Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The gigantic and unregulated power plants in the cloud

berthub.eu

Post reply on HN
Print view View original

201–210 of 258 posts

Re: The gigantic and unregulated power plants in the cloud

#201

Post by Dylan16807 »

DoctorOetker wrote: post #185
Dylan16807 wrote: post #170

Earlier quoted context omitted.

You're describing two very different concepts at the start. A data diode applies to a specific connection. It's easy to have a serial port that goes one way. Preventing any possible input to an already compromised device is much harder. But if your device isn't already compromised then it won't be looking at the input light levels for commands.

> But if your device isn't already compromised then it won't be looking at the input light levels for commands. But this is precisely part of the threat model, the manufacturers are best positioned to execute supply chain attacks on foreign buyers.

That was not part of the threat model in the section of the post that mentioned data diodes.

And it's vastly harder to do an attack like that.

Re: The gigantic and unregulated power plants in the cloud

#202

Post by ale42 »

more_corn wrote: post #161
t0mas88 wrote: post #129

Earlier quoted context omitted.

The risk is not turning all solar installations "on maximum". That happens nearly every summer day between 1 and 2pm. Automatic shutoff when the grid voltage is rising can be disabled, but more than 9 out of 10 consumer solar installations in the Netherlands deliver their maximum output on such a day for most of the summer, not running into the maximum voltage protections. The big risk is turning them all off at the…

Not if we have grid scale batteries. Solar shuts off, oh no. Sometime in the next four hours we need to get that fixed or something else up. Also flattens out the demand curve and allows arbitrage between the peak and valley.

Problem is, those batteries are not there (yet)...

Re: The gigantic and unregulated power plants in the cloud

#203

Post by huijzer »

bramblerose wrote: post #91
1053r wrote: post #59

Earlier quoted context omitted.

For the purposes of information security, the nameplate capacity is the correct number to consider for a very simple reason: we must defend as if hackers will pick the absolute worst moment to attack the grid. That is the moment when the sun is shining and it's absolutely cloudless across Netherlands, California, Germany, or wherever their target grid is. At that moment, the attacker will not only blast the grid with…

The failure mode is much simpler: you don't need to physically break anything, you just need to drop 10GW of production from the grid (send a "turn off" command to all solar inverters) leading to a cascade of failures. Getting the grid back online is a laboreous manual process which will take (a lot of) time. Think https://en.wikipedia.org/wiki/Northeast_blackout_of_2003 or https://en.wikipedia.org/wiki/2021_Texas_po…

That doesn’t necessarily lead to a failure. In Texas a nuclear plant went down. About 1.2 (or 4 times that) GW (https://www.keranews.org/news/2023-06-22/with-temperatures-s...).

The grid stayed online. Likely thanks to grid batteries, see aforementioned link.

Re: The gigantic and unregulated power plants in the cloud

#204

Post by mikewarot »

DoctorOetker wrote: post #120
mikewarot wrote: post #111

It irks me endlessly that we live in the worst timeline, where the computer equivalent of fuses and circuit breakers are almost completely unknown. Instead we trust code blindly. This results in almost all of the situations threads here address. In a better timeline, everyone has stable and secure OSs on all their devices, and the default is for everything to be locally networked, with optional monitoring from the ou…

it's incredibly hard to implement a data diode for PV systems, enemy satellites can modulate light (like a TV remote, but lower baudrate to stay below the noise floor) and an inverter could decode it and respond accordingly. They measure the PV panels anyway for MPPT.

Sunlight is about 1000 watts/meter^2 on the ground. Do you have any idea how much power you'd have to send to get through a Jewish Space Laser(tm) to even have a -40 db s/(s+n) signal to pull out of the noise through a side-channel attack?

It would be interesting to use a solar panel as a sensor for moonbounce of an IR laser, though. You'd have to try at the almost new moon, with a window of a few hours/month ;-)

Re: The gigantic and unregulated power plants in the cloud

#205

Post by msandford »

kortilla wrote: post #179
msandford wrote: post #135

Earlier quoted context omitted.

