Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The gigantic and unregulated power plants in the cloud

berthub.eu

Post reply on HN
Print view View original

131–140 of 258 posts

Re: The gigantic and unregulated power plants in the cloud

#131

Post by BenjiWiebe »

DoctorOetker wrote: post #122
Derbasti wrote: post #102

There's a reason why I took my inverter offline after making sure that it was installed correctly. A cheap power meter now serves to measure my power generation instead.

Taking it offline doesn't protect against supply chain attacks in the form of built-in kill switches. A satellite could transmit signed instructions by modulating light below the noise floor, inverters must sense the voltage/current state of the PV panels anyway for MPPT to work. Only deep inspection of the silicon and code can improve the situation. Perhaps Western blocks could develop provably secure silicon IP and…

I'm curious about the feasibility of modulating light onto a solar panel. I feel it would not be feasible, except possibly onto a single panel at a time over a long time period. Just a gut feeling based off radio stuff (GPS).

Re: The gigantic and unregulated power plants in the cloud

#133

Post by crazygringo »

bilbo0s wrote: post #123
crazygringo wrote: post #81

Earlier quoted context omitted.

You're turning war into a black-and-white "total war" situation. Total war is rare, and no -- no ships have sailed. It's easy to imagine a scenario where something happens between China and Taiwan, Europe gets involved in a way that majorly pisses off China, and China decides to sabotage Europe's grid in response. Nothing about that is "total war" with Europe, and it's not like Europe is going to escalate with nukes…

You've totally missed the point. No one advocated ignoring the vulnerability. I, myself, specifically stated that monitoring should be direct. Consumers should unilaterally decide where, when and how their assets are monitored. The material point on security is that there are many, many methods of disrupting a power grid. Even when you are looking for plausible deniability, shutting down solar panels from cloud websi…

No, your point was clearly stated:

> But the security argument? Yeah, that ship has sailed. Total war, means total war.

Those are your words.

I'm saying, focusing on total war is irresponsible and leads you to draw false conclusions. In the real world, limited conflicts are what we're dealing with 99.9+% of the time, thank goodness.

And now in your new comment, for some reason you're focusing on "plausible deniability" which is another red herring. If China wants to disrupt Europe's grid, it doesn't care about plausible deniability -- the entire point is to publicly retaliatiate. It just needs to do it, as easily as possible. The idea that relying on a cloud vulnerability "doesn't make a list of your top 10 options" doesn't make any sense at all. It might very well be the #1 option, or one of three tactics employed simultaneously.

Re: The gigantic and unregulated power plants in the cloud

#134

Post by pas »

SnorkelTan wrote: post #49

If solar panels can be turned off, why are utility companies having to sell excess power at a loss? Why can’t they tell the solar farms to reduce their output by the required amount?

as far as I understand there's a market based solution. producers bid prices for time slots (consumers too, but that's less important from the perspective of a solar power plant) and if they win the contract is live, they need to input for that slot. if they miss (go over or under) they get paid less (and of course a penalty is possible too, theoretically it's the same)

this incentivizes better capacity and availability forecasting for solar installations, and preserves the usual dynamics of the open energy market.

..

the problem is with these super small ones, where initially states just let people connect it, because it's green, yey. (but now DSOs started to make connecting waay harder. and regulators are investigating, eg. in Spain. [0])

of course the non-residential installations already usually need aFRR capability. (eg. this is the case in Hungary.)

and there's already a market for "reserves" in the EU. (but the interconnection rate is below the target 15% as far as I know. but still, there are intra-state markets, etc.) and we can see that when solar is high the reserve prices are surging. [1]

[0] https://caneurope.org/content/uploads/2024/04/Rooftop-Solar-...

[1] https://gemenergyanalytics.substack.com/p/european-power-res...

Re: The gigantic and unregulated power plants in the cloud

#135

Post by msandford »

tivert wrote: post #109
bramblerose wrote: post #91

Earlier quoted context omitted.

The failure mode is much simpler: you don't need to physically break anything, you just need to drop 10GW of production from the grid (send a "turn off" command to all solar inverters) leading to a cascade of failures. Getting the grid back online is a laboreous manual process which will take (a lot of) time. Think https://en.wikipedia.org/wiki/Northeast_blackout_of_2003 or https://en.wikipedia.org/wiki/2021_Texas_po…

> Getting the grid back online is a laboreous manual process which will take (a lot of) time. Think... It would be even more laborious and take more time to bring things back online if the attacker manages to damage or destroy equipment with an overload like the GP describes.

