site banner
PaperclipPerfector  4d ago (text post)   16770 thread views

Culture War Roundup for the week of October 12, 2026

This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.

Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.

We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:

  • Shaming.

  • Attempting to 'build consensus' or enforce ideological conformity.

  • Making sweeping generalizations to vilify a group you dislike.

  • Recruiting for a cause.

  • Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.

In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:

  • Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.

  • Be as precise and charitable as you can. Don't paraphrase unflatteringly.

  • Don't imply that someone said something they did not say, even if you think it follows from what they said.

  • Write like everyone is reading and you want them to be included in the discussion.

On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.

7
Top Bottom Old Controversial Comments
Jump in the discussion.

No email address required.

https://uk.finance.yahoo.com/news/french-supermarket-chains-cyberattack-forced-115141288.html

Major French supermarket chains on Monday said they were hit by a cyberattack that caused their refrigerators to shoot up in temperature in hundreds of stores, forcing spoiled food to be thrown away and raising concerns about food security.

"Food security requires more attention at all levels," said the EU's food and agriculture commissioner Christophe Hansen on X, condemning the attack and saying such "exploitation of food" was now a "reality".

At least 300 shops of Intermarche or its Netto brand were targeted, along with over 100 Cooperative U outlets, and several E. Leclerc stores, the retailers told AFP in separate statements.

BFM TV said hackers "managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores".

Those branches that were affected will have to "throw away all of the products" that are fresh and frozen, Intermarche told AFP.

Specialist French retail sector news website jebosseengrandedistribution.fr said other retail giants Carrefour Market and Monoprix were affected but the companies have yet to confirm this.

E. Leclerc confirmed to AFP "that a cyberattack affected one of its refrigeration equipment suppliers," resulting in "repercussions on the operation of refrigeration systems in several stores".

A source close to the issue said refrigeration control systems from Danish manufacturer Danfoss were targeted.

Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware". It added that it had long advised supermarkets to update from those models. Danfoss gave no figures of how many systems were affected.

A person close to French Prime Minister Sebastien Lecornu said France's cyber security agency had already identified "a vulnerability in software supplied by a Danish company and has contacted the vendor".

"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable," he wrote on X.

He added that the company's teams were "fully mobilised" to restore the situation as quickly as possible.

"An investigation will be necessary to shed full light on this attack," he added.

Intermarche condemned the food waste and financial losses resulting from the attack, without providing figures.

BFM TV said temperatures were "altered remotely, resulting in the destruction of stocks of fresh and frozen products".

The incident comes against the background of growing concern over the potential havoc that can be caused in Europe in all sectors by malicious actors carrying out cyberattacks.

By likely affecting hundreds of units simultaneously, the attack demonstrated "a certain level of sophistication," he added.

This is a poetry of stupid and the hackers are the least guilty party here. Lets start with the obvious. Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates. How did we get to the point where a device that should be pid controller, compressor and alarm can be hacked.

To make you feel better - all of your nice EVs are also permanently connected and I doubt that there is air gap between the infotainment and the firmware of the battery pack. Someday someone will be able to accelerate or set on fire EV remotely. And probably soon.

This is a poetry of stupid and the hackers are the least guilty party here. Lets start with the obvious. Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates. How did we get to the point where a device that should be pid controller, compressor and alarm can be hacked.

OK, I'll be the idiot here. Managing 3 houses manually with retro thermostats fucking sucks. Setting up a reasonable HVAC plan is excruciating to begin with, and then making sure these move back to "Eco" mode when you leave and "Active" mode when you're on the way is immensely helpful.

Same with my pellet smoker. It's connected to Wifi so I'm not tethered to the backyard for a 14 hour brisket cook. That's worth the risk of a hacker getting access to my ReqTec credentials and being able to burn it.

And I'm just a lazy American trying to save $200/mo on my energy bills while enjoying smoked meats. Being able to monitor and change systems at scale is incredibly valuable, and the risk algebra actually does favor some centralized control from the corporate nexus.

This connectivity being insecure is a totally separate issue that I would agree with being "poetry of stupid".

And what happens with your brisket when your smoker decides to have firmware update? /s - but it has been known to happen with other classes of devices.

Ok - let me describe you an utopia:

Your devices have well defined api-s, you have some raspberry pi that is used as a server, your phone is connected trough headscale to your home network. You have rock hard security, absolute privacy and solid control. All of the benefits of cloud accounts with zero of the downsides.

I am not against api enabled devices (although I would greatly prefer to have the sensors and open firmware that I could tweak myself), I am against cloud connected ones. Your doorbell, thermostat, heatpump and wifi capable buttplug don't need internet access. They don't need wifi and bt access and cloud account before they can have basic functionality. They need open standards for management and authentication.

The whole model of - device needs internet access, makes nat traversal, needs account that is on cloud that is managed by the manufacturer and could be managed only trough their proprietary app that also needs a cloud account is hostile, stupid and risky. Someone eventually will figure out how to overheat a smart water heater and some poor soul will get scalded.

Being able to monitor and change systems at scale is incredibly valuable, and the risk algebra actually does favor some centralized control from the corporate nexus.

Only if you are serious about security. If you are lax about it what is you have is central asshole waiting to fucked. Without lube.

