This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.
Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.
We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:
-
Shaming.
-
Attempting to 'build consensus' or enforce ideological conformity.
-
Making sweeping generalizations to vilify a group you dislike.
-
Recruiting for a cause.
-
Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.
In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:
-
Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.
-
Be as precise and charitable as you can. Don't paraphrase unflatteringly.
-
Don't imply that someone said something they did not say, even if you think it follows from what they said.
-
Write like everyone is reading and you want them to be included in the discussion.
On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.
Jump in the discussion.
No email address required.
Notes -
https://uk.finance.yahoo.com/news/french-supermarket-chains-cyberattack-forced-115141288.html
This is a poetry of stupid and the hackers are the least guilty party here. Lets start with the obvious. Why freezers needs to be visible, why do they need to be remotely managed, why is not this done on dedicated internal network, why do they need firmware updates. How did we get to the point where a device that should be pid controller, compressor and alarm can be hacked.
To make you feel better - all of your nice EVs are also permanently connected and I doubt that there is air gap between the infotainment and the firmware of the battery pack. Someday someone will be able to accelerate or set on fire EV remotely. And probably soon.
My house has smart lights in it. I decided to try pairing them to my phone in case I have time to ever want to change their color one day.
After connecting the app tells me some of the bulbs need a firmware update. Light bulbs need firmware updates these days, apparently.
So yes of course supermarket refrigeration systems also need firmware updates.
While I'm generally in the camp of having as little "smart" appliances as possible due to the obvious problems with hacking, currently I'm curious about going entirely the other way: IF your appliance is already smart anyway, why not run an oversight AI whose sole job is verifying that the appliance runs as intended and which just stops any weird behaviour like the extended defrosting here? Surely some companies will find a way to fuck this up and make the AI itself hackable, but at least in principle this would obviate the need to patch every possible exploit or weakness; As long as the AI is unaffected, it can just overrule obvious nonsense.
And you can go even further, at least once costs have crashed far enough: Imagine each AI just building a custom codebase for its particular appliance, which they only minimally expose to the outside, so that not only are no exploits reusable, even just finding exploits is a completely uneconomical Hacking Blind nightmare.
The future is going to be fucking weird, and scary.
There's a small industry for this sort of thing in the networking sphere, originally as intrusion detection or endpoint monitoring, and quickly pivoted from raw algorithmic or threshold-based structures to AI-based routines (imo, before it was ready).
The simplest problem is that a lot of shops just don't use it. In some contexts it's either effectively required, like criminal justice or defense industry work, or strongly encouraged like academia, but even in those spheres it's not always done or done well. The last setup I ran for a small and closed environment was 30+ hours of setup and configuration, and not a small amount of weekly tuning to get it to stop spamming me for false positives or ignore test 'incidents', and that was where everything fit in a single if big room. And those requirements are relatively recent.
(to be fair, some of those hours was a meeting to find out who owned a fucking firewall).
So I can understand a business not wanting to implement that, and doubly not wanting to do so in pre-2013 where a lot of this hardware came from. And, of course, running an LLM on 2013 hardware just isn't happening: a lot of these old embedded computing machines run under a half-gig memory and a processor that measures its single core's clock speed in hundreds or even tens of megahertz.
That said, even assuming they could have done it, both approaches are rough in many ways. Customers and non-technical endusers are notoriously prone to alarm fatigue, where even a small number of false positives discredit the alarm fully. At the same time, they'll also routinely implement processes you'd never imagine. And ultimately, you're trying to safeguard against the aftermath of intrusion, so you don't just need to worry about the AI being 'hackable', but even stupid stuff like the hardware controller getting locked up or reprogrammed into sending replays of past 'good' data, for some examples.
It's not impossible, but it's a lot of work for marginal benefit, especially compared to more traditional security approaches.
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link