9 ms·

I am so glad to see this is the top comment. Hacks on public infrastructure feel to me like one very small step away from actual military actions. I don’t under

I am so glad to see this is the top comment. Hacks on public infrastructure feel to me like one very small step away from actual military actions. I don’t understand why they never seem to be reported with the gravity they deserve.

TedDoesntTalk 6y ago
For all we know, this is the 100th such attack on US infrastructure and this is just the first one reported in recent memory. A successful attack is much less likely to be made public, for obvious reasons. We may have suffered from successful attacks and not know it (small enough concentrations of contaminants can’t be tasted) Install water filters, HN. Use them. We have AquaSana under-the-sink in several locations through the house... no pitchers. Whole-house filters do not filter nearly the same variety of crap that under-the-sink and PUR pitchers do. Say no to Brita. Learn your NSF ratings and choose wisely. You’re only paranoid if you’re wrong.
- aerostable_slug 6y ago
  A chemist may be able to correct me, but I'm pretty sure an AquaSana filter will do nothing to remove excess sodium hydroxide.
  - jaggederest 6y ago
    It will if it's reverse osmosis (RO), but not all filters do that. That particular brand sells both RO and non-RO units. If it's a vast excess of NaOH, you'll have other problems besides your water filter failing, like chemical burns. Most US tapwater is fantastically clean and drinkable, and doesn't generally need a filter. The Safe Drinking Water Act is pretty powerful stuff. https://www.cdc.gov/healthywater/drinking/public/regulations.html https://www.cdc.gov/healthywater/drinking/public/regulations...
    - TedDoesntTalk 6y ago
      > Most US tapwater is fantastically clean and drinkable, and doesn't generally need a filter. It is my understanding that most municipal water utilities only test water quality every 3 months. A problem can come and go between testing cycles. Even with weekly testing, I’d expect the same risk (there’s still a window between tests). Basically you’re only going to know about a problem when it’s too late.
      - jaggederest 6y ago
        You also have to look at the success and failure rates of those tests. Most tests reveal no problems, which implies periodic sampling is plenty to handle the rare problems that crop up. If we found more problems, we would demand more testing, but increased testing is pointless if there is no problem to be found. In reverse, if the tests are not specific enough, they can cause issues when you over test due to false positives on the tests. Indeed, you'll see that if a water test comes back positive, there will be multiple retests and a much greater rate of testing until the problem is abated, at least at my local drinking water board.
      - loeg 6y ago
        > It is my understanding that most municipal water utilities only test water quality every 3 months. A problem can come and go between testing cycles. This isn't remotely true.
        TedDoesntTalk 6y ago
        Which part?
        loeg 6y ago
        The whole of it. You stated that most municipal water supplies aren't monitored for months at a time. This is extremely incorrect. The EPA-mandated quarterly report is a summary, not the entirety of samples collected. It would be dangerous and reckless not to monitor drinking water for months at a time. E.g., Seattle explicitly states: > We monitor your water 24 hours a day, 365 days a year. We test samples from the region between 10 and 100 times per day. https://www.seattle.gov/Documents/Departments/SPU/Services/Water/Water_Quality_Report_2019.pdf https://www.seattle.gov/Documents/Departments/SPU/Services/W... (PDF) > To ensure the safety of our drinking water, SPU's water quality laboratory analyzes over 20,000 microbiological samples each year (more than 50 a day) and conducts chemical and physical monitoring daily, 365 days per year. https://www.seattle.gov/utilities/your-services/water/water-quality/lab-testing#:~:text=To%20ensure%20the%20safety https://www.seattle.gov/utilities/your-services/water/water-...
TheOtherHobbes 6y ago
Someone asked a couple of days ago if they should go into security. Yes - they should. Because there is going to be a lot more of this happening in the not so distant future.
- aspaceman 6y ago
  Yeah we're still in kiddie shit days playing with firecrackers and poprockets. Wait till we get our M2 Browning.
  - ISL 6y ago
    I suspect that the first iterations of the M2-equivalent already exist, we just haven't seen them put to use against visible targets.
- throwaway0a5e 6y ago
  They've been saying that for ~30yr. While you can definitely make a respectable living in the cybersecurity industry the fact of the matter is that over that same time period the people vomiting JavaScript trackers all over the internet made the same or more money with less effort invested.
- xwdv 6y ago
  This is all “Do as I say, not as I do” advice. Sure, go into security, help make the world more secure... meanwhile I’ll be here writing some JavaScript making twice what you make and working probably half the hours you do.
tgsovlerkhgsel 6y ago
This is over-reported in my opinion. Because this is most likely "teenager broke into a poorly secured shack and turned a random valve to be naughty", not "state actor sabotaged critical infrastructure".
- kadoban 6y ago
  How about "state actor could have easily sabotaged critical infrastructure but teenager got there first" ?
  - lazyasciiart 6y ago
    Sounds like we need more teenagers.
    - TeMPOraL 6y ago
      Teenagers are the OG chaos monkey. (Still, the problem remains: if a naughty teenager can turn a valve for shits and cause a threat to public health, then perhaps that valve needs some access control.)
PradeetPatel 6y ago
It's been established that security itself does not increase revenue nor make the quarterly returns look good. Unless there's an incentive for key stakeholders to spend more resources to strengthen the security of their deliverables, it is unlikely for things to change in the near future. Perhaps a change in KPI or regulation requirements may create such incentive to ensure appropriate actions are taken.