The cost and expertise to run an actually secure home intranet has dropped precipitously, which is great. I do think this is the future for programmers and DIY experts, but many people prefer a nice UI and a subscription to plugging in devices!

There are going to be a lot of very awful terror attacks in the coming months and years enabled by AI here. You think amusement park ride control systems are all 100% airgapped? Of course not.

You think amusement park ride control systems are all 100% airgapped? Of course not.

Most of the ones I see aren't even grid-powered -- ancient diesel motors are a pretty good air-gap!

You think amusement park ride control systems are all 100% airgapped? Of course not

No, but I would hope that everything important is done by physical switches which close physical circuits.

I've been in a ride that had a malfunction that made it unable to stop (pirate ship), and a technician had to run under the ride to enable an emergency break, so I guess at least that one did not have remote access.

had to run under the ride

I'd hope that it's at least a bit more remote than that!

At no point was the ride going low enough to hit someone standing under it, but it must be very unnerving to have it swing above your head like that.

I expect most amusement park ride control systems are so ancient there's no networking to exploit.

They will become really amusing for a short time. For the life me I really can't understand why there isn't major effort right now in just disconnecting things and putting vpns and firewalls. It is cheap easy and actually quite effective.

Someday someone will be able to accelerate or set on fire EV remotely. And probably soon.

There are widespread rumors that intelligence agencies have had the ability to remotely hijack cars since the early 1990s.

I mean, they can't. To remotely hijack a car, the engine, brakes, and steering need to be under computer control. Otherwise there's simply nothing to hijack. You can do it with a modern car (mid-2010s or later), but in the early 1990s they still had carburetors and cable-driven throttles.

If the engine is under computer control you could shut it down remotely. You could plausibly do that with an early 2000s car (if it has a modem on board, which it won't, but which I guess the CIA could sneak in there if they wanted), but I wouldn't call shutting it down to be "hijacking". It's only the cars that have things like active braking and lane assist where the computer even has enough control over the car to plausibly be capable of e.g. driving you into a tree on purpose.

if it has a modem on board, which it won't

After the Hezbollah pager detonation, can you really say that it won’t? I highly doubt the Mossad is the first intelligence agency in the world to ever sneak things into the supply chain for various reasons. There were rumors Intel was putting secret spying hardware in at the chip level in the late 90s.

There's been a recent (if less literal) blow-up in crypto spheres because a hardware wallet provider, shortly after being sold to an investor, pretty clearly seems to have begun implanting cell hardware.

In a much less sophisticated manner, to be fair. There's a fun question about whether that says they were the first, or whether it says they were the dumbest.

the hackers are the least guilty party here.

No, the hackers are the most guilty. This was stupid and pointless, and the best reason I can put on it was to show that "next time we'll ask for ransom not to do this, this isn't a spoof, we just proved we could fuck your stores up", which is criminal behaviour.

Otherwise it's just destruction for the sake of it, spoiling food for nothing more than showing off how clever they are. Yeah, the stores should have better IT security, but who would have thought anyone would be destructive for the sake of mindless vandalism to do something like this?

Yeah, the stores should have better IT security, but who would have thought anyone would be destructive for the sake of mindless vandalism to do something like this?

Anyone frequenting IRC in the late 90s?

Do you have any proof that the hackers were in jurisdiction in which spoiling French food is a crime?

Do we really need to be at the point of "oh show me the jurisdiction where this activity is a crime" now? Whatever happened to "only fuckwits do this"?

Any corporation that doesn't have an on-site sysadmin hotrodding biofeedback in the Matrix is having their ass cheeks flapping in the wind, chummer. Like they say about women wearing revealing clothing: they were asking for it.

I don't mind being a fuckwit.

"The Net interprets censorship as damage and routes around it" while less true than in the 90s is still true enough today. Same as with malicious activities. Internet (okay apranet) was designed as military communication network capable of transmitting information even while severely degraded. That lead to a network that was anarchistic in its core. Just copy pasting meat space concepts and territories doesn't change its nature. Internet allows someone in Kenya to fuck you up in your country, in your home, in your bedroom for the lulz and destroy your life. This is why security is your responsibility - because the state as an entity that is entrusted and capable of providing protection is just not strong enough or not existing even in some contexts.

The only true internet crime is having bad opsec.

This is a poetry of stupid and the hackers are the least guilty party here. Lets start with the obvious. Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates. How did we get to the point where a device that should be pid controller, compressor and alarm can be hacked.

My house has smart lights in it. I decided to try pairing them to my phone in case I have time to ever want to change their color one day.

After connecting the app tells me some of the bulbs need a firmware update. Light bulbs need firmware updates these days, apparently.

So yes of course supermarket refrigeration systems also need firmware updates.

While I'm generally in the camp of having as little "smart" appliances as possible due to the obvious problems with hacking, currently I'm curious about going entirely the other way: IF your appliance is already smart anyway, why not run an oversight AI whose sole job is verifying that the appliance runs as intended and which just stops any weird behaviour like the extended defrosting here? Surely some companies will find a way to fuck this up and make the AI itself hackable, but at least in principle this would obviate the need to patch every possible exploit or weakness; As long as the AI is unaffected, it can just overrule obvious nonsense.

