Hacker News Reader

Comment by SOLAR_FIELDS | Hacker News Reader

Through my work I deal with grocery software and I can tell you that grocery software is ages behind the times. For most small retailers (small being a business owner with less than 10 stores in their retail chain, mostly local grocers) you are dealing with processes that would have been considered antique for the year 2000

View on HN

It’s the same in a lot of sectors. Airlines. Electricity companies. Probably train lines. Banks. Fire services.

With all the disruption from AI on our industry, I can’t help but feel a little jealous.

Maybe AI will be able to give us a better FTP server in these industries

We already have that it's called SFTP. ;)

Wait what do you mean you want to use a key to log in, our stuff doesn't support that.

what do you mean "your ssh client deprecated that protocol", we use it everywhere!

AI enabled hackers are going to break everything that’s connected to the internet forcing it to move in to the modern era.

Disconnecting is also effective. Fridges don’t need to be on the internet.

That's not clear. Perhaps the savings made by having connected fridges over the year has offset the hacking event waste, so overall it could still be worth it. Now they need to apply security patches, and possibly only use the connection for monitoring (read-only) and have a kind of "2FA" / physical presence required when sending commands from the web

What savings?

Not having to pay extra employees to maintain the fridges I guess

Shifting when they consume electricity to take advantage of price differences during the day?

I would think that might have an impact on the temperature inside said fridges.

Yes, fridges don't have constant temperatures anyway. So you can shift when they run around a bit.

Not having to pay some token fine multiplied by however many times your employees didn't perfectly pencil whip the temp checks in the 3yr record retention period when you sell some bad fish and get audited as part of the investigation into that.

Yes they do if you operate a massive national chain and would like to minimize deadly health incidents due to avoidable human error.

Europe doesn't need to continue using fax machines and bury its head in the sand.

There's also the option to adopt digital technology and just not be an idiot about it this time since the price of intelligence is now effectively 0.

Or, France can continue preventing any productivity increases from technology and watch its social systems continue to collapse.

They don't need to be on internet. They just need to be available remotely. Simple VPN would've solved the issue entirely (...well, up to the moment when they won't update that, but updating VPN is far cheaper than commercial refrigerator controller I'd imagine)

into the modern era... ... or back into the dark ages

What does AI have to do with this?

AI is ruthlessly effective at finding vulnerabilities.

It's not so much that it's ruthlessly effective, it's more that it doesn't care about all the tedium of applying all the known techniques to all possible targets.

So much security in the past relied on "no one would bother to look in to this". We now have armies of bots relentlessly scanning over everything which is the main reason everything has been getting hacked over the last few months.

I think this is irrelevant.

There is no evidence AI was used to do this and it feels like a random way to force AI into the conversation? It’s just spectacularly negligent behavior by people who think that they don’t have to trouble themselves with security, but want the convenience of having their stuff on the Internet for remote management.

This is just like the OPM hack 10 years ago.

I'm really hoping that if it comes to pass, millions of AI-based hacking agents running amok on the internet, exploiting every single thing they can find, will at long last finally cause companies to get their shit together and secure their systems.

Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.

My hope and what I see happening is that the major players in the software space are frantically patching as many bugs as they can right now to keep ahead of attackers, and we come out the other end with incredibly robust software.

All the unsupported iot stuff will be obliterated by malicious bots, but the next generation of iot will be both more robust and less directly exposed to the internet. Like how Matter devices sit behind a hub rather than directly connecting to the internet.

I don't disagree with you. But let's expand.. Imagine every neighborhood had autonomous brick throwing drones randomly smashing windows. Imagine every neighborhood had autonomous flame throwing drones randomly setting fires. Imagine every neighborhood and autonomous gun shooting drones randomly killing. Imagine every neighborhood and autonomous grenade lobbing drones randomly blowing up walls.

You can not defend everything. At some point you have to realize the world works because not every exploitable thing is exploited and we live in a civil society (most of us anyway).

I get it, the internet makes things different. But your analogy doesn't work You can not build a building that can not be destroyed.