The "turning the grid up to 11" attack isn't really possible. I know it seems like it is, but the inverters will only advance frequency so much before they back off, the inverters will only increase voltage so much. Etc. Sounds scary, isn't practical. Turning everything off when the panels are at peak output? That lets frequency sag enough that plants start tripping offline to protect themselves and the grid and it'l…

Months isn’t correct. Unless there was damage it could be recovered within a day.

Would love to know more about this. How would that happen? What's the process to bring it back up so fast?

The video has a lot of good info and seems compelling. During the Texas freeze many power company officials said the exact same thing, if the Texas grid went down it would have taken weeks to bring everything back online.

Re: The gigantic and unregulated power plants in the cloud

#206

Post by DoctorOetker »

Dylan16807 wrote: post #201
DoctorOetker wrote: post #185

Earlier quoted context omitted.

> But if your device isn't already compromised then it won't be looking at the input light levels for commands. But this is precisely part of the threat model, the manufacturers are best positioned to execute supply chain attacks on foreign buyers.

That was not part of the threat model in the section of the post that mentioned data diodes. And it's vastly harder to do an attack like that.

Its quite trivial really, what is needed to capture a weak signal with known modulation from the background is integration time. Think of how deep space light can be captured with digital cameras with "long" exposure times it can reveal light the human eye can't see because the integration time of light on the retina is too short.

Now other light sources will also integrate with time, this is where the modulation scheme comes in. First consider the amount of time you'd have to integrate the noisy signal to raise it above the noise floor. Thats the on time you need. How do we remove background light variations from other sources? Consider a discrete time pre-agreed pseudorandom sequence, that has "0" periods as often as "1" periods. To remove a constant background you take calculate the sum of light intensities of all "1" periods and the sum of all measured intensities of "0" periods. Then you subtract the "0"-sum from the "1"-sum, a constant signal will remove itself, the satellite signal will be summed N times. since your pseudorandom sequence was kept secret, random variations in light (think bird passing by) will not conspire to selectively block light during the "1" periods, so such noise will be uncorrelated with your pseudorandom signal. adding N uncorrelated noises grows by sqrt(N), so the S/N-ratio grows as sqrt(N). These are widely understood methods, an engineer might call it lock-in amplification, a physicist might call it correlation. This is very basic engineering / science knowledge. It's baffling that people consider this "hard" to execute, sure if you're the milk-man in a village this is hard to execute.

Re: The gigantic and unregulated power plants in the cloud

#207

Post by huijzer »

ale42 wrote: post #202
more_corn wrote: post #161

Earlier quoted context omitted.

Not if we have grid scale batteries. Solar shuts off, oh no. Sometime in the next four hours we need to get that fixed or something else up. Also flattens out the demand curve and allows arbitrage between the peak and valley.

Problem is, those batteries are not there (yet)...

Don’t underestimate exponentials. Tesla produced 6.5 GWh of battery storage in 2022, 14.7 GWh in 2023, and will probably double again in 2024.

And other battery manufacturers such as BYD grow fast too.

Re: The gigantic and unregulated power plants in the cloud

#208

Post by Aachen »

delroth wrote: post #51

> In the Netherlands alone, these solar panels generate a power output equivalent to at least 25 medium sized nuclear power plants. Since this didn't pass the smell test: the author is looking at nameplate capacity, which is a completely useless metric for variable electricity production sources (a solar panel in my sunless basement has the same nameplate capacity as the same panel installed in the Sahara desert). Lo…

> (a solar panel in my sunless basement has the same nameplate capacity as the same panel installed in the Sahara desert).

Isn't latitude taken into account by grid operators for determining their expected peak output? The owners would otherwise be installing bigger (more expensive) converters than needed, so they'd know this value at least roughly. Even smarter would be to include the angle etc. but not sure what detail it goes into compared to latitude which is a very well-known and exceedingly easy to look up value for an area

I certainly see your point about it not being apples to apples, but on a cloudless summer day, the output afaik genuinely would be the stated figure (less degradation and capacity issues). The country is small enough that it's also not unlikely that we all have a cloudless day at the same time

One might well expect some sun in summer and put some of the used-in-winter gas works into maintenance or, in the future, count on summer production of hydrogen— although hacks are likely a transient issue so I wouldn't foresee significant problems there

Re: The gigantic and unregulated power plants in the cloud

#209

Post by Aachen »

titzer wrote: post #69
pheatherlite wrote: post #25

Earlier quoted context omitted.

