I wouldn't be surprised if something alone the lines of `split("20")` or `replace("20", ““)` was the culprit somewhere (to turn it into a 2-digit year). I've seen the most absurd date handling code...
Yeah, and I could imagine some developer fixing a Y2K big in the late 90s thinking, "Hmm, this may cause a problem in 2020, good thing I'll be long gone by then."
And that proves that the Y2K problem was real: even in 2020 some companies that had only these printers apparently simply can't do their business until the repair of the printers is made.
The official explanation from the vendor is that this was an "anti-fraud security setting".
Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation?
Regardless, a problem that requires a "software fix" from the vendor and manual visitations to each individual machine doesn't sound like a mere "setting"
Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.
I don't deal with PCI personally, so $0.02, but we're talking retail or unattended devices here.
I.e. low wage, minimal training, not technically proficient users with unsupervised physical access to the machine
A machine through which a large amount of cash (virtual or otherwise) flows.
The criteria of (a) being updatable by a semi-technical customer & (b) being secure against technically malicious or socially engineered ignorance attacks seem challenging to simultaneously satisfy.
allowing easy update over usb is its own thread model, lessened with only allowing signed updates. Like almost everything, it's likely these parking meters have terrible security design. the parking meter I use commonly is incredibly slow, every button push takes 1/2 a second to update the small lcd ui, I really wonder what it can be doing to be so slow. It's probably using multiple levels of interpolation to run a js program or something.
Even if it's only one model, if the companies have only that one model of printers they won't be able to sell anything until the printers are serviced.
Effectively, having such a bug in software, even in multiple units of the same model translates to a single point of failure for the company using it.
2020 was a common pivot year used in the "windowing" workaround to the Y2K bug. 2-digit years < 20 are defined as 20XX, while years >= 20 are defined as 19XX.
