Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The gigantic and unregulated power plants in the cloud

berthub.eu

Post reply on HN
Print view View original

191–200 of 258 posts

Re: The gigantic and unregulated power plants in the cloud

#191

Post by yetihehe »

akira2501 wrote: post #140
pheatherlite wrote: post #25

Earlier quoted context omitted.

If we've learned anything from the security cam and baby cam scandals, then it's that convenience is king and we as a society would rather risk everything than be arsed to take few additional steps to setup/learn something to prevent such basic breaches. We (the society) don't even want to change the default password on most things.

> and we as a society would rather risk everything than be arsed to take few additional steps Large manufacturers would like you to think this. It would provide them a convenient excuse for not even trying to differentiate the market along these lines. > We (the society) don't even want to change the default password on most things. Actually.. I just want to use my device _first_ and not go through some manufacturer…

> In my experience, if you don't pre load the user with this garbage, and then wait for them to have an actual _need_ that depends on the feature, they're FAR more compliant with following even lengthy instructions to get it done.

Nope, they want to have it working out of the box like with any other manufacturer out there. If you enable functions only after user wants it, they will comment "this sh*t doesn't work" on your app store page. Then you have to respons to each comment with "what doesn't work, could you specify please?" and then after several days that user has enabled the functionality, but in the mean time several another gave such comments.

Re: The gigantic and unregulated power plants in the cloud

#192

Post by yetihehe »

BlueTemplar wrote: post #182
MathMonkeyMan wrote: post #41

Earlier quoted context omitted.

To be fair, I can do it only if I have time and physical access to the network. Home routers have different gateway IPs, different web interfaces, different password policies (e.g. there might be an admin password and an additional password for changing anything), etc. It reminds me of https://xkcd.com/627/ >, but when you're launching a product that isn't good enough. It's hard enough to open up a port even with uPN…

You mention IPv4. We're in 2024, this is getting ridiculous. Governments should have done the same thing as with digital TV transition(s) : first ban selling devices that can't do IPv6, then ban selling (most) devices advertising they can do IPv4.

Here comes Matter protocol to the rescue, it supports IPv6 natively. It's even more complicated than Zigbee and of course doesn't specify all the devices available (but 1/4 of protocol specification is dedicated to smart fridge functionality because one fridge producer actually had someone to do any collaboration with protocol makers) and allows for "manufacturer specific fields" which means all manufacturers will have incompatible implementations of some fields anyway and you can't control them universally.

Re: The gigantic and unregulated power plants in the cloud

#193

Post by callmeal »

Spivak wrote: post #53
m463 wrote: post #35

Earlier quoted context omitted.

why can't people just make stuff and sell it?

Because humans are an ongoing cost and no one has figured how to sell non-consumable slowly depreciating goods as one-off purchases and keep paying your employees once you saturate your market. Option 1: Artificially sell the thing as an ongoing cost. Option 2: Artificially make the depreciation cycle faster. Get consumers to regularly replace it anyway with upgrades or trend changes. Option 3: Make ongoing money fro…

>keep paying your employees once you saturate your market.

employees? they get fired once the market is saturated and demand flattens. ITYM shareholders.

When you look at it from that angle, another possible solution is:

- downsize manufacturing plant/capacity to make it match (or slightly exceed) replacement demand.

But that would mean a steady state profit margin (and not a cancerously growing one), so it will never fly.

Re: The gigantic and unregulated power plants in the cloud

#194

Post by yetihehe »

USiBqidmOOkAqRb wrote: post #180
yetihehe wrote: post #5

>The owner of the panels and inverters can meanwhile establish a connection with that manufacturer using an app or website, and via the manufacturer see how their own panels are doing > It wasn’t necessary from a technical standpoint to let everything run through the manufacturer’s servers, but it was chosen to do it this way. (emphasis from article) I'm working on IoT cloud system. It was chosen to be done this way…

>they want their panels to be accessible when they are outside their home I call bullshit . They've been conditioned to think that they want it, because all product brochures have it. What kind of tangible benefit could there be to know how bright the sun is at your home while you're not there? A cool party trick to virtue signal or a break between doomscrolling, I suppose, but it's not like you're gonna jump up and…

> I call bullshit. They've been conditioned to think that they want it, because all product brochures have it.

You gave reason WHY they want it. Maybe consumers were conditioned to want access, but they still want access. If you give them similar devices, they will chose the one which has application or webpage to see how their big investment is actually working. It's not about current state of device, it's all about historical data and month-by-month savings presented as a nice graph. They will check this maybe every week or month (later every several months), but buyers still want to know what their installation did for them.

Re: The gigantic and unregulated power plants in the cloud

#195

Post by berkes »

dpedu wrote: post #143
berkes wrote: post #130

Earlier quoted context omitted.

The Netherlands (about which the article mainly is) has 8.4 million households, let's presume they own average of one such PC you mention. A delta of 400W would mean a total consumption delta of 3.36GigaWatt. That's "peanuts" to cover. And that presumes an attacker can switch on/off all 8.4million computers in a small timeframe. 100% of them would need to be on, online and hacked. I don't think this is a realistic pr…

I don't doubt that that many watts is easy to cover - eventually. The problem is that it can be instantly turned on and off, whereas the grid takes time to shed load or add capacity. I found a figure on Wikipedia saying that the NL's 4.7GW worth of offshore wind capacity is 16% of their total electricity demand nationwide. 4.7/.16 = 30GW total, so this theorized computer load attack would represent about 10% of their…

You skipped over the part where I point out that my assumptions are completely off. These numbers presume that all computers in all Dutch households are hacked, running and connected to the internet. 5% of that would be on the high side even.

