17 ms·

Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor

• kennywinker 8y ago
  A Dark Room is a _very_ good game. It’s available on many other platforms - highly recommend you check it out!
  • giancarlostoro 8y ago
    NGL I am not huge on Ruby (dont hate it just do more with Python) but I would buy that game just to code in Ruby in the game as weird as that sounds. I love out of the box easter eggs.
• tluyben2 8y ago
  I love the amount of control we are using over our devices. It is not like people can do anything malicious with it. Anyway; so like Apple (less and less luckily), Nintendo forbids editable code to run on their devices? Or is it allowed if there is a gaming aspect involved? Or just not at all?
  • Wowfunhappy 8y ago
    You can purchase a BASIC interpreter on the 3DS eShop. It's called SmileBASIC, and it's pretty full featured. http://smilebasic.com/en/ http://smilebasic.com/en/ It doesn't make intuitive sense to me why a BASIC interpreter would be allowed, but not a Ruby interpreter. The difference is likely that Nintendo was never informed about the Ruby interpreter. While I wish everything was user-modifiable, I'm generally okay with game consoles being locked down, because they don't bill themselves as general-purpose computing devices. I can't run my own software on my BluRay player either.
    • kevin_b_er 8y ago
      It was the deception by the developer. He chose to hide it from all reviews and gave a false description of what the product to sell on the platform was.
      • Dylan16807 8y ago
        I really don't think an easter egg like this is enough for "false description of the product". Is Excel 97 not a spreadsheet program?
        • Wowfunhappy 8y ago
          Was Excel 97 submitted to a separate authority for testing and validation prior to release? It was, don't you think the authority should have been informed of any hidden functionality or easter eggs?
          • AnaniasAnanas 8y ago
            > don't you think the authority should have been informed of any hidden functionality or easter eggs? The users? Sure. An authority? No, not really.
          • Dylan16807 8y ago
            It was submitted to a lot of stores with harsh requirements for shelf space, acting partly on testing and partly on trust. I'd say the authority there is comparable, and no they didn't need to be informed as long as the program admirably performed its job with no malicious code.
    • jplayer01 8y ago
      Which was then used to enable privilege escalation in an exploit. https://mrnbayoh.github.io/basicsploit/ https://mrnbayoh.github.io/basicsploit/ Nintendo is doing far more to prevent piracy and homebrew than they ever have before. It's no surprise to anybody who's familiar with this stuff that they aren't okay with arbitrary code execution, especially if none of the interpreter code was vetted/audited by anybody security conscious. I'm even surprised so many people here aren't getting it.
      • Wowfunhappy 8y ago
        Oh, heh, I hadn't heard about that exploit! I will point out that the Switch already supports untrusted and unvetted code execution—it's called Javascript. The Nintendo Switch may appear to not have a web browser, but it pops up when you try to log into a captive portal. Without it, no one would be able to use public wifi hotspots. I will also note that Nintendo hasn't exactly done a great job at preventing piracy or homebrew on the Switch—both are available provided you have a somewhat older model, and on the latest firmware even.
        • naikrovek 8y ago
          Show me a captive portal that exploits a hole in the security of the Switch, and I'll show you a whole line of captive portals that will very soon no longer load on a patched Switch. Also, I don't think JavaScript is required by most captive portals. Form tags don't require JavaScript. Recovery Mode was the fault of Nvidia, not Nintendo. Soon after that was discovered, the silicon for the Switch was iterated and now you need a signed binary, even in recovery mode. They plug holes as soon as they find them. I don't think it's fair to compare the relatively limited number of people that work at Nintendo to the literal army of people that work to break Nintendo's work every day.
          • Wowfunhappy 8y ago
            You can create a captive portal on your home network that just lets you navigate to any website. https://www.imore.com/how-use-hidden-web-browser-nintendo-switch https://www.imore.com/how-use-hidden-web-browser-nintendo-sw... Edit: Oh, the particular article I linked has you use a public, specially-crafted DNS server, instead of setting one up on your home network as I've done in the past. Oh well, same principle. Plenty of captive portals do indeed require Javascript, which is why the Switch's web browser supports Javascript.
    • phaedrus 8y ago
      A major issue (for me) with SmileBASIC is they removed (presumably at Nintendo's request) any way to export or import code except for their walled garden. Previous versions of SmileBASIC (for the regular DS, under the name Petite Computer) allowed one to (iirc) scan a QR code to input files. Someone has made a modem for SmileBASIC, but it's a lot of typing to get it loaded (presumably Nintendo would quickly pull it from the curated list of programs if someone tried to upload a copy of that).