"Every neighbourhood" is still a local problem, and can be solved locally. A grenade-lobbing device in australia can not reach 1 Microsoft Way, Redmond with multiple hits per second, nor do we have the resources to produce such artillery at the rate of multiple per second. Any analogy that you want to extend into the real world has to acknowledge these real-world limitations in more than just a footnote, or it's not a useful simile.

>Imagine if your neighborhood had a million autonomous door-opening drones randomly flying around identifying doors and entering them. It wouldn't take long for everyone to lock their doors.

Pretty interesting example, because I'd like to live in a society where I don't have to lock my doors, because it's safe and I trust people around me. Releasing drone police randomly opening doors in the name of security sounds like a strict downgrade, not "a good thing because people will learn".

Recommend you unironically disconnect from the Internet.

and don’t live in a city.

I don't fully understand what you suggest. I live in a big city. It's very safe here - I am not afraid of walking alone in the night, neither is my wife. Theft is a problem, but not huge - I leave my bike unchained when going into a store, and chained outside overnight, for example. I lost my LED bike lights twice though, weird thing to steal but I guess they're very easy to detach. I also leave my apartment door unlocked when I'm inside, including overnight.

Of course, as you said, in a city I will never feel safe enough to leave a door unlocked when leaving my apartment - big cities are big, and even 0.1% of bad apples may spoil things for everyone. But wanting a safer and more high-trust society sounds like a good thing, right? How would disconnecting from the internet help me.

I just figured you might do something that gets you closer to the things you want,

while still living in the real world.

I don’t really “hope and dream” for stuff like feeling safe.

Especially when it can be had for so much less than the not-feeling-safe options.

(and yes, people randomly taking my things makes me feel unsafe.)

Disconnecting from the Internet makes it harder for people to break into your hardware.

> Releasing drone police randomly opening doors in the name of security sounds like a strict downgrade

This is happening on the Internet hourly, and it’s not the police. Well, sometimes. But mostly not.

No AI is needed for that. The Morris Worm was 38 years ago. Various MS Worms were as common as MS Windows 20-ish years ago. Anyone who's glanced over web server logs in the WordPress era knows about automated scanning for its myriad flaws.

Though one could argue that "AI" is needed, currently, for an editor to decide that a story about a hack is worth publishing.

(Yes, current-day AI's do shift the equilibrium. Somewhat. The French fridges would not be news if the situation was anywhere near as bad as the doomsayers seem eager to proclaim.)

I am reminded of this every time I fly Southwest Airlines

Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.

There is plenty of room for antiquated process and technology in utilities that has nothing to do with grid operations, trust me. :)

You can do a one way link, sensors on infrastructure which emit data only but can not receive anything. Then another device like an ESP32 or whatever the industrial version is which reads the data and makes it available to the internet.

You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.

Air-gapping is a start.

Critical National Infrastructure should go further, as Iran found out with Stuxnet.

So... how do you feel about apps[0] that let you automate pushing electricity to the grid from your own home battery based on wholesale electricity prices?

Nothing could possibly go wrong?!?...

[0] https://www.amber.com.au/

Unfortunately this isn’t possible. If we spent billions upgrading electricity infrastructure, sure. But it’s much cheaper overall to make smart use of solar panels and batteries that are already being installed in the grid. And that requires a smart grid, full of networked equipment.

For example, during peak sunlight times, many neighbourhoods now generate more solar than they use. Without a sink for that power, voltages would go haywire on power lines and damage equipment. So the grid uses control boxes to manage how much power each house is allowed to send back to the grid. And all that needs compute, live metering and so on.

Grocery stores can be as behind the times as they want. I'm worried about hospital fridges.

Other than computer security, by what standards ?

They are clearly making money just fine and in very low margin business. Moving cash registers to some electron app and vibecoding inventory management coz current system's app windows are ugly would improve it by 0 to negative %

This isn’t grocery software, it’s a microcontroller for controlling a refrigeration system. The same controller is used in non-grocery refrigeration installations.

I know someone at a 100 store operation and they're equally working in the stone age.

Reply on news.ycombinator.com