes a long time to make a completely new data center so I can understand the long downtime.
But it takes a long time to make a completely new data center so I can understand the long downtime.
Posted: May 9th 2011 10:25AM aurickle said
@hami83
Not only do they have to build a new data center, but these servers will certainly be running the most current operating software and patches.
The only reason why those items would not have been updated before this was if doing so would break significant portions of the code that runs their services. This means that not only do they have to get the new servers set up with everything migrated onto them but they also have to rewrite a lot of code.
Of course, to do this they first need to test every single thing to make sure it works. Whatever is broken, they then need to figure out why followed by how to fix it. Then they have to test absolutely everything all over again -- to make sure the item was fixed but also to ensure that nothing else got broken in the process.
Plus, they're testing to ensure that this same attack can't happen again along with doing their best to find any other vulnerabilities.
As you pointed out, NONE of this can be accomplished quickly even if they are working around the clock. They also can't throw the full resources of the company at the problem because most of their people are not IT techs. You can't take a 3D modeler or a marketing rep and expect them to know an SSL from their elbow.
It's not practical to bring in lots of new people, either. They won't know the systems or the code (and believe me, code to do the same thing can be radically different depending on who programmed it). What's more, anyone they hire short term becomes a potential security risk long term. They would have to be VERY careful screening new people for this. To say nothing of the fact that you can't just bring new staff on overnight.
Those of us living in the internet age are used to everything happening overnight. Growing up, I was used to pictures taking days to get across the country and now we get upset if it takes more than 5 seconds for them to travel around the world. But the reality is that the systems that make this instant gratification culture possible are often extremely complex and take huge amounts of development time. We need to keep our expectations here realistic, and also appreciate the fact that Sony is not going to be taking ANY chances on this. They know that they could not afford another event like this. So while they don't want to keep anything down a moment longer than necessary, they are also being understandably cautious.
Reply
Not only do they have to build a new data center, but these servers will certainly be running the most current operating software and patches.
The only reason why those items would not have been updated before this was if doing so would break significant portions of the code that runs their services. This means that not only do they have to get the new servers set up with everything migrated onto them but they also have to rewrite a lot of code.
Of course, to do this they first need to test every single thing to make sure it works. Whatever is broken, they then need to figure out why followed by how to fix it. Then they have to test absolutely everything all over again -- to make sure the item was fixed but also to ensure that nothing else got broken in the process.
Plus, they're testing to ensure that this same attack can't happen again along with doing their best to find any other vulnerabilities.
As you pointed out, NONE of this can be accomplished quickly even if they are working around the clock. They also can't throw the full resources of the company at the problem because most of their people are not IT techs. You can't take a 3D modeler or a marketing rep and expect them to know an SSL from their elbow.
It's not practical to bring in lots of new people, either. They won't know the systems or the code (and believe me, code to do the same thing can be radically different depending on who programmed it). What's more, anyone they hire short term becomes a potential security risk long term. They would have to be VERY careful screening new people for this. To say nothing of the fact that you can't just bring new staff on overnight.
Those of us living in the internet age are used to everything happening overnight. Growing up, I was used to pictures taking days to get across the country and now we get upset if it takes more than 5 seconds for them to travel around the world. But the reality is that the systems that make this instant gratification culture possible are often extremely complex and take huge amounts of development time. We need to keep our expectations here realistic, and also appreciate the fact that Sony is not going to be taking ANY chances on this. They know that they could not afford another event like this. So while they don't want to keep anything down a moment longer than necessary, they are also being understandably cautious.
Posted: May 9th 2011 2:08PM ChromeBallz said
@aurickle I'm pretty sure that the sole reason they never updated (or even secured) their servers was because it was easier for them, network wise, to just let it be so open and not have to worry about firewall settings, connection settings and whatever which would have to be updated and maintained along with the basic soft and hardware.
Just a matter of budget cuts in the wrong places. And as someone else stated in another article, Sony's desperation to keep up with already established networks like Live but it's inexperience with software in general.
Reply
Just a matter of budget cuts in the wrong places. And as someone else stated in another article, Sony's desperation to keep up with already established networks like Live but it's inexperience with software in general.
Posted: May 9th 2011 3:17PM jonnyfrag said
@aurickle
Quoting:' Of course, to do this they first need to test every single thing to make sure it works. Whatever is broken, they then need to figure out why followed by how to fix it. Then they have to test absolutely everything all over again -- to make sure the item was fixed but also to ensure that nothing else got broken in the process'
You really don't know SOE do you? LOL
Slap some shiz together with bailing wire and hot glue, does the server not restart itself? Ok we are good here, moving on...
Reply
Quoting:' Of course, to do this they first need to test every single thing to make sure it works. Whatever is broken, they then need to figure out why followed by how to fix it. Then they have to test absolutely everything all over again -- to make sure the item was fixed but also to ensure that nothing else got broken in the process'
You really don't know SOE do you? LOL
Slap some shiz together with bailing wire and hot glue, does the server not restart itself? Ok we are good here, moving on...
Posted: May 9th 2011 6:04PM (Unverified) said
@aurickle i like how you summed that up aurickle but then my question is why did they wait until now todo it makes little sense. oh save money really sony and how much money have you saved now?
