Recent and related: Polish trains lock up when serviced in third-party workshops - https://news.ycombinator.com/item?id=38530885 - Dec 2023 (347 comments)
Dieselgate, but for trains – some heavyweight hardware hacking
211–220 of 309 posts
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#212Earlier quoted context omitted.
If an individual did this, they'd go to prison.
Article 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years. It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour. To all software engineers: please refrain from engaging in criminal activities. If you are…
Let's repeat this one for the parts of the peanut gallery harping on irrelevant issues such as whether object orientation was part of the design methodology or SEL4 part of the firmware runtime stack:
"To all software engineers; please refrain from engaging in criminal activities. If you are instructed to do something illegal, it is important to report it to the relevant authorities."
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#213My impression is that the quality of train firmware is generally not very good, and I hope that this scandal will lead to greater scrutiny. 3 years ago, Deutsche Bahn publicly complained of "grotesque" software problems with newly delivered Bombardier trains. For example, when train drivers changed the direction of travel, the train software would crash. It then took 1 hour to boot the train up again [0]. Switzerland…
> Minimal or no usage of digital electronics
Everyone in this thread seems to be forgetting that those might be useful and not just fancy toys. I prefer trains that have digital signage indicating their location, and connections at the next station. Higher level of automation in trains (e.g. Communications-based train control) also drastically increases efficiencies in speed and scheduling, allowing more trains on the same tracks, and minimises time wasted waiting or accelerating/decelerating needlessly.
The problem is poorly implemented software, not the existence of software.
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#214How is this different from companies like Apple or John Deere that DRM components and brick the device if repaired by "unauthorized" technicians? (I think both are equally egregious personally, but I know there's a lot of support here for Apple, so I'm curious how people reconcile these. I don't want to make this a religious war about Apple, but those practices in general regardless of which company is doing it). Is…
I'm not a fan of Apple's practices, but there's some aggravating elements to this. Apple doesn't brick your device if it it spends time at a repair location, for instance. Apple also doesn't simulate failures on synthetic dates to force repair.
I wouldnt be so sure, one can think of https://en.wikipedia.org/wiki/Batterygate as an example of a little bit of "bricking"
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#215How is this different from companies like Apple or John Deere that DRM components and brick the device if repaired by "unauthorized" technicians? (I think both are equally egregious personally, but I know there's a lot of support here for Apple, so I'm curious how people reconcile these. I don't want to make this a religious war about Apple, but those practices in general regardless of which company is doing it). Is…
> Is it the secrecy that makes it different? i.e. if the train company were honest about it then it would be ok? IMHO mainly that and clearly those trains are required to be designed in such a way that they could be repaired by a third party (either by law or by contract based on how the situation is described). Apple provides (nor is required) no such guarantees. Also it has more or less legitimate reasons for its d…
You make some pretty good points. Especially the "you know what you're getting" is very strong. Basically the difference between fraud vs not fraud. Thanks!
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#216Earlier quoted context omitted.
Article 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years. It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour. To all software engineers: please refrain from engaging in criminal activities. If you are…
> Dear software engineers, please do not commit a crime Yes, developers shouldn't knowingly write code to commit crime, but developers don't tend to receive instructions that directly. Unsurprisingly, the company doesn't mention to every employee that they are knowingly breaking the law. Instead, developers receive a request to build a feature, and it typically won't be at all obvious that the intended use of that fe…
Sometimes it may not be obvious but the feature still might seem super suspicious. For example, suppose that the malware discussed in this article was broken down into two sub-features assigned to different people: geofencing detection, and bricking the train. The person writing the "bricking the train" part should have realized that there is practically no legitimate reason for that code to be written, and if they ask their manager for a reason and are told "don't worry about why, just write the code", they should report this suspicious activity to law enforcement. There are many reasons that law enforcement would want to know, including that the engineer's manager might not even be acting in the company's own interests but might have taken a bribe from a hostile foreign power.
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#217Title is a bit misleading, because this *gate is not about faking ecology, and trying to pass certification in artificial conditions, as dieselgate was, but simulating fake failures instead. The company hardcoded algorithms that would report failures of parts that work correctly (like a compressor), if it detected that train has been repaired by another company (based on location readings), and stop the train from ru…
It's an example of fraudulent / malicious behavior found by decompiling industrial logic controllers, with incontrovertible evidence of illegality. Obviously no two situations are ever going to be the exact same, but I think it's clear why the analogy was made.
Yes, but “Dieselgate” is not appropriate here because that term has “cheating” loaded onto it, which represents a different struggle for companies than vendor lock-in. What this company is doing is related to DRM and arguably closer to what John Deere does with its products.
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#218Nevermind malware, not using seL4 should already be a crime in this context.
[deleted]
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#219Earlier quoted context omitted.
It will be stuck in legal hell due to conflicts of interests. Trains already exist, and they need to work - but maintenance/repair companies cannot legally modify software of them due to copyrights. It's a catch22 situation. I honestly hope that company will be fined to the oblivion, and for criminal charges for that, but i doubt it will happen.
Of course laws vary, and Polish copyright law might be completely crazy, but around here copyright only covers distribution of copies. It does not make it illegal to modify software that you own. It only limits distribution of copies of that software, modified or otherwise. If the owner of the train wants to modify the software then there is probably nothing stopping them.
> If the owner of the train wants to modify the software then there is probably nothing stopping them.
This of assumes that the owner of the train company has the skills to do this. In reality they probably would need outside help and that company might fall foul of copyright issues. (when they are distributing the modified code back to the train company, for example)
But the real problem of course is that all of this code is very likely safety critical. Can they modify it? Probably. Is it a good idea? Not really.
Re: Dieselgate, but for trains – some heavyweight hardware hacking
#220How is this different from companies like Apple or John Deere that DRM components and brick the device if repaired by "unauthorized" technicians? (I think both are equally egregious personally, but I know there's a lot of support here for Apple, so I'm curious how people reconcile these. I don't want to make this a religious war about Apple, but those practices in general regardless of which company is doing it). Is…
Functionally it is similar, but trains are very critical civil infrastructure. In the case of John Deere such fraud can also have a serious impact, but it does not affect the public in the same way.
If they want to explicitly claim exclusivity on maintenance or a certain enforced product lifetime, fine, it is a nasty practice but fair enough. But not making the operators aware of these conditions, when they knew months beforehand what would happen when they lost the tender, and while it was seriously affecting the public later on, that is criminal in a way that is not comparable to Apple's practices for instance.