15 ms·
Sol-Ark manufacturer reportedly disables all Deye inverters in the US
- boredatoms 2y agoWe need laws to prevent this
- jfengel 2y agoThere probably are. But it appears to be coming out of China, so good luck enforcing it.
- dymk 2y agoThere is a US based company that is importing and selling these devices. Go after them.
- 4ntiq 2y ago[flagged]
- Schiendelman 2y agoFor what? They didn't send the signal.
- dymk 2y agoSo? They’re responsible for importing the devices. They have an exclusive contract. Do your due diligence before offloading the risk to your customers. It’s like if Ford outsourced faulty brake systems, had a bunch of cars crash because of it, and then say “it’s not our fault, we didn’t actually make the brake system”.
- jfengel 2y ago[flagged]
- dymk 2y ago> You can close down the (smallish, veteran-owned) American company. This is marketing fluff from the company. Who cares that they're vet-owned? They've been around for 10 years, they are not new to the solar game. They even claim to be an industry leader, if we're trusting their word. > It would be great if American companies did more due diligence, but that increases costs. How much is it going to cost to either replace all the inverters sold, or remedy whatever the gripe is with the manufacturer? How much is the outage going to cost across the (tens? hundreds?) of thousands of inverters sold?
- anon84873628 2y agoY'all realize that Sol-Ark devices are the ones that didn't shut down, right? Because they're the ones with the exclusive contract. You're hypothesizing about the exact opposite of the real situation.
- Schiendelman 2y agoI don't think that analogy holds. The brake system wasn't faulty. Someone deliberately sabotaged it after it was sold.
- ericd 2y agoI don’t think it’s the Sol-Ark branded inverters that shut down, but Deye inverters that people imported via eg aliexpress?
- _trampeltier 2y agoIt seems they shut the inverters down because a legal dispute. So the reason is the law.
- Dylan16807 2y agoThat's like saying if I punch someone because of a legal dispute, the law is to blame.
- perihelions 2y agoCivil contract disputes don't empower or obligate you to commit crimes in the process of trying to make things right. The power inverters were *not their property*. Remotely accessing them, without authorization and with the intent of disabling them, is a textbook CFAA felony.
- HackOfAllTrades 2y agoTheir 'right' to do that was probably somewhere in unreadable ALL CAPS on a small piece of paper at the bottom of the shipping box that the end user never got. Fuck 'em. Isolate your local net from the world and only let through devices you trust. Plenty of ways to do that, even at low expense. But you will have to make the effort or pay someone else to do it.
- anon84873628 2y agoNot to mention the slight complication of the entity is not in your jurisdiction and subject to your laws. You buy a device from an intermediary and it phones home to a foreign jurisdiction. That sucks but I'm not sure what recourse you can realistically expect.
- account42 2y agoThe US is plenty capable of making any entity they want fall under their jurisdiction.
- rvba 2y agoCould USA wrap it under the terrorism laws?
- gdjskshh 2y agoWe have those laws. You return the faulty device to the entity you purchased it from. I bet some small-time installers that were sourcing on the grey market will go bankrupt because of this.
- malfist 2y agoYou return a solar inverter you already have installed? Maybe purchased years ago? And in the meantime you might be without power. That's not recourse.
- hedora 2y agoThe law needs to be updated for things with high installation costs. For example, we bought a built-in oven, and post-sale we discovered a sticker saying that by using the oven, we agreed to a EULA and binding arbitration, and to return it if we disagree. I think that, had we decided to decline the previously-undisclosed EULA, the manufacturer should have had to either provide one that works as they advertised (no EULA) and with identical dimensions, or they should have had to replace our brand-new cabinets with ones that matched a competitor’s product (and incur a large multiple of the cost we paid for the oven).
- malfist 2y agoCompletely agree. Those things make even less since in the second hand market. What happens if the solar system was bought from a resaler? Or install by another company and you didn't choose it? What happens when you sell your house and you've removed the sticker?
