site banner
PaperclipPerfector  1d ago (text post)   5171 thread views

Culture War Roundup for the week of October 12, 2026

This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.

Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.

We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:

  • Shaming.

  • Attempting to 'build consensus' or enforce ideological conformity.

  • Making sweeping generalizations to vilify a group you dislike.

  • Recruiting for a cause.

  • Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.

In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:

  • Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.

  • Be as precise and charitable as you can. Don't paraphrase unflatteringly.

  • Don't imply that someone said something they did not say, even if you think it follows from what they said.

  • Write like everyone is reading and you want them to be included in the discussion.

On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.

6
Top Bottom Old Controversial Comments
Jump in the discussion.

No email address required.

https://uk.finance.yahoo.com/news/french-supermarket-chains-cyberattack-forced-115141288.html

Major French supermarket chains on Monday said they were hit by a cyberattack that caused their refrigerators to shoot up in temperature in hundreds of stores, forcing spoiled food to be thrown away and raising concerns about food security.

"Food security requires more attention at all levels," said the EU's food and agriculture commissioner Christophe Hansen on X, condemning the attack and saying such "exploitation of food" was now a "reality".

At least 300 shops of Intermarche or its Netto brand were targeted, along with over 100 Cooperative U outlets, and several E. Leclerc stores, the retailers told AFP in separate statements.

BFM TV said hackers "managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores".

Those branches that were affected will have to "throw away all of the products" that are fresh and frozen, Intermarche told AFP.

Specialist French retail sector news website jebosseengrandedistribution.fr said other retail giants Carrefour Market and Monoprix were affected but the companies have yet to confirm this.

E. Leclerc confirmed to AFP "that a cyberattack affected one of its refrigeration equipment suppliers," resulting in "repercussions on the operation of refrigeration systems in several stores".

A source close to the issue said refrigeration control systems from Danish manufacturer Danfoss were targeted.

Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware". It added that it had long advised supermarkets to update from those models. Danfoss gave no figures of how many systems were affected.

A person close to French Prime Minister Sebastien Lecornu said France's cyber security agency had already identified "a vulnerability in software supplied by a Danish company and has contacted the vendor".

"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable," he wrote on X.

He added that the company's teams were "fully mobilised" to restore the situation as quickly as possible.

"An investigation will be necessary to shed full light on this attack," he added.

Intermarche condemned the food waste and financial losses resulting from the attack, without providing figures.

BFM TV said temperatures were "altered remotely, resulting in the destruction of stocks of fresh and frozen products".

The incident comes against the background of growing concern over the potential havoc that can be caused in Europe in all sectors by malicious actors carrying out cyberattacks.

By likely affecting hundreds of units simultaneously, the attack demonstrated "a certain level of sophistication," he added.

This is a poetry of stupid and the hackers are the least guilty party here. Lets start with the obvious. Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates. How did we get to the point where a device that should be pid controller, compressor and alarm can be hacked.

To make you feel better - all of your nice EVs are also permanently connected and I doubt that there is air gap between the infotainment and the firmware of the battery pack. Someday someone will be able to accelerate or set on fire EV remotely. And probably soon.

Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates

Having worked as a refrigeration tech before, I may have some insight- this was almost certainly done for management and monitoring. Defrost cycles are very important to keep freezers from bricking themselves, and danfoss controllers are very common as an alternative to a mechanical time clock- because they’re fully programmable to the conditions of the specific box.

Why they were connected to the internet is probably because corporate wanted to be able to mess with it without sending someone in person. The stated reason was probably so they could set passwords but in reality it was to make in house maintenance personnel’s lives easier.

Seems to me that the smarter way to do this would be to have a site-to-site VPN between your corporate office and the store's internal network. Then the freezers remain on the "internal" corporate network and aren't exposed to the internet.

This may be shocking to professional software engineers, but most companies do not put systems on a VPN prior to those systems being hacked.

I guess a lot depends on when the system was put together, but as a professional I.T. guy, oof. Of course you put them on the VPN! That's been the sane choice for at least twenty years. If you absolutely, positively can't for some reason, then you at least whitelist the control server at the firewall level and block other traffic to the device.

Now if they were small enough not to have an I.T. department, I'd understand. But more likely I.T. was overruled.

It was probably put together by career HVAC techs who told them to set up communication via a web portal so they could initiate defrosts* on their cellphones, and then set the passwords to their lastnames.

*For those in the back who don't know, commercial freezers are supposed to have an electronic defrost that clears ice off the evaporator so it doesn't inhibit airflow. This attack worked by reprogramming that defrost to never end.

Most full-size residential fridge units have auto-defrost circuits. I'm not aware of having to run one manually before: it's probably not meant to be manually controlled like that. The little ones generally need to be taken outside to thaw occasionally. I believe heat pumps for HVAC need auto-defrost too.

Usually commercial freezers have a manual defrost switch to test functionality or restore operation after a freeze up caused by misuse, which is what they triggered.

Yes but that does require more infrastructure. It's also very possible that the units connect to a manufacturer cloud controller on the Internet only on outbound connections, which is typically reasonably secure so long as you use SSL pinning etc, or even on an IPSEC tunnel, but that the cloud controller was itself compromised in some way.

The manual for one of the affected models is available online, see page 11. The idea of a web host running on the hardware controller is... not the worst thing I've ever done, but :

"If the remote connection is on a WAN then the LAN router may need to be configured to allow this inbound counnection, with the addition of the web port added tot he end of the http string."