      • Wowfunhappy 8y ago
        The QR Codes were likely removed because they were cumbersome. I'm not convinced Nintendo was involved. There's a Megaman clone for the DSi version which requires you to scan more than 100 (!) QR codes. That's not fun, and even as an edge case, it's not an experience you want anyone to have with your product. Better to push them to the central server.
        • elsonrodriguez 8y ago
          There's a chance Cubic Ninja has made Nintendo weary of QR codes in third party software.
          • Wowfunhappy 8y ago
            That's very possible too, but other 3DS games still use them, and hackers have found plenty of other entrypoints since Cubic Ninja.
  • olodus 8y ago
    I wonder how far you could go with a language game Zachtronics - style before Nintendo would shut you down. I'm betting it would probably be all good until you allowed interfacing with some more basic underlying systems to the language (such as network for example) to the language. They can't be against custom map making for example right? How Turing complete are you allowed to make your custom map editor?
    • crooked-v 8y ago
      The requirement would probably be sandboxing without access to the rest of the machine, since that's what they've allowed for previous "programming toy" releases. SmileBASIC has full programming capability aside from direct hardware and network access, including comprehensive control of rendering and importing/exporting programs (http://smilebasic.com/en/ http://smilebasic.com/en/).
    • naikrovek 8y ago
      See: Human Resource Machine on Switch. It's a game about programming in assembly where you actually program in "assembly". It's not real assembly, but at the same time, it kind of is.
  • icebraining 8y ago
    It seems a full coding platform is being launched for the Switch[1], so that's likely not the problem. My guess is that they want to approve it first, which seems sensible if it's being published on their store (even if we wish there were alternatives to their store). [1] https://news.ycombinator.com/item?id=16176742 https://news.ycombinator.com/item?id=16176742
  • CJefferson 8y ago
    There are several code systems on Nintendo systems. What Nintendo is upset about is this was hidden, so they couldn't properly check it.
• robrtsql 8y ago
  > The apps would be tied to the game itself, and would only be able to run when loading up that game, but you can see why Nintendo would take issue with its implementation. I have a few guesses, but no, I don't see why Nintendo took issue with this. Is it because users could damage their devices with access to something like this? Is it because this could somehow be used to undermine Nintendo's DRM or cheat in online games?
  • kro92kfmrzz 8y ago
    There’s definitely an argument to be made about how this dev should only be shipping to hundreds, thousands, or millions of personal devices via Nintendo’s infra only what’s printed on the tin. My hacker nerd side is all giggly. My security and consumer conscious sides bristle at the idea some dev thought it was a great little in-joke to ship this to unsuspecting users.
    • sucrose 8y ago
      > dev should only be shipping to hundreds, thousands, or millions of personal devices via Nintendo’s infra only what’s printed on the tin That's a very long-winded way of saying, "He should only sell what was advertised." > unsuspecting users Nobody is forcing anyone to find or access Easter Eggs. It wasn't malicious nor annoying, it wasn't even accessible unless you attached a keyboard. I haven't seen any backlash from "unsuspecting" buyers, only Nintendo. I see the potential worries from a security perspective, but as an "unsuspecting" consumer, why would you care?
      • deleted 8y ago
        [deleted]
  • zach_garwood 8y ago
    I agree. I can see Nintendo being upset because it's not a game, but I'm failing to see why this is such a big deal?
    • 8y ago
• jplayer01 8y ago
  Well, this was to be expected. I was wondering when it was announced how long it would take for Nintendo to drop the hammer.
• 0815test 8y ago
  There goes my idea of porting Core War to the Nintendo Switch. Ah well.
  • segfaultbuserr 8y ago
    lol. Will Nintendo sue you under the DMCA and claim you are attacking their platform with viruses?
  • crooked-v 8y ago
    The 3DS has a sandboxed BASIC implementation available complete with exporting and loading programs (http://smilebasic.com/en/ http://smilebasic.com/en/), so other programming-in-a-VM games would probably be fine, presuming the developer was actually upfront about that at the time so proper security and content-rating testing could be done.
  • naikrovek 8y ago
    Feel free to port to a Switch emulator. I realize that the point of porting Core War is lost on an emulator. Even when the OS shell crashes, it starts right back up, anyway.
