Looks like Newag have been naughty boys and have put software lockouts
in their trains so they won't work at competitors maintenance facilities
and other miscellanious BS:

https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hacking
/

Can't imagine they'll be getting many new orders, at least outside of Poland
anyway.

<Muttley@dastardlyhq.com> wrote:
> Looks like Newag have been naughty boys and have put software lockouts
> in their trains so they won't work at competitors maintenance facilities
> and other miscellanious BS:
>
> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hacking
> /
>
> Can't imagine they'll be getting many new orders, at least outside of Poland
> anyway.
>
>

See the previous thread.

On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:

> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hacking

I've already posted this!

--
Rob
"I have never understood why it should be necessary to become irrational
in order to prove that you care, or, indeed, why it should be necessary
to prove it at all." - Avon, Blake's 7

On Mon, 11 Dec 2023 11:01:41 +0000
Robert <monstoor@spammedia.com> wrote:
>On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>
>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>
>https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>g
>
>I've already posted this!

Sorry, missed it. The lack of replies probably means its all a bit beyond
the most of the posters on here.

<Muttley@dastardlyhq.com> wrote:
> On Mon, 11 Dec 2023 11:01:41 +0000
> Robert <monstoor@spammedia.com> wrote:
>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>
>>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>
>> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>> g
>>
>> I've already posted this!
>
> Sorry, missed it. The lack of replies probably means its all a bit beyond
> the most of the posters on here.
>
>

The badcyber link was not, IIRC, previously directly posted. It is worth a
read if you are interested in things IT as it goes into more detail than El
Reg’s article.

On 12/12/23 04:34, Tweed wrote:

> The badcyber link was not, IIRC, previously directly posted. It is worth a
> read if you are interested in things IT as it goes into more detail than El
> Reg’s article.

The OEM's response is great too - we didn't to it, we wouldn't do it,
some one else must have hacked our system. Evil hackers did it.

On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
Tweed <usenet.tweed@gmail.com> wrote:
><Muttley@dastardlyhq.com> wrote:
>> On Mon, 11 Dec 2023 11:01:41 +0000
>> Robert <monstoor@spammedia.com> wrote:
>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>
>>>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>
>>>
>https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>
>>> g
>>>
>>> I've already posted this!
>>
>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>> the most of the posters on here.
>>
>>
>
>The badcyber link was not, IIRC, previously directly posted. It is worth a
>read if you are interested in things IT as it goes into more detail than El
>Reg’s article.

It is pretty interesting. But seems the incumbants would sooner discuss
blocked train toilets and ticketing prices. Hey ho.

On 12/12/2023 09:22, Muttley@dastardlyhq.com wrote:
> On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
> Tweed <usenet.tweed@gmail.com> wrote:
>> <Muttley@dastardlyhq.com> wrote:
>>> On Mon, 11 Dec 2023 11:01:41 +0000
>>> Robert <monstoor@spammedia.com> wrote:
>>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>>
>>>>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>>
>>>>
>> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>>
>>>> g
>>>>
>>>> I've already posted this!
>>>
>>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>>> the most of the posters on here.
>>>
>>>
>>
>> The badcyber link was not, IIRC, previously directly posted. It is worth a
>> read if you are interested in things IT as it goes into more detail than El
>> Reg’s article.
>
> It is pretty interesting. But seems the incumbants would sooner discuss
> blocked train toilets and ticketing prices. Hey ho.
>

Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
or something else!

--
Colin

On 12/12/2023 09:22, Muttley@dastardlyhq.com wrote:
> On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
> Tweed <usenet.tweed@gmail.com> wrote:
>> <Muttley@dastardlyhq.com> wrote:
>>> On Mon, 11 Dec 2023 11:01:41 +0000
>>> Robert <monstoor@spammedia.com> wrote:
>>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>>
>>>>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>>
>>>>
>> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>>
>>>> g
>>>>
>>>> I've already posted this!
>>>
>>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>>> the most of the posters on here.
>>>
>>>
>>
>> The badcyber link was not, IIRC, previously directly posted. It is worth a
>> read if you are interested in things IT as it goes into more detail than El
>> Reg’s article.
>
> It is pretty interesting. But seems the incumbants would sooner discuss
> blocked train toilets and ticketing prices. Hey ho.
>

I found the articles fascinating as well. The biggest lesson learnt is
everything is hackable if you throw enough resources at it. The next
lesson is that there are some manufacturers who should not be allowed to
trade.

