https://signalandsilence.substack.com/p/i-think-someone-hack...

Could this be the same group? Or someone inspired by reading that article? Or just entirely unrelated?

It's not like "boom, got u" and then they walk off after destroying some food.

They are doing tons of attacks against all types or physical and digital infra all over Europe.

This is just one of hundreds, thousands happening.

https://en.wikipedia.org/wiki/Bronze_Soldier_of_Tallinn

https://en.wikipedia.org/wiki/Bronze_Night

I mean, how dare Estonia not be ecstatic about the Soviet soldiers who kept them thoroughly liberated until 1991.

Recall Trump's regime refused at one point to sell weapons to Ukraine.

Continually undermining the leader of a country who's defence prevents Putin's expansion and further war in Europe ... it's not 'discord' it's absolute treachery.

It was very clearly communicated before the war with Ukraine that the trigger was the threat of Nato expansion into Ukraine. So, don't be daft, Europe and many US administrations wanted war with Russia, they constantly poked the bear with Nato and Maidan and Nordstream since the 90's, and they finally got one.

The truth behind this freezer attack could be Europe's crossing into Russian territory and droning their petroleum infrastructure using Ukraine as the launchpad, and this is Russia is retaliating by hitting some soft targets.

OR, the truth could be America/its factions are drone attacking Russian diesel and independently China is attacking Europe to create chaos. Maybe China and America are secretly working together to get Russia and Europe into a war.

Or the truth could be some qanon teenager in his basement shutting down French coolers for lulz and that has nothing to do with Ukraine, diesel, or anything else.

Curious you would assume it's Russia Russia Russia when no one knows anything and good luck finding out.

I read the comment as being a satirical way of voicing critique.

"Comfy is easy for kids and adults to pick up. Modeled loosely after the classic BASIC computer language and designed for early readers, Comfy's linguistic rules are easy to teach and to type-in on desktop, tablet, and mobile." -David Woldrich

"Our public education is so pozzed in Dem/Blue states, though; that has nothing to do with ethnic makeup in the students. Bloated budgets fueling insidious DEI agendas with openly consumer-hostile teachers unions. Maybe in sane states it's better." -David Woldrich

"I am so pleased to see such low snarkiness levels overall in a discussion regarding Ayn Rand. There is a lot not to like about the harshness of Randian principles, but I find the ideal she paints of the human condition compelling." -David Woldrich

"White supremacy is a left wing media fiction; it lives only in wojack memes as far as I can tell." -David Woldrich

"You sound vaccinated." -David Woldrich

"Was there projection? Some, but talking past the sale is a persuasion technique and I wasn't in the mood to argue." -David Woldrich [showdead=true] https://news.ycombinator.com/item?id=46098207

You know what you're doing, and you're being intentionally mendacious. Your telling admission about your own projecting and using a "persuasion technique" after jimmaswell correctly called you on it brings Sartre's description of bad-faith argument to mind:

"Never believe that anti-Semites are completely unaware of the absurdity of their replies. They know that their remarks are frivolous, open to challenge." -Jean-Paul Sartre

David Woldrich: Please stop mentally mutilating children and yourself beyond hope of regeneration.

You condemned the explicit victim-blaming analogy without admitting that your own "poked the bear" argument follows the exact same logic.

And like your bigoted, red-pilled, white-supremacy-denying, fascist-apologetic politics, your "educational" video for children is so fucking creepy and pedagogically incoherent that it's an unwitting showcase for precisely what Dijkstra meant by "mentally mutilated beyond hope of regeneration".

https://www.youtube.com/live/Yrcapy2e8Fs

You're actually recommending teaching children to use one- or two-letter variable names, yet you blame school funding, teachers, and "insidious DEI agendas" for educational failure:

"we like to keep our variables very short like one or two letters in the name" -David Woldrich

"so we want to keep them short so keep them to one or two characters long if you can help it" -David Woldrich

Even if all the Russian bot servers are currently offline and on fire, we still have you to carry Putin's water, defend him by mindlessly parroting Trump's "Russia Russia Russia", victim-blame Ukraine for being invaded, and mentally mutilate children beyond hope of regeneration.

