At 20k euros, would it not just be cheaper to hire some software people to jailbreak them?

If companies that did this got jailbroken and blacklisted by the government, pretty much nobody would try this bullshit.

This ("software people to jailbreak them") is exactly the identity of the hackers who have been sued

It takes a lot of resources, all rooted in a lot of uncertainty. Not an option for businesses that need equipment.

> Not an option for businesses that need equipment.

On the flip side, it can often be the only option for businesses that need equipment. The US has a longstanding trend of hacking John Deere tractors to accept third-party servicing since John Deere's first-party offerings are both expensive and often unavailable.

It not only was an option in this case, it was the path taken when all the other options were depleted.

The company was a bit too much in bed with the government to begin with...

That’s pretty much what happened and how this story came about

This isn't a software issue. This is a hackers-found-out-they-were-cheating-and-deactivated-their-train-DRM-and-now-these-hackers-are-getting-sued-issue.

And getting sued by a train manifacturer is typically a asymmetrical battle for a private person. Consider watching the original talk (very entertaining and insightful, probably one of the best hacking related videos I watched in 2024), and if you like them toss them a tenner or so.

Rather than Cheating, don't you mean tortuous interference, followed by vexatious litigation?

When you intentionally design systems with purpose to delay, but overall sabotage, you show malice and you defraud the purchaser (after-the-fact), you also interfere with their business with third-parties, and impose coercive costs that have never been acceptable.

Coercion is generally not accepted by any civilized society that still follow its original founding principles, and coercion and corruption tend to go hand-in-hand.

The firmware would need to be certified. They mentioned that in the q&a couple of minutes ago.

Apparently its a critical component.

I remember they said in the last talk last year that there is a "cheat code" that resets the software locks, but almost every train also had slightly different software to obfuscate that they are sabotaging their competition.

Yes, although i recall it was more lack of build automation meaning not every train had every patch

I couldn't figure out how to donate from their website. Where did you donate to?

The payment information is a bit obfuscated, being only a parenthesized sequence of letters and numbers in the OP.

IBAN: DE41 2001 0020 0599 0902 01

BIC: PBNKDEFFXXX

Purpose: Lokomotive

Payee: CCC eV

I don't suppose they have any other published, easier methods?

I spent almost an hour trying to jump through the fiery, spinning hoops being dangled by my bank website only to finally at the end be given an "It looks like this part of our site isn't working. Please try again later."

Thank you, bank /s

For anyone else wanting to try their hand and weather the gauntlet, I found slightly more detail of their published bank acct info at: https://www.ccc.de/en/membership

and an official, physical address over at: https://www.ccc.de/en/imprint

For Europeans, this is an extremely easy method and the normal way to send money electronically. The information provided is all that's needed.

If you're trying to send from America, it's still the normal way to send a payment to Europe so see how your bank sends international payments.

“Extremely” is a bit extreme for something that takes 100,000 times longer than a Venmo payment. Or, intercontinentally, a stablecoin transfer

It literally doesn't. And why would Europeans use venmo? That type of app arose in the USA specifically, to work around not having a convenient way to send money from one bank account to another - much like bulletproof school backpacks, it solves a uniquely American problem.

As an Australian we have payid to transfer free and instantly between banks instead of needing a 3rd party app but I think he's right that if you are relying on IBAN and needing to do an individual bank transfer then it's not ideal.

It should be as easy as possible to donate, imo it would be better even setting up a basic kofi or buy me a coffee account, or I see the Ukrainians using paypal all the time.

It should be a 3 click payment not a bank transfer requiring copying and pasting IBAN numbers and bank account numbers etc

To poke fun at the Germans at least they are not requesting we fax a copy of the money in :P

> As an Australian we have payid to transfer free and instantly between banks

That... is what SEPA is, but built into the european banking system directly.

> I think he's right that if you are relying on IBAN and needing to do an individual bank transfer then it's not ideal.

It's not ideal that you can do a simple transfer by inputting the recipient's IBAN and an amount and be done with literally no third party involved? What?

> imo it would be better even setting up a basic kofi or buy me a coffee account, or I see the Ukrainians using paypal all the time.

You think it's easier to require setting up a third party account, adding your card to it, getting the card authorised, and doing the payment that way, with fees.

Than putting 20 digits in your own bank's application and pressing "send"?

