6 ms·

Cash registers in Poland fail due to new year bug (PL)

54 points by Donmario 7y ago

ethbro 7y ago
I would love to hear what bizarre encoding they used that resulted in 2020 being an issue. (I'm assuming these machines aren't all < year old and just break on any new year)
- skymt 7y ago
  2020 was a common pivot year used in the "windowing" workaround to the Y2K bug. 2-digit years < 20 are defined as 20XX, while years >= 20 are defined as 19XX. https://en.wikipedia.org/wiki/Date_windowing https://en.wikipedia.org/wiki/Date_windowing
  - jeewes 7y ago
    Thanks for sharing. Y2K used to be just an interesting story from the past. Never guessed that it would still be biting people 20 years later. Ouch...
- estebank 7y ago
  I would assume that they were made Y2K compliant by pushing the cutoff date back to 2020, so date math are operating on 1920 dates by accident.
foobarian 7y ago
On the topic of dates broken around New Year's, there is this perennial favorite: http://dangoldin.com/2019/01/06/javas-simpledateformat-yyyy-vs-yyyy/ http://dangoldin.com/2019/01/06/javas-simpledateformat-yyyy-...
nippoo 7y ago
I wouldn't be surprised if something alone the lines of `split("20")` or `replace("20", ““)` was the culprit somewhere (to turn it into a 2-digit year). I've seen the most absurd date handling code...
- hn_throwaway_99 7y ago
  Yeah, and I could imagine some developer fixing a Y2K big in the late 90s thinking, "Hmm, this may cause a problem in 2020, good thing I'll be long gone by then."
  - acqq 7y ago
    And that proves that the Y2K problem was real: even in 2020 some companies that had only these printers apparently simply can't do their business until the repair of the printers is made.
jaredwiener 7y ago
Similar issue in NYC with parking meters: https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-meters.html https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-mete...
- throwawayjava 7y ago
  The official explanation from the vendor is that this was an "anti-fraud security setting". Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation? Regardless, a problem that requires a "software fix" from the vendor and manual visitations to each individual machine doesn't sound like a mere "setting"
  - CydeWeys 7y ago
    I assume the meters are network-connected because they take credit cards, but they can't be remotely updated? Seems like an obvious omission.
    - leereeves 7y ago
      Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.
      - Cyph0n 7y ago
        Sure, but there are at least two other options that are essentially as secure, assuming the “remote attack” threat model: 1. Allow customers to download updates and flash over USB. 2. Boot device into a limited mode that allows signed updates. Certificate should be stored in secure memory.
        deleted 7y ago
        [deleted]
        7y ago
acqq 7y ago
Apparently it's a "bug in the software of popular Delio cash printers from Novitus". The product page of the printer mentioned is: https://www.novitus.pl/en/produkty/systemy-fiskalne/delio-prime-e.html https://www.novitus.pl/en/produkty/systemy-fiskalne/delio-pr... It can be seen that the printer already existed in 2009 and then got something ("Polish Promotional Emblem" according to Google Translate) https://www.novitus.pl/sites/default/files/certyfikaty_tp_550.jpg https://www.novitus.pl/sites/default/files/certyfikaty_tp_55... Even if it's only one model, if the companies have only that one model of printers they won't be able to sell anything until the printers are serviced. Effectively, having such a bug in software, even in multiple units of the same model translates to a single point of failure for the company using it.
astura 7y ago
So far I've heard of the following fail due to some sort of 2020 bug: Parking meters: https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-meters.html https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-mete... Video games: https://www.dsogaming.com/news/star-wars-jedi-fallen-order-wwe-2k20-and-other-games-are-not-launching-due-to-a-denuvo-2020-bug/ https://www.dsogaming.com/news/star-wars-jedi-fallen-order-w... Now cash registers. Anything else?
- Forge36 7y ago
  Maybe we'll hear about more on Monday. I wonder if there will be a central site with stories like these
- gglnx 7y ago
  Trains in Hamburg: https://www.ndr.de/nachrichten/hamburg/Software-Fehler-legt-U-Bahnen-lahm,hochbahn578.html https://www.ndr.de/nachrichten/hamburg/Software-Fehler-legt-...
- rasz 7y ago
  article mentions another game, WWE2K20

