5 ms·

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Co

by crocal 2y ago

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a stop in case the GPS is jammed or interfered with. We were not very listened to… until Ukraine. Critical infrastructures should not depend from things that are located in space or on the other side of the planet. These are one of those things were market logic should be anticipated with regulations (we can’t wait for the next Titanic). Another point touched by the article.

killjoywashere 2y ago
Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you. https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://www.wired.com/story/change-healthcare-admits-it-paid-ransomware-hackers/ https://www.wired.com/story/change-healthcare-admits-it-paid... #2 > Does your stuff need computers working 5,000 kilometers away? [implying that's bad] What if you live on the Gulf Coast, exposed to hurricanes? You want compute resources warm and ready far away from that region. After Katrina, the Tulane medical school was able to re-form quickly because the noteservice was running a bulletin board forum on a VM in Romania. Everything else was underwater. #3 > This is the sound-powered phone Have you used a sound-powered phone? I managed damage control in a ship. Sound powered phones barely works. And the coordination system to actually fight that fire requires radios and making overhead announcements that definitely depend on electrical power. #4 > They tried to sort of renew this emergency telephone network When the entire San Diego region lost power during rush hour for 4 hours in 2011, the cell phone system still worked. I was able to email documents to Tokyo from a car despite no traffic lights. #5 > Because if the cable to the US is down Sure, but there are a lot of disasters where the cables are fine. Graceful degradation is all about having widely distributed options. Lots of people have What. Signal is even better for people with more serious responsibilities, IMHO. And, friends, if you think IP networks are vulnerable, get yourself a starlink terminal and a HAM radio license. https://en.wikipedia.org/wiki/SpaceX_Starshield https://en.wikipedia.org/wiki/SpaceX_Starshield
- dralley 2y ago
  TL;DR hybrid-cloud, multi-cloud, or at the very minimum multi-region is a really good idea.
- indymike 2y ago
  > Change Healthcare has lost $872M since it was attacked in February. The question is, what is the cost to secure? I've been in so many meetings where the cost of security is 10-15x the cost of a breach. It's horrifying.
  - stouset 2y ago
    Part of this is that nobody has cared about security since the beginning, for basically anything in tech. It’s an industry-wide issue that permeates every level of the stack. And so yeah, individual companies trying to retrofit security onto a jenga tower of technology is going to have to spend a ridiculous amount of resources to have any kind of impact. I don’t know what the answer is, but I too believe things won’t change until the day someone figures out how to push a “kill all humans” OTA update to all the self-driving cars on some random Tuesday afternoon.
    - ryandrake 2y ago
      > I don’t know what the answer is, but I too believe things won’t change until the day someone figures out how to push a “kill all humans” OTA update to all the self-driving cars on some random Tuesday afternoon. Even in that case I’m pessimistic that any action will happen. People will go on TV and say grave things, hearings will be held. Fingers will be pointed. Task Forces will kick off. Reports will be written. Bureaucrats will have stern conversations with bureaucrats. Politicians will say: we must this and we shall that. IT companies will sell their “solutions”. But no actual action will happen. It will be all talk and commerce but no actual hands unplugging and plugging in cables. We have completely lost the societal will to actually do anything besides generate words and reports.
      - eastbound 2y ago
adrianN 2y ago
Trains use a variety of sensors for odometry. Losing one of them is not catastrophic.
- crocal 2y ago
  Except the stated goal here is to replace these sensors with GPS.
  - adrianN 2y ago
    It has been a couple of years since I worked in the area, but back then that wasn’t the plan and would’ve been deemed impossible both for safety and for accuracy reasons. Do you maybe have a source?
    - crocal 2y ago
      Sure thing: http://clugproject.eu/en http://clugproject.eu/en (Edit: they even have a 2.0, see my sibbling comment)
      - adrianN 2y ago
        From https://clugproject.eu/en/presentation https://clugproject.eu/en/presentation > A failsafe on-board multi-sensors localisation unit consisting of a navigation core (IMU, tachometer, etc.) brought in reference using GNSS, track map and a minimal number of reference points From https://www.clug2.eu/objectives/ https://www.clug2.eu/objectives/ > to complement the existing European Train Control System (ETCS) odometry system by using GNSS to enable absolute safe train positioning whilst also transforming today’s train localisation by demonstrating a GNSS based multi-sensor fusion architecture. Okay, so as I expected they want to add GNSS as an additional sensor input. That is useful because without it train odometry is purely relative and the train doesn't know where it is until is reads the first balise. The plan doesn't seem to be to remove all other sensors. Denial of GNSS would then mean that start-of-mission is about as tedious as it is today and odometry accuracy might be reduced. Depending on the number of balises on the track that lowers the capacity of the track a little but is far from catastrophic.
Animats 2y ago
Railroads... Railroads can now outsource train control. Wabtec's "Wabtec Cloud Positive Train Control Communication Solution" - "A complete turnkey hosted office solution for I-ETMS-based Positive Train Control (PTC) systems"[1] (Wabtec used to be Westinghouse Air Brake.) Wabtec has had break-ins, but claims they only involved employee info, not control systems.[2] [1] https://www.wabteccorp.com/digital-intelligence/signaling-and-train-control/communications/wabtec-cloud-positive-train-control-communication-solution https://www.wabteccorp.com/digital-intelligence/signaling-an... [2] https://industrialcyber.co/ransomware/wabtec-suffers-data-breach-and-stolen-data-as-lockbit-hackers-likely-behind-attack/ https://industrialcyber.co/ransomware/wabtec-suffers-data-br...
- 616c 2y ago
  This may be the first time I had that "well, that's enough Internet today ..." reactions on HN from a cybersecurity/cyber-physical protection perspective, and not something gross on Reddit. So, my hat off to you, Internet stranger.
- tru3_power 2y ago
  Lol is this basically a train SaaS solution? Whats wild to me is that SaaS products aren’t actually required to issue CVEs since customers aren’t the ones responsible for patching.
marcosdumay 2y ago
Railroads should absolutely use GPS. They also should supplement it with local transmitters, like aviation does. They should have lots and lots of local transmitters.
- numpad0 2y ago
  Rails has clever systems for locating trains by detecting circuit shorted by trains' wheels, no need to replace that with GPS. Besides railroads passes valleys and tunnels, GPS won't work anyway. The absolute last resort for trains is semaphores and mutexes based on physical tokens. Those concepts came from there, and were still used sometimes to this day. Doesn't sound high tech, but it works.

