In any case, either there was no code review, or the reviewers accepted that for one reason or another. Not sure which case is more scary..
It's clear this was intended by the manufacturer of the trains, who directed the writing of the code, it's not like a hacker put this in without their manager knowing, right?
What kind of code review are you thinking of by whom?
[Wait, reading other comments, I'm thinking HN switched the article at the top, and some of these comments were written when the article at the top had much less information? That may explain why these comments are so confusing!]
So I meant a regular code review you would do for anything else.
I can see two scenarios at play:
1. either it's "free for all" and someone (anyone?) can put arbitrary shady stuff in the code
2. or there's a process for adding shady stuff to the codebase (some "stakeholder" creates a ticket, someone creates a PR, and the it's reviewed, etc.)
I'm wondering if you read the same posts at the top, or if maybe HN has switched the link since you read it and commented? Or if you just reached different conclusions!
My conclusion was that it doesn't appear there is any reason to think this was a "rogue" employee. What motivation would they have to do this? The motivation belonged to the train company that made the trains and owned the the software, the company did it on purpose to try and make other repair facilities look bad and make their train repair facilities look like a better value.
I'm surprised that you seem to be considering that, maybe, like a programmer just put this in there without being told to. For fun? Just out of their own individual motivation to secretly help the company's profits?
Considering this isn't a some random webshit SaaS, but a piece of critical national infrastructure, such a rogue programmer would - in my books - be committing treason.
(Keep in mind that functioning rail system is of military importance, and there's a literal war being fought just over our eastern border.)
> Keep in mind that functioning rail system is of military importance
This sounds reasonable to me, and it made me curious how the US law of treason might apply to this scenario. (Obviously the US law is not relevant in Poland, but the American definition of treason is viewed as exceptionally strict, so it's interesting to consider.)
(American) treason has two elements:
I. You owe allegiance to the United States; and
II. You either:
(a) levy war against the United States; or
(b) give "aid and comfort" to the enemies of the United States.
Making the trains stop running at predictable times seems like it could reasonably be read as "giving aid" to enemies of the state, if the information on how the trains work is communicated to them, or if a conflict actually occurs and the trains stop running during the conflict. If the enemy doesn't know about the issue and it never comes up during a conflict, it might be a challenge to argue that the enemy received "aid and comfort".
The other thing to note here is that the programmer would appear to be committing treason whether his boss told him to add the code or not.
My Scenario 1. wasn't about some rogue employee, only about unstructured development process, possibly even with no version control.
So there's this one developer that adds the shady code, asked by a higher-up, but other developers don't even know about it if they don't look into those files. And so no-one has a chance to analyze if it's safe to add the code.
Or maybe there's version control, but anyone can commit to `develop`. And so you see a weird commit from someone else, but that's it.
The only _maybe_ non-criminal but still very shady and unethical way to do it that I can quickly come up with, is if there was a formal process for adding those "hacks" would be to implement it as any other feature, perform a full safety analysis, etc., just as I can imagine it's done for regular stuff.
But then I cannot really imagine how I would answer the question about deliberately messing with train subsystems, in a train that could be running >100km/h, full of passengers...
So now it makes perfect sense to me that you thought it was about a 3rd party review, or about a rogue developer.