Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dieselgate, but for trains – some heavyweight hardware hacking

badcyber.com

Post reply on HN
Print view View original

131–140 of 309 posts

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#131

Post by josefx »

bluGill wrote: post #73
Crosseye_Jack wrote: post #21

Earlier quoted context omitted.

Just thinking outloud. But if you made it so your competitor couldn't fulfill their servicing contract, then the entity taking out the contract might just very well come to you to solve the problem. You might not win the contract on price, but win it by default because you made it impossible for anyone else to complete it. That is until your scheme is uncovered because you left the GPS coordinates of your competitors…

More sanely (not to be confused with likely!) the courts will decide that since this is something only the OEM can do, it must done at no charge as part of normal warranty work.

These trains will be used for decades. Normal warranty wont cover anything of note.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#132

Post by magicalhippo »

RecycledEle wrote: post #84

I wonder if the solution to all these screwy engine controls (tampering with emissions testing, preventing 3rd party repairs, etc.) is to standardize the interfaces to these systems so they can be replaced. Standardizing the outputs of the sensors would let us swap in and out various components to ensure the system is not cheating the regulators.

F1 does this. All teams are required to run the same, approved, ECU[1]. They can change certain mapping tables and such but it's a sealed unit and they can't replace the firmware.

[1]: https://wheelsports.co/formula-1s-standardised-ecu-explained...

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#133

Post by gunapologist99 »

aizyuval wrote: post #123

I'm solely consuming EN content. And if it's from another country, it's only whats leaked by big media. It make me wonder how much good content could be translated.

I think you're saying, how much other good content is out there that I'm missing out on because I only read English, and it's a good point.

However, English has become the (now ironically named) lingua franca of, at least, the more educated parts of the world, and many people who are most comfortable in their native languages are still often translating their best work into English in order to see it more widely read. This is often the case with scientific papers, for example.

Perhaps England's biggest gift to the world was its language.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#134

Post by rcxdude »

93po wrote: post #106
yetihehe wrote: post #103

Earlier quoted context omitted.

Newag was required by contract to provide accurate service manuals so that competitors could safely maintain the trains. This was not a "just take your car to dave, he knows some stuff". For SPS and other competitors this was like "you need to show every certification that exists and certify all your tools to prove that indeed you can service those cars, or you will be foreclosed due to fines". Plus, they were provid…

i wouldnt be surprised if this info was somewhere in those 20k pages, and perhaps if the procedures were actually followed, stuff like GPS based lockouts wouldn't happen

Ah yes, on appendix 35 of section C, "do not store the train in your service yard specifically or it will stop working"

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#135

Post by metadat »

93po wrote: post #106
yetihehe wrote: post #103

Earlier quoted context omitted.

Newag was required by contract to provide accurate service manuals so that competitors could safely maintain the trains. This was not a "just take your car to dave, he knows some stuff". For SPS and other competitors this was like "you need to show every certification that exists and certify all your tools to prove that indeed you can service those cars, or you will be foreclosed due to fines". Plus, they were provid…

i wouldnt be surprised if this info was somewhere in those 20k pages, and perhaps if the procedures were actually followed, stuff like GPS based lockouts wouldn't happen

The article covers this, and says the information about the lockouts was not in the manufacturer provided manuals.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#136

Post by danhor »

Log_out_ wrote: post #64
lqet wrote: post #28

My impression is that the quality of train firmware is generally not very good, and I hope that this scandal will lead to greater scrutiny. 3 years ago, Deutsche Bahn publicly complained of "grotesque" software problems with newly delivered Bombardier trains. For example, when train drivers changed the direction of travel, the train software would crash. It then took 1 hour to boot the train up again [0]. Switzerland…

Because this software is not made by software engineers, it's made by plc programmers, electric circuit designers and whoever did drift into the field. Except for beckhoff to tc3 they haven't made it to object orientation yet, so the field is stuck as a whole in the blue screen mines of yore. Managing complexity with thin standard docs, no version control while the machines grow ever more complex sensor and actuator…

I'm not sure if you've ever used modern software. It's sometimes amazing just how unreliable it is. Web browsers crash every few weeks, windows is known for regularly needing a reboot, evince regularly crashes on me, you can't call 911 with some of cell phones, ... . This reminds me of https://danluu.com/everything-is-broken/ .

The clearest example of the difference of reliability is looking at public digital signage (on transit and elsewhere). If it's based on LED segments or something similarly basic (with old-school embedded software development) it will basically always work. New LCD Screens inside trains/busses and outside working with a modern software setup (using an OS, often with a pc architecture, quite often just displaying a website) are broken ~10%-20% of the time. Looking at (for example) busses, a large portion of the time the screen will either be blank, not display anything, old information or just wrong information. Going inside fast food restaurants with large LCDs for the menu, often something is broken, frozen or something else.

It is of course possible to make modern software more reliable. It's just much, much harder than making embedded software or PLC programming reliable. Software can be easily made more complex, but it's hard to make it non-complex or to wrap the complexity so it isn't an issue anymore. The ecosystem isn't set up for non-complexity.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#137

Post by croes »

>it is hard to find an institution in Poland that has done anything beyond kindly expressing interest in the matter. We are not aware of any action taken either by the Office of Consumer and Competition Protection or by the Railway Transport Office,

That the worst part of all that.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#138

Post by [deleted] »

nielsole wrote: post #52
kibwen wrote: post #32

Earlier quoted context omitted.

Hell, even if governments are squeamish about requiring code to be fully open and public, they can still require the manufacturers to privately submit to the government all code that powers public infrastructure (like trains), to be made available to any relevant party upon request.

code escrow in general should be much more common.

[deleted]

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#139

Post by machiaweliczny »

h2odragon wrote: post #46
HackerThemAll wrote: post #24

In a properly functioning country the responsible persons should already be imprisoned. Some governmental agencies were aware of that for at least half a year, but failed to act. The fact that source code was not immediately dumped and analyzed is the evidence of malevolence, corruption and intentionally putting people's lives at risk. Welcome to the dark side of Poland - where citizens don't matter.

"the responsible persons" ... hmmm. Who would that be? The programmer who implemented the code? Do you think they thunk these tricks up? They was just following orders. The manager of the programming team, who set these tricks as things that needed to be implemented? Again, just following orders. The "Cxx" Title people who directed that there be "some protection" in some way that got implemented as what we see? Did t…

IMO responsible is enginer and everyone up management chain + possibly peers if engineer part of a team. And those people should have a trial.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#140

Post by twisteriffic »

TeMPOraL wrote: post #122
twisteriffic wrote: post #33

Earlier quoted context omitted.

Bad software is a symptom, not the cause.

Here it's more like the software - any software - is a problem . I agree with GP, and my experience confirms that adding software to something that used to work without it almost universally makes it worse in every aspect, understandability and repairability being just two major ones. On top of that, taking anything that run on old-school industrial/embedded firmware and replacing that with software using modern prac…

That again is a problem of leadership and not of software.
Post reply on HN