Switch hacking/homebrew scene explodes when a team excommunicates one of their members for disclosing an exploit another person found without permission. Accused claims they did nothing of the sort and makes a side remark accusing the original accuser of transphobia.

18  2018-07-13 by roothorick

ReSwitched Team Twitter (Discord server link pinned there)

ktemkin Twitter is the apparent unauthorized reporter that was excommunicated. What becomes relevant far later is she is a transwoman that downplays that in her public persona.

SciresM Twitter originally discovered the exploit in question (details have been withheld and probably aren't all that important anyway),

Sci openly discourages brigading, which is interesting with comments that come later:

[6:02 PM] SciresM: @everyone There'll be some slight turbulence while we adjust the server to account for this. Hang in there.

Please note: any and all attempts to use this ban as justification to be a shithead in the server (especially in transphobic ways) will be met with a strict zero tolerance policy.

[6:52 PM] SciresM: I would like to repeat: do not harass ktemkin here or elsewhere.

Anyway, relevant comments from the remaining RS members in their Discord, with the occasional contextualizing comment from others:

[6:02 PM] SciresM: .ban @ktemkin Submitted a bootrom bug she did not originally discover (without finder consent) to bug bounty (for up to $200k), as well as other questionable behaviors towards multiple community members.

(The channel was locked for a while as people started understandably losing their shit)

[6:32 PM] SciresM: It was not f-g, she found that.

[6:41 PM] TuxSH: this is not déjà-vu, this is another exploit

[6:42 PM] SciresM: It was not sent to Nintendo.

[6:49 PM] nicolás: @azza900 like many others hedge is affected because she was friends with kate and feels betrayed

(Hedge Twitter is genderfluid and the prefers pronouns she/her, as noted on her twitter description. Hedgeberg made some tweets confirming this situation is the primary reason for her recent funk and that she feels betrayed. Her Twitter account has since been locked, hiding the tweets.)

[6:49 PM] nicolás: it wasn't hedge's bug either

[6:50 PM] Plailect 🌹: @iBlackSunday the exploit in question has not yet been released

[6:50 PM] Shúbshúb [5.x.x]: @Plailect 🌹 is said exploit on the same level as b9s?

[6:52 PM] Plailect 🌹: @Shúbshúb [5.x.x] I'm not gonna give details on sciresm's exploit, that's for him to do

[6:53 PM] Plailect 🌹: @parrotgeek1 afaik said bug is not patched in the wild

[7:06 PM] nicolás: for all we know she didn't get paid at all (but having submitted is the problem already)

[7:20 PM] n.: getting information on vulndisco from an nvidia employee is probably as unethical as pirating videogames

[7:21 PM] SciresM: @n. I won't comment further except to say that that's not what happened

Two and a half hours later, Kate strikes back on Twitter:

I haven’t sold out any Switch bugs to Nintendo; though it’s possible I exercised bad judgement in submitting some Pixel C bugs, possibly. I don’t know what the actual accusations are, as @SciresM has not been willing to communicate them to me. To date, I have not made a dime. =\

I’m really not pleased with the way that @SciresM has “come forward” with accusations— he’s provided very little info about what he believes happened, and refused to communicate with me. I won’t lie: this hurts— and given the lack of comms, I don’t even know what I deserve.

I did use a bootrom bug that @SciresM found to illustrate why a security policy decision made on the Pixel C was a bad one— but I only used this as I was under the impression (and had evidence) that NVIDIA and their subordinate OEMs already knew about that bug.

Sci counters:

We spoke more than enough in DMs. I can post more logs if you'd like, but I think that would be a major breach of privacy. [With screenshot of DMs](https://twitter.com/SciresM/status/1017608556441288706)

Around the same time, he also commented in Discord:

[10:10 PM] SciresM: We discussed this at length, examined a ton of evidence, and came to the only conclusion that there was to come to: She violated trust by reporting a bug that wasn't her discovery, and was subsequently banned.

[10:10 PM] SciresM: I've talked to ktemkin.

Kate counter-counters:

That DM is well after you made your accusations to the public, and contains only me apologizing “just in case”, while you still haven’t actually talked to me at all about what’s going on. I’m okay with you not wanting to talk about this, but not with the public accusations. :/

Then elaborates:

The vuln I reported was a config issue that was already fixed on the Switch and had been before I submitted to Google. The vul needed to be patched on th Pixel C as well, so I let them know via their bug system. I didn’t explicitly submit it to any “bounty”-targeted programs.

