Hacker News Reader

Comment by sgc | Hacker News Reader

Seems like 95% of devices could be managed with a hardware filter that only allows through a handful of very rudimentary signals (more like Morse code than a full digital transmission), and then of course a properly designed on-device API that defines those signals and doesn't allow you to trigger a defrost remotely, when that should only ever be done with somebody physically present for example.

View on HN

Defrost cycles do not require someone to be physically present. These are happening multiple times per day, per evaporate, per cold box. A moderate grocery store or cold storage warehouse will have dozens, it not hundreds, of defrosts per day. They NEED central dispatching and/or remote controls. Controls engineers have already thought of these things. They DO depend on rudimentary signals to schedule these events and coordinate defrosts so that only a selection of evaps defrost at a time and the box can maintain cold temps. It also promotes temperature stability, energy efficiency, and keeps equipment from being overloaded.

Morse code is a fully digital transmission.

How exactly would a more obscure (or even “analog”) encoding help? This seems orthogonal to reducing surface complexity and remotely executable command subsets.

The point is having the digital transmission simple enough that you can use fully *physical* filters to discard everything but the 3-4 messages you need through. Of course it is still digital, but my point is, it is a physically enforced studied, safe subset and doesn't allow for full network access. There are of course a variety of ways to further firewall that, but something needs to act like as much of an air gap as possible while allowing for remote communications.

How do you authenticate such a system? 3-4 “quasi analog” messages seem incredibly easy to replay, if nothing else. If you need to depend on something actually cryptographic to make the system replay proof, you can just as well use that system for all aspects of access control. This makes no sense.

Well it would receive control signals from an on-site relay server with the hardware to communicate with it, and that would of course also be firewalled and use encryption to communicate with the outside world. That server could always in theory become compromised despite your best efforts, so the benefit is obvious: don't create even the theoretic possibility of being hacked by a class of message that should never exist.

The idea is not to solve everything with one simple trick, but to reduce the attack surface as much as possible in hardware. If you are dumb enough to make your 4 messages something like off, on, hard reset, random dangerous maintenance protocol, then it does nothing. If instead it encodes 4 useful and typically used states that can't destroy your system, then you have massively reduced the requirement for onsite, and accepted that more serious issues require onsite control.

Oh, so basically, reduce the vocabulary that can be communicated remotely compared to what's available locally? I can get behind that.

It's not an easy balance to strike, though; the less capable the remote interface is, the less useful it is. "Only completely harmless commands" might simply not be good enough. For example, is "deactivate electricity output of this solar panel" (e.g. because market conditions make it unprofitable to supply at a given instance) harmless or not? What about "increase supplied frequency by 0.01 Hz to stabilize the grid"?

System needs to be carefully designed by experts for sure. Apparently that is a hard ask given the current state of affairs.

Reply on news.ycombinator.com