> It should be a 3 click payment not a bank transfer requiring copying and pasting IBAN numbers and bank account numbers etc

It's a SEPA transfer, it's super common and nothing very complicated. There is no bank account number involved: the BIC is the bank's own identifier, and while it was commonly required 10 years ago it's been optional for a long time, my bank's application doesn't even have a field for that anymore.

There's a standard format for qrcode SEPA called EPC (https://en.wikipedia.org/wiki/EPC_QR_code), however the amount is fixed which is not always desirable e.g.

- qrcode for a 133.70€ donation https://epc-qr.eu/?bname=CCC%20eV&iban=DE41%202001%200020%20...

- qrcode for a 13.30€ donation https://epc-qr.eu/?bname=CCC%20eV&iban=DE41%202001%200020%20...

> You think it's easier to require setting up a third party account, adding your card to it, getting the card authorised, and doing the payment that way, with fees.

> Than putting 20 digits in your own bank's application and pressing "send"?

Posting from U.S. (and admittedly a very U.S.-centric response), but in the case of Venmo/Paypal/buymeacoffee/Patreon/gofundme, yes.

I spent another half-hour trying to go the route of Wise suggested by a sibling comment but got stuck in the KYC hurdles. I already sent them my I.D. several times, but the selfie-verification flow won't complete for me, and I'm drawing the line at choosing not to install their app.

> Posting from U.S.

Yes if you're trying to use SEPA from the US I can see that, no issue there.

But from the perspective of a very euro/german centric CCC[0], SEPA is really not complicated, and almost certainly free (I understand that a few banks still charge for those but most don't, possibly to a limit). So that's likely a blind spot of theirs: SEPA is probably the cheapest and most straightforward method for 95% of their donations or more.

Even more so as this is the central organisation, but the CCC is mostly a network of local clubs[1], so revenue to the national CCC is I assume almost entirely from the clubs shunting some of their income up

[0] if you check their front page, 1/2 to 2/3 the posts are in german, so are several of the pages

[1] https://www.ccc.de/en/regional

You're trying to send money internationally. It sounds like your bank doesn't want you to send money internationally. This is your problem with your bank.

I don't see why you'd need Wise for a one-off payment. Just go to the international transfer page at your bank and enter the details? Do they not have one?

As they indicated at the top, it looks like their bank's international transfer feature (to the extent that it exists) is broken: https://news.ycombinator.com/item?id=42527151

I believe this is par for the course for US banking and why so many alternate payment systems exist. And in all fairness, it does very much remind me of european banking 15-20 years ago, before the spread of smartphones and banks getting on with the program and making SEPA a (and later EPC) a baseline feature, undoubtedly prodded on by member states.

And I can understand having to translate from SEPA to SWIFT and then needing to deal with that to be less than ideal. When I had to send money to a friend outside the EU I had to go through the bank's website (not available at all from the mobile application) and to register & wait for validation of their account as beneficiary (24h delay IIRC).

At the same bank, SEPA transfers is a button on the home screen of the mobile application, and doesn't require any setup, just input the IBAN or scan the EPC and go (and god would I like more businesses to accept SEPA / use EPC instead of requiring inputting my credit card every time or going through third party payment providers)

> You think it's easier to require setting up a third party account, adding your card to it, getting the card authorised, and doing the payment that way, with fees.

- You don't have to setup an account

- You don't have to get the card authorised (I don't know what this means)

- Adding your card numbers in takes me 10 seconds, in the case of Paypal, it's already there so no time

- Fee's are minimal, not even worth wondering about

In terms of donation, entering in the amount to donate and clicking submit is yes, easier than going into my bank's website, bringing up the international transfer, and it's asking me for SMS confirmation that I want to do this, and I can't be bothered going further.

edit: I think maybe we are fighting the wrong battle.

You think IBAN is super easy, and maybe in Europe it is.

I'm not in Europe though and neither is the other chap, so maybe the donations are very easy in Europe but not so much out of it.

I've never done an IBAN payment in my life but I've donated thousands and thousands of dollars to loads of places all over the world without issue for years including Ukraine, this is the first time I've seen a place only accepting an IBAN donation, which feels like a friction that is not there for other places.

You're donating to a European place. For Ukraine they let you send money directly to the US account of the entire country of Ukraine (an account held at JPMorgan Chase by the way!! That's right, having the world's reserve currency allows American private entities to fractional-reserve entire countries) and earmark it a certain way, and the National Bank of Ukraine would figure it out. That's a highly unusual way to do things. If you want to send a payment to a specific person inside Ukraine, normally you would give their Ukrainian account number to your bank and let your bank figure it out, just like you are doing here.

