18 ms·
Activists release code to generate free public transportation tickets in U.K
- deleted 7y ago[deleted]
- fredley 7y agoSeems like they baked secrets into their app bundle (RSA keys). Basic engineering fuckup.
- gentaro 7y agoNot even a basic engineering fuckup. That's just an "I don't know what the hell I'm doing" fuckup.
- Illniyar 7y agoI doubt it a "I don't know what the hell I'm doing" fuckup. Probably more of a "I warned my higherups, and they overruled me because they wanted the feature more than they wanted the app to be secure, and so they can handle the fallout" fuckup.
- gentaro 7y ago> and so they can handle the fallout" fuckup. Even if this guy objected to it, unless he quit his job straight after implementing this, you can be sure it came back down on him. This is the kind of situation where you have to clearly argue your case and stand your ground.
- heavenlyblue 7y agoThat’s why it has to be through e-mail.
- afarrell 7y agoDo you know of any good online courses or study groups on rhetoric for engineers/scientists?
- fredley 7y agoIn my head, it went like this: Mgmt: Can we do this? Eng: Yes, but... Mgmt: [Tunes out after Yes] Do it Saying 'No' instead of 'Yes, but' is hard but a really valuable ability.
- dragonwriter 7y agoI've seen that work out the opposite way, where “Yes, but” gets the part after “but” listened to, and “No, because” with a reason that isn't really a can’t be done reason but a cost to consider gets you not only ignored on the specific point but also frozen out of being involved in business and upper management contact because you are seen as projecting an air of laziness/inflexibility.
- vageli 7y ago> > and so they can handle the fallout" fuckup. > Even if this guy objected to it, unless he quit his job straight after implementing this, you can be sure it came back down on him. > This is the kind of situation where you have to clearly argue your case and stand your ground. Hopefully the theoretical person stated their objections in writing. Would be useful in avoiding the fallout.
- scruffyfox 7y agono, that'll be a requirement from the ticket machine manufacturer, not the app developer
- stevecat 7y agoI've used these apps before in the UK, and it is great being able to generate a ticket offline, but it appears they've achieved that by including the private keys in the app. Oh dear. Would there be any fool proof alternative to allow for offline ticket creation in a mobile app when that app can be reverse engineered?
- matthewmacleod 7y agoI don’t understand how offline ticket creation could work in any scenario, full-stop. Surely you need to have a data connection in order to purchase the ticket in the first place, right?
- mjlee 7y agoYou could carry a balance on the app that gets reconciled when you're online. Alternatively, Apply Pay works offline for NFC transactions - I've not tried doing an in-app purchase offline but that might work too.
- matthewmacleod 7y agoOh, sure - I mean you could carry a balance, but that would be inherently insecure (clearly not something they are particularly fussed about). Apple Pay is a little different in that the terminal is online - I was under the impression all contactless terminals perform auth in real-time, but I may be mistaken.
- mjlee 7y agoI've used Apple Pay completely offline - on trains, buses and planes for example. The terminals in London Underground stations might be constantly online, but I doubt very much there's a 100% guarantee for London Buses.
- Nextgrid 7y agoBuses are online. I’ve seen them authenticate a new card in real-time (they charge £0.10 on a card they haven’t seen recently to check if it’s cancelled).
- afarrell 7y agoIf this is activism, what is political goal here? It seems like all this does is enable people with a highly-paid skill (accessing tor, then deploying/running scripts) to not pay for transport.
- dchest 7y agoLink from onion website: http://www.freepublictransport.org.uk/ http://www.freepublictransport.org.uk/
- baud147258 7y agoI'm not sure that making public transportation free is the right idea to make more public transportation available, since the public transportation networks use the money from fares to function (in addition to money from the gov, any network with farebox recovery ratio [0] < 100% will need an external money source) [0] https://en.wikipedia.org/wiki/Farebox_recovery_ratio https://en.wikipedia.org/wiki/Farebox_recovery_ratio Still I agree that public transportation is a common good and I'm happy to live in a country with above-average networks (both at the local and national levels).
- kitd 7y agoThe public version is to demonstrate that large enterprises looking after public infrastructure & contracts still fail spectacularly to implement basic security practices in their products. Under the covers, it's an invitation to have a go at transport operators who are unpopular and have a reputation for offering low-quality services at high cost.
- dgellow 7y agoSo the goal is to say "look, your security is stupid, we will all have free rides until you fix it"? That's most likely to result in more money being spent by the public transport company to counter the bad PR and fix the issue.
