Delphiza
Delphiza on Hacker News
It is done automatically and continuously by the on-prem facilities management system, and monitored and adjusted remotely. If you disconnect the freezer from the control systems you need a meatbot to do the same work. Simplifying the problem to 'my kitchen freezer never needs to be adjusted, so the supermarket freezer can be disconnected' doesn't address the need.
They are used for security, but VPNs don't magically make things secure. In the industrial control space VPNs are considered risky because a remote device can be compromised and access everything else on the same VPN. Separate networks, VLANs, firewalls and other security approaches are used before hitting the problem with a VPN hammer.
Those were toasters, not fridges :)
Similar to the 'S' in VPN
The reason is because the optimisation and automation means that there are no staff in the stores qualified to 'turn the knob' (and it is more complicated than that). What is the store to do, employ full-time knob-turners? They won't even pay for the uniforms of shelf packers or give them two toilet breaks on a shift.
Supermarket freezers are a bit more complicated than that. They can run at different temperatures and can consume a lot of power, so are part of a bigger store HVAC and electrical system as they may load-balance. Stores do not have qualified engineers on site to do anything with refrigeration equipment and it is better to have minimum wage offsite monitoring than expect a minimum wage shelf packer who only gets one toilet break a day to care about the fridges.
The one good reason is that there is nobody skilled left in the office of the supermarket. The days of people with the skills to hit a supermarket HVAC system with a hammer are long gone. When the fridges are on the fritz, the minimum-wage shelf packer goes and packs shelves as far away from the fridge as possible.
Wait until the market matures enough for underpaid or disgruntled employees being able to sell data easily.
That is a shocking read! check_code_of_day WTAF! How did Danfoss not go around to all customers and hand-install a patch for this.
While the app is beeping at them to pack more shelves, and they have already used up their only toilet break of the day to trying to stop the resourcing AI chatbot from putting them on triple shifts for the rest of the week.
The trained and retained supermarket employees are gone. The refrigeration service engineer has been replaced by an AI chatbot. We can't scale to qualified people running complex systems on remote air-gapped networks.
Yes, that is likely. Although Danfoss seems to have their own controllers, I think that you are right, that the attack was not an 'Internet connected fridge', but an HVAC or FMS (Facilities Management System) that was connected to the fridges.
Look for "Danfoss AK-SM 720 user manual" and scroll through the pdf.
You'll find that these are quite complex control systems and their data may not be integrated into an operational or security control centre. So if they are not configured for, or resourced (in terms of operators), to handle anomalies, how do they notice and respond?
Without knowing anything about the attack it may be that the controllers were not connected directly to the public Internet, but an on-site VPN that became compromised some other way. Or with a compromised laptop of a technician that connected.
So while you are thinking about fridges today, think about how you would secure and operate control systems across tens of thousands of stores. Would that be easier without Internet connectivity? How do you get qualified and experienced technicians into each (air gapped) store? Another complexity is that many of these systems are part of facilities management systems (HVAC, lighting, security, fire control) and managed or owned by a completely different organisation that is not going to share their data.
IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.
The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.
Good find.
The biggest issue is that many of these IoT devices are badly secured. I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.
There are a bunch of good reasons to connect a commercial refrigeration unit to the Internet (via IoT). Notification when failover to the secondary cooling system happens, notification of when ambient temperature is too high, optimisation of energy consumption (especially after hours).
Doing it insecurely by, for example, having a device with a web server on the fridge is problematic. Not being able to deploy firmware updates. Having too much of the control loop exposed (as opposed to monitoring only), can lead to issues.
Service-oriented industries with costly assets will look to Internet connectivity for competitiveness and efficiency. It needs to be done better.
I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.
The paper refers to "indirect water use in electricity generation, and water-intensive semiconductor manufacturing".
Water use in electricity generation is significant. In the England we are in the middle of a drought and it is surprising to realise that electricity generation uses 2.5x more ('environmentally extracted') water than public supply and 10x more than agriculture.
"AI automating jobs", which is the narrative from tech bros to raise funding translates into "AI is going to take your job", for the average Joe. If you are a graphic designer that is now struggling to find work, why would you want a data centre in your town (or anywhere)?
Rejection (or fear) of AI translating into rejection of the physical infrastructure that supports it is perfectly reasonable.
Somewhere along the way, consoles lost where they fit into the 'living room space'. The biggest thing (for me) was when games stopped with local co-op. Having two controllers and being able to play together was a good way to spend time doing casual gaming. Lego star wars did it well. Gears of War, Halo and others used to be a good way to to spend time with your children. The Wii had all ages playing together. Now, all that you can do is play Minecraft together. I was watching my (adult0 daughter play the new Subnautica, and would like to have joined in without having to go to a different room.
Yes, what we remember is interesting, especially while reflecting on posts such as OPs. The Internet that I grew up with didn't have bots, neighbourhood gossipers, weaponised propaganda... we spurned people trying to sell stuff. My teenage Internet predated widespread use of email, so predated spam. Maybe my rose-coloured glasses remember a smaller number of real people and a demographic that was closer to my own.
I had the same weird feeling reading the post. Where OP was 'living there' in 2007, I was building sophisticated apps with big teams to do things build commercial insurance systems. I don't know whether I built the things that OP missed about the old days, or paved over the things that he used as a child.
If there is one thing I miss about the Internet that I grew up with, it is the trust and self-policing. We were on forums (even usenet) and got along. Now it is all walled gardens, rage bait, racism, and people shouting at each other.
I had to do an age check in the UK recently. There were various options (credit card, face scan, etc). The one that I chose was email address. My email address has been around long enough to vote, so I am
that old. It seems like a good heuristic. If your email address is, say, 10 years old, you are likely to be old enough to create an account.
I will get downvoted by people suspicious of handing over a lot of personal data, but we do have GDPR laws, and they're not getting me to install a proctopod (tm). Giving someone my email address to verify my age is not a big deal. They're getting my email address to create an account anyway.
The practicalities of implementing 'good enough' age verification, where the website can prove that they conformed to an acceptable approach, do not require giving up all or significant freedoms. Maybe we get to something similar to DNS verification where you need to create a dummy TXT record in an already verified account.
Social media platforms are offloading detection of harmful content and algorithms to UK parents.
What kind of class teaches 'tech-illiterate' parents to help their children not succumb to a multi-trillion dollar industry pushing out addictive and damaging content? It should be easy to develop such classes right? Maybe dust off the classes for 'health-illiterate' parents that were needed to stand up to the tobacco and alcohol industries? </s>
If the only benefit of space-based datacentres is a hedge against infrastructure attacks in a world war then we are in an awful place.
I'm not disagreeing with you but peace is far more prosperous for humanity than blowing the worlds' retirement funds on datacentres-in-space as a military endeavour.
An curious example where an academic at full-time at Harvard is obviously less qualified than millions of people that live in 15-minute cities all around the world. Maybe he should spend less time researching urban planning, and more time doing field work.