TedDoesntTalk 6y ago

For all we know, this is the 100th such attack on US infrastructure and this is just the first one reported in recent memory. A successful attack is much less likely to be made public, for obvious reasons. We may have suffered from successful attacks and not know it (small enough concentrations of contaminants can’t be tasted) Install water filters, HN. Use them. We have AquaSana under-the-sink in several locations through the house... no pitchers. Whole-house filters do not filter nearly the same variety of crap that under-the-sink and PUR pitchers do. Say no to Brita. Learn your NSF ratings and choose wisely. You’re only paranoid if you’re wrong.

aerostable_slug 6y ago
A chemist may be able to correct me, but I'm pretty sure an AquaSana filter will do nothing to remove excess sodium hydroxide.
- jaggederest 6y ago
  It will if it's reverse osmosis (RO), but not all filters do that. That particular brand sells both RO and non-RO units. If it's a vast excess of NaOH, you'll have other problems besides your water filter failing, like chemical burns. Most US tapwater is fantastically clean and drinkable, and doesn't generally need a filter. The Safe Drinking Water Act is pretty powerful stuff. https://www.cdc.gov/healthywater/drinking/public/regulations.html https://www.cdc.gov/healthywater/drinking/public/regulations...
  - TedDoesntTalk 6y ago
    > Most US tapwater is fantastically clean and drinkable, and doesn't generally need a filter. It is my understanding that most municipal water utilities only test water quality every 3 months. A problem can come and go between testing cycles. Even with weekly testing, I’d expect the same risk (there’s still a window between tests). Basically you’re only going to know about a problem when it’s too late.
    - jaggederest 6y ago
      You also have to look at the success and failure rates of those tests. Most tests reveal no problems, which implies periodic sampling is plenty to handle the rare problems that crop up. If we found more problems, we would demand more testing, but increased testing is pointless if there is no problem to be found. In reverse, if the tests are not specific enough, they can cause issues when you over test due to false positives on the tests. Indeed, you'll see that if a water test comes back positive, there will be multiple retests and a much greater rate of testing until the problem is abated, at least at my local drinking water board.
    - loeg 6y ago
      > It is my understanding that most municipal water utilities only test water quality every 3 months. A problem can come and go between testing cycles. This isn't remotely true.
      - TedDoesntTalk 6y ago
        Which part?
        loeg 6y ago
        The whole of it. You stated that most municipal water supplies aren't monitored for months at a time. This is extremely incorrect. The EPA-mandated quarterly report is a summary, not the entirety of samples collected. It would be dangerous and reckless not to monitor drinking water for months at a time. E.g., Seattle explicitly states: > We monitor your water 24 hours a day, 365 days a year. We test samples from the region between 10 and 100 times per day. https://www.seattle.gov/Documents/Departments/SPU/Services/Water/Water_Quality_Report_2019.pdf https://www.seattle.gov/Documents/Departments/SPU/Services/W... (PDF) > To ensure the safety of our drinking water, SPU's water quality laboratory analyzes over 20,000 microbiological samples each year (more than 50 a day) and conducts chemical and physical monitoring daily, 365 days per year. https://www.seattle.gov/utilities/your-services/water/water-quality/lab-testing#:~:text=To%20ensure%20the%20safety https://www.seattle.gov/utilities/your-services/water/water-...

TheOtherHobbes 6y ago

Someone asked a couple of days ago if they should go into security. Yes - they should. Because there is going to be a lot more of this happening in the not so distant future.

aspaceman 6y ago
Yeah we're still in kiddie shit days playing with firecrackers and poprockets. Wait till we get our M2 Browning.
- ISL 6y ago
  I suspect that the first iterations of the M2-equivalent already exist, we just haven't seen them put to use against visible targets.
throwaway0a5e 6y ago
They've been saying that for ~30yr. While you can definitely make a respectable living in the cybersecurity industry the fact of the matter is that over that same time period the people vomiting JavaScript trackers all over the internet made the same or more money with less effort invested.
xwdv 6y ago
This is all “Do as I say, not as I do” advice. Sure, go into security, help make the world more secure... meanwhile I’ll be here writing some JavaScript making twice what you make and working probably half the hours you do.

tgsovlerkhgsel 6y ago

This is over-reported in my opinion. Because this is most likely "teenager broke into a poorly secured shack and turned a random valve to be naughty", not "state actor sabotaged critical infrastructure".

kadoban 6y ago
How about "state actor could have easily sabotaged critical infrastructure but teenager got there first" ?
- lazyasciiart 6y ago
  Sounds like we need more teenagers.
  - TeMPOraL 6y ago
    Teenagers are the OG chaos monkey. (Still, the problem remains: if a naughty teenager can turn a valve for shits and cause a threat to public health, then perhaps that valve needs some access control.)

PradeetPatel 6y ago

It's been established that security itself does not increase revenue nor make the quarterly returns look good. Unless there's an incentive for key stakeholders to spend more resources to strengthen the security of their deliverables, it is unlikely for things to change in the near future. Perhaps a change in KPI or regulation requirements may create such incentive to ensure appropriate actions are taken.