I... didn’t pass myself off as the author of the exploit. I found evidence that the exploit was known well before @SciresM independently discovered it, and then referenced that in my own reports to substantiate that the config bug is serious.

And now it gets personal:

Given how many times @SciresM and I have argued over his disregard for LGBT and trans rights, I don’t think any of this is actually a major concern of Scire’s. I’ve given up on expecting decency from him. Instead, he’s lied to the public repeatedly— so good riddance, I guess.

Let's return to Discord!

RS makes some dubious claims about what was discussed in the screencapped DMs:

[11:18 PM] Plailect 🌹: Ktemkin was clearly contacted by @SciresM (proof: https://twitter.com/SciresM/status/1017608556441288706) in direct contradiction to her claim that no attempt at communication has been made. She has admitted to including, without permission, a bug she did not find in a bug report to Google (proof: https://twitter.com/ktemkin/status/1017608653493305344). Regardless of whether or not Google already knew about said bug (and I have serious reason to doubt that they did), she did not have the right to share the information given to her in confidence. Without even getting into the financial incentive for her actions, this breach of trust is a violation of the ethical standards set by this community and warranted a public ban.(edited)

[11:26 PM] Plailect 🌹: As @SciresM said earlier, all that needed to be said has been said. Please be aware that any further discussion which contributes nothing but pointless bickering may result in moderator action.

The most recent development:

[11:56 PM] SciresM: fwiw: the issue was discussed internally with the team.

[11:56 PM] SciresM: (Or at least, with several relevant parties)

I like that "several relevant parties" note. The hell does that even mean?

12 comments

1  SnapshillBot 2018-07-13

You're not shit next to me. My genes are just light years superior to yours and I don't even need to look at you.

Snapshots:

  1. This Post - archive.org, megalodon.jp*, removeddit.com, archive.is

  2. ReSwitched Team Twitter (Discord se... - archive.org, megalodon.jp*, archive.is

  3. Twitter - archive.org, megalodon.jp*, archive.is

  4. Twitter - archive.org, megalodon.jp*, archive.is

  5. Twitter - archive.org, megalodon.jp*, archive.is

  6. https://twitter.com/SciresM/status/... - archive.org, megalodon.jp*, archive.is

  7. https://twitter.com/ktemkin/status/... - archive.org, megalodon.jp*, archive.is

I am a bot. (Info / Contact)

1  Mary-Celeste 2018-07-13

skrrt skrrt my dicc hurt

1  le_epic_xd 2018-07-13

zoom zoom my balls sting

1  Tricitiesdrama 2018-07-13

*zing zing

1  ShizukaHiratsuka 2018-07-13

i remember using homebrew a while ago for my old wii and ripping mario kart. good times

1  PurpleIcy 2018-07-13

That's Kafkatrap if I've ever seen one. :OmegaThonk:

1  roothorick 2018-07-13

This just happened:

[3:05 AM] megane: Alright, there's a lot of stuff that's happened. Kate made what was probably a poor decision to use that bug as an example for the Pixel C, but she did not submit it to a bug bounty program, and never intended to betray or hurt anyone. SciresM publically denounced her, banned her, and made an official announcement on behalf of ReSwitched. This was not discussed with Kate beforehand, or even internally with the rest of the team. SciresM did not discuss Kate's actions with her before doing any of this. This could have been handled quietly and respectfully. SciresM could have said that there had been creative differences and that Kate was no longer affiliated with ReSwitched. He didn't. His decisions started vitriol, and he still hasn't communicated any actual details to Kate or the rest of the team. I find these actions reprehensible. I especially find it reprehensible that SciresM and other moderation staff have decided to censor discussion of these events.

I expect to be removed from the team following this message. This is fine. I no longer wish to support ReSwitched given these actions.

I would appreciate it if I were allowed to remain in the server, but we'll see what happens.

@everyone

(same message spammed over and over again by two different users)

[3:07 AM] Qyriad: holy shit

[3:07 AM] Vªl: Megane's name starts with a non-ascii character

[3:07 AM] Nevostrius: inb4 .lock again 

[3:08 AM] misson20000: .ban @idonwhat that is very obnoxious

[3:08 AM] BOTRobocop: idonwhat#4577 is now b&. 

[3:08 AM] Adùbbz: Can the bot auto-remove specific messages?

