Trabisnikof posted:

and while the system was down, they continued to accept flight plans, but those were manually entered which has its own risks, since manual data entry can get hosed up.

quote:

Yes it does. According to its chief executive, Martin Rolfe, “several layers of backup” exist, but apparently the dodgy data caused the secondary automatic processing system to be suspended “to ensure that no incorrect safety-related information could be presented to an air traffic controller or impact the rest of the air traffic system”.

Jabor posted:

(if you try to say "i will just anticipate everything" instead of making a choice then you're an idiot, lol. and you're just choosing to handle them in an arbitrary and unpredictable fashion.)

uninterrupted posted:

"listen man there's never a reason to shut the whole thing down if you can't handle an error just ignore it"
-the therac-25 dev team

infernal machines posted:

they forgot to use waypoint_real_escape_string() and this is what happened

uninterrupted posted:

this is why business logic is an ongoing problem.

say you've got a pacemaker. pacemaker needs to deliver shocks based on rules passed to it by a config. that config is checked against, whatever, an ongoing EKG and drops shocks accordingly.
what's a good failure state? it stops running? it drops a shock every x minutes? can you even have an alarm blare on a pacemaker? do you get an email that your heart is dying?

ideal world, the pacemaker has some rules at the config change, where it rejects rules like "shock whenever heart rate is above 0" and keeps the old config. but also it should keep a log of old readings, and fail the same way if the new rules would make it shock a heart 1000% more than previous in an hour.
ALSO it should have some failsafe mechanism, where if it has a default mode it can fail to where it's delivering the minimal shocks needed to keep someone alive when some boundary has been crossed in BP/HR/whatever.
it's not just a matter of "fail open or fail closed", it's a matter of "where can we afford to fail" and "how do we isolate where we can fail with minimal repercussions and beat the absolute poo poo out of the data we will be processing" and "how do we know we are in the critical flow where failing means a corpse" and "how we handle being at a critical point where there's a non-zero chance a bug is murdering this patient".

im sure someone who's worked with embedded medical devices would say this is woefully incomplete, but the point is failure stakes are high here. and they're very different from whether or not your next tinder match had the same id as the previous one.

actual edit:

and the reason this is such a motherfucker is tools can't find this out of the box. insecure dependencies? Toss ECR and dependabot at your poo poo, they'll find all of it. insecure cryptography? most SAST will scream if you add "skip ssl check" options. most well used lib that touch sql will have basic sqli controls, along with sast behind it. business logic is the one thing where devsecopsproduct need to actually talk about poo poo that can go wrong and put up hand-crafted guardrails.

uninterrupted posted:

can you even have an alarm blare on a pacemaker?

ymgve posted:

absolutely

ymgve posted:

absolutely, that is a standard feature on every modern pacemaker

(and really annoying when you get woken up with a funny alarm clock sound every morning that you can't locate until you realize it's coming from your chest because battery is now at like 20%)

also to expand on your other things: there are two different things that can go in your chest, an ICD which is a device that shocks your heart back to sanity, and a pacemaker that gives small jolts every second. there are also devices can do both.

I assume the failure mode for the pacemaker side is the same that when it's (un)intentionally "turned off" by a strong magnet - keep a regular 60 bpm going and ignore all sensor inputs and custom programming. the failure mode for the ICD side is "don't loving shock if the sensor input is in any way vague", the heart has to have abnormal rhythms for several seconds before a shock is even considered

also the devices logs everything that's going on, so any incident can be examined later on

Shame Boy posted:

tbf i feel like provably handling every possible input sanely when the inputs are as well-defined as they are in this case isn't actually out of the question, especially with the timescales and budgets allotted to safety-critical systems like ATC

uninterrupted posted:

"listen man there's never a reason to shut the whole thing down if you can't handle an error just ignore it"
-the therac-25 dev team

Trabisnikof posted:

the company that made the software thinks they handled the error correctly:

Shame Boy posted:

idk this sounds like there's a lot more going on here than anyone's saying and i hope the AAIB or whoever does an actual formal report cuz it sounds like one of those "small bug in a small part of a large, interconnected, complex system causes a cascading failure" situations and those are always fascinating to read about

Oneiros posted:

nah, if your air traffic control system's response to someone submitting a "malformed" flight plan is to completely shut down an entire loving country's air travel for a day

Subjunctive posted:

MSFT figured out how their key got leaked, I guess.

https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/

quote:

“Your cock is mine now,” the hacker told one of the victims, according to a researcher who discovered the hacking campaign at the time.

Mr. Nice! posted:

question for y'all - to preface: i'm a moron. i don't think secureboot is currently enabled on my system. are malware rootkits really that big of an issue for a home pc?

e: to clarify - i’m asking about uefi vs csm boot. my mobo is currently set to csm and i’m wondering if it’s really necessary to switch.

post hole digger posted:

Not my cock!

...is what the uhh victim would say

flakeloaf posted:

short answer probably not

"compatibility support module" lets your modern board, which would prefer to use uefi, run a not-modern operating systems that cannot because it was written before uefi was invented

i shouldn't think you'd need to choose "csm or uefi", since the option is usually "uefi or uefi but try csm if that doesn't work"

Winkle-Daddy posted:

lol, lmao even
https://twitter.com/__silent_/status/1698345924840296801

Subjunctive posted:

MSFT figured out how their key got leaked, I guess.

https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/

Antigravitas posted:

rjmccall posted:

i wonder how they fixed the race condition allowing the key data to be present in a crash dump. in-process crash handler to zero out sensitive buffers?

rjmccall posted:

i wonder how they fixed the race condition allowing the key data to be present in a crash dump. in-process crash handler to zero out sensitive buffers?

NoneMoreNegative posted:

Help, my sec has been truly hosed

https://techcrunch.com/2023/09/02/smart-chastity-cage-emails-passwords-location/

pseudorandom name posted:

you mmap() a page to contain the key material and then pass MADV_DONTDUMP to madvise()

Last Chance posted:

..razor…

pseudorandom name posted:

you mmap() a page to contain the key material and then pass MADV_DONTDUMP to madvise()