A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

Post by WalterBright » Fri, Aug 09, 2019, 2:04 AM UTC

blackflame7000 wrote: post #271

WalterBright wrote: post #268

Earlier quoted context omitted.

> as possible in catastrophic situations That isn't really something engineers can design to. What happens is the aerodynamics group calculates the maximum loads on the airplane. This is increased by 50% and called the "ultimate load", and the parts are all designed to not break up to that load. Parts stronger than that are overweight, and weight is the enemy of all airplanes. After parts are designed, they go throug…

I think what he is referring to is the modern use of composites and carbon fiber which are both stronger and lighter than older aluminum or titanium components. Titanium, for example, is a very hard metal that will fracture more readily than a softer composite that is able to dissipate the stress better.

Post by irundebian » Fri, Aug 09, 2019, 8:22 PM UTC

jakeogh wrote: post #184

MFLoon wrote: post #155

Earlier quoted context omitted.

I don't think this is a realistic depiction of the threat model of people who would hack commercial jets. Sure, state sponsored APTs probably could access it if they wanted, but none of them are in the business of crashing passenger planes. Maybe tracking them or grounding them or stuff like that, but they already have those capabilities through economic or bureaucratic or military power. The "bad actors" of concern…

The ones who would benefit from it being open sourced are the passengers and plots. Your excuse is mitigatiable, release it picewise, starting with the customer facing code to trusted outside groups. Ultimately your argument applies to all life or death code, even code we put inside our bodies, which as you mentioned, is also highly specific and specalized. Because the bar is higher there should be less review is a c…

Post by jakeogh » Sat, Aug 10, 2019, 2:37 AM UTC

irundebian wrote: post #274

jakeogh wrote: post #184

Earlier quoted context omitted.

The ones who would benefit from it being open sourced are the passengers and plots. Your excuse is mitigatiable, release it picewise, starting with the customer facing code to trusted outside groups. Ultimately your argument applies to all life or death code, even code we put inside our bodies, which as you mentioned, is also highly specific and specalized. Because the bar is higher there should be less review is a c…

Open-source obviously doesn't imply security as it can be seen by security-critical open source software like openssl which repeatedly showed that it contained very critical bugs for a long time without anybody noticing it. No one really would benefit from open sourcing it without being able to (security) test it in realistic scenarios. Obviously security researchers would profit in discovering bugs which may have no…