Definitely worse. I was building web-accessible hardware in 2013. This was, to be fair, a couple years pre-Let's Encrypt, and SSL wouldn't have solved this specific problem.

But I still knew better than that.

Early descriptions of the attack have claimed that there was a master password for the device exposed on the same interface (unclear if it's the HTTP or XML), which allowed the control commands through in bulk.

Yeah, this sounds terrible. I wonder how hard it is to run Tailscale on a freezer. Surely the licensing costs for a freezer tailnet are miniscule compared to the reputational damage they have suffered.

A lot of this hardware predates tailscale, and pre-2016 VPNs were... very frustrating to manage even on normal desktop or laptop computers: you at least could run IPSec so the protocol situation wasn't awful, but the server management was either OpenVPN's too-techy-for-some-techs world, or expensive per-user licensed stuff, or untrustworthy stuff like Hamachi.

As for how difficult it would be to fix today... depends a lot on the hardware implementation. A pure MCU-driven approach would be cleaner, less expensive, and more stable, but also much harder to write a VPN or VPN-like capability into, just because of limited RAM and multithreading. An ESP32 can (and many people do) run it, but it's something you need to build into the system early and limits what else you can do. And 2010-era microprocessors would be really hard-pressed to run the stuff Danfoss's guides show, anyway.

It looks like they were on (Linux-based?) conventional embedded computers, at which point adding tailscale is mostly a matter of sysadmin work (and, uh, depending on how old the distro fork/variant, a lot of swearing about compile time and troubleshooting dependencies).

I mean, if this freezer can run an HTTP server with a control panel, it can certainly run Tailscale. I agree that older VPNs were terrible, I remember arranging them between us and our more paranoid customers (not the most paranoid ones, which demanded we keep maintaining our homebrew dial-up client) was a royal pain in the ass. Even bare Wireguard sucks.

All of these manuals are online for technicians to read.

Oh my, that is indeed dire.

Geez, page 60 has a default admin password of 12345... There's a decent chance they just used that and then clicked the defrost button. It's fortunate that the attackers appear to have been unsophisticated, apparently you can also remotely upload new firmware and they don't describe any verification or signature validation.

Or maybe half a step more sophisticated they got VPN creds for the grocery store from a data breach or something, I doubt they were just sitting accessible on the internet. That's the sort of thing Shodan would have flagged years ago.

And right next to the default password:

To guarantee the best experience when connecting to your AK-SC, ensure you [sic] PC has the latest version of Adobe® Flash®

Yes, all of that stuff is absolutely industry standard- because most of these freezers are worked on by contractors with an end user who don’t know nothing about nothing and they need a default admin password.

Their main competitor is even worse.

The default admin password would be common in normal IT world until 2020: it took a combination of California law (2018's SB-327) and NIST's mandate, along with some questionably-authorized-by-statute contracting pressures, that really made it universal for routers. I'll still see it (or password) on internal-only equipment, including some still-being-sold-as-new Unifi devices.

It's not even necessarily wrong in an environment where you'd expect some intrusion detection, or where the device requires a change on first login. It's just bizarre to do it, and then recommend people forward a WAN directly. This particular attack seems to have depending on another, different 'master' password, so I guess it doesn't even matter, but that's another thing that on its own points to 'reasonable if you're not that concerned about horizontal movement' (common in 2013) and really bad if you have any reason to worry about being the first hop in an infection.

Like, I'd hope they have fail2ban or equivalent set up? But I wouldn't be optimistic.

The competitor being worse makes me really concerned.

You are aware these are freezers, right? Like they're important but they're not holding onto private data or whatever.

Emerson writes the password on the device for technicians to have access to, and Ke2therm uses all fives(no, it can't be changed).

More comments

This system was not designed by IT professionals.

What is this place?

This website is a place for people who want to move past shady thinking and test their ideas in a court of people who don't all share the same biases. Our goal is to optimize for light, not heat; this is a group effort, and all commentators are asked to do their part.

The weekly Culture War threads host the most controversial topics and are the most visible aspect of The Motte. However, many other topics are appropriate here. We encourage people to post anything related to science, politics, or philosophy; if in doubt, post!

Check out The Vault for an archive of old quality posts. You are encouraged to crosspost these elsewhere.


Why are you called The Motte?

A motte is a stone keep on a raised earthwork common in early medieval fortifications. More pertinently, it's an element in a rhetorical move called a "Motte-and-Bailey", originally identified by philosopher Nicholas Shackel. It describes the tendency in discourse for people to move from a controversial but high value claim to a defensible but less exciting one upon any resistance to the former. He likens this to the medieval fortification, where a desirable land (the bailey) is abandoned when in danger for the more easily defended motte. In Shackel's words, "The Motte represents the defensible but undesired propositions to which one retreats when hard pressed."

On The Motte, always attempt to remain inside your defensible territory, even if you are not being pressed.


New post guidelines

If you're posting something that isn't related to the culture war, we encourage you to post a thread for it. A submission statement is highly appreciated, but isn't necessary for text posts or links to largely-text posts such as blogs or news articles; if we're unsure of the value of your post, we might remove it until you add a submission statement. A submission statement is required for non-text sources (videos, podcasts, images).

Culture war posts go in the culture war thread; all links must either include a submission statement or significant commentary. Bare links without those will be removed.

If in doubt, please post it!


Rules


Recommended Posts And Communities

Recommended Realtime Chats