6 ms·

Incredible mental gymnastics

by Daz1 3y ago

atoav 3y ago
If any sequence of (radio) button presses can lead to the violent destruction of your product, you are at fault. To rate limit switching would be a no brainer here.
- stavros 3y ago
  How are you sure that it was the number of presses that caused it? It could have exploded on the first switching, because it's not designed to be switching off heavy loads.
  - gdprrrr 3y ago
    Then why does it switch heavy loads if it shouldn't do that?
    - stavros 3y ago
      Because someone unauthorized used a device to force it to do that. These devices are not built to be operated by the general public. Anyone who operates these devices knows to reduce the load first. I don't see the sense in saying "these devices, built for a specific industry with specific, exacting specs, should instead have been built with different specs that were never meant to occur". Everywhere in industry we train operators to know how to operate machinery that can be made to break itself, because it's cheaper to train the operator than to make the machine unable to break itself.
      - Dylan16807 3y ago
        When I press the power button on my remote, I ain't "forcing" anything.
        stavros 3y ago
        You have a remote to your smart meter? Or are you talking about an entirely different device?
        Dylan16807 3y ago
        Do you think the type of device matters? The remote sends a signal to the chip in the device, and that chip decides what to do, often ignoring the signal if it's currently busy or otherwise doesn't want to. There is no force here. Even if it wants to turn off on request in case of dangerous external circumstances, it doesn't need to turn back on so easily and rapidly.
        stavros 3y ago
        Yes, I think it matters whether it's a consumer device or specialized equipment that will be handled by trained operators. You're looking at a $500K farming tractor and complaining that it doesn't have collision avoidance.
        deleted 3y ago
        [deleted]
        Ekaros 3y ago
        I would probably expect a collision avoidance in ultra-modern farming tractor. Or at least it to monitor what is in front and stop if clearly unexpected object would be in the path. They are nearly self-driving anyway. And critical failure is expensive in many ways. Now, smart meter being able to shut power off is somewhat expected. But I would also expect it to be protected command.
      - atoav 3y ago
        Yeah, but you know why load breakers are usually in electrical rooms with a lock on them? Because that is one of the mechanisms used to ensure only authorized personal is doing the switching. Guess where you don't have that? When you accept inputs via radio. The least you could do then is rate limit the input, better even would be authentication. This doesn't even has to be misuse. It could just be some wonky device sending the "wrong" sequence of zeros and ones on the right frequency and boom. Guarding against this kind of interference is totally the task of the manufacturer. Designing the device in such a way, that you cannot turn a load switch into a makeshift dimmer for a short moment as well.
      - Ekaros 3y ago
        Also they do work for occasional switch of under heavy load. And occasional here being in order of once a year rate at most frequent. Still, maybe they should have better security. Specially as there is radio interface.
        stavros 3y ago
        Yep, definitely agreed on the security aspect.
      - mtlmtlmtlmtl 3y ago
        >Because someone unauthorized used a device to force it to do that. Seriously? The device has no authentication. By the design, anyone within range is authorised. And it wasn't "forced". There's no code execution here. It was sent commands, it accepted them. And comparing it to industrial applications with trained workers is just absurd. This is not some hugely complicated industrial system. I really don't see how logic for designing heavy machinery for industrial applications can be uncritically applied to consumer devices. It's just a different space, with different requirements and it's much less complicated.
        dwaite 3y ago
        > Seriously? The device has no authentication. By the design, anyone within range is authorised. Citation?
      - amluto 3y ago
        > Anyone who operates these devices knows to reduce the load first. How? This is a system for remotely opening a circuit. The user can’t reduce the load first. At best they can (likely with too much latency to be at all reliable) wait for the meter to report a small load.
        diydsp 3y ago
        By remote is meant only a few feet. The intended user can switch off or unplug the load in person then operate the meter.
        krisoft 3y ago