by crocal 2y ago

killjoywashere 2y ago

Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you. https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://www.wired.com/story/change-healthcare-admits-it-paid-ransomware-hackers/ https://www.wired.com/story/change-healthcare-admits-it-paid... #2 > Does your stuff need computers working 5,000 kilometers away? [implying that's bad] What if you live on the Gulf Coast, exposed to hurricanes? You want compute resources warm and ready far away from that region. After Katrina, the Tulane medical school was able to re-form quickly because the noteservice was running a bulletin board forum on a VM in Romania. Everything else was underwater. #3 > This is the sound-powered phone Have you used a sound-powered phone? I managed damage control in a ship. Sound powered phones barely works. And the coordination system to actually fight that fire requires radios and making overhead announcements that definitely depend on electrical power. #4 > They tried to sort of renew this emergency telephone network When the entire San Diego region lost power during rush hour for 4 hours in 2011, the cell phone system still worked. I was able to email documents to Tokyo from a car despite no traffic lights. #5 > Because if the cable to the US is down Sure, but there are a lot of disasters where the cables are fine. Graceful degradation is all about having widely distributed options. Lots of people have What. Signal is even better for people with more serious responsibilities, IMHO. And, friends, if you think IP networks are vulnerable, get yourself a starlink terminal and a HAM radio license. https://en.wikipedia.org/wiki/SpaceX_Starshield https://en.wikipedia.org/wiki/SpaceX_Starshield