If we've learned anything from the security cam and baby cam scandals, then it's that convenience is king and we as a society would rather risk everything than be arsed to take few additional steps to setup/learn something to prevent such basic breaches. We (the society) don't even want to change the default password on most things.

People gonna be people. It's up to engineers and product designers to make things user friendly but also safe-by-default. If something needs to be configured, then provide instructions on how to configure it. Instead of pretending that it's society's fault (can't be arsed ), maybe ask why the IT industry can't make instructions that are written out--explicit, fairly standard, and easy to follow--like the manual for p…

> Instead of pretending that it's society's fault (can't be arsed), maybe ask why the IT industry can't make instructions that are written out

Because the competitor that doesn't have this installation "hassle"¹ will sell more units. It ends back up with society choosing to behave this way in aggregate

Society is obviously good (wouldn't want to live without it) and capitalism held up for hundreds of years now (not sure it's the best solution but with the tweaks that are in place in many well-faring countries it seems to work okay for them), but I do believe "society" does have a tendency to go for easy and cheap more than complicated and thorough when the need is not self-evident and has not been tangibly pointed out in living memory

¹ Example of hassle that HN users may not think of as exceedingly difficult: iOS setup. My dad asked me to help him set up his new tablet. I've fallen for Apple's motto and was annoyed he doesn't just do it himself. So we sit there and... lo and behold, it's good that he asked me. I forgot the details by now but things like what the heck screen time is, whether the Find My network is something to enable, whether to enable automatic updates, what to do about Siri, whether Apple Pay is something he needs to use banking apps, etc. are not things he'd have any idea of and I can give the necessary context from my IT background even if I don't have iOS myself. However, we still needed to contact their support because we both couldn't figure out how to get an Apple account set up. The continue button was disabled. I tried scrolling: nothing. Tapping the button: nothing. No error message, nothing. Turns out, the flow was only tested in portrait mode but my dad wants landscape mode easier for typing and so we never tried portrait. A part of the screen was in fact scrollable (I've used Apple devices before and my dad used the old tablet weekly, it's not like we're not familiar with their design patterns or don't know how to use a touchscreen) and revealed a required input field that would have been visible by default in portrait. Next, even setting up a standard Microsoft 365 email server in Apple Mail wasn't self-evident, iirc because he had never heard of the word Exchange and the oauth flow worked across multiple devices with again different bugs in Apple's own UIs (one needed landscape instead of portrait, another required some trick with zooming beyond intended bounds iirc)

"Hassle" is already perceived in setting up what people proclaim the most user-friendly of systems. Units that don't need it will absolutely sell better, even if that leads to a potential national energy supply risk

Re: The gigantic and unregulated power plants in the cloud

#210

Post by ossyrial »

epistasis wrote: post #156
delroth wrote: post #62

Earlier quoted context omitted.

I have no idea what you're talking about, since nowhere did I use solar capacity factor data nor did I look at number of reactors per plant.

You are using both with your energy generated numbers. That's where they come from. Your solar TWh comes from 25GW at ~15% capacity factor, and to get your nuclear numbers you're looking at 1.6GW for each of nuclear "plants" when each reactor is usually about 1GW or less. There are ~90 reactors in the US, at 54 plants. The article is assuming 1 reactor per plant for the Netherlands.

> The article is assuming 1 reactor per plant for the Netherlands.

Small addition that isn't mentioned in the English version of the article, but only in the original Dutch version: the article talks specifically about the Borssele power station [0] (which has a power output of 485MW).

[0]: https://en.wikipedia.org/wiki/Borssele_Nuclear_Power_Station

Post reply on HN