And you can go even further, at least once costs have crashed far enough: Imagine each AI just building a custom codebase for its particular appliance, which they only minimally expose to the outside, so that not only are no exploits reusable, even just finding exploits is a completely uneconomical Hacking Blind nightmare.

The future is going to be fucking weird, and scary.

IF your appliance is already smart anyway, why not run an oversight AI whose sole job is verifying that the appliance runs as intended and which just stops any weird behaviour like the extended defrosting here?

There's a small industry for this sort of thing in the networking sphere, originally as intrusion detection or endpoint monitoring, and quickly pivoted from raw algorithmic or threshold-based structures to AI-based routines (imo, before it was ready).

The simplest problem is that a lot of shops just don't use it. In some contexts it's either effectively required, like criminal justice or defense industry work, or strongly encouraged like academia, but even in those spheres it's not always done or done well. The last setup I ran for a small and closed environment was 30+ hours of setup and configuration, and not a small amount of weekly tuning to get it to stop spamming me for false positives or ignore test 'incidents', and that was where everything fit in a single if big room. And those requirements are relatively recent.

(to be fair, some of those hours was a meeting to find out who owned a fucking firewall).

So I can understand a business not wanting to implement that, and doubly not wanting to do so in pre-2013 where a lot of this hardware came from. And, of course, running an LLM on 2013 hardware just isn't happening: a lot of these old embedded computing machines run under a half-gig memory and a processor that measures its single core's clock speed in hundreds or even tens of megahertz.

That said, even assuming they could have done it, both approaches are rough in many ways. Customers and non-technical endusers are notoriously prone to alarm fatigue, where even a small number of false positives discredit the alarm fully. At the same time, they'll also routinely implement processes you'd never imagine. And ultimately, you're trying to safeguard against the aftermath of intrusion, so you don't just need to worry about the AI being 'hackable', but even stupid stuff like the hardware controller getting locked up or reprogrammed into sending replays of past 'good' data, for some examples.

It's not impossible, but it's a lot of work for marginal benefit, especially compared to more traditional security approaches.

Yes you are right. I should actually put an AI on making sure my smart lights and other smart garbage are patched, even if I don't want to use the smart features, just to stop from being a malware vector into my house..

In fact I remember my refrigerator had a little QR code in the bottom right corner next to the make and model that told me to configure WiFi.

Why does my refrigerator have Wi-Fi? No idea. Do I want this feature? No. Should I configure it anyway and keep it updated and lock it to an AP that can't do anything? Yes.

Sigh.

IF your appliance is already smart anyway, why not run an oversight AI whose sole job is verifying that the appliance runs as intended and which just stops any weird behaviour like the extended defrosting here?

Or at least notifies you of suspicious activity.

Light bulbs need firmware updates these days, apparently.

Light bulbs shouldn't need firmware updates either.

They don’t unless you go out of your way to buy ones that need such. Known also as ”smart lights”.

"Smart lights" should not need firmware updates either. It is really not that difficult to get it right the first time.

That’s effectively just saying no software should ever have security bugs.

Yes, it is that difficult to get it right.

One man's modus ponens is another's modus tollens.

I think the lesson here is that electronics are not expensive enough.

This is a poetry of stupid and the hackers are the least guilty party here.

I despise this framing, and it is obviously false. The most guilty party in any situation is always the actual guilty party. When a women walks down a dark alley in skimpy clothing and gets raped, the most guilty party is the rapist. When a farm sets out an unattended stand with fresh produce and a box to put money in and someone comes and steals everything, the most guilty party is the thief. When a supermarket doesn't put locks on their toothpaste and someone comes and shoplifts a bunch of toothpaste, the most guilty party is the shoplifter. When someone puts refrigerators on the internet and they get hacked, the most guilty party is the hacker.

Yes, you need to be vigilant and aware that bad people exist and take precautions to protect yourself from them. If someone is in a low trust environment where bad people are prevalent, it is irresponsible and negligent not to take precautions, and anyone who fails to do so does share some of the blame for the obvious outcome where the bad people harm them. But they share less than half of the blame, because if the bad people didn't exist then obviously no harm would happen at all and the precautions wouldn't be necessary. There is a finite amount of blame to distribute, and the majority always belongs with the bad people who actually do bad things.

The most guilty party in any situation is always the actual guilty party.

Yes. The sysadmin. IT security with minimal exceptions[1] always had serious component of victim blaming in the 90s.

The difference with the rest of your scenarios is that in IT there was never trust which could be betrayed. Everyone knew from the beginning that everyone is out to get you. There was never presumption of safety on the internet.

So a better analogy is who is to blame when a soldier dies on the battlefield - the enemy shooter or the soldier that didn't take cover?

[1] Technically illiterate activists in the third world and the likes.

So a better analogy is who is to blame when a soldier dies on the battlefield - the enemy shooter or the soldier that didn't take cover?

The king or president who instigated the war.