On Tue, 12 Dec 2023 11:59:09 +0000
ColinR <rail@greystane.shetland.co.uk> wrote:
>On 12/12/2023 09:22, Muttley@dastardlyhq.com wrote:
>> On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
>> Tweed <usenet.tweed@gmail.com> wrote:
>>> <Muttley@dastardlyhq.com> wrote:
>>>> On Mon, 11 Dec 2023 11:01:41 +0000
>>>> Robert <monstoor@spammedia.com> wrote:
>>>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>>>
>>>>>>
>https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>>>
>>>>>
>>>
>https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>
>>>
>>>>> g
>>>>>
>>>>> I've already posted this!
>>>>
>>>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>>>> the most of the posters on here.
>>>>
>>>>
>>>
>>> The badcyber link was not, IIRC, previously directly posted. It is worth a
>>> read if you are interested in things IT as it goes into more detail than El
>>> Reg’s article.
>>
>> It is pretty interesting. But seems the incumbants would sooner discuss
>> blocked train toilets and ticketing prices. Hey ho.
>>
>
>Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>or something else!

Last time I looked train manufacturers were international. I don't know if
any Newag stock is operating in this country but its not impossible.

On Tue, 12 Dec 2023 11:59:09 +0000, ColinR <rail@greystane.shetland.co.uk> wrote:

>On 12/12/2023 09:22, Muttley@dastardlyhq.com wrote:
>> On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
>> Tweed <usenet.tweed@gmail.com> wrote:
>>> <Muttley@dastardlyhq.com> wrote:
>>>> On Mon, 11 Dec 2023 11:01:41 +0000
>>>> Robert <monstoor@spammedia.com> wrote:
>>>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>>>
>>>>>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>>>
>>>>>
>>> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>>>
>>>>> g
>>>>>
>>>>> I've already posted this!
>>>>
>>>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>>>> the most of the posters on here.
>>>>
>>>>
>>>
>>> The badcyber link was not, IIRC, previously directly posted. It is worth a
>>> read if you are interested in things IT as it goes into more detail than El
>>> Reg’s article.
>>
>> It is pretty interesting. But seems the incumbants would sooner discuss
>> blocked train toilets and ticketing prices. Hey ho.
>>
>
>Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>or something else!

Yes, neither the train manufacturer, not the maintenance company, are known here, so there's limited local interest.

It strikes me that the logic to cause these problems for a third party maintenance company is very convoluted. Wouldn't
it be easier if the trains will only run if they receive regular encrypted 'OK' signals from the manufacturer? This
could be described as a safety system.

With planes, customers third parties are allowed to maintain them, but they have to be trained and certified by the
manufacturer, which is probably a good source of income. Similarly, all parts should come from authorised suppliers, and
have a complete audit trail. There's been a recent case of a company failing to do this:

<https://www.reuters.com/business/aerospace-defense/uks-sfo-makes-one-arrest-launches-probe-into-fake-jet-engine-parts-2023-12-06/>

<https://www.telegraph.co.uk/business/2023/12/06/sfo-arrests-man-fake-aircraft-engine-parts-ryanair-scandal/>

Western aircraft stolen by Russia are no longer receiving this certified maintenance, and are becoming increasingly
unreliable. They are probably now worthless on the international market, as nobody knows the authenticity of their
parts.