An innocent victim does not deserve to be attacked. The people of Ukraine are innocent victims, in my opinion.

ALSO, in my opinion, the leadership of Ukraine are puppets and corrupt. The world leaders who keep them there are responsible for fomenting disastrous war and keeping it going rather than suing for peace before hostilities began.

America is particularly dupicitous on Ukraine, funding and extending the war for years to the tune of hundreds of billions with kickbacks galore, providing intelligence and satellite support for counter attacks on Russian oil while now simultaneously making Russian diesel deals. Absolute clown world.

I don't wash my hands of any of this and I never want war, but my opinion doesn't carry far. I acknowledge war happens without my consent, and I am allowed to speculate why it happens even while propaganda runs thick from all corners.

So, perhaps where we may disagree the most is whether the west was/is making provocative and consequential moves using Ukraine as a sacrificial pawn or not.

I have no idea what or whether you think, but I am curious if you believe I am in error.

I worry about the elitist BASIC hate too, but many of us cut our teeth on BASIC and turned out fine, so it is my hope the great unwashed masses will naively appreciate my efforts someday and likewise benefit. I like to think the Comfy language is rather more like a veneer over JavaScript with sane defaults and so is more powerful than BASIC.

Microsoft had personas back in the day for the different types of developers in the world. The .Net guys were 'Elvis' and the visual basic guys were something unflattering like 'Wilbur'. It's fine, I don't mind being called a Wilbur.

Anyhow, thanks for caring about me as a person, it means a lot to be recognized. Have a great day!

John No-Name McCain apparently did get a street named after him in Ukraine in 2019. The world is so broken. ;(

There was a vote to get Lindsey a street named after him after he was unalived, but the votes fell short.

I don't know why you'd think a country can only be an invader if it invaded Ukraine. There are plenty of targets to choose from.

Okay, let me explain why this is wrong. This will be an imperfect example, but hopefully it gets the point across.

When you shut down the refrigerators and freezers of something like 700 stores, people notice. They go to get food that day, and there is nothing fresh. Nothing. Go to the next store, still no fresh or frozen food.

Was there a natural disaster? No. Was there an attack? Yes, but the attacker is unknown. But who was in charge? Who was supposed to prevent this? They remember.

It's getting colder outside in the North, fall is here. This is traditionally a time where a lot of people were, for thousands and thousands of years, stocking up food and doing final harvests to survive the long winter.

If suddenly hundreds of stores don't have fresh food across the country, that is a large impact. Not even just what happened, but what could happen. If it happened to these hundreds of stores, what about thousands? What about other types of stores? What about other types of attacks? And your brain starts thinking about the other possible type of things that might be able to be fucked with remotely. The fear sets in. People that are afraid make less rational decisions. Maybe they also decide the current people in political power aren't fit for task, because they can't keep them safe. Maybe this didn't happen under the other guys.

Meanwhile, millions of dollars of food was just wasted. Not only that, but it also has to be disposed of. Because it's such a large amount of food, it will take additional trips from the trash disposal service. They may even bring people in on overtime across the country. The people at the stores themselves will probably work extra hours, quickly trying to rotate the bad food out and hopefully (now if not soon) get the new food in. In addition, the food logistics network has to get additional shipments of food it wasn't expecting to transport to hundreds of stores. That's a lot of extra time on the road, a lot of extra wear on equipment. It also stresses the food supply and production itself.

So I don't know what "doesn't have any real impact" looks like to you, but to summarize, this is going to do millions of dollars of economic and political damage, and contributes to social upheaval. It probably cost next to nothing to actually attack.

(This is also right out of Russia's hybrid war playbook against Europe. Russia just sank a Bulgarian tanker btw: https://www.bbc.com/news/articles/cmn06w5x9g25o )

millions of dollars of economic damage sure, it doesn't contribute to social upheaval. It's a one time pain in the ass, this seems pretty hysterical tbh

Remember lots of Russian tactics is pretending they can do a lot of bad stuff if people don’t do what they want. “Stop helping Ukraine or we will nuke you”.

