Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Contractor admits planting logic bombs in his software

arstechnica.com

Post reply on HN
Print view View original

121–130 of 156 posts

Re: Contractor admits planting logic bombs in his software

#121

Post by im3w1l »

elcomet wrote: post #71
jrockway wrote: post #24

Earlier quoted context omitted.

We really like PR in this field. We call making a copy of a file "piracy", as in piracy on the high seas. We call adding a password to an Excel spreadsheet a "bomb", as in a device designed for leveling entire cities and brutally murdering everyone nearby. We call adding restrictions to books and films "digital rights", kind of like the "bill of rights" that protects our country's core values. The prosecutors and ind…

I think the word piracy was not invented by tech people, but by right holders who wanted to make it look as bad as real piracy. It was an amazing strategy for them.

As I remember it, the pirates called it piracy, and the right holders preferred calling it theft (you wouldn't steal a car).

Re: Contractor admits planting logic bombs in his software

#122

Post by pc86 »

Rainymood wrote: post #15

Malicious compliance by the contractor. Hilarious incompetence by Siemens.

How is this malicious compliance? He wrote code to intentionally stop working at certain times in order to defraud Siemens by getting them to pay for what is essentially the same work over and over again.

Re: Contractor admits planting logic bombs in his software

#123

Post by pc86 »

BuildTheRobots wrote: post #46

> The parties in the case stipulated a total loss amount of $42,262.50 That's an oddly specific loss amount, especially the 50c

You have to be specific, as others have mentioned. And it's not that odd:

  * Contractor's time multiplied by their hourly rate
  * Whoever was overseeing the contractor for some percentage of their time 
    multiplied by their fully loaded hourly rate
  * Processing and payment of contractor's invoices
  * Discounts or coupons given out as a result of late orders due to this problem
  * Anything in any contract relating to late orders that was caused by this problem, even in part
You start multiplying fully loaded employee costs (including 401(k) matches, healthcare, etc) by fractions of a percentage for how often they deal with this person and it's not at all hard to end up with fractions of a penny at the end of it all.

Re: Contractor admits planting logic bombs in his software

#124

Post by im3w1l »

jlgaddis wrote: post #73
ghostpepper wrote: post #53

Earlier quoted context omitted.

So the delay, or triggering condition, is the differentiator? Thanks, that actually makes a bit more sense. I skimmed the wikipedia page before posting and it wasn't immediately obvious.

I think the "delayed action" aspect is key to the use of the term "logic bomb" -- as in the phrase "a ticking time bomb waiting to go off" that we've probably all heard. As PeterisP mentioned, the delayed action is integral to the concept of a logic bomb, as opposed to just invoking a piece of malware that immediately starts breaking things. Delaying the "attack" helps to hide its origin, making it harder to discover…

Going even further off topic, but it's pretty neat that logic bombs exist in nature. Plasmids are circular dna molecules found in bacteria. They can replicate independently of their host, and they can spread to other bacteria. They often provide useful functions, most famously - antibiotic resistance, to their host. So there is a high degree of symbiosis.

Anyway plasmids have these things called addiction molecules to prevent the bacteria from eliminating them. They create a long lived poison, and a short lived anti-poison. If the plasmid is no longer around, then the anti-poison degrades and the cell dies.

Re: Contractor admits planting logic bombs in his software

#125

Post by loco5niner »

ropiwqefjnpoa wrote: post #103
mgleason_3 wrote: post #37

Wow, does 6-months in jail seem a little severe? How does one even get someone prosecuted for this crime? We hired a licensed plumber on 2 occasions - to install a sink and later a shower. We just had a different plumber out because the sink was plugged up. He pointed out that the prior plumber had installed the sanitary-t upside down basically guarantying it would eventually become clogged. We also had him look at t…

No he shouldn't. We need to stop sending people to jail for all but the most heinous of crimes. He should be ordered to pay you back twice for what it cost to install and repair.

Twice seems a very low.

Re: Contractor admits planting logic bombs in his software

#126

Post by logfromblammo »

iso947 wrote: post #88
logfromblammo wrote: post #61

Earlier quoted context omitted.

We deliver source to the customer, and include compiled binaries and installers as a (paid) courtesy. Without the source, the customer loses the ability to switch software contractors, which is against their procurement rules. Even if you don't have the clout of being huge, not controlling the source for business-critical software is basically putting the supplier's gun up to your own head. Companies that take binary…

Vast majority of companies rely on Microsoft and other proprietary software

I was not discussing computing infrastructure, such as the OS or office productivity suites, but rather custom business logic, that is specific to the company.

Re: Contractor admits planting logic bombs in his software

#127

Post by manicdee »

lostlogin wrote: post #66
elldoubleyew wrote: post #30

Earlier quoted context omitted.

What was the case of the microcontroller detecting the counterfeit cable? I don't think I've ever heard of this.

iPhones do this for the charging cable. They don’t brick as such, they just don’t charge. Sooner or later that gives you a brick.

I would prefer that cheap “charging” cables not turn into house fires thank you.

Re: Contractor admits planting logic bombs in his software

#128

Post by manicdee »

rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

And coffee pods!

Re: Contractor admits planting logic bombs in his software

#129

Post by perl4ever »

manfredo wrote: post #101
taxidump wrote: post #99

Earlier quoted context omitted.

This sounds similar to planned obsolescence, so the moral is if you design it that way, as a manufacturer, you are ok. Definitely a grey area here. Edit: After some thought, I feel a precedent. My car has parts that don't become obsolete, they flat break requiring never ending service. Surely I can sue for fraud as the auto company has the ability to use another means. (Devils advocate)

Deliberately introducing errors in one's work to defraud an employer is not remotely close to planned obsolescence. Planned obsolescence is not the deliberate introduction of malfunctions, it is the engineering tradeoff between longevity and other characteristics. For example, Apple noticed that most customers replaced their phones within 2-3 years. A lithium ion battery's lifetime is determined by its charging and d…

"Deliberately introducing errors in one's work to defraud an employer is not remotely close to planned obsolescence"

Perhaps, but it's two points on the same continuum.

Re: Contractor admits planting logic bombs in his software

#130

Post by jrockway »

vokep wrote: post #112
jrockway wrote: post #24

Earlier quoted context omitted.

We really like PR in this field. We call making a copy of a file "piracy", as in piracy on the high seas. We call adding a password to an Excel spreadsheet a "bomb", as in a device designed for leveling entire cities and brutally murdering everyone nearby. We call adding restrictions to books and films "digital rights", kind of like the "bill of rights" that protects our country's core values. The prosecutors and ind…

"Digital rights" feels quite appropriate and accurate though, and in fact should be considered a natural extension of the rights in the bill of rights.

I'm not sure that software which prevents you from attaching a debugger to iTunes is giving you rights.

The FSF seems to like calling it "digital restrictions management". I can get on board with that. (Every few years I edit the Wikipedia article to try and make that name stick, but it gets reverted immediately.)

Post reply on HN