So a more realistic "attack" would be able to move demand, 0.5% of the total grid capacity. Switching on/off one smelter in an aluminium factory, is probably more than that. Hacking a major charging-station company and switching off their chargers is probably more than that even.

I understand the direction you think, and I agree that the combined power usage of "consumer devices" is big. But the larger power system is rather well protected by an attack on these devices through the diversity of these devices and the diversity of their setup (consumer firewalls, routers, individual protection, in-house fuses, local load killswitches etc).

The solar devises lacks this diversity, as the article mentions. There are few brands, and all of a brand need to connect to the one cloud service in the exact same way. So this does have a single point of attack. Whereas "switching on/off all personal computers in a country" is of an entirely different level.

Re: The gigantic and unregulated power plants in the cloud

#196

Post by akira2501 »

yetihehe wrote: post #191
akira2501 wrote: post #140

Earlier quoted context omitted.

> and we as a society would rather risk everything than be arsed to take few additional steps Large manufacturers would like you to think this. It would provide them a convenient excuse for not even trying to differentiate the market along these lines. > We (the society) don't even want to change the default password on most things. Actually.. I just want to use my device _first_ and not go through some manufacturer…

> In my experience, if you don't pre load the user with this garbage, and then wait for them to have an actual _need_ that depends on the feature, they're FAR more compliant with following even lengthy instructions to get it done. Nope, they want to have it working out of the box like with any other manufacturer out there. If you enable functions only after user wants it, they will comment "this sh*t doesn't work" on…

> they will comment "this sh*t doesn't work" on your app store page.

What if I told you those 3% of people will say this no matter what you do. These comments and the reality of your product are entirely disconnected. We had a small userbase and added voice uploads into the app; unsurprisingly, about 3% of them are clearly impaired in some way when they leave a message. [x-files theme].

In any case, a simple "Fast / Slow Setup?" question to start is all you need, and a "Do More Setup?" after they finish one item has, again, in my experience, been entirely sufficient.

Reasonable people understand, "oh.. this needs the cloud.. and I didn't do that part yet.. so I'll go ahead and click the 'social media provider' button." If you also decide this is a good time to ask about a news letter, well, you got what you bargained for.

Re: The gigantic and unregulated power plants in the cloud

#197

Post by tlb »

msandford wrote: post #135
tivert wrote: post #109

Earlier quoted context omitted.

> Getting the grid back online is a laboreous manual process which will take (a lot of) time. Think... It would be even more laborious and take more time to bring things back online if the attacker manages to damage or destroy equipment with an overload like the GP describes.

The "turning the grid up to 11" attack isn't really possible. I know it seems like it is, but the inverters will only advance frequency so much before they back off, the inverters will only increase voltage so much. Etc. Sounds scary, isn't practical. Turning everything off when the panels are at peak output? That lets frequency sag enough that plants start tripping offline to protect themselves and the grid and it'l…

Inverters may be protected against changing settings, but if you can replace the firmware it can likely cause permanent hardware damage. Which the manufacturer, perhaps under pressure from its government, can do.

Re: The gigantic and unregulated power plants in the cloud

#198

Post by pjc50 »

yetihehe wrote: post #5

>The owner of the panels and inverters can meanwhile establish a connection with that manufacturer using an app or website, and via the manufacturer see how their own panels are doing > It wasn’t necessary from a technical standpoint to let everything run through the manufacturer’s servers, but it was chosen to do it this way. (emphasis from article) I'm working on IoT cloud system. It was chosen to be done this way…

OK, so key question: why is there a control plane in there at all?

I can understand people wanting to be able to see the metering live, but remote control of the panels just seems like a security incident waiting to happen. I'm quite glad I have a non-internet-connected inverter.

Re: The gigantic and unregulated power plants in the cloud

#199

Post by immibis »

1053r wrote: post #59
delroth wrote: post #51

> In the Netherlands alone, these solar panels generate a power output equivalent to at least 25 medium sized nuclear power plants. Since this didn't pass the smell test: the author is looking at nameplate capacity, which is a completely useless metric for variable electricity production sources (a solar panel in my sunless basement has the same nameplate capacity as the same panel installed in the Sahara desert). Lo…

For the purposes of information security, the nameplate capacity is the correct number to consider for a very simple reason: we must defend as if hackers will pick the absolute worst moment to attack the grid. That is the moment when the sun is shining and it's absolutely cloudless across Netherlands, California, Germany, or wherever their target grid is. At that moment, the attacker will not only blast the grid with…

The "bad iPhone bug" scenario happened a few weeks ago, in the form of Crowdstrike. You underestimated the damages.

Re: The gigantic and unregulated power plants in the cloud

#200

Post by anentropic »

berkes wrote: post #130
dpedu wrote: post #127

I can make my computer wildly vary the amount of power it is drawing by performing different things in software. Max out the CPU and GPU load and it will instantly change from drawing ~100 watts to 500 or more. There have been plenty of botnets in the past. Some even in the millions of computers. If such a botnet decided to make every node's power draw fluctuate per above, wouldn't this cause the same type of problem…

The Netherlands (about which the article mainly is) has 8.4 million households, let's presume they own average of one such PC you mention. A delta of 400W would mean a total consumption delta of 3.36GigaWatt. That's "peanuts" to cover. And that presumes an attacker can switch on/off all 8.4million computers in a small timeframe. 100% of them would need to be on, online and hacked. I don't think this is a realistic pr…

> Tesla F-ing up an OTA update that suddenly switches all charging Tesla's off, is probably a theoretical worse scenario.

and sounds like something that could easily occur

Post reply on HN