If they logged in, took a screenshot, and published that (even if lots of things are blurred), there's probably more attack surface for some three-letter-agency to bust down their doors and disappear them...
1) no passengers on board - you can't be accussed of endangering passengers
2) long past - you can't be accused of anything that happened recently
3) the plan literally no longer exists - you can't be accussed of damaging a plane
I guess they mean you should sell the vulnerability to highest bidder instead of reporting? Weird choice.
Some sort of acknowledgement of the report certainly would have been good here, but at least they did disable the account. I presume the reported vulnerability no longer exists.
Probably added test2:test2.
Not worked in aerospace only enterprise but sometimes I worry I'm too cynical and then I remember the things I've seen and think I'm not cynical enough.
That said nothing I work on is aerospace level critical, could cost a lot of money if it's out but no one would ever have died.
State media goons with Nazi-tourette celebrating Kirk's murder and calling for murdering dissenters or arming the terrorist Lina Engel, no worries, the regime got them covered.
Call a minister of the regime a moron or quote them and you better have your bath robe ready when their henchmen break in the next morning.
Just google Norbert Bolz, Trusted Flaggers™, Mario Sixtus, Böhmermann, Schwachkopf Habeck and Hammerbande.
constantcrying•12h ago
Exposing software like that to the internet is of course a completely insane step.
Jtsummers•11h ago
This is a groundside problem, and perhaps it is insane to have it exposed to the open internet but it's not on the aircraft. It needs to be exposed to some network because the intent is that fleet controllers (airlines, or in this case Navy) use it to reach out to their aircraft wherever they may be.
That said, it absolutely fits the quality I've come to expect from IT systems developed by aerospace and defense companies.
2OEH8eoCRo0•11h ago
zppln•10h ago
deepsun•11h ago
sumnole•10h ago
Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical stacks like ADA/Spark?
Jtsummers•10h ago
This is not actually as common as many people seem to believe. The mandate died almost two decades ago. DOD aircraft fly on Fortran, JOVIAL, C, and C++ more than Ada. And DOD IT systems are a clusterfuck.
> It's one of the few sectors that still plan software upfront waterfall style
That's not the good thing you seem to think it is.
Also, why do you call it ADA? It's not an acronym. Amusingly, SPARK is, or was, and you write it as "Spark". It originally stood for "SPADE Ada Kernel" and the language continues to be stylized as SPARK.
sumnole•8h ago
Jtsummers•6h ago
If you can do this, then I might believe you about Waterfall being the best approach out there.
Right now your counter example is "teams with little experience" which is not much of an argument. Teams with little experience fail all the time, because they are inexperienced. Give them a $100 million Waterfall project to plan and execute over 3+ years and their failure would be even more spectacular.
constantcrying•10h ago
I wrote DO-178 Software, literally every single project I ever worked on has trivial login credentials.
>DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical stacks like ADA/Spark?
None of this matters or contradicts what I said. You will be able to get into it with user:root password:root or some variation. In all likelihood you will even find a requirement for this, which is of course verified.
If you apply the methodology practiced to a web application, the OP is exactly what you will get.
ghc•9h ago
Jtsummers•8h ago
ghc•4h ago
Edit: Never mind! I just saw their other comment and it seems more like they are blissfully ignorant of the reality on the ground.
downrightmike•9h ago