Water system controllers don't belong on the internet, says ex-NSA chief • Hacker News Board

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#171

Post by KetoManx64 » Sun, Aug 09, 2026, 6:17 PM UTC

amluto wrote: post #156

spauldo wrote: post #114

Earlier quoted context omitted.

A microcontroller based solution is rarely a good replacement for a PLC. You can find integrators willing to come out and troubleshoot your device in the field a lot more easily than embedded progammers and vendor support is usually excellent. When your plant is down, that sort of thing matters. PLCs handle harsh environments for decades, whereas with a microcontroller all the thermal issues and power conditioning ar…

This system barely deserves a PLC. The modules are only a couple of extremely basic analog inputs and outputs, plus a wildly outdated and unsupported HMI. And the entire plant could possibly be replaced with something more modern for less money than upgrading the PLC. (Or I could get something cheap from AutomationDirect - I have no idea how good their PLCs are.)

I worked at a manufacturing plant that had originally been setup in ~2003 or so and they had a bunch of servers and desktops still hanging on by a fingernail when started there. It took me about a year of but I was able to clone and virtualize them all and they all ran fine on a 6 core Proxmox server with 32GB of RAM. Really drove home the realization of how far technology has progressed and how commoditized manufacturing/enterprise tools have become.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#172

Post by mikestew » Sun, Aug 09, 2026, 7:44 PM UTC

tda wrote: post #150

aliasxneo wrote: post #31

Part of my career encapsulates a period where I was a PLC programmer, installer, commissioner, and troubleshooter for massive build outs (sky scrapers, data centers, laboratories, factories). Interestingly, this was after years of teaching myself software engineering, eventually participating in large open source projects. The clash of entering the PLC world was _extremely_ harsh. Let me give an example: I once worke…

Yep, everything is lacking. No version control, ladder diagrams instead of written code, goto statements as primary control flow in code. A $500 PLC with less processing power than a 1985 086 and 1 whole MB of memory. Upgradable with a $200 license to 1.5MB, only programmable with a 20GB monstrosity of a piece of software in which download means copying a program.e to the PLC, and upload means downloading a backup to…

Hey, hey, a little trigger warning over here? My last job before retirement was in that world. If it had been my first software job, it would have been my last.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#173

Post by procarch2019 » Sun, Aug 09, 2026, 10:45 PM UTC

andyjohnson0 wrote: post #138

amelius wrote: post #35

Earlier quoted context omitted.

Forgive my ignorance but isn't a PLC simply a computer with some GPIO ports? I.e., a Raspberry Pi could be called a PLC? Why are we talking about them as if they are something else? Is it an exotic OS that makes them different?

In addition to the other replies here: PLCs are ruggedised and built to survive for years in the kinds of hostile environment that are frequently found in industrial settings. And PLC vendors typically provide guaranteed support periods that are much longer (like a decade or more) than those commonly provided by conventional computer OEMs.

The hardware my company uses has a lifecycle of 15-20 (aka what we typically look at when we consider lifecycle of a plant). This is not meant to be the whole life of a plant, but possibly the life of the current controls. Things/people/companies change. I’ve seen some really shortsighted people rip and replace a sub-decade control system because of “bad experiences”. The industry can be great where it’s great and terrible where it’s terrible.