• jdietrich 8y ago
  >The narrative that has played out online is exactly what's wrong with this trashcan fire of a world. >Everyone is an armchair expert. Everyone thought the worst. You've seen that I've been called a dick, idiot, and everything in between. Because sensationalised news sells. If the narrative was 'I added a sandbox to A Dark Room that lets you mod the game and provide a medium for kids to code (and technical parents to show their kids what they do),' it would have gone unnoticed. This is just desperate. Nintendo are notoriously protective of their platforms and their IP. It has been an essential part of their business model for over 30 years, going back to the NES10 chip. Expecting Nintendo to disregard their own Terms of Service because this specific breach is well-intentioned is utterly naive. Rajan says: "I snuck it in assuming that plugging in a USB keyboard and pressing the "~" key wasn't part of the test plan". He intentionally deceived Nintendo as to the nature of his app by including a hidden feature that allows for arbitrary code execution. He announced the existence of that feature on social media. What else did he expect to happen?
  • HeWhoLurksLate 8y ago
    TBH, the only reason I'm upset is because I missed the chance to try it.
  • praptak 8y ago
    The fact that Nintendo were always like this does not mean it is okay. If there's anything wrong with this story it's how everyone seems to silently accept it is okay for a company to tell you what you can run on the hardware that you "buy" but not really own.
    • roblabla 8y ago
      If nintendo didn’t put DRM, publishers would avoid the platform, as they would see it as insecure. Blame the laws allowing this.
      • failrate 8y ago
        Sure, just like developers never make games for Windows PC.
• mimixco 8y ago
  Another recent post here on HN is from the app developer himself. Only hours ago, he told detractors "not to worry" about Nintendo's response. And now this.
• crankylinuxuser 8y ago
  And this is what happens when people don't own the hardware they buy. Instead, they get awful DRM'ed bullshit, with a monopolistic store 'owner' digitally forcing whatever they say on their fiefdom. The first computer I had access to had BASIC built in. Having control of a computer of what runs and not is an absolute basic right of ownership. And from these computers called "game consoles", you the purchaser have none of that.
  • icebraining 8y ago
    I agree with you. On the other hand, what if someone wants an awful DRM'ed bullshit? Seems like poor form to purposefully bait-and-switch them. If, say, my Yubikey had some secret dance move that allowed people to read the private key from it, I'd be pretty miffed.
    • anfilt 8y ago
      A yubikey is a lot different than a locked down phone or gaming console.
      • HeWhoLurksLate 8y ago
        Not on the point of access to personal information- my phone, and I would guess thousands of others, have and use a banking app, have contacts, etc. YubiKeys are similarly not constrained to one use case, and I, too, would be pretty irritated if someone bypassed my laptop's encryption by pressing tilde. That's not to say that jailbreaking, or any other gaining of execution is inherently bad, it just depends on the use-case- as a teenager, programming on a Switch sounds great, while as a parent, the possibility of my kid gaining access to unlimited blood and gore, Konami code style, might turn me off the platform.
  • Kim_Bruning 8y ago
    What surprises me is the number of people who seem to be agreeing with Nintendo in this case. I guess the Overton window is shifting away from a position of software freedom; which is unfortunate. :-/
• miki123211 8y ago
  In what way was that code editor malicious? Did it allow i.e. creating your own games, modifying other games etc? I don't think so, since I'd expect apps on such platforms to be totally sandboxed. If you could only enter data into it via a keyboard, you couldn't even use it to download programs off the internet, except doing it the 80s "let's retype those ten pages of code into my computer" style.
  • crooked-v 8y ago
    If it's a full implementation with OS-level access, a USB device that fakes keyboard input could do all kinds of spyware-like stuff with only brief access to the hardware, and without most users even knowing it's possible.
    • tylerhou 8y ago
      Are Switch games themselves even allowed full OS access?
    • nacs 8y ago
      It doesn't allow OS-level access -- its limited to the game/app sandbox. Also Nintendo does have a full BASIC interpreter available for sale on their app store.
  • javagram 8y ago
    > I'd expect apps on such platforms to be totally sandboxed. This hasn’t been the case for any previous Nintendo console. Xbox does use HyperV to silo games from apps, but we’ve never heard anything about Nintendo doing something similar.
    • icebraining 8y ago
      According to the Wikipedia summary of this CCC video[1], the Switch OS (called "Horizon") sandboxes all userspace processes. [1] https://media.ccc.de/v/34c3-8941-console_security_-_switch https://media.ccc.de/v/34c3-8941-console_security_-_switch
  • 8y ago
• saidajigumi 8y ago
  The narrative in the article also misses the following point, which I've seen many times over the years, in both game dev and non-game dev shops: It is massively unprofessional to ship an Easter Egg without broad consent to do so. Planning a fun "secret" for your users? Great! Surprising people involved in the publishing pipeline, esp. in a "will I get caught" way? Not so great. That's where Rajan went off the rails.