        > By remote is meant only a few feet. How does it enforce that? Is it just based on signal strength? > The intended user can switch off or unplug the load in person then operate the meter. This is just the wrong way to think about it. The "intended user" is all nice, but what can an attacker do? That is how these problems need to be analysed.
        amluto 3y ago
        I regret to inform you that remote means from the office. These meters use a mesh network to report usage and receive instructions from the utility’s central systems. If a technician were on site, they could physically remove the meter or open the main breaker.
  - atoav 3y ago
    Then you can sue the electrical engineer who placed that component into a destructive path. If you use a lamborghini car instead of a lamborghini tractor to plow your field don't be surprised if the car breaks. But if you use a smart meter (which by definition is in the path of the load) to switch something on/off it should not break as long as the load is within the spec of the meter. If it is out of spec of the meter, see above. On a electrical component level the switching element they are using is rated for a maximal temperature. If they continue switching when it is outside of that temperature, because they did not observe a cooldown phase or don't guard against overheating in any other way, it is totally on them. They are operating the switching element outside of the scope, and they should never do that, even if some input tells them to do so.
  - diydsp 3y ago
    It appears to have broken after only a small number of switch changes. My guess is the radio'd commands are an incorrect sequence which operates the meter in an incorrect sequence. E.g. 1. Disconnect circuit 1 2. Connect circuit 2 Bypass step 1 by only sending 2 and bad things happen.
- nvy 3y ago
  Ever actually read the FCC certification on products? Ever see the bit about "this device must accept even harmful interference"? That is what this is about. It's not necessarily the fault of the manufacturer if a device can be harmed by deliberate RF-based (mis)use.
  - goodcanadian 3y ago
    You have that completely backwards. That line means that even deliberately harmful interference should not break it.
    - nvy 3y ago
      I don't think that's correct, because otherwise it would require all devices to have significant EM shielding which clearly they do not.
  - atoav 3y ago
    > It's not necessarily the fault of the manufacturer if a device can be harmed by deliberate RF-based (mis)use. I am not too familiar with the FCC as I am from Europe, but even the linear motor of a standing desk will rate limit the amount of movement you can make it do within a given time frame (those linear motors are not designed for permanent operation). If your meter is rated to switch a certain current, that rating is made under the assumption of a certain ambient temperature and temperature of the switching element. Switching it heats it up, so there has to be a cooldown period if you plan to still operate it within spec. Operating components within spec is the task of the manufacturer, and checks to avoid going out of spec should be one of the first things to design into such a product to prevent house fires or malfunction. Guard mechanisms like rate limiting are cool because they can protect you against liabilty if your programmer makes an error, but they become more important the more exposed the controls are. There is a reason why e.g. a RCD cannot be permanently be fixed in the on-position (the switch is not tied to the lever internally), because you want it to switch off even in the case of misuse in order to save lives. This is magnitudes more important if your controls are exposed to external inputs (e.g. via radio, or over the network/internet), as accidental or malicious misuse might be more prevalent there. Note: I am not saying there is a strict legal requirement to do this, I say that this is what I expect from a modern design made by professional electrical engineers.
- teawrecks 3y ago
  who is "you" in your post. your first sentence makes it sound like you think the owner of the device is at fault, but the second sentence makes it sound like the maker of the device should be held responsible. maybe unintentionally ambiguous?
  - proto_lambda 3y ago
    > your product "you" is the manufacturer of the device that bricks itself if touched wrong by arbitrary (untrained) personnel.
  - atoav 3y ago
    Sorry for the ambiguity, you as in you, the designer/manufacturer of the product. The owner has no way to know the thermal limits of some unknown internal switching component, and even if they have who says the radio signals are emitted by the owner?
- Daz1 3y ago
  Please qualify that ridiculous statement? Any device powerful enough to do so can be intentionally and catastrophically destroyed through misuse. This is one step removed from even that - a third party device designed for hackers being intentionally used for destructive purposes.