- anon84873628 2y agoWell, did you try to decline? How do you know what would or wouldn't happen?
- malfist 2y agoPlease engage in honest discourse. Both of us know that if you take a range back to best buy because you wouldn't agree to the EULA isn't going to cause best buy to send you all new cabinets
- totallykvothe 2y agoPeople responsible for this kind of evil need to pay with personal property seizure.
- anon84873628 2y agoSo like, the people who bought devices from unauthorized distributors should have their devices stop working? Seems you got your exact wish!
- tdeck 2y agoCan someone who has a solar inverter explain why these are connected to the internet?
- 4ntiq 2y ago[flagged]
- marviel 2y agoUnless I'm missing some hidden joke; this attitude is misanthropic. I'd like to see less of it in general, but I'd especially like to see less of it here.
- 4ntiq 2y ago[flagged]
- do_not_redeem 2y agoThis is a very uncharitable and hatingly-blinded take.
- 4ntiq 2y ago[flagged]
- reaperducer 2y agoI'm reading this article and grinning, because someone somewhere at Deye knows they sold these inverters fraudulently. Some sales person out there just went into full ah-fuck-it mode and delivered shipments and shipments of these things. NICE. This user's biography reads, "you are the least qualified to comment on the subject" Sounds about right.
- deleted 2y ago[deleted]
- 2y ago
- Aeolun 2y agoWhere is the government when you need it…
- shrubble 2y agoIt’s not clear how the device was bricked. Could it be reset to not be bricked by disconnecting it from the Internet and rebooting or reflashing?
- bagels 2y agoThis time, it's a malicious manufacturer, next time it's a malicious hacker. Doesn't seem like connecting these to the internet is worth it.
- 4ntiq 2y agoI love the narrative of a Chinese manufacturer selling electronics to the West only to one day shut everything off for no reason at all than to fuck with people and disappear and for people to find out the supposedly registered company never existed. It's like a trashy, second-rate William Gibson knock off novel but there's something awfully amusing about it.
- lazide 2y agoFrankly it doesn’t even require (special) maliciousness (per-se) - spinning up random ‘brands’ to sell to rubes on Amazon while obfuscating beneficial owners is essentially standard operating procedure. The only surprising thing here is they took an action to brick something instead of just abandoning it.
- 4ntiq 2y ago>The only surprising thing here is they took an action to brick something instead of just abandoning it. You're right, but I wouldn't say surprising. I do wonder what would happen if the units just stopped working outright one day and they're all intended to be gridded and nothing works properly anymore and the distributors are stumped and can't get ahold of anyone.
- lazide 2y agoFair point - it would be trivial frankly to embed a ‘bug’ which causes them to all brick at some arbitrary point in the future too. Considering the level the firmware works at, probably even catch on fire.
- profsummergig 2y ago> and for people to find out the supposedly registered company never existed This already happened to me. Sort of. Saw an advt for Air Jordans for $7. With a pic of actual Air Jordans. Thought to myself, "it's only $7, let's see what happens". A very sorry looking pair of shoes arrived a couple weeks later. With "Air Jordan" printed on them. They weren't actual Air Jordans. There was no way, absolutely no way, to get in touch with the Chinese company that did this.
- keyle 2y agoAny idea what the impact is for the state grids? I wonder if they got a sudden drop in feed-ins and whether it affects pricing. Any idea how common this manufacturer is across the place? I'm not from the states, but I do know that if my solar would be bricked, it would take me weeks to find out. I don't exactly check up on it and it's out of sight.
- nullc 2y agoMost of the users of these products were off grid. A number of the products used in off grid installs have invasive IOT remote access/administration. It's only a matter of time until it leads to loss of life-- e.g. from people who freeze to death because they can't reconfigure or turn up a system without internet access which is out or doesn't work without power--, if it hasn't already.