This feels like an "American discovering the outside world for the first time and discovering that American systems aren't very good" moment.

It's just an IBAN. Not "IBAN numbers and bank account numbers".

The most popular way to transfer money between friends in Poland is a BLIK-to-phone-number transfer. Those transfers are done from the banking app. I don’t need to know someone’s account number, I just need their phone number. BLIK transfers are instant, unlike regular bank transfers, which may take up to 1 business day (specifically, they are done via batch processing 3 times in a business day), and they are always free, unlike instant bank transfers (though that depends on your bank/account type).

BLIK payments are just an interface on top of regular bank payments.

They are an interface on top of Express Elixir, not Elixir.

Both are an option for regular transfers.

What I meant is that in BLIK, phone number gets resolved to a bank account number and a regular (express) transfer gets made, which can be seen in your account history.

The problem that I'm guessing GP had is that their bank blocked the wire transfer because it looked fraud-y.

> If you're trying to send from America, it's still the normal way to send a payment to Europe

It’s not; SWIFT is, and that requires additional information not shown there (although some of it is encoded in the IBAN if you know how to decode it).

SWIFT is not a payment system. It’s only a messaging system. It’s generally used to send initiating orders between financial institutions but they then have to be cleared or directly settled through something else.

IBAN isn't a payment system either, but I'm talking about the end user experience: insert account number, insert amount, click send. Sometimes you also need the SWIFT code which specifies the receiving bank.

I have to contradict this, as an American. Don’t attempt to send from your bank as it is likely to be difficult and complicated and involve huge fees. Use Wise instead.

I guess you can use something like https://wise.com to make the IBAN transfer locally, and pay them using a more convenient payment method for you, like ACH, PayPal, Credit Card, etc

This is a registered European association using fee-less European payment standards to fund a lawsuit entirely in Europe involving only European parties.

Do you see the rest of the world complaining when no-one can send free uncomplicated transfers to fund a U.S. non-profit because the U.S.A. prefers to run a draconian consumer banking system?

The shier American arrogance in this comment thread gives me an aneurism. Fix your banking system, ours works.

i am doing little more than lamenting the hurdles placed in front of me that i couldn't figure out how to overcome (albeit with a dash of frustrated snark), after having spent north of three hours of my time today. i am not rich, nor well off by many reasonable measures. i rent a small room in a small town, hardly making ends meet, but i simply wanted to donate a couple bucks toward a cause i believe in, out of principle, as i'm not usually a donating type (see bit about renting a small room and barely making ends meet).

i wanted to leave some breadcrumbs for anyone else in a similar situation (that is, trying to donate from U.S., not the bit about wealth) trying to figure out how to make it work, because i sure expended some effort digging it up.

this specific discussion thread is a call to donate and to write here in solidarity in having done so. i may not have successfully donated cold, hard cash, but i'll dare say my pledge of most of my afternoon trying to move mountains in order to send some scratch their way fits in here. it may have barely registered as a drop in the bucket had i been successful, but i believe this is what the thread is about.

Hey, thank you for trying to donate and sorry it was more difficult than it should be. I think even writing about the effort that you put into it helps. <3

Thank you for your generous donation <3

> This is a registered European association using fee-less European payment standards to fund a lawsuit entirely in Europe involving only European parties

Okay, but surely you can appreciate that making it easier for Europeans and non-Europeans to contribute to this cause would achieve the goal of the donation campaign more efficiently?

My personal opinion is that it would be very much worth it to accept payments via PayPal, Stripe, or other global electronic payment methods[^1]. And show how much money has been received to date.

I would rant about being content with “it works for us, people will donate if they really want to” but I’ve already done that too many times this year.

^1: yes there are some fees associated with this. But it’s also more convenient and probably more people would donate. But for some people the convenience argument does not compute.

Stripe is not free and neither is PayPal. Assume at least 5 to 10℅ gets lost on the way and for smaller transactions it is more. For small non profits sepa is the way to go.

it's 2.9 % and 0.30, not "at least 5-10"

This German association funds a lawsuit entirely in Poland involving only Polish parties. And sadly, we don’t use the Euro, but rather have our own trash currency, so at least a currency conversion will be involved.

I'd love all participants in this thread to provide their countries.

As a Belgian (EU), I love how I can pay them just by sending them money, without all these weird intermediate companies stealing your personal details and sometimes even your money.

