5 ms·

https://twitter.com/SarahTaber_bww/status/1105256557154127872 https://twitter.com/SarahTaber_bww/status/110525655715412787... >I don't I've quite articulated w

https://twitter.com/SarahTaber_bww/status/1105256557154127872 https://twitter.com/SarahTaber_bww/status/110525655715412787... >I don't I've quite articulated why I'm so critical of the tech industry. Tech isn't just software anymore. They're coming for ag, food, & manufacturing- & they're bringing a negligent attitudes towards risk & safety that they learned in the cushy world of apps. And this malware is affecting industries with a strong incentive for safety, think about what that might imply about every other industry.

peteradio 8y ago
Really good rant there
- webdevatlurk 8y ago
  @SarahTaber_bww is a really good twitter follow for people who want to learn interesting bits about agriculture & tech.
gmueckl 8y ago
Repeat after me: safety is not security. Ponder this for a while. Safety is about giving guarantees that the right response happens at the right time to prevent disaster. Security is making sure that whoever you are communicating with is who they claim to be and not an imposter. Heavy industry cares a lot for safety. An exploding refinery is not in any company's best interest. But the systems they rely on have absolutely no notion of security. They have no way to distinguishing between true and spoofed input values that are fed into a control system.
- mikeash 8y ago
  By those definitions, a refinery whose control systems ensure it can never explode, but allow anyone with internet access to override anything, is insecure but perfectly safe. Yet the result is explosions and dead people. That doesn't make sense.
  - gmueckl 8y ago
    No, it does make perfect sense in a way. Safety in these terms means that things are extremely unlikely to go wrong by themselves. Interventions are simply not a part of that model. There is some, but not a lot of awareness in the industry that the implicit trust between components in these systems is insecure and ultimately jeopardizes their safety. It is too easy to spoof process values that are sane, but do not reflect the true state of the system. The systems fundamentally miss any mutual authentication between their components. Process measurement devices typically even offer a simulation mode in their firmware to do just that. At worst, all you have to do is to crack a simple password to gain access to this feature remotely.
bsder 8y ago
> I don't I've quite articulated why I'm so critical of the tech industry. Tech isn't just software anymore. She is picking the wrong target. Tech would do security if directed to do security. Business management doesn't care about security. Until someone has to pay big money or do jail time for lack of security, this will not change.
- anigbrowl 8y ago
  Hierarchical management structures are part of the problem. Managers generally treat technicians as flunkies and don't value their opinions, and most technicians aren't willing to get yelled at or fired, so corporate systems select for the lowest common denominator instead of the highest common factor. It's not going to change under our existing system because capitalists don't give a shit about consumers or employees, and 99% of managers just want to get into the winners' circle.

peteradio 8y ago

Really good rant there

webdevatlurk 8y ago
@SarahTaber_bww is a really good twitter follow for people who want to learn interesting bits about agriculture & tech.

gmueckl 8y ago

Repeat after me: safety is not security. Ponder this for a while. Safety is about giving guarantees that the right response happens at the right time to prevent disaster. Security is making sure that whoever you are communicating with is who they claim to be and not an imposter. Heavy industry cares a lot for safety. An exploding refinery is not in any company's best interest. But the systems they rely on have absolutely no notion of security. They have no way to distinguishing between true and spoofed input values that are fed into a control system.

mikeash 8y ago
By those definitions, a refinery whose control systems ensure it can never explode, but allow anyone with internet access to override anything, is insecure but perfectly safe. Yet the result is explosions and dead people. That doesn't make sense.
- gmueckl 8y ago
  No, it does make perfect sense in a way. Safety in these terms means that things are extremely unlikely to go wrong by themselves. Interventions are simply not a part of that model. There is some, but not a lot of awareness in the industry that the implicit trust between components in these systems is insecure and ultimately jeopardizes their safety. It is too easy to spoof process values that are sane, but do not reflect the true state of the system. The systems fundamentally miss any mutual authentication between their components. Process measurement devices typically even offer a simulation mode in their firmware to do just that. At worst, all you have to do is to crack a simple password to gain access to this feature remotely.

bsder 8y ago

> I don't I've quite articulated why I'm so critical of the tech industry. Tech isn't just software anymore. She is picking the wrong target. Tech would do security if directed to do security. Business management doesn't care about security. Until someone has to pay big money or do jail time for lack of security, this will not change.

anigbrowl 8y ago
Hierarchical management structures are part of the problem. Managers generally treat technicians as flunkies and don't value their opinions, and most technicians aren't willing to get yelled at or fired, so corporate systems select for the lowest common denominator instead of the highest common factor. It's not going to change under our existing system because capitalists don't give a shit about consumers or employees, and 99% of managers just want to get into the winners' circle.