[3:08 AM] Qyriad: Ouch

[3:09 AM] oreo639: It is based off kurisu and kurisu does do that (as a piracy filter).(edited)

[3:09 AM] Vªl: Auto-ban for spamming specific messages as well? Would make moderation a lot easier tbh

[3:09 AM] Qyriad: The spam might be a bit much, but like, that's a message

[3:09 AM] misson20000: sorry you've become a copypasta apparently

[3:09 AM] Qyriad: I'd instead suggest auto-removing repetitive text or something

[3:09 AM] misson20000: ^

[3:09 AM] Adùbbz: It's not the message itself @Qyriad, just people have been spamming it

[3:09 AM] misson20000: ^

[3:09 AM] Vªl: ^

[3:09 AM] Qyriad: Yeah so don't ban it >.>

[3:10 AM] Cyka Blyat: 

[3:10 AM] Shadów: ¯_(ツ)_/¯

[3:10 AM] misson20000: indeed

[3:11 AM] stuckpixel: the message has been left in the server multiple times, I think it's run it's course

[3:11 AM] stuckpixel: it's still all over

[3:11 AM] stuckpixel: in multiple channels

[3:11 AM] stuckpixel: on twitter

[3:11 AM] stuckpixel: I think we get the point

[3:11 AM] stuckpixel: thanks

1  roothorick 2018-07-13

I missed some hot action over on Twitter. Kate's getting more aggressive! Now she's accusing wololo.net of spreading bad information.

Probably easier to just post a link for this. Thread between Kate and wololo https://twitter.com/frwololo/status/1017571147414528000

Thread branched a little, scroll up from here for a little more https://twitter.com/ktemkin/status/1017678934228398081

Moving on, rumors travel fast:

From what I’ve been told, the @reswitchedteam is currently harshly censoring anyone who asks questions about the situation or criticizes the lack of transparency. I’ve been internally criticizing RS practices for a while in an effort to get things to improve… There is a dead link here to another tweet

… but how can RS improve if it won’t even listen to its own?

She retweeted a full resolution screenshot of Qyriad's rant: https://twitter.com/ktemkin/status/1017673205014618112

I’ll probably tweet a couple more times about this, considering people are repeatedly at-ing me, but I don’t want to continue dabbling in the drama. I’ll probably get back to cool technical tweets soon— I just thought people deserved to have this addressed.

The “bug” that Scire is referring to is publicly documented in several places— including in notes in open-source code— and has been since well before Scire independently discovered it. I considered it basically public domain at that point and wow’d that we hadn’t seen it earlier.

It’s also not the bug that I reported. I did not report that bootrom bug to NVIDIA, but rather suggested that the Pixel C team correct a hardware misconfiguration — and pointed to the publicly documented bug as an example of how the misconfiguration could lead to badness.

I don’t want to point to it right now, as I don’t think the misconfiguration has been fixed on the Pixel C side yet, but as soon as it’s safe to talk about I definitely will. :)

For context: The Pixel C uses the same SoC as the Switch, and as a result much of what RS has discovered also applied to the phone. Thus responsible disclosure becomes a consideration.

1  Ed_ButteredToast 2018-07-13

https://i.imgur.com/zWEv5Gp.jpg

1  ticktockwarrior 2018-07-13

lmao, neither /r/switchhaxing or /r/switchhacks have any threads up about this. despite the fact that it's incredibly relevant to the switch scene and will affect development heavily.

nice job posting all the relevant info, but /r/drama never appreciates or puts effort into understanding this kind of stuff.

1  roothorick 2018-07-13

Not for not trying.

1  aef823 2018-07-13

The nintendo scene was always a fucking weird part tbh.

Doesn't surprise me that it went #MeToo inb4 big gay tho.

In my experience with retards using the "disagreements betwen LGBT and trans rights" to hide behind.

The problem was less disagreements and more the dumbass using said hiding spot as a stick up their ass.

1  wtfuxlolwut 2018-07-13

Fucking kids today following responsible disclosure practices, this generation of hackers are weak source. Never disclose always exploit ruin all the things.

1  PopeCumstainIIX 2018-07-13

The programming scene in general has gone awry lately with the CoC drama, I don't really get why these smart people get sucked into a stupid authoritarian mindset, a.k.a. /r/gitinaction

1  OddSandwich 2018-07-13

ktemkin is a shit head tranny who kept using the discord server to blog about her own personal shit. Of course she's a fucking trouble maker.