You're missing the point. Low trust societies are worse than high trust societies, because even when you take all of the appropriate security measures, those measures inherently come with costs and friction that wouldn't be necessary if there weren't untrustworthy people around. The actual perpetrators are the people directly inflicting all of the costs, both the damages when they get away with something and the security costs when people move to stop them. The naive people are indirectly responsible for the costs caused by insufficient security measures. If they weren't naive OR if there weren't scumbags around, they wouldn't get sabotaged so drastically, but no matter how cynical they are there's nothing they can do to prevent the security costs and friction forced upon them by the scumbags. There's a clear asymmetry here.

I wonder if the issue is just treating criminals as sub-human or something, the fargroup, and thus absolving them of responsibility because you're not even being thinking of them as rational agents in the interaction. They're not just some environment, like wandering into the woods and getting mauled by a bear. They're people and thus deserve blame when they inflict harm.

The internet is not a society of any sort though, any expectation of trust that broad is just idiocy. The moment you connect a device to the internet, it's full PvP. Until the ingroup is all of internet connected humanity, any network enabled software will have some North Korean sweatshop or misanthropic scumbag looking to mess with it.

Yeah, and? I think you're mostly just proving my point for me. The more of them there are the worse things get. It's not all or nothing. An internet with 10,000,000 PvP hackers is worse than an internet with 1,000,000 PvP hackers, is worse than an internet with 100,000 PvP hackers. Every single hacker contributes to making the internet a slightly worse place. More subtle flaws in more niche places will get exploited faster with additional scumbags.

Similarly, a community with 0.1% shoplifters might have stores just ignore them and eat the cost. A community with 1% shoplifters might lock up valuable items or hire security guards (raising prices to meet the excess demand). A community with 10% shoplifters is going to have stores close up and seek opportunities elsewhere, turning into a food dessert. Each scumbag contributes to making things a worse place for everyone else.

My point isn't that you should "expect" people to be good, in terms of predicting that they will be good. My point is that bad people are still bad even when you expect them and prepare for them. Their predictability does not negate their badness, it only allows you to mitigate it. Therefore they are still bad.

I think you are missing my point. To commit crime you have to have law, the DNA of the internet was always lawlessness and anarchy. It started as a warzone. The fact that meatspace has claimed control and thinks its rules apply - doesn't change the nature of the place. Hackers are not criminals - internet was created to be unrulable - well it was created to be undisruptable, but the two kinda go together. So the burden is on the defender, by default. In the real world you have the whole monopoly of violence thing that says rape is not ok. Internet was designed so that monopoly of violence is impossible. Well the governments figured this one clever trick that if they can put chokepoints and match your digital to physical identity they could break your kneecaps. But still.

...no?

First and foremost, this is less about the literal law and more about the moral law. If the government suddenly legalized rape, all the rapists would still be just as horrible people, still cause as much harm, and still be worthy of blame for ruining people's lives. Similarly, the hackers are bad people regardless of what the law says. Rape is not bad because the law says it's bad, it's bad because it causes harm. It's illegal because it's bad, not the other way around.

But also... there are laws against hacking. They are criminals, 100% literally, they broke actual laws doing what they did. The internet might metaphorically be compared to another world where people can do things anonymously and act like avatars disconnected from their physical selves, but in a literal sense it is not. It is a series of electronic signals made by physical computers, taking place in the physical world, and manipulated by physical humans pressing buttons on their physical keyboards. When someone does anything on the internet, they are literally performing actions, and those actions can be made illegal. Enforcement is way more difficult, which is why they usually get away with it, but they still deserve blame for breaking laws and causing harm.

I think you are missing my point. To commit crime you have to have law, the DNA of the internet was always lawlessness and anarchy. It started as a warzone

Arguably the same was true in so-called meatspace for a lot of human history (or pre-history, if you prefer). Back in the day, it was arguably completely normal and unremarkable to raid a neighboring tribe, kill everyone there with the exception of a few people to be taken as slaves, etc. Since then, norms have arisen providing that the law of the jungle no longer applies in the case of physical human interaction. And we are all a lot better off as a result.

Simply put, human society started as a warzone as well. To a large extent we've gotten beyond that and in my opinion there's no reason the same thing shouldn't happen in cyberspace.

To a large extent we've gotten beyond that and in my opinion there's no reason the same thing shouldn't happen in cyberspace.

Because for that to happen you need to disable out of country communications, encryption, running unsigned software and to have state firewalls that will inspect every packet.

In your analogy, we couldn't have made murder illegal, and murder can't have been immoral, before the invention of CCTV. To say that an action ant be immoral or illegal unless you have the capacity to prevent all occurrences of that action is nonsense.

Because for that to happen you need to disable out of country communications, encryption, running unsigned software and to have state firewalls that will inspect every packet.

I think your argument here is that the proposed norms of behavior I am referring to are impracticable. (Please feel free to correct me if I misunderstood.) And to that I would respond that in the physical world there are millions of crimes committed every year, many of which go unsolved and unpunished. Nevertheless, it would be silly to just throw up our hands as a society and go back to the law of the jungle. Because we are still far better off.

Assume that we have a world in which death notes are common. France's laws can't protect you. How will you deal with the threat?

The default assumption about meatspace states is that they control a physical space, have the only say what goes in there, control the inputs and outputs. And because to commit a meatspace crime you have to be in physical proximity to the victim - it means you are at least nominally under said state power. And this arrangement works well and is easy to understand. You kill a man in Reno just to watch him die and then you go to Folsom. To commit a crime you have to overcome the state.

