upvote
> The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details). … This is not something that a non-expert supermarket employee would be able to handle well.

I still don't see why the expert has to be remote, or why an integrated computer can't do the optimization. Or why it needs to be fiddled with at any significant frequency.

reply

  > I still don't see why the expert has to be remote
Because there are 1000 store locations. You're either then paying for 1000 mostly idle engineers, or somebody not really qualified has to don that hat, or you're flying your engineers around constantly. Or just connect the devices to the Wild Wild Web and be done with it.
reply
>>just connect the devices to the Wild Wild Web and be done with it.

Yup, they're done with it, all right. "It" being all the food being cooled for sale this week. Done.

They do not need engineers at every location to turn every knob. They need to define procedures and limits, and the ability to call the engineers when things go out of those limits. Even putting only remote MONITORING online, but requiring the local person to check and turn the knobs/press the buttons. That also adds an extra set of real eyes on the situation — when the engineer calls the local dept manager to start the defrost because the hacked line says it is now time to defrost, the local manager —with eyes on the freezer— can tell him "NO!" because this was not on their schedule and the freezers are all stocked, not emptied for the defrost.

Instead, the defrost cycle just turned on in the middle of the night, and neither the now-remote engineers nor the local managers knew until it was too late. ——Again.

Security is always a trade-off against convenience. And the idiot human managers almost always all pick convenience because their managers incentivize profit, and security costs and convenience appears to save up front. They nevermind the later costs because they'll already be promoted up or job-hopped out.

reply
That's my thought too.

These fridges may need more complex control for a variety of reasons, but that doesn't mean they have to be connected to _the internet_. To a local network for control, sure.

Put your security measures into the network itself, but I really do feel fridges are another thing which do not need to be IoT devices.

reply
> I still don't see why the expert has to be remote

Because then he can get paid more.

reply
> “That's why this equipment is remotely accessible”

Complicated things don’t have to be connected to the internet. Most environment control systems in small buildings (typically with hundreds of sensors and actuators) aren’t. There is smart, deterministic, software involved but most of the time, no cloud.

reply
And how much money the shop looses from the attack? It sounds it wiped out all the saving remote automation brought.
reply
> Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.

People always say stuff like this, but it never tracks for me. If you’re a chain with 1,000 stores, $500,000 is barely a blip on your budget sheet in exactly the same way that $500 is barely a blip on the budget of a single store.

Plus there’s no way this remote management stuff doesn’t cost at least $500/store in operating costs.

reply
> Plus there’s no way this remote management stuff doesn’t cost at least $500/store in operating costs.

Going by the number of companies that still can't grasp having to pay for ongoing maintenance for and IoT system, even with CRA and NIS2, some still selling stuff running on 12+ year old software, I wouldn't expect them to pay much for this service or to even properly maintain it.

reply
Don't compare it to the entire balance sheet, compare it to how much you'd have to pay someone to optimize it.

At $500/store/year times 1,000 stores, you can pay an entire team of experts for a year to come up with a way to save that money, and come out ahead. That team's manager can then go to their boss and say, look, I saved the company half a million dollars a year, and they'll get a nice bonus from it.

reply
How did these work then before the internet existed?
reply
deleted
reply
If only 50$ of those savings were invested in Tailscale.
reply
Or netbird. I was exactly thinking the same btw clearly we're missing out something. or maybe cybersecurity is a cow ready to be milked?
reply
Did Tailscale not have a major vulnerability just a few days ago?
reply
For a specific service only, not the networks. But that doesn't even matter that much - if you require the attacker to get both into the network and into the device, that's a significant improvement.
reply
I don't see why saving $500 per store a year is better than exposing your systems to cyber attacks.
reply
"That will never happen to us" - until it does.
reply
It’s not even “That will never happen to us” it’s “Joe, I need the WiFi password for the new fridge, do you remember what it is?” “Sure it’s $t0reNam3secur3dbec4useitsin13372023”
reply
It was a better deal before AI, but now the economics of a lot of things are changing rapidly.
reply
And yet... if they had instead invested in making the equipment operable locally we wouldn't be here today. This is the problem with thinking of your users as "nontechnical" lesser beings. The engineering problem becomes remove control and ownership from the user instead of make the product usable. In this case by removing control from the user they simply gave it to an attacker. Great job, guys.
reply