On Tue, 12 Dec 2023 15:50:41 -0000 (UTC), Muttley@dastardlyhq.com wrote:

>On Tue, 12 Dec 2023 11:59:09 +0000
>ColinR <rail@greystane.shetland.co.uk> wrote:
>>On 12/12/2023 09:22, Muttley@dastardlyhq.com wrote:
>>> On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
>>> Tweed <usenet.tweed@gmail.com> wrote:
>>>> <Muttley@dastardlyhq.com> wrote:
>>>>> On Mon, 11 Dec 2023 11:01:41 +0000
>>>>> Robert <monstoor@spammedia.com> wrote:
>>>>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>>>>
>>>>>>>
>>https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>>>>
>>>>>>
>>>>
>>https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>>
>>>>
>>>>>> g
>>>>>>
>>>>>> I've already posted this!
>>>>>
>>>>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>>>>> the most of the posters on here.
>>>>>
>>>>>
>>>>
>>>> The badcyber link was not, IIRC, previously directly posted. It is worth a
>>>> read if you are interested in things IT as it goes into more detail than El
>>>> Reg’s article.
>>>
>>> It is pretty interesting. But seems the incumbants would sooner discuss
>>> blocked train toilets and ticketing prices. Hey ho.
>>>
>>
>>Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>or something else!
>
>Last time I looked train manufacturers were international. I don't know if
>any Newag stock is operating in this country but its not impossible.

I don't think so.

On Tue, 12 Dec 2023 15:55:25 +0000
Recliner <recliner.usenet@gmail.com> wrote:
>On Tue, 12 Dec 2023 11:59:09 +0000, ColinR <rail@greystane.shetland.co.uk>
>wrote:
>>Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>or something else!
>
>Yes, neither the train manufacturer, not the maintenance company, are known
>here, so there's limited local interest.

Really? Its not about the train maker per se, its the fact that its been
done.

>It strikes me that the logic to cause these problems for a third party
>maintenance company is very convoluted. Wouldn't

Not convoluted at all. Geofencing is relatively simple.

>it be easier if the trains will only run if they receive regular encrypted
>'OK' signals from the manufacturer? This

As opposed to that idea which could bring all trains to a halt if the mobile
network goes down or if a train is parked in a notspot for any length of time.
Plus it would require the manufacturer to maintain such a broadcast system
which would probably be spotted fairly quickly by someone in the phone
company if not elsewhere.

>unreliable. They are probably now worthless on the international market, as
>nobody knows the authenticity of their
>parts.

Russian maintenance probably wasn't great to start with either.

On Tue, 12 Dec 2023 16:12:45 -0000 (UTC), Muttley@dastardlyhq.com wrote:

>On Tue, 12 Dec 2023 15:55:25 +0000
>Recliner <recliner.usenet@gmail.com> wrote:
>>On Tue, 12 Dec 2023 11:59:09 +0000, ColinR <rail@greystane.shetland.co.uk>
>>wrote:
>>>Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>>or something else!
>>
>>Yes, neither the train manufacturer, not the maintenance company, are known
>>here, so there's limited local interest.
>
>Really? Its not about the train maker per se, its the fact that its been
>done.
>
>>It strikes me that the logic to cause these problems for a third party
>>maintenance company is very convoluted. Wouldn't
>
>Not convoluted at all. Geofencing is relatively simple.

It was done rather crudely.

>
>>it be easier if the trains will only run if they receive regular encrypted
>>'OK' signals from the manufacturer? This
>
>As opposed to that idea which could bring all trains to a halt if the mobile
>network goes down or if a train is parked in a notspot for any length of time.
>Plus it would require the manufacturer to maintain such a broadcast system
>which would probably be spotted fairly quickly by someone in the phone
>company if not elsewhere.
>
>>unreliable. They are probably now worthless on the international market, as
>>nobody knows the authenticity of their
>>parts.
>
>Russian maintenance probably wasn't great to start with either.

Major maintenance wasn't done in Russia, but Russia did have ready access to the authentic parts.