1  roothorick 2018-07-13

I totally missed that there's a gbatemp thread that's up to 48 pages right now: https://gbatemp.net/threads/ktemkin-drama.511193/

One person there insinuated that Kate might be defecting to the much-reviled Team Xecuter 🤣

And now fail0verflow has been dragged into it: https://twitter.com/marcan42/status/1017760860696203265

Over in Discord, RS is doubling down:

[11:52 PM] stuckpixel: @eva [5.1.0] take your opinions elsewhere; what happened happened. You're fine discussing it wherever, but we're not going to change our mind without significant reason to do so.

[12:31 PM] misson20000: Talking about what happened is on thin ice at the moment. Stay civil.

[12:34 PM] SciresM: I don't consider it a misunderstanding. I'm really not interested in commenting further.

12:37 PM] SciresM: I've said everything that needs to be said - I am attempting to protect the privacy of the people involved in coming to the decision, which was not easy. I'm willing to accept any negative PR that follows from that.

At any rate, RS will continue to exist, and atmosphere will continue being worked on.

[12:39 PM] EdTheNerd: People are focusing on sciersm due to being the one to take the actual banning action, but are ignoring that for this to have happened, I assume some sort of majority decision was made

(EdTheNerd is a purple "HoP" user class. Whatever that means. Apparently they're not all that in the loop.)

Also defending deleting Qyriad's comments and kicking her:

[12:40 PM] Adventure Snivy 3.0.0 & 5.1.0: Oh but why kicked?

[12:40 PM] misson20000: because she pinged everyone three times

Deleting the comment doesn't make a lot of sense, as the ping still goes through despite the comment being deleted.

[12:40 PM] misson20000: we don't mind that she agreed with kate

[12:40 PM] SciresM: Kicked for pinging everyone three times.

[12:40 PM] EdTheNerd: Qyriad reposted deleted messages and pinged the entire server in their opinion post

Why was the first message deleted though? Again, you didn't undo the ping.

[12:40 PM] SciresM: I talked to Qyriad last night, not that it's relevant to anyone.

[12:41 PM] ParaInt: but why was Qyriad's message removed?

[12:41 PM] misson20000: Because it pinged everyone

cough

[12:41 PM] EdTheNerd: Everyone is free to discuss civilly, but disrupting the server in the process is no good.

That also goes for staff.

It was removed, @ParaInt, because it @ everyoned every time they reposted it

Most of the reposts I saw removed the @everyone...

[12:43 PM] misson20000: ReSwitched takes trust seriously when it comes to exploits

[12:45 PM] EdTheNerd: The removal of a staff member is news.

Hence the ping.

A staff members opinions on said news is not news, hence the ping not being ok.

Repeating to do so when it is removed multiple times is not ok(edited)

[12:45 PM] SciresM: Fwiw: The message I posted was written by myself + a few others -- it was all agreed upon beforehand.

[12:45 PM] SciresM: Also: does a delete really not remove the ping?

[12:45 PM] SciresM: That's awful.

💡

People keep asking why it was deleted and they keep responding it was the ping, even now. Censorship is SERIOUS BUSINESS guys.

[12:47 PM] roblâbla: Free speech doesn't apply in this server :3(edited)

[12:47 PM] SciresM: @None it is, if nothing else, a private server.

[12:47 PM] misson20000: ReSwitched has never been a free speech server

Oh, that went over well.

[12:49 PM] SciresM: I'm not particularly interested in fighting on the issue of whether RS is a private server, because that's a fact. Even if you think you have a good argument for why it's not, we consider it one and will treat it as such.

[12:49 PM] SciresM: This argument is...a waste of time.

Someone screenshotted a post on gbatemp: https://cdn.discordapp.com/attachments/420029476634886144/467386728022278165/unknown.png

CTCaer is an active dev in the Switch hacking scene. He's not affiliated with RS, f0f, or TX. Far as I know, he's independent.

[12:50 PM] Ave [5.1.0]: is kate going to be back, and will she get an apology from sciresm?

[12:50 PM] SciresM: No.

[12:54 PM] EdTheNerd: Again, people focusing on sciersm so harshly on this need to remember that this was a joint decision of multiple staff members.

He has chosen to be the face of it to protect the others from the present shitstorm, but remember that when you decide to focus your anger on him

Guys, you probably should pick a new face at this point.

[1:00 PM] Hiccup: It might be better if this discussion gets its own channel, at least temporarily.

