Submitted 7 months ago by Docus@lemmy.world to unitedkingdom@feddit.uk
http://www.techmeme.com/240316/p8#a240316p8
cross-posted from: infosec.pub/post/9811127
Two of the UK’s biggest supermarket chains, Tesco and Sainsbury’s, were hit with technical issues on Saturday; Sainsbury’s blames a software update (Bloomberg.com)
Bloomberg.com: Two of the UK’s biggest supermarket chains, Tesco and Sainsbury’s, were hit with technical issues on Saturday; Sainsbury’s blames a software update — Two of the UK’s biggest supermarket chains - Tesco and Sainsbury’s - were hit with technical issues on Saturday.
This because their checkout are just Windows PC with what I guess is some big wigs’ nephew’s VB/C# app running?
It’s not just the wastefulness of the overly large software stack, and the massively overblown hardware requirements that adds, it’s the size of the attack surface. Oh and lack of control of a closed platform.
What a grown up would have done is a tiny Linux thing that ran nothing but what was required and locked down. Made with Buildroot or Yocto. Running on some low power ARM thing.
I’m guess they have got some Windows infection.
It doesn’t sound like you’re aware of PCI DSS
Regulatory burden aside, you don’t do data analysis at scale running “some big wigs’ nephew’s VB/C# app.”
I’ve not worked directly with any of these payment systems, but I can’t believe the only solution is go all 90s style Windows based system. There will be embedded ways that comply to regs.
I can see they are Windows based when there is issues. I’m sure of Tesco and Morrisons but Sainsburys I don’t go to often enough to have see an issue that bring up Windows. I was being flippant, but I don’t hold using Windows to build stuff in high regard. In my experience the software engineers who doing that don’t know anything else.
Yes, the thing that tallies up how much cash should be left in the till, operated by people on minimum wage, has been coded by the CEO’s nephew. Sure.
I’m sure they would do the sensible thing and get a big hot shot Japanese tech company to do it.
What do you do when you need to update all the machines with your setup?
A common way is to have two (or more) system partitions. You update one, charge the boot one and reboot. Typically the system partition is read only use. The bootloader tries the one it is told to try first, if it finds itself back in the bootloader it boots the other. You have a watch dog that resets if not kicked.
Buildroot and Yoctor give you a few update options. Then there is things like: swupdate.org
And it’s not really that hard to role your own.
Oneeightnine@feddit.uk 7 months ago
Partner went into one of the larger stores today (she works there) and it was absolutely pandemonium. Credit to the staff because from what I understand some customers got very, very upset.