Recliner <recliner.usenet@gmail.com> wrote:
> On Tue, 12 Dec 2023 15:50:41 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>
>> On Tue, 12 Dec 2023 11:59:09 +0000
>> ColinR <rail@greystane.shetland.co.uk> wrote:
>>> On 12/12/2023 09:22, Muttley@dastardlyhq.com wrote:
>>>> On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
>>>> Tweed <usenet.tweed@gmail.com> wrote:
>>>>> <Muttley@dastardlyhq.com> wrote:
>>>>>> On Mon, 11 Dec 2023 11:01:41 +0000
>>>>>> Robert <monstoor@spammedia.com> wrote:
>>>>>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>>>>>
>>>>>>>>
>>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>>>>>
>>>>>>>
>>>>>
>>> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>>>
>>>>>
>>>>>>> g
>>>>>>>
>>>>>>> I've already posted this!
>>>>>>
>>>>>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>>>>>> the most of the posters on here.
>>>>>>
>>>>>>
>>>>>
>>>>> The badcyber link was not, IIRC, previously directly posted. It is worth a
>>>>> read if you are interested in things IT as it goes into more detail than El
>>>>> Reg’s article.
>>>>
>>>> It is pretty interesting. But seems the incumbants would sooner discuss
>>>> blocked train toilets and ticketing prices. Hey ho.
>>>>
>>>
>>> Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>> or something else!
>>
>> Last time I looked train manufacturers were international. I don't know if
>> any Newag stock is operating in this country but its not impossible.
>
> I don't think so.
>

I think the article is of relevance to the UK because our new trains are
heavily software dependent. Although we hope our suppliers don’t get up to
anything naughty it’s worth considering. Perhaps train software source code
should be lodged with the certifying body (perhaps it is?) to guard against
this sort of thing, to provide resilience in case the vendor goes bust, or
perhaps even if the vendor loses everything due to a ransomware attack.
This incident shows how a very expensive train can suddenly become useless.

On Tue, 12 Dec 2023 16:32:48 +0000
Recliner <recliner.usenet@gmail.com> wrote:
>On Tue, 12 Dec 2023 16:12:45 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>
>>On Tue, 12 Dec 2023 15:55:25 +0000
>>Recliner <recliner.usenet@gmail.com> wrote:
>>>On Tue, 12 Dec 2023 11:59:09 +0000, ColinR <rail@greystane.shetland.co.uk>
>>>wrote:
>>>>Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>>>or something else!
>>>
>>>Yes, neither the train manufacturer, not the maintenance company, are known
>>>here, so there's limited local interest.
>>
>>Really? Its not about the train maker per se, its the fact that its been
>>done.
>>
>>>It strikes me that the logic to cause these problems for a third party
>>>maintenance company is very convoluted. Wouldn't
>>
>>Not convoluted at all. Geofencing is relatively simple.
>
>It was done rather crudely.

Did you read the technical article?

On Tue, 12 Dec 2023 16:34:05 -0000 (UTC)
Tweed <usenet.tweed@gmail.com> wrote:
>Recliner <recliner.usenet@gmail.com> wrote:
>> On Tue, 12 Dec 2023 15:50:41 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>>> Last time I looked train manufacturers were international. I don't know if
>>> any Newag stock is operating in this country but its not impossible.
>>
>> I don't think so.
>>
>
>I think the article is of relevance to the UK because our new trains are
>heavily software dependent. Although we hope our suppliers don’t get up to
>anything naughty it’s worth considering. Perhaps train software source code
>should be lodged with the certifying body (perhaps it is?) to guard against
>this sort of thing, to provide resilience in case the vendor goes bust, or
>perhaps even if the vendor loses everything due to a ransomware attack.
>This incident shows how a very expensive train can suddenly become useless.

Hopefully Siemens, Alsthom et al haven't done anything this stupid. But it
wouldn't be hard to set the software to demand maintenance whether the train
needs it or not. Or if a company has purchased trains on a hire purchase type
of agreement , would it be a surprise if their trains suddenly stopped working
if they were however many months late on payment?