To answer some contras:

In my experience, the process takes about 10 seconds before the payment confirmation appears in the destination bank. Outside business hours and for some bank combinations, the actual money might be in a reservation/underway/unspendable state until the next business day starts. You can not cancel the transfer once it's gone, so most businesses don't care about that delay.

Typing the IBAN is a tiny bit annoying. I see QR codes appearing, containing bic+iban+amount+message to autofill. You pay by scanning the QR code and pressing OK.

AFAIK bic+iban+amount+message is all you need to pay from anywhere in the world. The BIC can be derived from the IBAN if you have the right and up to date database, but outside the EU it is smart to know it, just to be sure.

Sometimes, reading HN, I wonder if I should write a loooong blog post about how Belgium does its money transfers(iban) and buys bread (Bancontact). I suspect most of the EU will answer: duh, boring! Meanwhile, the average USAian brain goes poof.

10 seconds in a German bank? You must be joking, it still takes days.

SEPA transfers are generally as easy as it gets - a free direct transfer straight from your bank, avoiding unnecessary intermediaries. You paste the number, confirm and it's done. Sounds like you need to complain to your particular bank for its subpar service.

If you are American the easiest way to send money to a European bank account is Wise. If you’re European you should be able to do it through your bank.

Why not use Bitcoin, ethereum, or monero address to receive funds from the tech saavy viewership?

I was hoping to find something like that.

Those downvotes. The amount of bile on HN against crypto is a mark of shame on this community.

Yeah I don’t get it honestly. This is a tech enthusiast forum isn’t it?

> I highly encourage everyone to watch the previous presentation: https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_tra...

According to the schedule [1], there's a presentation from that team titled "We've not been trained for this: life after the Newag DRM disclosure" that will start at 23:00 local time (in about 30 minutes at the time of this writing) on this livestream [2].

Edit: presentation's over and it was outstanding.

[1] https://events.ccc.de/congress/2024/hub/en/event/we-ve-not-b...

[2] https://streaming.media.ccc.de/38c3/eins/hls

Here's the live recording link for those who missed it and are too impatient to wait for the cleaned-up one: https://streaming.media.ccc.de/38c3/relive/233cb1d4-4833-538...

Thank you! I have to say that my favorite in their latest update is the 60 day counter can be reset after closing the cabin door and hitting the SOS in the toilet. Now I want interview with the engineers sharing these product requirements...

The Luigi-related reference of the talk at 37:03 of the livestream, "Delay, Deflect, Derail" (referring to the response by the Newag train manufacturer representatives, including the president and vice-president of the company, at the parliamentary committee meetings) got a round of applause from the audience.

The "...Derail" portion of the slogan references Newag's handout shown a few seconds earlier in the presentation.

One of the last slides:

    Lessons learned?

        Lawsuits are temporary, glory is forever.

        Go public.

... so a version of the train unlock logic looks at door status and WC emergency button?

You do NOT fuck with the safety system.

Sure, it's not the mission critical safety system and you're only reading it, so what's the harm? Well, one of these days someone doing that is going to typo == into a =, or whatever the PLC version of one-character oopsie is.

Was going to sling an even 100, but yours is funnier so did the same, thanks.

Precedent isn't as big a concern as many might think, most of Europe does not operate under a precedent-based justice system: it doesn't matter what were the previous decisions of courts on similar cases, the law is the only thing that matters.

Can you elaborate? I'm not a lawyer, but my understanding of the value of precedent is to have courts rule on matters in a manner that is consistent with past rulings. Are you suggesting that courts can interpret the law completely differently from how past courts have ruled? Do you feel like that makes court decisions unpredictable?

To be clear, the law changes over time, so newer laws have less precedence, and I expect courts to respect new laws even though no courts have made ruling based on such a law before.

Norway works on a precedent system.

When electric scooters were reclassified as «small electric vehicles» they suddenly came under the same drunk drive laws as motorbikes and cars. So the lower courts ruled a bunch of drunk driving of electric scooters as severely as they would drunk driving of a 2000 kg car that can go 200 km/h. Essentially they just followed the precedence of previous rulings on drunk driving without taking into consideration the intent of the law. People got huge fines and lost their car licenses for several months on the assumption that if they were careless enough to drink and drive an electric scooter they would be just as likely to drink and drive their car.

Eventually a case went all the way to the Supreme Court where they actually thought it through and and decided that there wasn’t any reason to assume that a person would drink and drive a car just because they did so with an electric scooter.

We need to fight for the Right to Repair to be in legislation for ALL products! If we buy a product, we should have full access to all software and have the ability to fix it!