4 ms·

> the underlying Windows Desktop I think I found the problem

by tantalor 2y ago

SpaceL10n 2y ago
It's shocking just how many kiosk manufacturers expose the underlying OS. Ariane isn't the only one.
- RicoElectrico 2y ago
  On Linux you can make Qt use the framebuffer directly without a window manager. With that setup there's nowhere to break out. And if it crashes to the console - no way out either with no physical keyboard present.
  - amluto 2y ago
    An actually good design would be secure even with a physical keyboard. “All” you need to do is keep the keyboard from interacting with the Linux VT system (which is not conceptually difficult).
  - fy20 2y ago
    At my 9-5 we make kiosks based on a custom Linux system. Everything is run within Docker containers, so even if you somehow kill the UI it'll just restart the container. VT on the host OS are disabled. I can see why most companies prefer Windows though for these type of devices. Driver issues with graphics and third party hardware are a constant pain point for us. Unless you control the whole ecosystem and write your own drivers (e.g. smart TVs), Linux based systems are tricky. I'd imagine Windows has the same issue to some extend, but it's the default target for manufacturers, so their Windows drivers are usually better. I feel there could be a market for a custom Linux OS aimed for these use cases. Windows licensing is not cheap when you have tens of thousands of devices, and they aren't running the 'Home' version.
    - withinboredom 2y ago
      Isn't the iot version of windows free?
      - DaSHacka 2y ago
        IoT as in LTSC IoT? No, you still have to pay for a license
w0m 2y ago
Honestly this seems like a crazy simple client application bug; simply add a single quote as part of your name and it crashes. How does that pass even incredibly basic QA to make production? Maybe I've been blessed (or cursed?) to only work at shops with full qa teams.
hnburnsy 2y ago
They should be using kiosk mode which allows only one app to run and no access to the desktop. https://learn.microsoft.com/en-us/windows/iot/iot-enterprise/customize/kiosk-mode https://learn.microsoft.com/en-us/windows/iot/iot-enterprise...
- fuzzfactor 2y ago
  I think they are using kiosk mode. However sometimes if you plug in a keyboard and hit ctrl-alt-del you get task manager and can run additional programs. I can imagine the Allegro app uses a virtual keyboard of some type for this user entry, and it goes south from there.
  - jeroenhd 2y ago
    The screenshot suggests they use Windows 7 (could be one of the IoT versions that recently still received updates, but I doubt it). I don't think 7 had the system features listed in the kiosk mode documentation.
    - vel0city 2y ago
      Exactly this. They should be using a very stripped-down Windows IoT build in kiosk mode. Even for this outdated (and insecure) generation it looks like they're not actually using the Embedded version of Windows. While I don't think that had a named "kiosk mode", there were lots of things one could have done to make it not just crash to a regular full-featured desktop.
userbinator 2y ago
If they developed their application on Linux, you might see a Linux desktop instead.
- bennyp101 2y ago
  Not the year for it

> the underlying Windows Desktop I think I found the problem

SpaceL10n 2y ago

It's shocking just how many kiosk manufacturers expose the underlying OS. Ariane isn't the only one.

RicoElectrico 2y ago
On Linux you can make Qt use the framebuffer directly without a window manager. With that setup there's nowhere to break out. And if it crashes to the console - no way out either with no physical keyboard present.
- amluto 2y ago
  An actually good design would be secure even with a physical keyboard. “All” you need to do is keep the keyboard from interacting with the Linux VT system (which is not conceptually difficult).
- fy20 2y ago
  At my 9-5 we make kiosks based on a custom Linux system. Everything is run within Docker containers, so even if you somehow kill the UI it'll just restart the container. VT on the host OS are disabled. I can see why most companies prefer Windows though for these type of devices. Driver issues with graphics and third party hardware are a constant pain point for us. Unless you control the whole ecosystem and write your own drivers (e.g. smart TVs), Linux based systems are tricky. I'd imagine Windows has the same issue to some extend, but it's the default target for manufacturers, so their Windows drivers are usually better. I feel there could be a market for a custom Linux OS aimed for these use cases. Windows licensing is not cheap when you have tens of thousands of devices, and they aren't running the 'Home' version.
  - withinboredom 2y ago
    Isn't the iot version of windows free?
    - DaSHacka 2y ago
      IoT as in LTSC IoT? No, you still have to pay for a license

w0m 2y ago

Honestly this seems like a crazy simple client application bug; simply add a single quote as part of your name and it crashes. How does that pass even incredibly basic QA to make production? Maybe I've been blessed (or cursed?) to only work at shops with full qa teams.

hnburnsy 2y ago

They should be using kiosk mode which allows only one app to run and no access to the desktop. https://learn.microsoft.com/en-us/windows/iot/iot-enterprise/customize/kiosk-mode https://learn.microsoft.com/en-us/windows/iot/iot-enterprise...

fuzzfactor 2y ago
I think they are using kiosk mode. However sometimes if you plug in a keyboard and hit ctrl-alt-del you get task manager and can run additional programs. I can imagine the Allegro app uses a virtual keyboard of some type for this user entry, and it goes south from there.
- jeroenhd 2y ago
  The screenshot suggests they use Windows 7 (could be one of the IoT versions that recently still received updates, but I doubt it). I don't think 7 had the system features listed in the kiosk mode documentation.
  - vel0city 2y ago
    Exactly this. They should be using a very stripped-down Windows IoT build in kiosk mode. Even for this outdated (and insecure) generation it looks like they're not actually using the Embedded version of Windows. While I don't think that had a named "kiosk mode", there were lots of things one could have done to make it not just crash to a regular full-featured desktop.

userbinator 2y ago

If they developed their application on Linux, you might see a Linux desktop instead.

bennyp101 2y ago
Not the year for it