So my brother-in-law got an Xbox 360 for Christmas this year — his first console ever, he's been a PC gamer since forever and finally caved because everyone kept telling him he was missing out on Halo 4 co-op. He unboxed it Tuesday morning, set it up in about twenty minutes (way faster than I expected, Microsoft's actually gotten that part right), signed in to Xbox Live... and got dumped into a queue. Then an error. Then nothing for like six hours.
Turns out it wasn't just him. Christmas Day and the day after, both Xbox Live and PSN were getting hammered, and not by the normal "everyone opened a present and logged on at once" surge that happens every single year around the holidays. This was deliberate. Some group was taking credit for DDoS-ing both networks right when the largest number of brand-new consoles in the entire calendar year were being plugged in for the first time. Just a genuinely mean thing to do, honestly. I don't care what your reasoning is, there's a special kind of pettiness in picking December 25th to do it.
I ended up spending part of Christmas afternoon walking him through troubleshooting steps that didn't matter at all, because the problem wasn't on his end. Restart the router, power cycle the console, check the cable, sign out and back in. None of it does anything when the actual issue is the authentication servers getting flooded. I knew that going in, if I'm being honest, but it felt weird to just say "yeah it's broken, nothing you can do" to someone who just spent $300 and wanted to play a game with his brother-in-law on a day off work. So I let him do the ritual anyway. Everyone needs the ritual.
What gets me is how routine this has become. Not the outage part, exactly, more the shrug that follows it. A few years ago this would've been the story of the week. Now it's a paragraph on a few tech sites, some annoyed tweets, Microsoft's support account posting "we're aware and investigating," and by the 27th basically nobody's talking about it anymore. Networks this size have turned into utilities, and we treat outages the way we treat the power flickering during a storm — annoying, expected eventually, not really anyone's fault even when it very much is somebody's fault.
Sony had it rougher than Microsoft did if you go by what people were reporting, though it's hard to say for sure since neither company loves publishing real numbers on this stuff. I saw a lot of people saying PSN was effectively unusable well into the 26th, which if you just got a PS3 under the tree is a pretty rough welcome to the platform. My own take is that gaming networks in 2012 are still built like they're bracing for a bad Tuesday, not for the one week a year where tens of millions of new devices try to log in simultaneously while somebody is actively trying to knock them over. That's a design problem as much as a security one.
The other thing nagging at me is how little visibility any of us actually have into what's happening on our own network at moments like this. You just see "can't sign in" and have to guess: is it me, is it my router, is it the whole service, is it a deliberate attack, is it just Christmas traffic. There's no status page that tells you the truth fast enough to matter, not for either service, not back then and not really now either. You find out what actually happened from a few reporters, a couple hours later, after everyone's already given up and gone back to unwrapping the rest of their presents.
Anyway he's up and running now, we played a few rounds of Halo 4 Tuesday night once things settled down, and it was fine, genuinely fine, the kind of dumb fun you forget you're capable of having until you're doing it. But I keep thinking about all the kids who got a console Christmas morning and spent their first day with it staring at a sign-in error instead. That's a rough first impression to hand someone, and it's not really their fault or their parents' fault. It's just where we are right now with how fragile this stuff still is under the hood.