The "turning the grid up to 11" attack isn't really possible. I know it seems like it is, but the inverters will only advance frequency so much before they back off, the inverters will only increase voltage so much. Etc. Sounds scary, isn't practical.

Turning everything off when the panels are at peak output? That lets frequency sag enough that plants start tripping offline to protect themselves and the grid and it'll cascade across the continent in just a few minutes. Then you have a black start which might take months.

There's an excellent video on how catastrophic a black start is. https://youtu.be/uOSnQM1Zu4w?si=x0dA7X7-19CJm6Kf

Re: The gigantic and unregulated power plants in the cloud

#136

Post by akira2501 »

Nextgrid wrote: post #7
yetihehe wrote: post #5

>The owner of the panels and inverters can meanwhile establish a connection with that manufacturer using an app or website, and via the manufacturer see how their own panels are doing > It wasn’t necessary from a technical standpoint to let everything run through the manufacturer’s servers, but it was chosen to do it this way. (emphasis from article) I'm working on IoT cloud system. It was chosen to be done this way…

The cloud can operate as a dumb TURN relay relaying E2E-encrypted traffic. Then the worst the cloud can do is deny service to remote management (and even then, local management would still work), but it wouldn't be able to send direct control commands to the equipment since they don't have the authentication nor encryption keys. This also makes it simpler from a programming point of view - instead of having separate…

This should be the basic model. A fully third party TURN service. You pay $20/mo to keep your home connected, and all devices and providers can use a standard protocol, and users remain fully in control of their data.

Re: The gigantic and unregulated power plants in the cloud

#137

Post by akira2501 »

toast0 wrote: post #57
lucianbr wrote: post #28

Earlier quoted context omitted.

What's the reasoning for not allowing both control paths, via cloud but also locally? So that people who can and want to, will use the local control.

The real answer is it's more than twice the work to have both paths, and there's not enough demand for it. That said, Apple Homekit integration is local network based, so products that do that and the typical manufacturer cloud system have done both paths. Homekit is a pain to use without Apple hardware/software, but there you go. (There's a plugin for HomeAssistant, but I'm still classifying that as a pain)

I have a weather station.

It can connect to standard cloud weather service providers and I can view my data there.

I can also just redirect that exact same protocol to any other host or IP I specify.

They built it once and just gave me the ability to control WHERE that data goes. It's honestly not that hard.

Re: The gigantic and unregulated power plants in the cloud

#139

Post by bww »

The author seems to imply, as if it were generally understood and accepted, that the reason nuclear reactors are heavily regulated is because they produce a lot of energy.

Perhaps that's a component, but one really doesn't need to think about it too hard to identify better explanations for why this particular energy source is held to unusually high regulatory standards.

I don't have an opinion as to whether other large-scale sources of energy should be held to similar standards, but to suggest that solar energy's failure modes are comparable to nuclear energy seems intentionally misleading.

Re: The gigantic and unregulated power plants in the cloud

#140

Post by akira2501 »

pheatherlite wrote: post #25
yetihehe wrote: post #5

>The owner of the panels and inverters can meanwhile establish a connection with that manufacturer using an app or website, and via the manufacturer see how their own panels are doing > It wasn’t necessary from a technical standpoint to let everything run through the manufacturer’s servers, but it was chosen to do it this way. (emphasis from article) I'm working on IoT cloud system. It was chosen to be done this way…

If we've learned anything from the security cam and baby cam scandals, then it's that convenience is king and we as a society would rather risk everything than be arsed to take few additional steps to setup/learn something to prevent such basic breaches. We (the society) don't even want to change the default password on most things.

> and we as a society would rather risk everything than be arsed to take few additional steps

Large manufacturers would like you to think this. It would provide them a convenient excuse for not even trying to differentiate the market along these lines.

> We (the society) don't even want to change the default password on most things.

Actually.. I just want to use my device _first_ and not go through some manufacturer controlled song and dance of dark patterns.

In my experience, if you don't pre load the user with this garbage, and then wait for them to have an actual _need_ that depends on the feature, they're FAR more compliant with following even lengthy instructions to get it done.

It's more a problem of aligned benefits and timing than anything else.

Post reply on HN