dralley 2y ago
TL;DR hybrid-cloud, multi-cloud, or at the very minimum multi-region is a really good idea.
indymike 2y ago
> Change Healthcare has lost $872M since it was attacked in February. The question is, what is the cost to secure? I've been in so many meetings where the cost of security is 10-15x the cost of a breach. It's horrifying.
- stouset 2y ago
  Part of this is that nobody has cared about security since the beginning, for basically anything in tech. It’s an industry-wide issue that permeates every level of the stack. And so yeah, individual companies trying to retrofit security onto a jenga tower of technology is going to have to spend a ridiculous amount of resources to have any kind of impact. I don’t know what the answer is, but I too believe things won’t change until the day someone figures out how to push a “kill all humans” OTA update to all the self-driving cars on some random Tuesday afternoon.
  - ryandrake 2y ago
    > I don’t know what the answer is, but I too believe things won’t change until the day someone figures out how to push a “kill all humans” OTA update to all the self-driving cars on some random Tuesday afternoon. Even in that case I’m pessimistic that any action will happen. People will go on TV and say grave things, hearings will be held. Fingers will be pointed. Task Forces will kick off. Reports will be written. Bureaucrats will have stern conversations with bureaucrats. Politicians will say: we must this and we shall that. IT companies will sell their “solutions”. But no actual action will happen. It will be all talk and commerce but no actual hands unplugging and plugging in cables. We have completely lost the societal will to actually do anything besides generate words and reports.
    - eastbound 2y ago

adrianN 2y ago

Trains use a variety of sensors for odometry. Losing one of them is not catastrophic.

crocal 2y ago
Except the stated goal here is to replace these sensors with GPS.
- adrianN 2y ago
  It has been a couple of years since I worked in the area, but back then that wasn’t the plan and would’ve been deemed impossible both for safety and for accuracy reasons. Do you maybe have a source?
  - crocal 2y ago
    Sure thing: http://clugproject.eu/en http://clugproject.eu/en (Edit: they even have a 2.0, see my sibbling comment)
    - adrianN 2y ago
      From https://clugproject.eu/en/presentation https://clugproject.eu/en/presentation > A failsafe on-board multi-sensors localisation unit consisting of a navigation core (IMU, tachometer, etc.) brought in reference using GNSS, track map and a minimal number of reference points From https://www.clug2.eu/objectives/ https://www.clug2.eu/objectives/ > to complement the existing European Train Control System (ETCS) odometry system by using GNSS to enable absolute safe train positioning whilst also transforming today’s train localisation by demonstrating a GNSS based multi-sensor fusion architecture. Okay, so as I expected they want to add GNSS as an additional sensor input. That is useful because without it train odometry is purely relative and the train doesn't know where it is until is reads the first balise. The plan doesn't seem to be to remove all other sensors. Denial of GNSS would then mean that start-of-mission is about as tedious as it is today and odometry accuracy might be reduced. Depending on the number of balises on the track that lowers the capacity of the track a little but is far from catastrophic.

Animats 2y ago

Railroads... Railroads can now outsource train control. Wabtec's "Wabtec Cloud Positive Train Control Communication Solution" - "A complete turnkey hosted office solution for I-ETMS-based Positive Train Control (PTC) systems"[1] (Wabtec used to be Westinghouse Air Brake.) Wabtec has had break-ins, but claims they only involved employee info, not control systems.[2] [1] https://www.wabteccorp.com/digital-intelligence/signaling-and-train-control/communications/wabtec-cloud-positive-train-control-communication-solution https://www.wabteccorp.com/digital-intelligence/signaling-an... [2] https://industrialcyber.co/ransomware/wabtec-suffers-data-breach-and-stolen-data-as-lockbit-hackers-likely-behind-attack/ https://industrialcyber.co/ransomware/wabtec-suffers-data-br...

616c 2y ago
This may be the first time I had that "well, that's enough Internet today ..." reactions on HN from a cybersecurity/cyber-physical protection perspective, and not something gross on Reddit. So, my hat off to you, Internet stranger.
tru3_power 2y ago
Lol is this basically a train SaaS solution? Whats wild to me is that SaaS products aren’t actually required to issue CVEs since customers aren’t the ones responsible for patching.

marcosdumay 2y ago

Railroads should absolutely use GPS. They also should supplement it with local transmitters, like aviation does. They should have lots and lots of local transmitters.

numpad0 2y ago
Rails has clever systems for locating trains by detecting circuit shorted by trains' wheels, no need to replace that with GPS. Besides railroads passes valleys and tunnels, GPS won't work anyway. The absolute last resort for trains is semaphores and mutexes based on physical tokens. Those concepts came from there, and were still used sometimes to this day. Doesn't sound high tech, but it works.