Also USA has been pinning every single cyber attack on Russia/Iran/NK/China for several years, and I am personally very doubtful that western countries do not run ransomwares. In any case the result is that everyone thinks those countries do have the capability to do this.

Possibly, but I bet most of their nuclear stockpile hasn't been kept maintained and it wouldn't surprise me if parts of it had been stolen to be sold. This is why Putin threatens a nuclear attack, but doesn't do it as there's a good chance it would show how many duds they have (also setting off nukes would likely force a response from other countries).

No, the reason is that he's not completely insane and doesn't want to cause a nuclear war as you seem to presume.

Remember that USA had the "strike first" doctrine that the eastern block never had.

Russia had (has? I don't think it works) an interesting counter system: https://en.wikipedia.org/wiki/Dead_Hand (Dead Hand, aka Perimeter)

Which their leadership never fails to mention when we (the EU) goes past some imaginary red line.

There are no red lines. There is only drone war and making Russia regret that they are attacking our allies.

Should we (the EU?) have sent weapons to the Venezuelan opposition in 1999? When exactly did Chávez become a dictator? He was clearly not a democrat (coup attempt in 1992) but I think it would have been premature and unlikely to have had good outcomes if we had done it in 1999 or 2000 (he was democratically elected both times). He was obviously a dictator when he died in 2013 but a large part of the Venezuelan population still hadn't cottoned on to it or they thought it was great.

Iran was similar. The crazies were quite popular in 1979.

https://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair

France has presidential elections coming up next year, and growing civil unrest is happening. Cyber attacks are routine, and several have been officially attributed to Russia.

Anything that can trigger fear can elicit irrational reactions. That has been a known propaganda tool since forever.

> Every society is three meals away from revolution.

So I wouldn't entirely handwave it away.

In this case the question is, if US Army freezers were hacked earlier, why did nobody brief other operators of cooling equipment. Its a failure at the top! Everyone is getting flustered and knives are out.

But maybe they could not fix the underlying software or whatever and were not ready to share details without opening themselves up to more attacks. Also there are a lot of attacks happening all the time, which ones do you share?

If the psychological pressure at the top increases, more mistakes will be made. Sometimes mistakes can be subtle over or under reactions, sometimes the mistake is not to do anything. It is real effort to evaluate an appropriate response. For example, the military could reach out to commercial operators quicker, but then they have to handle all the comms, questions, and they also potentially leak more attack vectors. The commercials also start having this overhead of having to read emails from the military and internally those orgs have to deal with that overhead in comms to evaluate the seriousness.

This is a problem, because very few orgs have spare capacity for this stuff and so they have a choice. They can react to the military comms and risk mistakes somewhere else due to comms / management bottlenecks, or vice versa. There are only bad choices. And every time this happens, another choice has to be made.

Lots of these will be low-level attacks with manageable impact, which lowers the alertness over time, until that moment when something serious happens. If at point everyone is exhausted a real costly mistake will happen. Its the long game.

In this case, I am sure a consideration was that the attack was already used against high-profile cases and it makes sense to just use the attack vector more broadly before it gets closed.

Wait, it has its own cellular modem? Nevermind, then.

I agree that they had a firmware update, but unless they had the operational capacity to update the checks notes freezers of all their customers, that is not a fix. The theoretical and technological aspects of solving a problem are often the easy parts.

It's like if NASA would claim to have a fix for the Opportunity rover on mars to get it operational again. All they need to do is to replace the batteries. Well, that is not a fix if there is no way to actually replace the batteries in practice.

I don't see why the existence of a firmware update would remove the culpability of negligence from the hardware manufacturer.

“Also there are a lot of attacks happening all the time, which ones do you share?”

Completely untrue.

People going to the store to get food that day remember.

In Poland there were arson attacks on malls - https://warszawa.tvp.pl/95886809/pozar-marywilskiej-44-ruszy...

They also attempted to derail passenger trains - https://www.rp.pl/kraj/art43362151-rzecz-w-tym-sabotaz-na-to...

