7 ms·
>According to Dragon Sector, Newag entered code into the control systems of Impuls trains to stop them from operating if a GPS tracker indicated that the train
by Dah00n 3y ago
>According to Dragon Sector, Newag entered code into the control systems of Impuls trains to stop them from operating if a GPS tracker indicated that the train was parked for several days at an independent repair shop.
Oh, that seems pretty damning. I wonder if this was a lone developer or ordered from above.
- runiq 3y ago> Oh, that seems pretty damning. I wonder if this was a lone developer or ordered from above. Guess. (Did I miss the sarcasm again? I always miss the sarcasm.)
- stavros 3y agoWhat lone developer says "let me find all the GPS coordinates of all the train repair shops and make the trains not work if they've been parked there for days"?
- ykonstant 3y agoDon't underestimate these damned rouge developers!
- grudg3 3y agoI've heard of Khmer Rouge but not of Dev Rouge before.
- dirtyhippiefree 3y agoHumor is so little appreciated these days.
- smolder 3y agoHumor is prevalent in the internets various forums. It's well appreciated generally - easy upvotes on Reddit and elsewhere. But that also means that a serious forum with higher signal-to-noise ratio is something uniquely valuable.
- deleted 3y ago[deleted]
- Yizahi 3y ago"My cat slept on the keyboard and accidentally developed and merged working advertisement feature into a release build of the new AC game. It was totally on accident, happens all the time." (c) Ubisoft
- LegitShady 3y ago"I come to you now with apologies. This is the third time my cat has put paid mods into Skyrim, something for which he is very very sorry you are unhappy about."
- tiborsaas 3y agoYeah, sounds like a secret 20% project :)
- amelius 3y agoManagement: "a 6-pack of beer for the brilliant dev who figures out a solution to this problem of us ..."
- saalweachter 3y agoWe talk on HN a lot about ethics and programming and the importance of engineers refusing to develop unethical software. But I think we need another PSA that, if you are going to write some code that could land you in jail, make sure you get your entire reporting chain in writing telling you to do it, up to and including the CEO and the board of directors.
- nmeofthestate 3y agoAlternatively, if you're going to break the law, don't do that (break the law).
- sgift 3y agoAll of them. Dieselgate? Rogue dev. Trains breaking for independent shops? Rogue dev. Some airplane going down because of bad software? Rogue dev. Repeat after me: The company is never at fault.
- u32480932048 3y agoPerhaps GitHub Autopilot and ChatGPT teamed up to write the code upon noticing that the developer tripped and fell, causing a GSM modem to fall off their desk and into the assembly process.
- soco 3y agoIs this really suggesting some developer, buried under tasks and putting extra hours, thought to implement this feature in his free time for months, slipped it through reviews and scans and pipeline deployments, for... what? Really? I rather prefer to think the comment was sarcasm.
- blackbear_ 3y agoYes it was sarcasm, since it is common for management to shift the blame on individual engineers in these cases (see for example the Volkswagen emissions scandal and the Boeing MAX crash).
- sgerenser 3y agoIIRC Volkswagen actually used the term “rogue engineer” when speaking to the press.
- bluGill 3y agoIn VW's case there was some reason to believe that at first. There are reasons to test an engine in the lab without emissions controls, and so it is believable that a lazy engineer could put in code for the lab that also triggered in real world conditions. Note that the above is only believable before the rest of the investigation. Proper investigation proved the story wrong, but it is just possible enough to believe it could be true if the proper investigation hod come up differently.
- rob74 3y agoThey will surely try that explanation too if the others fail. Currently their stance seems to be "there is no such code on the trains, and if there is, it's not from us".
- prox 3y agoIt’s from those darn third party developers! ;)
- jacquesm 3y agoBlame the hacker, wait for it. Also: I wonder if their management realizes that they probably have a nice trail in the form of a bunch of repositories and commit messages. Would be nice if that leaked.
- meithecatte 3y agoYou're talking about industrial PLCs. They're programmed using a-bit-more-fancy Scratch snappy blocks. There is no version control. The firmware contained paths embedded as strings, so we know that firmware for each model and customer was developed in a separate folder on disk. I wouldn't be surprised if they also had .zip files with backups of previous versions.
- planede 3y agoAs a lone developer there is absolutely no motivation to do this and hide this decision from management. Having said that a lone developer can come up with the idea, propose it to management with the expectation of some fat bonus. But why do this in secret? There is just no possibility where upper management is not involved in this.
- whstl 3y ago100% agree. Doing this in secret without management's express approval means no bonus, working extra for no benefit, compromising your other tasks and exposing yourself to heavy liability for compromising the country's infrastructure. This is something that companies could get away with, but a single developers would not only lose their job, but risk going to jail.
- bluGill 3y agoNote that management's express approval could be verbal conversations that you cannot prove happened or not. With some work management can find some way to get a developer who has some other conflict of interest to do this: if your brother in law works for the maintenance yard situations then you have motive to ensure he has work.
- JumpCrisscross 3y ago“Newag president Zbigniew Konieczek said that ‘no evidence was provided that our company intentionally installed the faulty software. In our opinion, the truth may be completely different—that, for example, the competition interfered with the software.’” The ridiculousness of this defence makes it clear leadership was in the know.
- HelloNurse 3y agoI hope evidence will be provided in court.
- theginger 3y agoI guess they can't claim any copy write / drm violations if they also deny it was their code.
- dcow 3y agoRiiight?! This is a really strong defense for the white hats. Either it’s your code and you are egregious slime balls doing illegal things, or “some third party interfered and hacked your trains like you said and we fixed it you’re welcome”.
- lesuorac 3y agoI'm not sure that's the smoking gun. IIRC, there was some "konami" code to re-enable the train after disablement that was removed in a first-party update after the third-party repair company found the sequence. And not related to the third-party locations, one of the trains had some code where if the year>2021 & month>11 & day>? then the train would disable itself; ultimately doing it in the wrong year because the train was off during november / december of that year. This is a little excessive for somebody random to do.
- hifromwork 3y agoThe 2021-11-?? date was the day the train was scheduled to be serviced (so the intention of the code was to brick the code after the service). Only by random chance it didn't work, because the train was in maintenance a bit longer, and the code didn't trigger in January 2022 because of the date checking bug.
- crest 3y agoHis dog did it after eating the CS homework.
- stby 3y agonpm add block-repair-shop. It can happen so fast.
- figassis 3y agoIf an employee did this without authorization, the company should still be liable because I do not think safety regulations exempt manufacture from responsibility of employee actions. I believe the opposite is true, that they must ensure safety despite rogue employees, with reviews, audits and such.
- bluGill 3y agoThey need to show audits and that the code is obscure enough that it could be missed. I've seen IOCCC type things that do things I wouldn't catch in a code review. (IIRC there is a malicious code contest where the goal is to put backdoors in that others don't see in review, but I can't recall what it is)
- 8372049 3y agoThere's been a decent amount of those in the wild, too. If you're in an environment without unicode auditing you can do all sorts of crazy things without IOCCC levels of code tricks too.
- nneonneo 3y agoYou’re thinking of the Underhanded C contest: http://www.underhanded-c.org/ http://www.underhanded-c.org/. The goal is to write C code which looks completely innocent, but which actually performs some malicious or unwanted behaviour. In the last year they ran the contest (2016), the goal was to write a program that would compare two sets of measurements for similarity (nominally radiation emission spectra) but fail to give a correct answer when given a particular crafted input.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- Tangurena2 3y agoI suspect this is going to end all further sales of these trains outside of Poland. What railway will ever trust them again?