Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cash registers in Poland fail due to new year bug (PL)

translate.google.pl

Post reply on HN
Print view View original

11–20 of 25 posts

Re: Cash registers in Poland fail due to new year bug (PL)

#11

Post by FDSGSG »

throwawayjava wrote: post #8
jaredwiener wrote: post #7

Similar issue in NYC with parking meters: https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-mete...

The official explanation from the vendor is that this was an "anti-fraud security setting". Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation? Regardless, a problem that requires a "software fix" from the vendor and manual visitations to each individual machine doesn't sound like a mere "setting"

>Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation?

It is not.

Re: Cash registers in Poland fail due to new year bug (PL)

#12

Post by leereeves »

CydeWeys wrote: post #10
throwawayjava wrote: post #8

Earlier quoted context omitted.

The official explanation from the vendor is that this was an "anti-fraud security setting". Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation? Regardless, a problem that requires a "software fix" from the vendor and manual visitations to each individual machine doesn't sound like a mere "setting"

I assume the meters are network-connected because they take credit cards, but they can't be remotely updated? Seems like an obvious omission.

Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.

Re: Cash registers in Poland fail due to new year bug (PL)

#14

Post by Cyph0n »

leereeves wrote: post #12
CydeWeys wrote: post #10

Earlier quoted context omitted.

I assume the meters are network-connected because they take credit cards, but they can't be remotely updated? Seems like an obvious omission.

Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.

Sure, but there are at least two other options that are essentially as secure, assuming the “remote attack” threat model:

1. Allow customers to download updates and flash over USB.

2. Boot device into a limited mode that allows signed updates. Certificate should be stored in secure memory.

Re: Cash registers in Poland fail due to new year bug (PL)

#15

Post by hn_throwaway_99 »

nippoo wrote: post #6

I wouldn't be surprised if something alone the lines of `split("20")` or `replace("20", ““)` was the culprit somewhere (to turn it into a 2-digit year). I've seen the most absurd date handling code...

Yeah, and I could imagine some developer fixing a Y2K big in the late 90s thinking, "Hmm, this may cause a problem in 2020, good thing I'll be long gone by then."

Re: Cash registers in Poland fail due to new year bug (PL)

#16

Post by Forge36 »

astura wrote: post #13

So far I've heard of the following fail due to some sort of 2020 bug: Parking meters: https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-mete... Video games: https://www.dsogaming.com/news/star-wars-jedi-fallen-order-w... Now cash registers. Anything else?

Maybe we'll hear about more on Monday. I wonder if there will be a central site with stories like these

Re: Cash registers in Poland fail due to new year bug (PL)

#17

Post by acqq »

hn_throwaway_99 wrote: post #15
nippoo wrote: post #6

I wouldn't be surprised if something alone the lines of `split("20")` or `replace("20", ““)` was the culprit somewhere (to turn it into a 2-digit year). I've seen the most absurd date handling code...

Yeah, and I could imagine some developer fixing a Y2K big in the late 90s thinking, "Hmm, this may cause a problem in 2020, good thing I'll be long gone by then."

And that proves that the Y2K problem was real: even in 2020 some companies that had only these printers apparently simply can't do their business until the repair of the printers is made.

Re: Cash registers in Poland fail due to new year bug (PL)

#18

Post by kevin_thibedeau »

throwawayjava wrote: post #8
jaredwiener wrote: post #7

Similar issue in NYC with parking meters: https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-mete...

The official explanation from the vendor is that this was an "anti-fraud security setting". Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation? Regardless, a problem that requires a "software fix" from the vendor and manual visitations to each individual machine doesn't sound like a mere "setting"

It's BS. They've already been handling cards with expiration dates beyond 2020. The broken part can only be their internal date handling.

Re: Cash registers in Poland fail due to new year bug (PL)

#19

Post by [deleted] »

Cyph0n wrote: post #14
leereeves wrote: post #12

Earlier quoted context omitted.

Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.

Sure, but there are at least two other options that are essentially as secure, assuming the “remote attack” threat model: 1. Allow customers to download updates and flash over USB. 2. Boot device into a limited mode that allows signed updates. Certificate should be stored in secure memory.

[deleted]

Re: Cash registers in Poland fail due to new year bug (PL)

#20

Post by jeewes »

skymt wrote: post #3
ethbro wrote: post #2

I would love to hear what bizarre encoding they used that resulted in 2020 being an issue. (I'm assuming these machines aren't all < year old and just break on any new year)

2020 was a common pivot year used in the "windowing" workaround to the Y2K bug. 2-digit years = 20 are defined as 19XX. https://en.wikipedia.org/wiki/Date_windowing

Thanks for sharing.

Y2K used to be just an interesting story from the past. Never guessed that it would still be biting people 20 years later. Ouch...

Post reply on HN