Hacker News Reader

Comment by onli | Hacker News Reader

Doesn't sound all that convincing to me. There is no need for network controlled fridges in the first place. And it's not like setting up that network control was free. This is not about saving money, this is about ignoring what IT people preach since multiple decades now, spending more for the attack vector and then loosing a lot of money when that attack vector gets used. Margins? If it were about margins the problem wouldn't exist.

(I can see the need for remote monitoring, that the freezer actually worked. Controlling the temperature is the issue.)

View on HN

Do you say that as a supermarket manager, or a random person on an Internet forum? Because if it's the first, I'm very interested in hearing more on how you actually manage all the devices in your store and which ones require remote automation and which ones don't.

Automation doesn't require connecting to Internet.

Wow lots of supermarket managers on hn today

Supermarket managers got hacked today. Maybe they should take that as a hint to listen to others.

It will typically require some kind of network. And the person managing it will need access to that network.

It’s hard running that type of network securely, and costly to run it alongside a normal internet connection.

Cheaper to just use the internet connection and squint a bit at ‘securely’.

Is it really that hard to isolate some devices from the internet on an existing network?

They are all being sold on the idea of granting external access to a cloud application so that a third-party contractor can know when the system goes into disarray and pay for one less maintenance guy's salary.

Could the same thing be done with SMTP way more securely than opening up your firewall to some random AWS EC2 instance? Yeah no doubt.

Do you think grocery retail execs actually understand computers past Microsoft Word and Excel? I report to one, they can barely listen to me say the word WAN failover.

Like all things in IT, experience is the best teacher. Organizations will fail to invest in their technology, security included, and only then will the execs start to trust that the wizards in the backroom are telling them truths instead of asking for new toys - if they're lucky enough to still be the same exec that heard they should take security seriously before the Bad Thing happened.

In that case it's just a tradeoff between convenience and security, it isn't because it would be too technically difficult to isolate the systems. Whoever installed them could isolate them if there was no reason for them to be connected to the internet. I doubt most grocery store managers understand the precise engineering behind their freezers either, but they still buy them.

Very likely they were sold on these internet-connected systems without being told about the drawbacks, which is sad.

I never said technically difficult - as in impossible. Just harder. And more costly.

It’s more costly to do it properly, so most don’t.

The people selling the systems often don't fully know the downsides themselves either and in a sense they're incentivized to not know as it makes it easier to sell the lie that there are no drawbacks to having your HVAC system exposed to the wider web. But you are also overestimating the average skill of an IT person in these environments and the capacity for their IT or MSP team to step back and evaluate the security of all the systems they have to manage. There's only the ability to evaluate convenience vs security if you actually have the time to formulate the question - if you're drowning in ticket submissions you will likely fail to properly catch every such issue. Certainly for these larger EU corps they should have the capacity to make those determinations, but who knows exactly how the management of these systems were delegated. My bet would be it was the responsibility of an under-resourced team with too much to do already.

I'm catching issues as I can as the head of IT at an org replacing our Danfoss systems with something else, but it wasn't until about 1.5 years since the initial decision to replace them that I'm finding out from a sub-contractor of the contractor that there's a cloud app our HVAC network will need to talk to - which is not-so-funnily enough a requirement by the state for us to receive associated grant funding for a portion of the new system cost. This was never mentioned to me at all as the head of IT. It's not even a convenience vs security issue, it's a misaligned corporate communications and approval channels issue. In other words, the capacity to secure your technical systems is downstream of political organization.

> They are all being sold on the idea of granting external access to a cloud application so that a third-party contractor can know when the system goes into disarray and pay for one less maintenance guy's salary.

Even in that case there is zero reason for the devices to be reachable from outside the network rather than the devices reaching out to known hosts only.

that is harder to manage, and more brittle. hence more expensive. that is the reason.

Controlling the defrost was the issue here. The only way a cooler or freezer gets to 120F is by running the defrost overnight. And networked communication for sequencing defrost cycles IS essential so you don't run out of compressor capacity and/or run up outrageous electric demand charges. With the same communications you can sequence compressors and evaporators to get more stable temperature control, longer product shelf life, and may cut down on the compressor capacity you have to buy up front.

Then there is refrigerant leak detection, and automated calls and remote troubleshooting for the refrigeration vendor.

But since we've already got off-site access, why not throw in temperature controls so you can implement demand-based setpoints, schedules, and so the corporate facilities and product quality teams can keep an eye on things. They are required to keep detailed logs of each refrigerated space after all.

Any vendor selling grocery equipment without network communication is going to have a hard time staying in business.

Reply on news.ycombinator.com