Dieselgate, but for trains – some heavyweight hardware hacking • Hacker News Board

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#241

Post by jancsika » Fri, Dec 08, 2023, 6:54 PM UTC

dexterdog wrote: post #148

klabb3 wrote: post #72

Earlier quoted context omitted.

There’s no question that it’s sabotage. The only thing left to prove is the culprit, which is with 99% the manufacturer (motive, means, opportunity) but obviously need to be established in a court who is responsible and criminally culpable. The fact that lawmakers, courts and the public are lost in the tech is a problem, but surely this crime can be fitted into existing criminal code against sabotage… although the me…

"Lawlessness is the condition in which your adversary refers you to a law he made."

It's almost like you found a lossy encoding for discussing governance.

For example, both the NYC taxi medallion system and warlords controlling a city in a failed state would get input as "lawlessness" in your encoding.

But then if I ask what is the quality of life in each instance, I can't get that answer because there aren't bits in your encoding for that.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#242

Post by matkoniecz » Fri, Dec 08, 2023, 7:09 PM UTC

Piskvorrr wrote: post #177

praptak wrote: post #127

Earlier quoted context omitted.

I don't believe the Polish judicial systems has experience in dealing with corporate crime, especially of the tech-related kind. I'm a bit afraid of disappointment here.

Does it have experience in dealing with...sabotage? Specifically, a country that has a war on its eastern doorstep? I mean - how is "let's mess with something on purpose so that trains won't run" NOT sabotage, since such time as railways exist?

No, we do not have. Sabotage is rare to nonexisting and cases in past were rare and of "teenager builds device to control switch on tram tracks, derails tram for fun" type.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#243

Post by notyofriend » Fri, Dec 08, 2023, 7:12 PM UTC

korhojoa wrote: post #227

notyofriend wrote: post #119

Earlier quoted context omitted.

Simply of old designs is often a blessing as long as the drawing and documentation is readable and good. It can be hard to get replacement electronics for 1970s designs so sometimes you have to design new components but the functionality was relatively simple back then so it’s possible to build a 1:1 replacement

They've actually been modernized with newer power electronics and some of the soviet oversights have been addressed. They're still very reliable, and now somewhat more efficient.

Old electronics of that era could be drawn by a simple schematic and usually only performed one or 2 functions. That makes designing a drop in replacement very easy.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#244

Post by [deleted] » Fri, Dec 08, 2023, 7:16 PM UTC

dzdt wrote: post #62

Its insane how brazen this is. Code that 'bricks' the train locomotive if its gps coordinates remain with bounds of a competing repair facility for more than ten days! This is way beyond putting information barriers to repair, like undocumented interfaces or even crypto-signed firmware. This is actively malicious destruction of property. I don't know anything about the legal system in Poland, but I can't imagine how…

[deleted]

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#245

Post by o11c » Fri, Dec 08, 2023, 7:21 PM UTC

krisoft wrote: post #219

db48x wrote: post #171

Earlier quoted context omitted.

Of course laws vary, and Polish copyright law might be completely crazy, but around here copyright only covers distribution of copies. It does not make it illegal to modify software that you own. It only limits distribution of copies of that software, modified or otherwise. If the owner of the train wants to modify the software then there is probably nothing stopping them.

> If the owner of the train wants to modify the software then there is probably nothing stopping them. This of assumes that the owner of the train company has the skills to do this. In reality they probably would need outside help and that company might fall foul of copyright issues. (when they are distributing the modified code back to the train company, for example) But the real problem of course is that all of thi…

Performing a task for someone, whether directly or as a third party contract, generally doesn't invoke copyright.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#246

Post by mike_hock » Fri, Dec 08, 2023, 7:38 PM UTC

upwardbound wrote: post #210

jakozaur wrote: post #195

Earlier quoted context omitted.