They used drones to block airports across Europe (I ended with overnight stay after they attacked Eindhoven) - this one has no direct proof, but it was obviously Russia.

Russia used list of hospitals in Syria. As bombing target. https://en.wikipedia.org/wiki/Russian%E2%80%93Syrian_hospita... https://www.nytimes.com/2019/10/13/world/middleeast/russia-b...

When Armenia complained about poor performance of Russian weapons video of one of attacks was released as proof that weapons are fine.

https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine...

https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17

"Russia has never hatched, is not hatching and will never hatch any plans to attack anyone," he stressed. "Russia is a peaceful country, which is interested in good relations with its neighbors." -- Kremlin spokesman Dmitry Peskov

---------

that is just recent, if you look for older then say Beria is case where accurate depiction would be criticized as not realistic and ridiculous

It's been cartoonish for over a decade. An elderly spoiled rich kid is running the USA into the ground along with his playmates starting wars he said he wouldn't. Another elderly infantile man is upset one of his vassal states had a tantrum and invaded it. Some other children got really angry after a terrorist attack and retaliated with 100x casualties in a "nah nah nah we got more bombs than you." A shrewd child is turning his industrial power house into a large technopanopticon while selling it to other nations along with debt traps all while eyeing a former sovereign territory for takeover.

At this point I would rather vote for actual cartoon characters like Daffy Duck or Goofy. Duck Season FIRE!

Last night, after Trump told everyone he made an energy peace agreement between Russia and Ukraine, Russia attacked Ukraine energy infrastructure and left 600,000 people without power. These attacks on energy will be even more deadly as winter sets in.

Is that cartoonishly evil?

Russia's idea of hybrid warfare means doing things like dragging anchors across internet cables and paying people to firebomb warehouses and businesses.

That's exactly what's happening.

https://brusselsmorning.com/von-der-leyen-proposes-european-...

- they either didn't warn their customers this was a critical security patch, - many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!

Crazy stuff

[0] https://www.claroty.com/team82/research/freeze-the-controlle...

No one has to answer for an obviously dangerous risk, not even the company? Ship it!!!!!

Source: https://www.visitflanders.com/en/discover-flanders/culinary-...

The Belgian fries have no leg to stand on, nothing. Sorry. Just my opinion :) but I’ve been a life long fries lover from Germany - and these beat out all other fries I had so far in Europe at least by a wide margin :P

I know it wasn’t your article but I wanted to spread this important knowledge to the world!!

Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!

So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.

Connected vehicles are the example that terrifies me the most. There have been numerous examples of lax security in this area already and a fleet of rogue cars or delivery trucks could obviously cause huge amounts of damage, injury, and loss of life.

There's a legacy of openness in car tech and software that was never designed with robust security and isolation of critical components in mind. I've heard that this has started to change more recently and that's reassuring if true. But this still feels like an area with far too little regulation or oversight given the past choices of vehicle manufacturers and far too much rush to connect everything up remotely even for minor convenience reasons.

In some cases there also now seems to be legally mandated connectivity for things like automated emergency calls after an accident. This should at least have a genuine benefit in the unfortunate situation that it's needed - but until vehicle security looks more like Fort Knox than a sandcastle it might still prove to be a bad choice in the end.

Fortunately, there is a straightforward solution. Find the cellular modem fuse and pull it. You now have a modern, but fully offline car. Security aside, connected cars are absolutely awful for your privacy.

The "straightforward" solution is to tell vehicle manufacturers that they aren't allowed to sell vehicles with connectivity unless they also have proper security and privacy protections in place. If no-one can give them money for it then they won't do it.

I am not aware of such a requirement in the U.S. In any case, it would be extremely difficult to enforce, and many cars that initially had connectivity went offline when 3G networks were decommissioned. I doubt those cars are now "illegal."

Will they never learn?

The problem is that many of these setups are put behind essentially consumer connections, but with a better support contract or simply fitted with a 5G modem and a SIM card from the cell provider with the cheapest plan.

