4 ms·

If it's a matter of tracking, it could still be done using a simple connector and some kind of base station. Presumably these things have batteries that need to

If it's a matter of tracking, it could still be done using a simple connector and some kind of base station. Presumably these things have batteries that need to be charged, so they need to be returned to some central location and connect by copper wires periodically one way or another. They don't need network connectivity to accomplish this.

throwanem 3y ago
The batteries connect to the charger, yes. The tool never does, and probably can't be physically plugged into anything for want of connectors. And what difference would it make, anyway? In exchange for massively complicating every aspect of the monitoring and control tasks, you're just interposing the need to infect the battery firmware in order to pop the tool. Do you imagine the battery will be secure when the tool is not?
- fluoridation 3y ago
  You make the battery a simple storage device. It can't be infected any more than a piece of paper can be infected. Even if someone can write crap to the battery the tool won't care, since it just needs to write simple information to it, not execute anything. There are ways to solve the problem, it's just cheaper to make the tool an HTTP client and solve it on a server somewhere.
  - throwanem 3y ago
    Aside from assuming the secure firmware on the tool - and now, too, on the battery! - whose absence you were trying to solve a couple of posts ago, this sounds like a solid approach.
    - fluoridation 3y ago
      I've never seen anyone complain about the security of USB sticks (not at the firmware level anyway).
      - throwanem 3y ago
        You don't think perhaps that having a mass storage device available to the tool is going to encourage engineers to find uses for it? Updating the tool firmware, say - especially since with OTA updates unavailable for reason of the tool being forbidden to incorporate a radio, there's no other way to update the tool's firmware, not without complicating its design to expose a port rugged enough to survive the hard-knocks life an industrial tool is guaranteed to lead. You might argue that this isn't worse than the current state of play - which would be true, but irrelevant, because in order to justify the massive cost and complication of this proposed design, you need to be able to show that the result is to a comparable extent better. You have yet to do that, and I doubt it can be done at all.
        fluoridation 3y ago
        I don't see why a torque wrench needs to receive firmware updates if it has no connectivity whatsoever. It's a wrench. It has to tighten nuts according to a torque value selected via the keyboard. What could an update possibly do to make it perform this one task better? What are you on about? I'm arguing there were ways to solve the problem that didn't involve the tool connecting to the Internet. I don't need to show that my solution is better, because that has nothing to do with what I'm saying. And either way there's no "better" here. There's no objective measure of goodness. What's better to me and what's better to Bosch are not necessarily the same, and in fact they obviously aren't, as I never would have designed a tool this way, but then I don't have a tool manufacturing company.
csours 3y ago
How often does it return to the base station? What is the required latency of the rundown information? You charge it once per shift, and you need an update every minute. The dumb problem exists because of very real limitations.
- fluoridation 3y ago
  Every minute? What possible use could such granular information have?
  - inhumantsar 3y ago
    from the article: "allows engineers to tighten bolts and other mechanical fastenings to precise torque levels that are critical for safety and reliability." high precision factory gear in safety-critical applications seems like a reasonable use case to me.
    - fluoridation 3y ago
      The tightening is done by sensors inside the tool. That has nothing to do with any kind of tracking or with anything that happens across a network connection.
      - daveguy 3y ago
        But tracking tool health in safety-critical applications (think bolt torque on an airplane door plug) could benefit from automated tracking. Generally this is solved by regular inspections and calibration, which is cheaper and avoids the security issue. There is some benefit to automated tracking and fault identification. Doing it on an air gapped network means you have to be on site to check status and errors, which seems reasonable to me.
        fluoridation 3y ago
        And tracking tool health is something that precisely doesn't need to be done on a minute-by-minute basis. Doing it once at the end of every shift seems more than enough.
Ekaros 3y ago
And who guarantees such setup would be anymore secure or any better implemented? It would probably use some custom protocol that is much harder to test with as poorly written implementation...

throwanem 3y ago

The batteries connect to the charger, yes. The tool never does, and probably can't be physically plugged into anything for want of connectors. And what difference would it make, anyway? In exchange for massively complicating every aspect of the monitoring and control tasks, you're just interposing the need to infect the battery firmware in order to pop the tool. Do you imagine the battery will be secure when the tool is not?

fluoridation 3y ago
You make the battery a simple storage device. It can't be infected any more than a piece of paper can be infected. Even if someone can write crap to the battery the tool won't care, since it just needs to write simple information to it, not execute anything. There are ways to solve the problem, it's just cheaper to make the tool an HTTP client and solve it on a server somewhere.
- throwanem 3y ago
  Aside from assuming the secure firmware on the tool - and now, too, on the battery! - whose absence you were trying to solve a couple of posts ago, this sounds like a solid approach.
  - fluoridation 3y ago
    I've never seen anyone complain about the security of USB sticks (not at the firmware level anyway).
    - throwanem 3y ago
      You don't think perhaps that having a mass storage device available to the tool is going to encourage engineers to find uses for it? Updating the tool firmware, say - especially since with OTA updates unavailable for reason of the tool being forbidden to incorporate a radio, there's no other way to update the tool's firmware, not without complicating its design to expose a port rugged enough to survive the hard-knocks life an industrial tool is guaranteed to lead. You might argue that this isn't worse than the current state of play - which would be true, but irrelevant, because in order to justify the massive cost and complication of this proposed design, you need to be able to show that the result is to a comparable extent better. You have yet to do that, and I doubt it can be done at all.
      - fluoridation 3y ago
        I don't see why a torque wrench needs to receive firmware updates if it has no connectivity whatsoever. It's a wrench. It has to tighten nuts according to a torque value selected via the keyboard. What could an update possibly do to make it perform this one task better? What are you on about? I'm arguing there were ways to solve the problem that didn't involve the tool connecting to the Internet. I don't need to show that my solution is better, because that has nothing to do with what I'm saying. And either way there's no "better" here. There's no objective measure of goodness. What's better to me and what's better to Bosch are not necessarily the same, and in fact they obviously aren't, as I never would have designed a tool this way, but then I don't have a tool manufacturing company.

csours 3y ago

How often does it return to the base station? What is the required latency of the rundown information? You charge it once per shift, and you need an update every minute. The dumb problem exists because of very real limitations.

fluoridation 3y ago
Every minute? What possible use could such granular information have?
- inhumantsar 3y ago
  from the article: "allows engineers to tighten bolts and other mechanical fastenings to precise torque levels that are critical for safety and reliability." high precision factory gear in safety-critical applications seems like a reasonable use case to me.
  - fluoridation 3y ago
    The tightening is done by sensors inside the tool. That has nothing to do with any kind of tracking or with anything that happens across a network connection.
    - daveguy 3y ago
      But tracking tool health in safety-critical applications (think bolt torque on an airplane door plug) could benefit from automated tracking. Generally this is solved by regular inspections and calibration, which is cheaper and avoids the security issue. There is some benefit to automated tracking and fault identification. Doing it on an air gapped network means you have to be on site to check status and errors, which seems reasonable to me.
      - fluoridation 3y ago
        And tracking tool health is something that precisely doesn't need to be done on a minute-by-minute basis. Doing it once at the end of every shift seems more than enough.

Ekaros 3y ago

And who guarantees such setup would be anymore secure or any better implemented? It would probably use some custom protocol that is much harder to test with as poorly written implementation...