What does the death note change - that you could kill a man in Reno from Uganda, but there is no way the crime can be traced to you (or prevented). You totally bypass the state. In that world dying by death note because you showed your face or told someone your real name - will be classified as death by natural causes - aka stupidity.

Hacking is inevitable feature of the internet. To be able to prevent and police crimes you have to be able to control all of the infrastructure. And this is where my argument comes into play - if the state is incapable by definition to secure the cyberspace - then it is up to the sysadmins - because they have total control over what goes in their networks.

More comments

I don't accept this framing and it's not clear why anyone should. Everything you do is subject to the laws of the place your body occupies. And there are real meat-space consequences to their actions, whether a hacker just makes a laptop battery overheat or causes a food shortage by spoiling a country's worth of meat. You wish there was some weird magical world where you can do things but those actions have no moral valence, but that is a childish desire.

Everything you do is subject to the laws of the place your body occupies.

Yes. And defrosting French freezers is not a crime in North Korea. This is how North Koreans say hello to each other.

No, but deliberately allowing North Koreans to remotely defrost French freezers is an act of war by North Korea against France*, and French nukes work and North Korean ones don't.

* Technically a criminal one, as an attack on the civilian food supply chain.

North Korean nukes have been successfully tested more recently than French ones.

deliberately allowing North Koreans to remotely defrost French freezers is an act of war by North Korea against France

This would be true for "encouraging", and for some definitions of "allowing", but "allowing" has a lot of grey area. "We thought he deserved a fifth chance!" is a pretty good shield of plausible deniability in too much of the modern west, including France.

More comments

It's also subject to the laws of where the servers are, where the hardware you're messing with is. Just because NK doesn't have extradition treaties does not make this behavior ok. Defrosting freezers maliciously is morally abhorrent behavior and makes the world a worse place.

Yes. Even if you take the anarchist position, there's a big difference between making the screen display "Pwned" or whatever, versus doing malicious criminal damage.

The naive people are indirectly responsible for the costs caused by insufficient security measures.

However, the converse also applies: the most cynical (who demand others pay more for security) impose costs when they want too much security.

This is how progressives can [correctly] accuse everyone else of imposing too many costs on the community by impeding the immigration they want, and how everyone else [correctly] can accuse progressives of imposing too many costs through failing to ensure immigrants behave themselves.

There's a meme in software about "move fast and break things". Same thing- you can either have more software faster and cheaper but having more security issues [which create cost indirectly], or you can have no software and have systems that are extremely expensive [which create cost directly].

Either one fundamentally creates a cost, but it's asymmetrically enforced, as humankind hasn't figured out how to measure much less begin to force the people who argue conservatism in a particular area to pay the opportunity cost that creates beyond "move to a land of plenty such that conservatism doesn't work".

but no matter how cynical they are there's nothing they can do to prevent the security costs and friction forced upon them by the scumbags

Sure there is- you organize meanness to degrade their capabilities. Typically this requires grouping people by class- sex, race, age, nationality [Irish need not apply], social standing, g, whatever- and forcing them to pay for "being scumbags".

And the ways you might force them to pay are many- you can levy fines, imprison them (which is more a fine on their time), disenfranchise them, physically injure them, and deploy various means of scumbag-icide (from assassinations of key figures to whatever prefix for -cide you wish).

On the other hand, of course, "being scumbag" is sometimes not something one can avoid. Perhaps one is born stupid, or with some trait that make their existence untenable (including relative statuses, since human beings work that way), so either they themselves, or those with whom they can co-ordinate, will seek to take away what you have because there's no particularly attractive alternative.

The thing that complicates this analysis is the fact that "people that just want to watch the world burn" (as in this case) are always a net positive to kill, but it's not possible to ensure the social machinery that kills those people is never turned in their direction.

Agree this is how people in Johannesburg end up living their lives shuttling in between walled security compounds and still get robbed.

I wonder if the issue is just treating criminals as sub-human or something, the fargroup, and thus absolving them of responsibility because you're not even being thinking of them as rational agents in the interaction.

I think you're on to something. A whole bunch of the thoughts I've been thinking about posts from the last couple weeks about the ongoing Lindsey Clancy drama, AI doomerism, European Diplomats, the Cornel 7, and Spiderman: Brand New Day, all seem to be converging on a similar conclusion and I really want to explore in an effort post but it's already late and I really ought to call it a night.

I don't fully buy this. Telecoms were originally bult completely unsecured until phreakers ruined it. And even up until 2024 or so people could put whatever number they wanted on the caller id. Email was largely the same, totally unsecured, until the spam waves forced the mass lockdown.

There was the presumption of safety on the internet when it was a place only accessible to elites and nerds. And maybe now that's over, especially with the shitholes of the world getting hooked up. Indian cubercriminals act with absolute impunity, and nobody does a thing about it.