<Muttley@dastardlyhq.com> wrote:
> On Tue, 12 Dec 2023 16:34:05 -0000 (UTC)
> Tweed <usenet.tweed@gmail.com> wrote:
>> Recliner <recliner.usenet@gmail.com> wrote:
>>> On Tue, 12 Dec 2023 15:50:41 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>>>> Last time I looked train manufacturers were international. I don't know if
>>>> any Newag stock is operating in this country but its not impossible.
>>>
>>> I don't think so.
>>>
>>
>> I think the article is of relevance to the UK because our new trains are
>> heavily software dependent. Although we hope our suppliers don’t get up to
>> anything naughty it’s worth considering. Perhaps train software source code
>> should be lodged with the certifying body (perhaps it is?) to guard against
>> this sort of thing, to provide resilience in case the vendor goes bust, or
>> perhaps even if the vendor loses everything due to a ransomware attack.
>> This incident shows how a very expensive train can suddenly become useless.
>
> Hopefully Siemens, Alsthom et al haven't done anything this stupid. But it
> wouldn't be hard to set the software to demand maintenance whether the train
> needs it or not. Or if a company has purchased trains on a hire purchase type
> of agreement , would it be a surprise if their trains suddenly stopped working
> if they were however many months late on payment?
>
>

It has led me to wonder what the safety regime for train software is.
Aircraft software is tightly controlled. This Polish incident seems to
indicate that things seem to rely on the vendor self certifying - otherwise
this issue would have been found. Makes you wonder what else is in there.

<Muttley@dastardlyhq.com> wrote:
> On Tue, 12 Dec 2023 16:32:48 +0000
> Recliner <recliner.usenet@gmail.com> wrote:
>> On Tue, 12 Dec 2023 16:12:45 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>>
>>> On Tue, 12 Dec 2023 15:55:25 +0000
>>> Recliner <recliner.usenet@gmail.com> wrote:
>>>> On Tue, 12 Dec 2023 11:59:09 +0000, ColinR <rail@greystane.shetland.co.uk>
>>>> wrote:
>>>>> Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>>>> or something else!
>>>>
>>>> Yes, neither the train manufacturer, not the maintenance company, are known
>>>> here, so there's limited local interest.
>>>
>>> Really? Its not about the train maker per se, its the fact that its been
>>> done.
>>>
>>>> It strikes me that the logic to cause these problems for a third party
>>>> maintenance company is very convoluted. Wouldn't
>>>
>>> Not convoluted at all. Geofencing is relatively simple.
>>
>> It was done rather crudely.
>
> Did you read the technical article?

Yes. How could I have made that judgment otherwise?

On 12/12/2023 16:34, Tweed wrote:
> Recliner <recliner.usenet@gmail.com> wrote:
>> On Tue, 12 Dec 2023 15:50:41 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>>
>>> On Tue, 12 Dec 2023 11:59:09 +0000
>>> ColinR <rail@greystane.shetland.co.uk> wrote:
>>>> On 12/12/2023 09:22, Muttley@dastardlyhq.com wrote:
>>>>> On Mon, 11 Dec 2023 17:34:31 -0000 (UTC)
>>>>> Tweed <usenet.tweed@gmail.com> wrote:
>>>>>> <Muttley@dastardlyhq.com> wrote:
>>>>>>> On Mon, 11 Dec 2023 11:01:41 +0000
>>>>>>> Robert <monstoor@spammedia.com> wrote:
>>>>>>>> On 11/12/2023 09:51, Muttley@dastardlyhq.com wrote:
>>>>>>>>
>>>>>>>>>
>>>> https://www.theregister.com/2023/12/08/polish_trains_geofenced_allegation/
>>>>>>>>>
>>>>>>>>
>>>>>>
>>>> https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hackin
>>>>
>>>>>>
>>>>>>>> g
>>>>>>>>
>>>>>>>> I've already posted this!
>>>>>>>
>>>>>>> Sorry, missed it. The lack of replies probably means its all a bit beyond
>>>>>>> the most of the posters on here.
>>>>>>>
>>>>>>>
>>>>>>
>>>>>> The badcyber link was not, IIRC, previously directly posted. It is worth a
>>>>>> read if you are interested in things IT as it goes into more detail than El
>>>>>> Reg’s article.
>>>>>
>>>>> It is pretty interesting. But seems the incumbants would sooner discuss
>>>>> blocked train toilets and ticketing prices. Hey ho.
>>>>>
>>>>
>>>> Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>>> or something else!
>>>
>>> Last time I looked train manufacturers were international. I don't know if
>>> any Newag stock is operating in this country but its not impossible.
>>
>> I don't think so.
>>
>
> I think the article is of relevance to the UK because our new trains are
> heavily software dependent. Although we hope our suppliers don’t get up to
> anything naughty it’s worth considering. Perhaps train software source code
> should be lodged with the certifying body (perhaps it is?) to guard against
> this sort of thing, to provide resilience in case the vendor goes bust, or
> perhaps even if the vendor loses everything due to a ransomware attack.
> This incident shows how a very expensive train can suddenly become useless.