- Jonnax 7y ago"The reason we’ve decided not to go down the responsible disclosure path is being strong believers in public transportation being a common good that should be free for everyone, and this research is our contribution to get us closer to that end." This is trolling, right?
- Beltiras 7y agoWhy would they be? I can see the political argument for the position.
- dgellow 7y agoIt's a way to steal from the local community given that public transports are financed mostly by tax money and by tickets (a tax based on your usage of the infrastructure). They present it as if it was a political action. That's rather ironic IMHO. Free public transports just mean that you pay it through another way, and most likely mean that you remove the "use tax", thus increasing the contribution from people who don't actually use public transports.
- nailer 7y agoIn one of the Nordic countries (at work so can't do research) they made PT free because ticketing maintenance costs were more expensive than ticket revenue. In other words, free PT could save taxpayers money.
- Cederfjard 7y agoI think you're thinking of Luxemburg, rather than a Nordic country. Apparently some politicians are considering it in Denmark as well though.
- Mordisquitos 7y ago>Free public transports just mean that you pay it through another way, and most likely mean that you remove the "use tax", thus increasing the contribution from people who don't actually use public transports. Absolutely, and that is in fact their political stance. They believe that there should be no use tax on public transport and that people who don't use it should still be responsible for financing it. Their reasoning is probably based on the assertion that public transport causes positive externalities even for non-users, and that the resulting benefit to society as a whole outweighs the purported unfairness against individuals. You may or may not agree, it may or may not be a good policy, but it is a legitimate political stance. A separate issue is whether guerrilla tactics/direct actions such as these can be justified to attain a political goal in a liberal democracy, and yet another debate is whether these methods are even tactically useful in getting closer to their stated goal.
- bradleyjg 7y agoI’m sympathetic to the idea that public transit should have means tested fares, but outright free is a bad idea. It costs something to provide, quite a bit actually, and has limited capacity so there needs to be some mechanism to gate access. Price, which forces users to consider trade-offs, is the most straightforward way to do so.
- CapacitorSet 7y agoGates access to whom? Trade-offs in favour of what? Introducing a fixed price gates the poor the most (eg. a wealthy individual can afford to spend a couple hundred pounds on a yearly subscription without much thought), and often incentivises trade-offs in favour of individual transportation (i.e. cars), which is less desirable in terms of pollution and traffic.
- purple_ducks 7y ago> a fixed price gates the poor the most The poor already get free travel. As do pensioners.
- DanBC 7y agoHow do poor people in the UK get free travel please?
- tomglynch 7y agoI've run the app through Immuniweb to see if the keys show up. There's quite a few issues but I don't see the private keys. Link here: https://www.immuniweb.com/mobile/?id=hprUh4hL https://www.immuniweb.com/mobile/?id=hprUh4hL
- mehh 7y agoSo who was the developer of this app, I assume the transport company outsourced it?
- CodeBiscuit 7y agoLooks like it's been removed, anyone take a copy of the post?
- katsura 7y agoHere you go: https://web.archive.org/web/20190902105930/https://www.reddit.com/r/manchester/comments/cyefu5/activists_release_code_to_generate_free_public/ https://web.archive.org/web/20190902105930/https://www.reddi... Although, it redirects after a few seconds, but you should be able to see the link.
- maxfan8 7y agoIt just links to an onion address. http://2dpue32kldx6sm24r2lbisilqhzlglffssgyjgqwwq7masm74rliwoid.onion/ http://2dpue32kldx6sm24r2lbisilqhzlglffssgyjgqwwq7masm74rliw... I'm not sure if I'm allowed to post this on HN – I think it should be legal to post a link.
- kofejnik 7y agoidiots
- T3OU-736 7y agoTechnical cock-up aside, why the term "activists"? Not questioning the title of the HN post, rather, wondering if I missed something going on I have missed in the news which would justify the term (instead of "hackers" or, even "security researchers", though the later seems to stretch the definition of responsible disclosure)
- dagw 7y agoThey're ostensibly doing this as a political statement to start a debate and affect political change. Thus "activists".
- gnufx 7y agoPeople complaining might note that there is already a free bus service in central Manchester: https://tfgm.com/public-transport/bus/free-bus https://tfgm.com/public-transport/bus/free-bus
- boomskats 7y agoAhh, this reminds me of BT Cellnet storing those first pay-as-you-go credit ledgers locally on the Philips C12 / Diga handsets, and just hoping nobody would notice.
- Smithalicious 7y agoHoly mother of entitlement. Taking something without paying for it because you think it should be free isn't activism, it's, well, theft.