I'm not sure if we can ever get the trust back, but drone striking a few fraud factories would be a great start

On the other hand, the first ever spam campaign happened in the 70's on ARPANET

Was that e-mail spam in roughly the modern sense? The word "spam" was originally used to describe off-topic posts repeatedly posted to Usenet, and only later became a term for unsolicited bulk e-mail. (In both cases, the junk was mostly but not entirely commercial ads, initially for legitimate businesses like immigration law firms but over time only for scams as spam became illegitimate)

It was a mass email (sent to about 400 ARPANET users) advertising some computers from DEC: https://abusix.com/blog/the-birth-of-email-spam-gary-thuerks-1978-green-card-incident/

Feels like every major tech news should have the accompanying HackerNews thread just for more industry context or related info.

HN threads: https://news.ycombinator.com/item?id=50055304 and https://news.ycombinator.com/item?id=50058569

This is an interesting connection for essentially the same hack in the past: https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary

Near-simultaneous refrigeration failures or significant issues impacting at least six [US] military installations have now been confirmed through official sources during the last few days, with additional independent confirmation of multiple other incidents.

Self-aware enough to know this sounds insane, but I need you to stick with me.

Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates

Having worked as a refrigeration tech before, I may have some insight- this was almost certainly done for management and monitoring. Defrost cycles are very important to keep freezers from bricking themselves, and danfoss controllers are very common as an alternative to a mechanical time clock- because they’re fully programmable to the conditions of the specific box.

Why they were connected to the internet is probably because corporate wanted to be able to mess with it without sending someone in person. The stated reason was probably so they could set passwords but in reality it was to make in house maintenance personnel’s lives easier.

There's a lot of value in things like alerts, too. Being able to send someone an text message or even call someone when a glycol loop herps the derp can be a 10k-100k dollar value proposition, and pulling good logging data about current draw can give you warning months before actual death about a failing motor or compressor.

That said, the idea of inbound open ports for management is mind-boggling, even for hardware in the 2000s era. Even before you get to the security ramifications, it's just an absolute nightmare trying to get fifty sites to stick with static IP addresses, inform you when changing ISPs or modifying firewall configurations, or your DDNS provider changes literally anything. I know OT has worse practices than IT, but this one is pretty mind-boggling.

Forget setting up VPNs. Buy and configure a single main operational server, have the hardware send regular updates there, move all the heavy lifting and the UI somewhere you can control if and limit firmware updates to message protocols, certificates, and fundamentals. Allow big customers to buy, run, and redirect to their own server if they really need to own everything. Done. Two or three months work for an intern. I hate Everything Is The Cloud, but this is a tailormade situation for just putting things on the cloud.

Buy and configure a single main operational server, have the hardware send regular updates there,

Depending on the way the corporate network is setup, you might need one of these at each location: does a grocery chain have a corporate-wide VPN already? I assume not because then you could avoid this whole situation by never exposing the hardware to the Internet. Even then, locking down odd hardware in a subnet would be a good choice.

It's often said that the "S" in IoT stands for security, and it's not really wrong, but the way we define "security" does manage to be difficult to implement on embedded devices. "Oh just use TLS" isn't trivial: most configurations there will need certs that get updated regularly. Do you even trust your CA to remain on the approved lists indefinitely? Will your choice of RSA-4096 still be acceptable for the life of the unit (say, 50 years)? What's your plan for post-quantum cryptography on a device built in 2003?

Your fridge also suddenly needs a good clock source to check the certificate time limits: now you need to set that on the device, potentially every time it loses power. NTP works, but isn't foolproof or even secure in most deployments. These things aren't trivial, unfortunately.

In practice, a large, long-lived SSH key signed by corporate would work fine, but none of the normal tech stack is really setup for this today unless your users like command lines. I'm not saying it can't be done, but it's not in the normal wheelhouse for technicians who specialize in wrenches.

does a grocery chain have a corporate-wide VPN already?

I've never worked for one, but I assume they do for the POS system, along with other ERP system access for inventory, receiving, accounting, and so on. They should probably have multiple subnets per site for the sake of isolation, but that's a bit of a hassle to combine with a VPN and may not have been done.

They had inbound open ports to allow their maintenance managers to change settings store managers were messing with, probably. But why they didn’t take security precautions to prevent that I don’t know. Probably because they’re career hvac techs and it doesn’t occur to them that someone would want a freezer to stop working.

What were the hackers after? Ransom ware?

What were the hackers after? Ransom ware?

Seems like pure destruction to me, most likely from a nation state (who else would have motive, means, and opportunity?). Maybe it's retaliation for that Russian bot farm that got blown up?

Destruction and/or criminality. Next time someone in corporate HQ gets an email about "set up a crypto account to pay us $$$$ or else we shut your stores down", they'll know this isn't a spam email or pointless threat.

A practice run for the Chinese hackers who've already infiltrated much of American infrastructure.

MO seems more Russian than Chinese, Iranian is also technically possible. But I agree that hostile nation-state is the most likely motive.

It's still weird that the guy building the web interface would do it, even if he was a career HVAC tech that had gotten pushed into software dev. But it's plausible.

What were the hackers after? Ransom ware?

That's a fun thought. Ransomware naively feels a little weird for me. Telling the people they need to pay you gives them a window to replace the controllers (or just turn off internet access and hope you didn't leave a time bomb). But I may be missing an attack vector there, or they might have been working toward the timebomb and just noticed enough devices they got interrupted.