[1:01 PM] misson20000: @Hiccup this is a discussion that we're allowing, not encouraging

[1:01 PM] SciresM: @Hiccup I don't intend to make a new channel.

[1:04 PM] Zolexi: @Personablue read this please https://twitter.com/ktemkin/status/1017798314136252416 the bug has nothing to do with the switch

[1:05 PM] SciresM: @Zolexi as for "nothing to do with the switch", I can at least comment that my implementation of deja vu uses it.

[1:10 PM] Qyriad: Also @noir [latest][regular unit] if the decisions that were made were supposedly agreed upon by the staff, it was done in a place I was unable to see before I was demoted. i.e. it was done privately with select staff members

[1:11 PM] SciresM: @Qyriad it was.

[1:12 PM] Qyriad: @SciresM how much of the team was included in that?

[1:12 PM] thecommondude: aurora and u were definitely not included from the looks of it right? @Qyriad

[1:13 PM] Qyriad: Correct

[1:14 PM] SciresM: The actions taken were agreed upon by 8 people.

[1:15 PM] SciresM: Qyriad was excluded specifically because Kate wasn't a part of the discussions (because of the severity of the issue), for a personal reason that I'll elect to let Qyriad disclose if she chooses.

[1:16 PM] Qyriad: I'm in a relationship with Kate, yes. That automatically counts me out?

[1:16 PM] SciresM: That wasn't the issue!

We getting personal again? Where's my popcorn...

[1:16 PM] SciresM: I don't want to disclose stuff about your current situation without your permission.

[1:18 PM] misson20000: I don't think the details of who was and wasn't included are relevant.

Despite a member being opposed to such an extent that they spoke out publicly and stepped down. Hmm.

[1:19 PM] SciresM: I don't want to comment on who was or wasn't excluded. Anybody who was excluded is welcome to say so in here and I'll discuss the reasons for their exclusion.

[1:27 PM] thecommondude: speaking of, were there any other resignations?

[1:27 PM] Qyriad: Aurora Wright

Somehow missed their original declaration... maybe it wasn't really made public.

[1:39 PM] figgyc: im rerereposting this:i'd like to speak about the "other questionable behaviors" which are as of yet not discussed whatsoever in the ban message

[1:39 PM] Qyriad: @SciresM @figgyc

[1:40 PM] SciresM: @Qyriad @figgyc Not my place to violate the privacy of those involved. That message (and that particular language) was written and agreed upon by 8 people -- I wasn't its sole author.

What I want to know is, did he discuss those "questionable behaviors" with Kate? And why the cocktease?

[1:41 PM] khaero: @SciresM did you talk to Kate after the ban? Or anyway those 8 people had a chance to talk to Kate about the ban?

[1:41 PM] SciresM: @khaero I did.

[1:41 PM] Qyriad: barely

[1:42 PM] SciresM: @Qyriad I am refraining from posting logs to protect privacy.

[1:42 PM] SciresM: If we'd like to have them posted, we can post them.

What happened to privacy?

[1:43 PM] SciresM: Seriously -- if Kate would prefer our conversation together public I'll make it public in its entirety. I feel I have nothing to hide in it.

[1:43 PM] SciresM: But I don't think it's productive.

Ah, hiding behind the "Only with her permission but I'm not going to ask and she has no idea because she's banned from the server" excuse.

[1:44 PM] Qyriad: "Schala told you you deserve this"

"I don't know what to say"

"I'm not going to guess what you wanted, whether or not you did, it happened"

[1:44 PM] Qyriad: Those are your three messages, correct?

[1:44 PM] SciresM: I sent five.

[1:44 PM] SciresM: If you want it public, make it public in its entirety.

Oh, so it's fine if someone else violates privacy?

[1:45 PM] SciresM: I don't think leaking one side of a conversation without context is fair

[1:46 PM] Qyriad: There are reasons she doesn't want the conversation to be public that are fairly unrelated to the events themselves—regarding mental health

[1:47 PM] Plailect 🌹: Pushing for transparency on Sciresm's part until suddenly it might actually happen and all of a sudden it's about her privacy...?

What's this? A mutiny?

[1:47 PM] Qyriad: @Plailect 🌹 Scire is misrepresenting what transpired

[1:48 PM] Qyriad: I'm honestly not asking him to post it, I'm asking him to stop being misleading

[1:48 PM] Plailect 🌹: If that's the case then I'm sure the full logs will show that

Hm, guess not.

That's all I see for right now.