  • ppseafield 8y ago
    Indeed. Although this isn't sexually explicit, it reminds me of the trouble Rockstar got in after the Hot Coffee fiasco. Their publisher had to pay out hundreds of millions of dollars. (Edit: pkroll is correct, the final penalties were $21 million.) https://en.wikipedia.org/wiki/Hot_Coffee_mod https://en.wikipedia.org/wiki/Hot_Coffee_mod
    • pkroll 8y ago
      That link puts the number closer to $21 million, where'd the "hundreds of millions" come from?
      • ppseafield 8y ago
        Ah, you're correct. I read one of the figures incorrectly.
    • def_true_false 8y ago
      >it reminds me of the trouble Rockstar got in after the Hot Coffee fiasco In that in both cases the backlash is more ridiculous than the Easter egg itself?
      • beenBoutIT 8y ago
        Easter egg's that end up costing a a fortune.
    • CobrastanJorji 8y ago
• ggggtez 8y ago
  I wasn't able to find their developer policy, but I'd assume this is a pretty cut and dry case of violating the policies he agreed to when he submitted the game for review. Nintendo is very protective of running pirated or unofficial games, ever since the late 80's, when knock-off games were rampant and leading up to today with DRM. I'm sure it's against their policies to sell a game where users are allowed to write arbitrary games/code without Nintendo approval. It would be different if the game was sold as a Ruby interpreter, because then they could at least verify it's capabilities and make an informed judgement about whether they should allow it.
  • naikrovek 8y ago
    https://developer.nintendo.com/ https://developer.nintendo.com/ To get an account there, you must agree to a few things, one being an NDA, and to get a Switch dev kit you must agree to a few more things, as well as go through a case-by-case evaluation of your game idea, if you are not an established game developer. We won't be seeing the agreement(s) that were likely broken, and if you can see them, you are under NDA.
• politician 8y ago
  That's wild because Super Mario Bros contains a built-in code editor (via arbitrary code execution easter eggs), and Nintendo is OK with that. https://www.youtube.com/watch?v=OPcV9uIY5i4 https://www.youtube.com/watch?v=OPcV9uIY5i4
  • webdevatlurk 8y ago
    My favorite example of this is the time it was used it to inject flappy bird. https://www.youtube.com/watch?v=hB6eY73sLV0 https://www.youtube.com/watch?v=hB6eY73sLV0
  • DerekL 8y ago
    The Switch eShop also has the programming game Human Resource Machine. http://www.nintendolife.com/reviews/switch-eshop/human_resource_machine http://www.nintendolife.com/reviews/switch-eshop/human_resou...
  • httpsterio 8y ago
    Isn't that a bug though and not a feature? Also running the inputs to generate compileable code isn't feasible on the original console because of the required precision of the inputs and only possible on emulators?
    • ihuman 8y ago
      No, a person can do it on a real console https://www.youtube.com/watch?v=hB6eY73sLV0 https://www.youtube.com/watch?v=hB6eY73sLV0
      • httpsterio 8y ago
        Thank you, I stand corrected.
      • vermilingua 8y ago
        Saying SethBling can do it, does not mean that ordinary people can do it. He is a very talented and focused individual.
• phaedryx 8y ago
  I follow him on Mastodon, where this all played out: https://ruby.social/@amirrajan https://ruby.social/@amirrajan His explanation: https://ruby.social/@amirrajan/101991299426077446 https://ruby.social/@amirrajan/101991299426077446 He did security checks: https://ruby.social/@amirrajan/101986725826245184 https://ruby.social/@amirrajan/101986725826245184
  • 59nadir 8y ago
    > He did security checks: https://ruby.social/@amirrajan/101986725826245184 https://ruby.social/@amirrajan/101986725826245184 This is worth nothing to Nintendo and should be worth nothing to other people. This should've been done as a collaboration with Nintendo in order to actually bring Ruby to the Switch, not snuck in.
  • eridius 8y ago
    So wait, he did "an immense amount of pen testing", while at the same time this was something he snuck in at the last minute on a whim? Something doesn't add up here.
• droithomme 8y ago
  > you can see why Nintendo would take issue with its implementation Actually, I don't see why. The interpreter only runs inside his game. It doesn't root the machine. Why would anyone object to this?
  • httpsterio 8y ago
    Because it could possibly be used to hack into the main system like with Lumines and the original PSP
  • roblabla 8y ago
    The implementation is based on mruby, which is riddled with bugs. I spent some time reversing A Dark Room before it got removed. I am confident that there are bugs allowing ROP, from which point getting CFW is a matter of privesc. We have privesc to bootrom on every firmware version up to 7.x (inclusive). This is obviously bad for nintendo.