There's some more esoteric options, though. Hitting food supplies is famously one a target for causing political unrest. Just shorting a few of the supermarkets would potentially be a very remunerative option, though it'd be a hilarious way for the hackers to get caught (or lose money). Burning Danfoss itself might be a thing, especially for the more ideological actors -- even if the threat genuinely doesn't exist for their newer products (not a given), there's no way its buyers avoid a security audit, and no way Danfoss avoids a ton of support costs downstream of that, on top of lost goodwill. Political or nationalist drives are always an option, if a goofy one. "Hey, Look At Me" or a personal grudge turned public is just plain dumb, but if any attack could be executed by a script kiddy, this one could.

Not sure some other options.

Seems to me that the smarter way to do this would be to have a site-to-site VPN between your corporate office and the store's internal network. Then the freezers remain on the "internal" corporate network and aren't exposed to the internet.

This may be shocking to professional software engineers, but most companies do not put systems on a VPN prior to those systems being hacked.

I guess a lot depends on when the system was put together, but as a professional I.T. guy, oof. Of course you put them on the VPN! That's been the sane choice for at least twenty years. If you absolutely, positively can't for some reason, then you at least whitelist the control server at the firewall level and block other traffic to the device.

Now if they were small enough not to have an I.T. department, I'd understand. But more likely I.T. was overruled.

It was probably put together by career HVAC techs who told them to set up communication via a web portal so they could initiate defrosts* on their cellphones, and then set the passwords to their lastnames.

*For those in the back who don't know, commercial freezers are supposed to have an electronic defrost that clears ice off the evaporator so it doesn't inhibit airflow. This attack worked by reprogramming that defrost to never end.

Most full-size residential fridge units have auto-defrost circuits. I'm not aware of having to run one manually before: it's probably not meant to be manually controlled like that. The little ones generally need to be taken outside to thaw occasionally. I believe heat pumps for HVAC need auto-defrost too.

Usually commercial freezers have a manual defrost switch to test functionality or restore operation after a freeze up caused by misuse, which is what they triggered.

Yes but that does require more infrastructure. It's also very possible that the units connect to a manufacturer cloud controller on the Internet only on outbound connections, which is typically reasonably secure so long as you use SSL pinning etc, or even on an IPSEC tunnel, but that the cloud controller was itself compromised in some way.

The manual for one of the affected models is available online, see page 11. The idea of a web host running on the hardware controller is... not the worst thing I've ever done, but :

"If the remote connection is on a WAN then the LAN router may need to be configured to allow this inbound counnection, with the addition of the web port added tot he end of the http string."

Definitely worse. I was building web-accessible hardware in 2013. This was, to be fair, a couple years pre-Let's Encrypt, and SSL wouldn't have solved this specific problem.

But I still knew better than that.

Early descriptions of the attack have claimed that there was a master password for the device exposed on the same interface (unclear if it's the HTTP or XML), which allowed the control commands through in bulk.

Yeah, this sounds terrible. I wonder how hard it is to run Tailscale on a freezer. Surely the licensing costs for a freezer tailnet are miniscule compared to the reputational damage they have suffered.

A lot of this hardware predates tailscale, and pre-2016 VPNs were... very frustrating to manage even on normal desktop or laptop computers: you at least could run IPSec so the protocol situation wasn't awful, but the server management was either OpenVPN's too-techy-for-some-techs world, or expensive per-user licensed stuff, or untrustworthy stuff like Hamachi.

As for how difficult it would be to fix today... depends a lot on the hardware implementation. A pure MCU-driven approach would be cleaner, less expensive, and more stable, but also much harder to write a VPN or VPN-like capability into, just because of limited RAM and multithreading. An ESP32 can (and many people do) run it, but it's something you need to build into the system early and limits what else you can do. And 2010-era microprocessors would be really hard-pressed to run the stuff Danfoss's guides show, anyway.

It looks like they were on (Linux-based?) conventional embedded computers, at which point adding tailscale is mostly a matter of sysadmin work (and, uh, depending on how old the distro fork/variant, a lot of swearing about compile time and troubleshooting dependencies).

I mean, if this freezer can run an HTTP server with a control panel, it can certainly run Tailscale. I agree that older VPNs were terrible, I remember arranging them between us and our more paranoid customers (not the most paranoid ones, which demanded we keep maintaining our homebrew dial-up client) was a royal pain in the ass. Even bare Wireguard sucks.

All of these manuals are online for technicians to read.

Oh my, that is indeed dire.

Geez, page 60 has a default admin password of 12345... There's a decent chance they just used that and then clicked the defrost button. It's fortunate that the attackers appear to have been unsophisticated, apparently you can also remotely upload new firmware and they don't describe any verification or signature validation.

Or maybe half a step more sophisticated they got VPN creds for the grocery store from a data breach or something, I doubt they were just sitting accessible on the internet. That's the sort of thing Shodan would have flagged years ago.

And right next to the default password:

To guarantee the best experience when connecting to your AK-SC, ensure you [sic] PC has the latest version of Adobe® Flash®

Yes, all of that stuff is absolutely industry standard- because most of these freezers are worked on by contractors with an end user who don’t know nothing about nothing and they need a default admin password.