Article 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years. It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour. To all software engineers: please refrain from engaging in criminal activities. If you are…

I think jakozaur is correct, and don't know why they're being downvoted. Here is the legal statute they are referencing: Art. 254a. Disruption of a network; damage. Anyone who takes, destroys, damages or renders unfit for use an element of a water supply, sewage, heating, electricity, gas or telecommunications network, or a railway, tramway, trolley bus or metro line, thereby causing a disturbance in the operation of…

Deter middle managers from what? Implementing shady business practices that skirt the edge of legality? That's day-to-day business, the only way to avoid that would be to quit. Sure, no one would commit this exact offense again, but (a) the practice will (would, if any conviction actually happens, big if) be changed just enough to make it legally ambiguous again, and (b) the law would probably be changed to make it legal.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#247

Post by eastbound » Fri, Dec 08, 2023, 7:39 PM UTC

dn3500 wrote: post #240

db48x wrote: post #171

Earlier quoted context omitted.

Of course laws vary, and Polish copyright law might be completely crazy, but around here copyright only covers distribution of copies. It does not make it illegal to modify software that you own. It only limits distribution of copies of that software, modified or otherwise. If the owner of the train wants to modify the software then there is probably nothing stopping them.

I don't know anything about Polish law either, but in the US, copyright law (DMCA in particular) makes it illegal to modify the software in a device you own, if it requires circumventing protection code or devices. Which it probably would in this case.

But could the authors be attacked for treason, destruction of property, or a simili-Patriot Act? Besides, have we learnt something about any public software being required to be delivered as open-source?

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#248

Post by eastbound » Fri, Dec 08, 2023, 7:42 PM UTC

gorkish wrote: post #178

Xelbair wrote: post #149

Earlier quoted context omitted.

It will be stuck in legal hell due to conflicts of interests. Trains already exist, and they need to work - but maintenance/repair companies cannot legally modify software of them due to copyrights. It's a catch22 situation. I honestly hope that company will be fined to the oblivion, and for criminal charges for that, but i doubt it will happen.

This is the kind of thing that will destroy a nation's manufacturing industry overnight. Who in their right mind would buy kind of equipment from a Polish company knowing that this kind of nonsense is both widespread and that their legal system has no solution? Hoestly, "Dieselgate" is not a fitting corollary for this travesty. This is considerably more sinister. Hopefully whatever happens from here will be an agent…

Aren’t we all doing this when we buy software from the cloud?

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#249

Post by gorkish » Fri, Dec 08, 2023, 7:47 PM UTC

toomuchtodo wrote: post #63

dzdt wrote: post #62

Its insane how brazen this is. Code that 'bricks' the train locomotive if its gps coordinates remain with bounds of a competing repair facility for more than ten days! This is way beyond putting information barriers to repair, like undocumented interfaces or even crypto-signed firmware. This is actively malicious destruction of property. I don't know anything about the legal system in Poland, but I can't imagine how…

If an individual did this, they'd go to prison.

An individual did do this. Companies do not suddenly grow arms and brains and learn to code, at least not quite yet.

Re: Dieselgate, but for trains – some heavyweight hardware hacking

#250

Post by jtriangle » Fri, Dec 08, 2023, 7:56 PM UTC

mrguyorama wrote: post #234

jtriangle wrote: post #181

Earlier quoted context omitted.

One could easily argue that F1 hasn't innovated much in the last decade or so. The coolest stuff we get is clever aero and advantageous workarounds that get outlawed extremely fast.

You are extremely downplaying the "clever" aero. Remember, simulation time and costs are regulated in F1. The innovation is producing extremely effective aero with minimal brute force simulation.

I'm aware that the tech to do so is really cool. It doesn't make the racing better though. It's not more exciting, the cars aren't really faster because of it because they're limited in other ways, and it's not really more competitive.

What F1 needs is disruption, more options, like too many options that all of them won't be test-able, less standardization. Even the limited sim time is a problem, because there are certainly optimizations left on the table that can't really be found otherwise. What you wind up with is a A-team and a B-team of mostly the same designs. That's booring, and moreso because if the cars really were 100% standardized, at very least it'd be competitive in terms of driver skill.

It's why these days, I don't watch much F1, I much prefer the more 'indie' racing leagues where, on any given raceday, anyone can win. The days of F1 being that way are long gone, and, it's not likely to change at-all.