Hacker News Reader

Comment by blowski | Hacker News Reader

> Dear software engineers, please do not commit a crime

Yes, developers shouldn't knowingly write code to commit crime, but developers don't tend to receive instructions that directly. Unsurprisingly, the company doesn't mention to every employee that they are knowingly breaking the law.

Instead, developers receive a request to build a feature, and it typically won't be at all obvious that the intended use of that feature is to commit a crime. There might even be a legitimate use of the feature, and then someone finds it can be abused to commit a crime.

View on HN

Sometimes it may not be obvious but the feature still might seem super suspicious. For example, suppose that the malware discussed in this article was broken down into two sub-features assigned to different people: geofencing detection, and bricking the train. The person writing the "bricking the train" part should have realized that there is practically no legitimate reason for that code to be written, and if they ask their manager for a reason and are told "don't worry about why, just write the code", they should report this suspicious activity to law enforcement. There are many reasons that law enforcement would want to know, including that the engineer's manager might not even be acting in the company's own interests but might have taken a bribe from a hostile foreign power.

> The person writing the "bricking the train" part should have realized that there is practically no legitimate reason for that code to be written

Hey Janusz, can you build a safety feature that prevents the train from operating under certain conditions. We don’t know all the conditions yet, so leave it flexible.

Even so, wouldn't someone still have to write either an if-then statement, or a database entry, to connect the geofencing capability to the bricking capability? Even if that was only a single line of code or SQL, it seems like a smoking gun and whoever did it can't possibly plead ignorance. No one who can operate a keyboard is that dumb.

OK, let's try how it goes:

Hey Czesław, I cannot leave it flexible, because it's a train that can run over 100km/h with 500 passengers inside, so I need to know the details to perform the required safety analysis. All in all, my name will be in the commit log if someone runs... git blame.

Here's a fix for the git blame part:

GIT_AUTHOR_NAME=Czeslaw GIT_AUTHOR_EMAIL=czeslaw@januszex.com git commit

(obviously, just kidding)

For some reason I'm afraid to check if that website exists :)

Yes, a real website. I actually bothered to check.

I think I owe you an explanation, as I was referring to the fact that in Poland "Januszex" is a meme.

Back in the 90s, when market economy started here, many many businesses' names had the "-ex" suffix, as apparently it sounded western.

And Janusz is a popular first name, which became a meme for a specific type of a businessman, I suspect that because years ago when the meme started, many of those businessman actually had that name (i.e. it was very popular in that generation).

Now, when you open januszex.com, what's there is a meme of "Janusz Alfa" [1] (I think it should be self-explicable), and a related long-nosed monkey meme (I guess they could be thought of as "Janusz Beta" ot sth like that).

EDIT: [1] The real person from the photo is a Polish politician. I couldn't find if he somehow "triggered" the whole meme situation, so I guess it was just a coincidence--someone stumbled upon his photo, used it, and the rest is history.

Reply on news.ycombinator.com