Building a WAN isn't magic, but it does require working with (competent) ISPs and paying the higher cost.

Yes you might need to be able to centrally monitor and manage things but that should be happening on a private network.

How exactly would a more obscure (or even “analog”) encoding help? This seems orthogonal to reducing surface complexity and remotely executable command subsets.

The idea is not to solve everything with one simple trick, but to reduce the attack surface as much as possible in hardware. If you are dumb enough to make your 4 messages something like off, on, hard reset, random dangerous maintenance protocol, then it does nothing. If instead it encodes 4 useful and typically used states that can't destroy your system, then you have massively reduced the requirement for onsite, and accepted that more serious issues require onsite control.

It's not an easy balance to strike, though; the less capable the remote interface is, the less useful it is. "Only completely harmless commands" might simply not be good enough. For example, is "deactivate electricity output of this solar panel" (e.g. because market conditions make it unprofitable to supply at a given instance) harmless or not? What about "increase supplied frequency by 0.01 Hz to stabilize the grid"?

If it's a lot, maybe the manufacturers should be compelled to provide security patches if remote control is required to operate their products. For the sake of national security, of course.

* Fridges are read-only through their remote interface.

Both of these can be true if you must connect them to the internet.

I doubt the fridge has a remote-controlled robot arm to unload itself.

Meanwhile you can use analog gauges if you need perfect max temperature monitoring.

That's what always pisses me off about this. Someone brought up "Hey, if we connect this to the internet to enable that feature, someone will start hacking fridges and hurting our customers, and I don't think the stupid page with a temperature graph on it is worth that tradeoff", and some ass told them to get over it and implement it.

Raymond Chen used to write about feature development at Microsoft, specifically how every single new feature idea started from a negative position, since it requires support and testing and engineering and thought, and has future repercussions, so it's often not a good idea to just add box checking features.

Microsoft believed this in the 90s. For things like UI functionality. That's the effort and thought and restraint required to have a consistent UI, for things to be thought out.

Somehow, between then and now, the industry threw all that thought away, and now everything has 400 totally unused, half implemented, utterly broken features.

Why are we here? "Move fast and break things" just breaks everything eventually. Someone, somewhere, eventually has to fix stuff.

That's termed Post-IPO problem. :)

To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.

All of this remote crap is meant to try to eliminate a physical presence on-site, which is stupid because when things eventually break, a physical presence is required on-site anyways.

One of my jobs in aerospace is systems reliability - an unstaffed system is not a reliable one.

Maybe they shouldn't.

You actually do want to be able to monitor them remotely, like most industrial/commercial refrigeration, to detect failures faster and more reliably. They should still be at least secured with normal auth/autz in addition to perimeter security, though.

If I can know when a fridge failed within the hour (even at night) then I can also dispatch a technician same/next day more easily.

Obviously read-only access to some sensor is not the same attack surface as having the ability to remotely shut-down the refrigeration.

- The device’s control has a radio transmitter that emits its readings, but no receiver. Listen for those messages to monitor it but there’s not a physical path to reply to it.

- The device’s controller writes a database or message queue. Its code never reads from that source. Monitors listen to those messages.

And many, many similar methods with the same core concept: the item transmits its status but doesn’t have a method to receive replies. You just have to commit to using any one of those thousands of mechanisms.

If it were hacked to start delivering temperature readings that were dangerously-high while you were out of town, then: Would you keep the food, or discard it?

Read-only is a strong control with lots of solid implementations.

But this line of discussion is entirely missing my original point.

But to address your specific point:

being able to monitor does not ( or at least should not ) automatically equal put it on the web

Obviously it's a question of cost and convenience, and just dumping your appliance on the internet and make it phone home is going to be the cheaper option. If you want security those appliances goes on a separate network, which cannot reach the internet.

This line suggests the units themselves were targeted individually with a hack:

> Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

But the problem with networked devices spread across tens of thousands of pretty much unguarded locations, surrounded by unvetted employees, but taking orders form a central location is that there is no such thing as "not online". They'll talk to the management server used to set up the nightly defrost schedules across the fleet. Even if they are in an isolated VLAN, it's always one step away from someone connecting a Pi to that network and off they go online. There's only so much zero-trust, NAC/802.1x and segmentation can do when some devices will be too old to support these and their network will be the entry point to the management server, then to the whole fleet.