I don't think a supplier with that level of probity could be trusted
with supplying an accurate copy of the source code.

What bothers me is that UK purchasers don't learn by their own mistakes
so they're definitely not going to learn from elsewhere.

On Tue, 12 Dec 2023 16:52:38 -0000 (UTC)
Tweed <usenet.tweed@gmail.com> wrote:
><Muttley@dastardlyhq.com> wrote:
>> On Tue, 12 Dec 2023 16:34:05 -0000 (UTC)
>> Tweed <usenet.tweed@gmail.com> wrote:
>>> Recliner <recliner.usenet@gmail.com> wrote:
>>>> On Tue, 12 Dec 2023 15:50:41 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>>>>> Last time I looked train manufacturers were international. I don't know if
>
>>>>> any Newag stock is operating in this country but its not impossible.
>>>>
>>>> I don't think so.
>>>>
>>>
>>> I think the article is of relevance to the UK because our new trains are
>>> heavily software dependent. Although we hope our suppliers don’t get up to
>
>>> anything naughty it’s worth considering. Perhaps train software source
>code
>>> should be lodged with the certifying body (perhaps it is?) to guard against
>>> this sort of thing, to provide resilience in case the vendor goes bust, or
>>> perhaps even if the vendor loses everything due to a ransomware attack.
>>> This incident shows how a very expensive train can suddenly become useless.
>>
>> Hopefully Siemens, Alsthom et al haven't done anything this stupid. But it
>> wouldn't be hard to set the software to demand maintenance whether the train
>> needs it or not. Or if a company has purchased trains on a hire purchase type
>
>> of agreement , would it be a surprise if their trains suddenly stopped
>working
>> if they were however many months late on payment?
>>
>>
>
>It has led me to wonder what the safety regime for train software is.
>Aircraft software is tightly controlled. This Polish incident seems to
>indicate that things seem to rely on the vendor self certifying - otherwise
>this issue would have been found. Makes you wonder what else is in there.

Quite. It wouldn't surprise me if like with this Newag train, a certain
sequence of keypresses in the cab in most modern trains will bring up some kind
of manufacturers undocumented in house service menu. Or perhaps even an
animated list of the dev team!

On Tue, 12 Dec 2023 17:59:33 GMT
Recliner <recliner.usenet@gmail.com> wrote:
><Muttley@dastardlyhq.com> wrote:
>> On Tue, 12 Dec 2023 16:32:48 +0000
>> Recliner <recliner.usenet@gmail.com> wrote:
>>> On Tue, 12 Dec 2023 16:12:45 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>>>
>>>> On Tue, 12 Dec 2023 15:55:25 +0000
>>>> Recliner <recliner.usenet@gmail.com> wrote:
>>>>> On Tue, 12 Dec 2023 11:59:09 +0000, ColinR <rail@greystane.shetland.co.uk>
>
>>>>> wrote:
>>>>>> Whilst I understand your point, this is a .uk newsgroup, not .eu or .pl
>>>>>> or something else!
>>>>>
>>>>> Yes, neither the train manufacturer, not the maintenance company, are
>known
>>>>> here, so there's limited local interest.
>>>>
>>>> Really? Its not about the train maker per se, its the fact that its been
>>>> done.
>>>>
>>>>> It strikes me that the logic to cause these problems for a third party
>>>>> maintenance company is very convoluted. Wouldn't
>>>>
>>>> Not convoluted at all. Geofencing is relatively simple.
>>>
>>> It was done rather crudely.
>>
>> Did you read the technical article?
>
>Yes. How could I have made that judgment otherwise?