    • baroffoos 8y ago
      The games themselves run in a sandbox and should not have access to the greater OS, hypervisor or arm trustzone which are on the switch.
      • minimaxir 8y ago
        "should" is the operative word.
      • xena 8y ago
        Assuming the jar has no holes. The jar apparently has holes and the brain inside it can peek out.
        • baroffoos 8y ago
          I haven't seen any exploits from application level getting access to the OS. There is basically one exploit being used on the switch which uses a bug in the nvidia chip at boot which gives you a higher level of access than the OS and all of the security checks. Its such a powerful exploit that can only be fixed by a hardware change that no other exploit is needed.
• Creationer 8y ago
  Looks like this new platform is getting flooded, and Nintendo's quality control is not keeping up. A game like this should have never been allowed a release - just from the poor visual quality alone.
• Lowkeyloki 8y ago
  What about people who already bought it? Does it stay installed on their consoles? And if they uninstall it, can they download it again? It's probably moot because I'd expect Nintendo to demand a patched version of the game with Ruby removed to replace the existing version for those who bought it even if Nintendo decides not to allow it up on the store again.
  • strangecasts 8y ago
    I can't remember them pulling games off consoles - when people discovered games allowing code execution on the 3DS, Nintendo either marked patches as mandatory as soon as they were ready (so you couldn't play without updating) or attempted to block the exploit on the OS side (as they did with Cubic Ninja, since the studio behind it shuttered)
• hunterjoe984 8y ago
  Sad
• logicallee 8y ago
  I read every word of the post (including quotations) and watched every second of the video. I've played on a Switch (owned by someone else). Can someone ELI5 what the issue is here or why there's any reason for remorse? Since it's a text adventure game, what's the difference between the game as allowed (text adventure) and the sandboxed bundled ruby? What's the difference between those 2 things? (A sandboxed ruby seems strictly equivalent to a text adventure game to me.) Not trying to be obtuse, just don't get it.
  • govg 8y ago
    One issue that can easily crop up - the sandbox has bugs that allow access outside the game. This makes the game suddenly more than just an adventure game, and could be exploited. This is what Nintendo is trying to prevent here.
    • logicallee 8y ago
      Oh okay. That's surprising to me because Ruby is a web language, so you would think that no, it wouldn't really have any known bugs like that. And again, if you're talking about potential bugs I'd think the text adventure game (or any game) might have bugs too. I still don't get it though because isn't it the user's hardware? Is there some more context here? I'm still confused.
• everyone 8y ago
  I will never understand why people buy consoles. By doing so, rather than getting some kind of pc, you are doing nothing but paying a lot more in order to greatly restrict your options and make all your gaming utterly beholden to some corp. It used to be the case that consoles were more convenient and faster to play games on. Now the opposite is true. To run a console game you have to make and sign into an account, be online, it will need to update its OS, then update the game, and loading times are enormous.
  • bobthepanda 8y ago
    For me at least, the appeal is that the Switch is capable of being handheld on things like the commute and flights. PC gaming is not as convenient or portable, and mobile gaming is not nearly as pleasant of an experience. You don't have to be online to run a Switch. And the Switch uses solid state memory so loading times are pretty good.
• erikpukinskis 8y ago
  I have often wondered... Could you make a video game for these platforms, Nintendo or iOS, where there is a fully... is endogenous the word? virtual machine in the game world that you could program on? Like, the registers and compute cycles weren't real ticks, they actually happen within the game loop? Like, if I made a space sim¹, and the flight computer ran on PICO-8², and there were actual transistors in the spaceship model, and there was a terminal with actual wires that go to them, would that get banned from the app stores? ¹ (similar to what 0x10c was intended to be) ² https://www.lexaloffle.com/pico-8.php https://www.lexaloffle.com/pico-8.php
  • mebo 8y ago
    Nintendo does tend to allow things that let users "code" their own games, as long as it's well-checked and the devs are upfront about it. See SmileBasic(http://smilebasic.com/en/ http://smilebasic.com/en/), a commercial BASIC interpreter for 3DS that let's you make simple games, condoned by Nintendo and sold on the eShop. Coincidentally, it led to 2 separate exploit chains that allow for native code execution - Nintendo doesn't want any of that and it's understandable that they want to avoid any possibility of it happening, especially if the groundwork for such an exploit is getting snuck in as a legitimate game without even telling them about it. People will always find their way around sandboxes and limitations, especially on a highly targeted system like the switch.
  • crooked-v 8y ago
    iOS has a full Javascript interpreter with native API access and Files.app integration available as an app: https://scriptable.app https://scriptable.app
• jeff_fenz 8y ago
  Can the Switch be jailbroken?