54 points by Donmario 7y ago

I would love to hear what bizarre encoding they used that resulted in 2020 being an issue. (I'm assuming these machines aren't all < year old and just break on any new year)

skymt 7y ago
2020 was a common pivot year used in the "windowing" workaround to the Y2K bug. 2-digit years < 20 are defined as 20XX, while years >= 20 are defined as 19XX. https://en.wikipedia.org/wiki/Date_windowing https://en.wikipedia.org/wiki/Date_windowing
- jeewes 7y ago
  Thanks for sharing. Y2K used to be just an interesting story from the past. Never guessed that it would still be biting people 20 years later. Ouch...
estebank 7y ago
I would assume that they were made Y2K compliant by pushing the cutoff date back to 2020, so date math are operating on 1920 dates by accident.

foobarian 7y ago

On the topic of dates broken around New Year's, there is this perennial favorite: http://dangoldin.com/2019/01/06/javas-simpledateformat-yyyy-vs-yyyy/ http://dangoldin.com/2019/01/06/javas-simpledateformat-yyyy-...

nippoo 7y ago

I wouldn't be surprised if something alone the lines of `split("20")` or `replace("20", ““)` was the culprit somewhere (to turn it into a 2-digit year). I've seen the most absurd date handling code...

hn_throwaway_99 7y ago
Yeah, and I could imagine some developer fixing a Y2K big in the late 90s thinking, "Hmm, this may cause a problem in 2020, good thing I'll be long gone by then."
- acqq 7y ago
  And that proves that the Y2K problem was real: even in 2020 some companies that had only these printers apparently simply can't do their business until the repair of the printers is made.

jaredwiener 7y ago

Similar issue in NYC with parking meters: https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-meters.html https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-mete...

throwawayjava 7y ago
The official explanation from the vendor is that this was an "anti-fraud security setting". Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation? Regardless, a problem that requires a "software fix" from the vendor and manual visitations to each individual machine doesn't sound like a mere "setting"
- CydeWeys 7y ago
  I assume the meters are network-connected because they take credit cards, but they can't be remotely updated? Seems like an obvious omission.
  - leereeves 7y ago
    Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.
    - Cyph0n 7y ago
      Sure, but there are at least two other options that are essentially as secure, assuming the “remote attack” threat model: 1. Allow customers to download updates and flash over USB. 2. Boot device into a limited mode that allows signed updates. Certificate should be stored in secure memory.
      - deleted 7y ago
        [deleted]
      - 7y ago

acqq 7y ago

Apparently it's a "bug in the software of popular Delio cash printers from Novitus". The product page of the printer mentioned is: https://www.novitus.pl/en/produkty/systemy-fiskalne/delio-prime-e.html https://www.novitus.pl/en/produkty/systemy-fiskalne/delio-pr... It can be seen that the printer already existed in 2009 and then got something ("Polish Promotional Emblem" according to Google Translate) https://www.novitus.pl/sites/default/files/certyfikaty_tp_550.jpg https://www.novitus.pl/sites/default/files/certyfikaty_tp_55... Even if it's only one model, if the companies have only that one model of printers they won't be able to sell anything until the printers are serviced. Effectively, having such a bug in software, even in multiple units of the same model translates to a single point of failure for the company using it.

astura 7y ago

So far I've heard of the following fail due to some sort of 2020 bug: Parking meters: https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-meters.html https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-mete... Video games: https://www.dsogaming.com/news/star-wars-jedi-fallen-order-wwe-2k20-and-other-games-are-not-launching-due-to-a-denuvo-2020-bug/ https://www.dsogaming.com/news/star-wars-jedi-fallen-order-w... Now cash registers. Anything else?

Forge36 7y ago
Maybe we'll hear about more on Monday. I wonder if there will be a central site with stories like these
gglnx 7y ago
Trains in Hamburg: https://www.ndr.de/nachrichten/hamburg/Software-Fehler-legt-U-Bahnen-lahm,hochbahn578.html https://www.ndr.de/nachrichten/hamburg/Software-Fehler-legt-...
rasz 7y ago
article mentions another game, WWE2K20