Incredible mental gymnastics

by Daz1 3y ago

Incredible mental gymnastics

If any sequence of (radio) button presses can lead to the violent destruction of your product, you are at fault. To rate limit switching would be a no brainer here.

stavros 3y ago
How are you sure that it was the number of presses that caused it? It could have exploded on the first switching, because it's not designed to be switching off heavy loads.
- gdprrrr 3y ago
  Then why does it switch heavy loads if it shouldn't do that?
  - stavros 3y ago
    Because someone unauthorized used a device to force it to do that. These devices are not built to be operated by the general public. Anyone who operates these devices knows to reduce the load first. I don't see the sense in saying "these devices, built for a specific industry with specific, exacting specs, should instead have been built with different specs that were never meant to occur". Everywhere in industry we train operators to know how to operate machinery that can be made to break itself, because it's cheaper to train the operator than to make the machine unable to break itself.
    - Dylan16807 3y ago
      When I press the power button on my remote, I ain't "forcing" anything.
      - stavros 3y ago
        You have a remote to your smart meter? Or are you talking about an entirely different device?
        Dylan16807 3y ago
        Do you think the type of device matters? The remote sends a signal to the chip in the device, and that chip decides what to do, often ignoring the signal if it's currently busy or otherwise doesn't want to. There is no force here. Even if it wants to turn off on request in case of dangerous external circumstances, it doesn't need to turn back on so easily and rapidly.
        stavros 3y ago
        Yes, I think it matters whether it's a consumer device or specialized equipment that will be handled by trained operators. You're looking at a $500K farming tractor and complaining that it doesn't have collision avoidance.
        deleted 3y ago
        [deleted]
        Ekaros 3y ago
        I would probably expect a collision avoidance in ultra-modern farming tractor. Or at least it to monitor what is in front and stop if clearly unexpected object would be in the path. They are nearly self-driving anyway. And critical failure is expensive in many ways. Now, smart meter being able to shut power off is somewhat expected. But I would also expect it to be protected command.
    - atoav 3y ago
      Yeah, but you know why load breakers are usually in electrical rooms with a lock on them? Because that is one of the mechanisms used to ensure only authorized personal is doing the switching. Guess where you don't have that? When you accept inputs via radio. The least you could do then is rate limit the input, better even would be authentication. This doesn't even has to be misuse. It could just be some wonky device sending the "wrong" sequence of zeros and ones on the right frequency and boom. Guarding against this kind of interference is totally the task of the manufacturer. Designing the device in such a way, that you cannot turn a load switch into a makeshift dimmer for a short moment as well.
    - Ekaros 3y ago
      Also they do work for occasional switch of under heavy load. And occasional here being in order of once a year rate at most frequent. Still, maybe they should have better security. Specially as there is radio interface.
      - stavros 3y ago
        Yep, definitely agreed on the security aspect.
    - mtlmtlmtlmtl 3y ago
      >Because someone unauthorized used a device to force it to do that. Seriously? The device has no authentication. By the design, anyone within range is authorised. And it wasn't "forced". There's no code execution here. It was sent commands, it accepted them. And comparing it to industrial applications with trained workers is just absurd. This is not some hugely complicated industrial system. I really don't see how logic for designing heavy machinery for industrial applications can be uncritically applied to consumer devices. It's just a different space, with different requirements and it's much less complicated.
      - dwaite 3y ago
        > Seriously? The device has no authentication. By the design, anyone within range is authorised. Citation?
    - amluto 3y ago
      > Anyone who operates these devices knows to reduce the load first. How? This is a system for remotely opening a circuit. The user can’t reduce the load first. At best they can (likely with too much latency to be at all reliable) wait for the meter to report a small load.
      - diydsp 3y ago
        By remote is meant only a few feet. The intended user can switch off or unplug the load in person then operate the meter.
        krisoft 3y ago