Reply
Posted: May 9th 2011 9:34PM Zuato said
@aurickle While it certainly makes sense for them to be cautious, the systems that were hacked were certainly not custom coded and from all indications were your standard internet facing software packages that Sony never bothered to update or lock down properly (I'm guessing a LAMP set up, but outside of the hackers that did it and Sony we may never know for sure). This is how they got in.
Beyond that the PSN stuff certainly is custom code, but locking down the internet facing stuff and keeping it patched would have gone a long way in reducing the chances this could or would have happened. From what the press has released they still have a security firm going through everything to see how far in these guys got and that is the biggest hold up as they do their investigation.
Personally this has affected myself and my kids as we have a PS3 in the house and everyone is ready to toss the thing out and get a 360 now (although I despise their money grabbing scheme per user/per year for most of the online stuff). The Kinect part looks pretty sweet and I play most of my games on the PC anyway.
Reply
Beyond that the PSN stuff certainly is custom code, but locking down the internet facing stuff and keeping it patched would have gone a long way in reducing the chances this could or would have happened. From what the press has released they still have a security firm going through everything to see how far in these guys got and that is the biggest hold up as they do their investigation.
Personally this has affected myself and my kids as we have a PS3 in the house and everyone is ready to toss the thing out and get a 360 now (although I despise their money grabbing scheme per user/per year for most of the online stuff). The Kinect part looks pretty sweet and I play most of my games on the PC anyway.
Posted: May 9th 2011 10:09AM RTaveira8 said
Oh hai Sony.
Can we get a date for SOE?
It would only be fair, perhaps an target date? something we can go by?
It would be a lot better than sitting around trying to figure it out from "reports".
Can we get a date for SOE?
It would only be fair, perhaps an target date? something we can go by?
It would be a lot better than sitting around trying to figure it out from "reports".
Posted: May 9th 2011 10:27AM aurickle said
@RTaveira8
There's no way they could provide a target, really. For one thing, they can't know what fixes might break something else and therefore how long it will take to pull off. On top of that, imagine if they did give a date and then something unexpected forced a delay. No matter how much they might have couched the date in terms of "hopefully" and "estimated" the internet would eat them alive if they missed it.
Reply
There's no way they could provide a target, really. For one thing, they can't know what fixes might break something else and therefore how long it will take to pull off. On top of that, imagine if they did give a date and then something unexpected forced a delay. No matter how much they might have couched the date in terms of "hopefully" and "estimated" the internet would eat them alive if they missed it.
Posted: May 9th 2011 10:46AM (Unverified) said
@aurickle
Why did they provide a Target date for PSN then? Wouldn't your same problems apply to that? You've confused me.
Reply
Why did they provide a Target date for PSN then? Wouldn't your same problems apply to that? You've confused me.
Posted: May 9th 2011 10:29AM Jade Effect said
I guess this is good news for players who are getting a little too much fresh air and sunshine while waiting for their game to come back online.
Posted: May 10th 2011 3:03PM kalipou134 said
@Jade Effect
More like the final nail in DCUO's coffin rofl
Reply
More like the final nail in DCUO's coffin rofl
Posted: May 9th 2011 10:42AM kunic said
Please list the update Massively:
"In his press conference on May 1st, boss Kaz Hirai already stated that PSN would receive a phased roll-out over the period of one month (ending May 31st), with the most sensitive services – notably those such as the PlayStation Store that contain customer details – coming last."
Source: http://www.mcvuk.com/news/44225/Sony-clarifies-six-week-fears
So we should expect the PSN to come back up pretty soon, but the Store to still be down.
"In his press conference on May 1st, boss Kaz Hirai already stated that PSN would receive a phased roll-out over the period of one month (ending May 31st), with the most sensitive services – notably those such as the PlayStation Store that contain customer details – coming last."
Source: http://www.mcvuk.com/news/44225/Sony-clarifies-six-week-fears
So we should expect the PSN to come back up pretty soon, but the Store to still be down.
Posted: May 9th 2011 10:53AM (Unverified) said
@kunic
This is very likely. The reason the network is still down is because the credit card companies won't let them bring it up. If they remove all the payment services from PSN then they can bring back the other functions.
It's also why SOE will probably be out longer. They are based on pay-for-play service and could be held hostage by Visa/Mastercard until they can come to an agreement with Sony.
Reply
This is very likely. The reason the network is still down is because the credit card companies won't let them bring it up. If they remove all the payment services from PSN then they can bring back the other functions.
It's also why SOE will probably be out longer. They are based on pay-for-play service and could be held hostage by Visa/Mastercard until they can come to an agreement with Sony.
Posted: May 9th 2011 11:19AM Yellowdancer said
@kunic
Wouldn't have mattered if you canceled. They can't delete payment histories anyway. No business can. They have to keep it for their own personal finance records for years. Everything you ever purchased online sits on a server somewhere forever.
Reply
Wouldn't have mattered if you canceled. They can't delete payment histories anyway. No business can. They have to keep it for their own personal finance records for years. Everything you ever purchased online sits on a server somewhere forever.