Their main competitor is even worse.

The default admin password would be common in normal IT world until 2020: it took a combination of California law (2018's SB-327) and NIST's mandate, along with some questionably-authorized-by-statute contracting pressures, that really made it universal for routers. I'll still see it (or password) on internal-only equipment, including some still-being-sold-as-new Unifi devices.

It's not even necessarily wrong in an environment where you'd expect some intrusion detection, or where the device requires a change on first login. It's just bizarre to do it, and then recommend people forward a WAN directly. This particular attack seems to have depending on another, different 'master' password, so I guess it doesn't even matter, but that's another thing that on its own points to 'reasonable if you're not that concerned about horizontal movement' (common in 2013) and really bad if you have any reason to worry about being the first hop in an infection.

Like, I'd hope they have fail2ban or equivalent set up? But I wouldn't be optimistic.

The competitor being worse makes me really concerned.

You are aware these are freezers, right? Like they're important but they're not holding onto private data or whatever.

Emerson writes the password on the device for technicians to have access to, and Ke2therm uses all fives(no, it can't be changed).

More comments

This system was not designed by IT professionals.

I can see there being utility for your freezers being on the network - maybe if one of them has a mechanical problem or other fault, having it on the network and reporting to a dashboard somewhere can raise an alarm to get that taken care of.

I would definitely agree that having any of your infrastructure on a network that is accessible from outside of your organization is fucking retarded.

We had a similar incident of a firmware update bricking Samsung refrigerators. Just a continuation of the trend of "you own nothing" and you need to rent everything and pay service contracts to the vendor. We got hp printers where you don't own the ink cartridge in your hand, but just a subscription contract to allow you to print a certain number of pages. We got subscriptions for heated seats and enabling the maxiumum power of the car.

Doesn't help that these legacy companies have notoriously incompetent software engineering and nonexistent concern for security. Things were real bad well before vibe coding and they'll only get worse.

I watched the Cyberpunk Netfix show and it had a bit about needing to pay a subscription to use your own washing machine. As shown by it locking up on a child when full of his wet school clothes. And the resulting cost of living ends up high enough that a regular non-corpo working mom can barely afford to live. They don't explicitly say the prices were algorithmially determined to be exactly what you can bear, but I'll assume something like that is happening in the setting. That's quite a cynical "late stage capitalism" take; as appropriate for cyberpunk.

But back in real life they are actually pushing to make something like that sci-fi dystopia real. We're just missing the cool cyber mods and true AI. We get to keep the appliances that lock up and the most banal forms of electronic surveillance.

In that setting, You also get to enjoy paying for premium real bottled water as the tap stuff will kill you.

Just a continuation of the trend of "you own nothing" and you need to rent everything and pay service contracts to the vendor. We got hp printers where you don't own the ink cartridge in your hand, but just a subscription contract to allow you to print a certain number of pages. We got subscriptions for heated seats and enabling the maxiumum power of the car.

Companies that pull this sort of Stierscheiße ought to be charged a 99.5% tax rate on subscription revenues, and have to write the government a thank-you note for the C-suites not spending the rest of their lives at donkey-work in inhospitable climates.

The issue probably is the cloud accounts, not that they had real ip addresses. Even my mild contempt towards french IT prowess doesn't assume a world in which they will leave them out in the open or allow them NAT traversal. Having the right to install your own server to manage your own devices should be basic ownership. But this is often impossible. Which is really infuriating with the security cameras that needs cloud account in china. Yaay.

What is this place?

This website is a place for people who want to move past shady thinking and test their ideas in a court of people who don't all share the same biases. Our goal is to optimize for light, not heat; this is a group effort, and all commentators are asked to do their part.

The weekly Culture War threads host the most controversial topics and are the most visible aspect of The Motte. However, many other topics are appropriate here. We encourage people to post anything related to science, politics, or philosophy; if in doubt, post!

Check out The Vault for an archive of old quality posts. You are encouraged to crosspost these elsewhere.


Why are you called The Motte?

A motte is a stone keep on a raised earthwork common in early medieval fortifications. More pertinently, it's an element in a rhetorical move called a "Motte-and-Bailey", originally identified by philosopher Nicholas Shackel. It describes the tendency in discourse for people to move from a controversial but high value claim to a defensible but less exciting one upon any resistance to the former. He likens this to the medieval fortification, where a desirable land (the bailey) is abandoned when in danger for the more easily defended motte. In Shackel's words, "The Motte represents the defensible but undesired propositions to which one retreats when hard pressed."

On The Motte, always attempt to remain inside your defensible territory, even if you are not being pressed.


New post guidelines

If you're posting something that isn't related to the culture war, we encourage you to post a thread for it. A submission statement is highly appreciated, but isn't necessary for text posts or links to largely-text posts such as blogs or news articles; if we're unsure of the value of your post, we might remove it until you add a submission statement. A submission statement is required for non-text sources (videos, podcasts, images).

Culture war posts go in the culture war thread; all links must either include a submission statement or significant commentary. Bare links without those will be removed.

If in doubt, please post it!


Rules


Recommended Posts And Communities

Recommended Realtime Chats