I'm honestly very surprised that a couple of things things haven't happened yet: the central server for managing these fleets getting hacked and allowing access to the entire fleet, and/or the companies realizing that the only way to limit the reach of an attack is to physically not have the hardware needed to do remote control.

In my world the central server can be hack in two ways, that is by a malicious operator or via some scheme like the US/Israeli attack on Irans uranium centrifuges. The central server also have no business being online, that to is on a closed network, running the whitelisted applications from the manufacturer.

As long a schedule is conceived in one place and applied in another, even with human intervention on both sides, either one of the sides can be swindled. At this point with the bar for a successful hack being lower than ever, completely removing the hardware necessary to make remote changes is probably the only way to limit the blast radius.

Maybe allowing to send the schedule but requiring a local employee to operate a local hardware only control to apply it could work, but who has the money for this kind of complexity. Something like this on every freezer (device, really) in a fleet probably costs multiples of the money they lost with the spoiled food.

[0] https://www.imdb.com/title/tt0060522

I have a smart fridge and washer. I won't name names. But for several years they were never connected or online at all (unless they was compromised and I didn't know). I connected them and one of the first updates included in the washer was changing the default wash cycle from something like 110 minutes to 46 or something. I don't remember all the values if I'm honest.

There are executives who have spreadsheets and charts of how much water that saved per household over varying periods of time. How much it would save with greater adoption. And the unsaid message, or maybe they'll be explicit, of how many people are going to face tragic water supply issues in the future.

It's a powerful message, even if we know it's cyncical and calculated to push not just washers, but firmware security systems and institutions to govern those systems.

And yes, compromised systems can also be used to build zombie networks to push horrible content.

I feel horrible that this critically important surface issue of water supply is used to push other agendas. I honestly wish I could do other work not related to it.

Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control. I think somewhere along the way executives got a little to comfortable saying 'they will buy what we give them'.

More to the point, maybe there is exactly too many smart people with agendas that don't seem to align well with my current needs vis-a-vis fridges:

I want something that keeps things cool with minimum of fuss and does not die upon update.

In short, that executive should be fired as they are not doing their job: they are actively undermining their own market.

Which is how they got into this situation. These are industrial refrigeration systems subject to a huge list of variables (how many units, their sizes, and doors hooked up to a refrigeration circuit, open vs closed cases, ambient conditions, hours of store operation, what type of refrigerant, whether heat is going to a cooling tower or air heat exchanger). They use a ton of energy, and percent optimization leads to millions of dollars over a fleet. They are designed to let the user dial in every operating parameter, like defrost.

Compare this to my home fridge where all these parameters are fixed in the firmware because the hardware is 100% identical.

Industrial systems are necessarily different from mass-produced home appliances.

Honestly, reality begs to differ.

This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.

Absolutely, and this is why I refuse to connect any home appliances to the Internet. I have a limited number of Zigbee devices, and they are managed through Home Assistant and can't access the Internet.

Then again when was the last time you opened your freezer hundreds of times during one day, letting humid air in and building ice at an accelerated rate? These units actively heat up the back of the freezer (evaporator plate) nightly to quickly melt the ice without warming up the food.

There is no reason to directly trigger it remotely but they probably work on a customizable schedule, to account for different store opening times, timezones, or freezer size and model. The hackers could target that schedule to make the defrost last longer.

Within a store certain freezers get more traffic than others, depending on how they're stocked, where they're located, etc, and therefore likely require more frequent defrosting. But that's something the store managers can figure out. It doesn't need to be managed remotely by some third party. So why did someone engineer that capability?

More features, generally, means more failure modes. More ways to exploit the system. Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion. It's very unhealthy and disordered behavior from an engineering standpoint--sacrificing reliability and simplicity for... what exactly? Some centralized control capability? But why?

> Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?

The purpose of the automation is the same as always, to run at peak effectiveness and reduce human error. Most of the workers in this industry much like the fast food one, are low paid, low skill, receiving only basic training, with a high turnover rate, across tens of thousands of locations from major cities to somewhere in the sticks. Even a disgruntled employee can do a lot of damage that's only obvious too late. So this extra work is taken out of their hands. You should really see a lot of the machines the big fast food chains use, you'd be amazed.

This kind of decision was never left to the store manager. In the past they'd get a printout and probably fail to follow the instructions occasionally, which may or may not cause damage or increases operating costs across the entire fleet. Now it's done over the network like everything else, for better or worse.

The small scale of the hack makes me think they've done a decent job at securing them so far. Spending more on people and security to avoid any hack (right?), or losing efficiency over tens of thousands of locations costs more than the spoiled food.

> Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion.

> More features, generally, means more failure modes.

Here's the kicker, they are necessary and desired by the customer and the failure scenarios were almost definitely factored into their calculations. I know you had a solid 5-10 minutes of though on the topic but for supermarket chains that's how they manage to operate cheaper, that's how they don't increase the cost of the food.

There isn't a complex real time control scenario here.. Obviously defrosting too much wastes energy, so you'll want to get that one right. But does having centralized control over that really make a difference at scale? Does having centralized control over temperature set-point make any difference?

From the basic physics of the process it's hard to imagine real time remote control being a decisive factor in efficiency.

> I know you had a solid 5-10 minutes of though on the topic but for supermarket chains that's how they manage to operate cheaper, that's how they don't increase the cost of the food.

I mean.. maybe? But nothing you wrote actually demonstrates that.

[edit] I guess if it's not about efficiency but instead a trust issue then it makes more sense from a marketing standpoint. But generally remote control isn't a great way to work around untrusted operators with physical access. They could just prop a door open or slice the seal if they wanted to..

That's like saying the store manager should manage the store website and networks instead of the chain's IT department.

No grocery store manager is going to be a licensed refrigeration technician. Ask them if they know about basic refrigeration concepts like superheat and subcooling, high side and low side pressures, compressor oils...

Further, a grocery store wants to optimize efficiency down to the percent, because that will save tens of millions of dollars over the fleet, and CO2 emissions. A store manager hardly has the capability.

Adjust: possibly, withing a range

Shutting down: Big no no

If an action needs another (physical) action to proceed, then don't make one independent of the other (obviously)

I see such idiots daily, in all venues of life: the world is simply really full of dumbfucks.

It's simply how things are and we shouldn't be afraid of pointing it out.

Very few things should be networked, or at the very least, not with any sort of control. I can't even blame the average person anymore for not being as aware about technology, unless there's some sort of aggression or dismissive responses when they're informed of the risks or potential risks. Software developers at this point may very well end up being as despised as lawyers or bankers, for not broadly enough condemning this sort of technological creep, but for being that guy smugly saying something about firmware updates ... on a refrigerator.

https://www.thehindu.com/news/national/eam-jaishankar-warns-...

I wonder if this attack is some kind of early warning about capabilities of disruptive forces.

You don't empty a fridge with built-in defrost. Your home fridge defrosts itself every 12-24 hours and you don't have to do anything.

Normally, the temperature recovers in ~1 hour after a defrost. The attack is apparently chaining manual defrost commands one after another so that the interior gets way too hot.

Ice anywhere else is treated as a separate problem and turning the cooler off to fix it is not typically an available option.

I feel like this is kind of holding the supermarket hostage and saying, “Sure your freezer is working fine, but if you refuse to buy new freezers from us prepare to get hacked.”

Sure you can argue that the supermarket should have just taken the old freezers offline. But you can also argue that the manufacturer could have supplied software updates but didn’t in order to force sales of newer models.

I've helped do it for industrial equipment (win95 controller or something) that couldn't be upgraded without spending millions, but it sill required pulling out the old 10base2 network and installing cat 6 cables in a factory floor and new switches.

https://news.ycombinator.com/item?id=49508506