Never stopped you in the past.

On Tue, 12 Dec 2023 20:49:40 +0000
Coffee <martin.coffee@round-midnight.org.uk> wrote:
>On 12/12/2023 16:34, Tweed wrote:
>> I think the article is of relevance to the UK because our new trains are
>> heavily software dependent. Although we hope our suppliers don’t get up to
>> anything naughty it’s worth considering. Perhaps train software source code
>
>> should be lodged with the certifying body (perhaps it is?) to guard against
>> this sort of thing, to provide resilience in case the vendor goes bust, or
>> perhaps even if the vendor loses everything due to a ransomware attack.
>> This incident shows how a very expensive train can suddenly become useless.
>
>I don't think a supplier with that level of probity could be trusted
>with supplying an accurate copy of the source code.
>
>What bothers me is that UK purchasers don't learn by their own mistakes
>so they're definitely not going to learn from elsewhere.

Given the lack of big train manufacturers now due to endless mergers and
takeovers in the last few decades its pretty much hobsons choice for them
these days. Siemens, Alsthom, CAF or Stadler is pretty much it for western
europe now.

On Wed, 13 Dec 2023 09:17:39 -0000 (UTC), Muttley@dastardlyhq.com wrote:

>On Tue, 12 Dec 2023 20:49:40 +0000
>Coffee <martin.coffee@round-midnight.org.uk> wrote:
>>On 12/12/2023 16:34, Tweed wrote:
>>> I think the article is of relevance to the UK because our new trains are
>>> heavily software dependent. Although we hope our suppliers don’t get up to
>>> anything naughty it’s worth considering. Perhaps train software source code
>>
>>> should be lodged with the certifying body (perhaps it is?) to guard against
>>> this sort of thing, to provide resilience in case the vendor goes bust, or
>>> perhaps even if the vendor loses everything due to a ransomware attack.
>>> This incident shows how a very expensive train can suddenly become useless.
>>
>>I don't think a supplier with that level of probity could be trusted
>>with supplying an accurate copy of the source code.
>>
>>What bothers me is that UK purchasers don't learn by their own mistakes
>>so they're definitely not going to learn from elsewhere.
>
>Given the lack of big train manufacturers now due to endless mergers and
>takeovers in the last few decades its pretty much hobsons choice for them
>these days. Siemens, Alsthom, CAF or Stadler is pretty much it for western
>europe now.

Hitachi also has two European train factories.

On Wed, 13 Dec 2023 09:52:55 +0000
Recliner <recliner.usenet@gmail.com> wrote:
>On Wed, 13 Dec 2023 09:17:39 -0000 (UTC), Muttley@dastardlyhq.com wrote:
>
>>On Tue, 12 Dec 2023 20:49:40 +0000
>>Coffee <martin.coffee@round-midnight.org.uk> wrote:
>>>On 12/12/2023 16:34, Tweed wrote:
>>>> I think the article is of relevance to the UK because our new trains are
>>>> heavily software dependent. Although we hope our suppliers don’t get up
>to
>>>> anything naughty it’s worth considering. Perhaps train software source
>code
>>>
>>>> should be lodged with the certifying body (perhaps it is?) to guard against
>
>>>> this sort of thing, to provide resilience in case the vendor goes bust, or
>>>> perhaps even if the vendor loses everything due to a ransomware attack.
>>>> This incident shows how a very expensive train can suddenly become useless.
>
>>>
>>>I don't think a supplier with that level of probity could be trusted
>>>with supplying an accurate copy of the source code.
>>>
>>>What bothers me is that UK purchasers don't learn by their own mistakes
>>>so they're definitely not going to learn from elsewhere.
>>
>>Given the lack of big train manufacturers now due to endless mergers and
>>takeovers in the last few decades its pretty much hobsons choice for them
>>these days. Siemens, Alsthom, CAF or Stadler is pretty much it for western
>>europe now.
>
>Hitachi also has two European train factories.

Fair point. Though would anyone risk them again after the problems with the
800s?