        > By remote is meant only a few feet. How does it enforce that? Is it just based on signal strength? > The intended user can switch off or unplug the load in person then operate the meter. This is just the wrong way to think about it. The "intended user" is all nice, but what can an attacker do? That is how these problems need to be analysed.
        amluto 3y ago
        I regret to inform you that remote means from the office. These meters use a mesh network to report usage and receive instructions from the utility’s central systems. If a technician were on site, they could physically remove the meter or open the main breaker.
- atoav 3y ago
  Then you can sue the electrical engineer who placed that component into a destructive path. If you use a lamborghini car instead of a lamborghini tractor to plow your field don't be surprised if the car breaks. But if you use a smart meter (which by definition is in the path of the load) to switch something on/off it should not break as long as the load is within the spec of the meter. If it is out of spec of the meter, see above. On a electrical component level the switching element they are using is rated for a maximal temperature. If they continue switching when it is outside of that temperature, because they did not observe a cooldown phase or don't guard against overheating in any other way, it is totally on them. They are operating the switching element outside of the scope, and they should never do that, even if some input tells them to do so.
- diydsp 3y ago
  It appears to have broken after only a small number of switch changes. My guess is the radio'd commands are an incorrect sequence which operates the meter in an incorrect sequence. E.g. 1. Disconnect circuit 1 2. Connect circuit 2 Bypass step 1 by only sending 2 and bad things happen.
nvy 3y ago
Ever actually read the FCC certification on products? Ever see the bit about "this device must accept even harmful interference"? That is what this is about. It's not necessarily the fault of the manufacturer if a device can be harmed by deliberate RF-based (mis)use.
- goodcanadian 3y ago
  You have that completely backwards. That line means that even deliberately harmful interference should not break it.
  - nvy 3y ago
    I don't think that's correct, because otherwise it would require all devices to have significant EM shielding which clearly they do not.
- atoav 3y ago
  > It's not necessarily the fault of the manufacturer if a device can be harmed by deliberate RF-based (mis)use. I am not too familiar with the FCC as I am from Europe, but even the linear motor of a standing desk will rate limit the amount of movement you can make it do within a given time frame (those linear motors are not designed for permanent operation). If your meter is rated to switch a certain current, that rating is made under the assumption of a certain ambient temperature and temperature of the switching element. Switching it heats it up, so there has to be a cooldown period if you plan to still operate it within spec. Operating components within spec is the task of the manufacturer, and checks to avoid going out of spec should be one of the first things to design into such a product to prevent house fires or malfunction. Guard mechanisms like rate limiting are cool because they can protect you against liabilty if your programmer makes an error, but they become more important the more exposed the controls are. There is a reason why e.g. a RCD cannot be permanently be fixed in the on-position (the switch is not tied to the lever internally), because you want it to switch off even in the case of misuse in order to save lives. This is magnitudes more important if your controls are exposed to external inputs (e.g. via radio, or over the network/internet), as accidental or malicious misuse might be more prevalent there. Note: I am not saying there is a strict legal requirement to do this, I say that this is what I expect from a modern design made by professional electrical engineers.
teawrecks 3y ago
who is "you" in your post. your first sentence makes it sound like you think the owner of the device is at fault, but the second sentence makes it sound like the maker of the device should be held responsible. maybe unintentionally ambiguous?
- proto_lambda 3y ago
  > your product "you" is the manufacturer of the device that bricks itself if touched wrong by arbitrary (untrained) personnel.
- atoav 3y ago
  Sorry for the ambiguity, you as in you, the designer/manufacturer of the product. The owner has no way to know the thermal limits of some unknown internal switching component, and even if they have who says the radio signals are emitted by the owner?
Daz1 3y ago
Please qualify that ridiculous statement? Any device powerful enough to do so can be intentionally and catastrophically destroyed through misuse. This is one step removed from even that - a third party device designed for hackers being intentionally used for destructive purposes.