Live data from Hacker News

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

wired.com

101–110 of 277 posts

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#101

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Why isn't iOS open source?

Significant portions are: https://github.com/opensource-apple/xnu

Edit: better link https://opensource.apple.com/

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#102
post #26

Earlier quoted context omitted.

Or to driving control! But, engineers keep making this mistake. Hackers were able to take over Jeeps via the entertainment system: https://www.bbc.com/news/technology-33650491 HN discussion: https://news.ycombinator.com/item?id=9942647

Take over as in turn off, not steer, right?

even if only, having your engine remotely killed while at speed on a freeway should not be a thing that is possible.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#103

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Unless you make MORE money by showing it than by keeping it private, why would they? There is every chance that some piece is useful for a competitor, so what you did was give your competitor some code they didn't have to write themselves.

The reason to have code open source would be to get public confidence perhaps, but I doubt that makes it a net positive in their eyes.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#104
post #82

I feel like this is the kind of thing that would've been completely ignored by everybody except for a handful of concerned hackers had it not been for the recent media outrage against Boeing (and in my opinion absolutely deserved). I guess the question is how bad is it (from the article it's hard to tell exactly, but it sure doesn't sound great)? And another question is how many of our systems that we rely on, from b…

>I have no idea how that company will ever earn back my trust Millions of ongoing safe flights? I dunno. I feel like they're getting savaged (which they deserve... to a point... but we will cross that point I am pretty sure, if we haven't already...) The thousands (tens of thousands?) of safe flights per day don't make the news. Boeing has been a pioneer in the safest form of transportation in existence. Mentour Pilo…

If you look at the Top 7 safest airplanes in terms of accidents per hours flown you get:

1) Airbus A340 - No crashes

2) Boeing 777 - 5 crashes, 2 intentional (Malaysia x2), 1 engine-related (Rolls-Royce problem), 2 pilot-error (Asiana/Dubai) - [Thanks fishywang]

3) Boeing 747-8

4) Boeing 737-NG

5) Boeing 767

6) Airbus A320

7) Boeing 757

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#105

Earlier quoted context omitted.

Airbus. Not a matter of pride, but you don't want to help your competitors offer the same capabilities as you for $0 R&D costs

Are you seriously suggesting that Airbus would rip off Boeings code? There is such a thing as copyright.

We're talking about open sourcing, not ripping off copyrighted code.

Would depend on licensing but in any event, once you start showing how the sausage is made others can find inspiration to develop their own code, at which point you can start getting into a costly legal battle over whose idea it originally was, whether certain algorithms are protected, etc...

My point is simply that there's no upside for Boeing to open source their code.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#106
post #43

Earlier quoted context omitted.

Or, Ada, no? :)

Shhh. Let the new kids enjoy their smug.

> Shhh. Let the new kids enjoy their smug.

Agreed. They need to discover on their own that critical software requires coq.

...

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#108
post #43

Earlier quoted context omitted.

Or, Ada, no? :)

Shhh. Let the new kids enjoy their smug.

I've done security auditing of ADA and C avionics code. (including for DAL-A components). As a language, I'd take Rust any day (in terms of security/robustness properties).

However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#109
post #18
post #2

Who thought that having any communication path from the passenger entertainment system to flight control was a good idea?

You want communications from the flight controls to the maintenance system. And you want communications from the entertainment system to the maintenance system, so technicians have a single list of everything that needs fixing. It's hard to implement strict one-way communications -- usually you at least need some kind of ACK for reliable transmission. Put all those together with a vulnerability in the middle, and you…

But for things like an entertainment system, that's fine. If it fails, oh well.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#110
post #84

I feel like this is the kind of thing that would've been completely ignored by everybody except for a handful of concerned hackers had it not been for the recent media outrage against Boeing (and in my opinion absolutely deserved). I guess the question is how bad is it (from the article it's hard to tell exactly, but it sure doesn't sound great)? And another question is how many of our systems that we rely on, from b…

And another question is how many of our systems that we rely on, from bridges to airplanes to traffic lights, are just actually very insecure I'd guess virtually all of them.

Worse yet, many cities want to become "smart" (pushed by iot companies' sales people in part).
Post reply on HN