- lazide 2y agoYeah, off grid (as in actually off grid) is a great example of ‘simple is better’ and ‘physical redundancy is essential’. It’s also the place where money ($$) is often the most constraining factor, so cheap amazon shit tends to be the norm.
- crooked-v 2y agoGoing by the article, it looks like the title is incorrect and it was Deye (the manufacturer) that did it and not Sol-Ark (the US distributor).
- greenthrow 2y agoTo be clear, Sol-Ark isn't only the distributor but per their own claims also designed and engineered the units too.
- tibbydudeza 2y agoDeye manufactured vs the units for OEM use different components - they build to spec.
- buckle8017 2y agoSol-Ark likely complained about Deye selling within the US. Deye said something to the effect of "we have contractual obligations". I think they're both at fault.
- echelon 2y agoThe biggest takeaway here should be that we need a domestic solar industry. We can't hold Deye or Chinese companies culpable. Moreover, this should serve as a warning shot for what could become a national security issue if we keep juggling international suppliers for critical infrastructure. They'll all have the capability of shutting down US electricity, which is unacceptable. There's no reason we should be importing this stuff.
- 10u152 2y agoThere are US manufacturers. I have a Tesla PW3 made in the U.S. and it includes solar charge controllers, batteries and inverter. Pretty competitive too.
- anon84873628 2y agoAnd is it connected to the internet? Do you think a future update will require you to login with your X account?
- andix 2y agoIm sure there is some US law, that considers this an act of terror against the national power grid ;)
- gdjskshh 2y ago[flagged]
- hakfoo 2y agoAren't some of those platforms more-or-less official outlets of the manufacturer for some brands already? While it's entirely possible some of the storefronts are just flashing "official widgetco shop" as a credibility-enhancing gesture, it's probably also the easiest way if you're a Chinese firm with little understanding of global last-mile logistics and small-dollar payment processing to get into the direct-to-consumer business. I thought AliExpress was spawned from the B2B relationships Alibaba already had. If you put up a rule like that, I suspect those sites would just pivot to being "Shopify for Chinese Vendors" -- offering an embeddable storefront that the manufacturer can put directly on their page. The only losers would be the consumers, who would no longer get the convenience of centralized search, being able to put together an order from ten vendors in a single shopping cart, and the ability to efficiently combine shipping. And let's not say "we lost manufacturing." We GAVE IT AWAY. It's not just that foreign labour is cheaper, it's that Asia was industrializing later, so you get state-of-the-science facilities, while the American plant is 50 years old and nobody wants to splash the capex to rebuild it to modern standards.
- int_19h 2y agoWhat you're saying is that American companies should be able to profit from the price disparity between China and US by reselling Chinese goods to US consumers at massively inflated prices, but regular Americans should not be able to do the same on their own.
- Firerouge 2y agoSol-Ark certainly seems to embody 'never let a crisis go to waste '. Sol-Ark may not have pulled the trigger on bricking the inverters, but it certainly sounds like their legal actions pressed Deye's hand. And then to shake down all the individuals who's inverters broke with a limited time opportunity to buy a brand new one from them....
- kstenerud 2y agoWait, what? So defending your rights under an exclusivity agreement through the courts is somehow now "forcing" their hand? The evil Sol-Ark by suing for compliance to their contract pushed the hapless Deye into bricking consumers hardware?
- deleted 2y ago[deleted]
- Firerouge 2y agoI like how you quoted forcing, but I very specifically did not use that term. Had there been no exclusivity agreement, I think we can agree that the inverters would not of been bricked for being located in the wrong regions. I think the malice from Sol-Ark here is that they are only offering a limited time deal, which may pressure people to pay up before the courts clear this up. Regardless of who shares the majority of the blame, Sol-Ark, Deye or 3rd party vendors, this could of been handled better by all parties involved, and should not have harmed end consumers in this way.
- lazide 2y agoBlaming Sol-Ark for that is just absurd.
- mint2 2y agoIt’s unclear who caused it exactly, but sol-ark does not seem to be at fault unless one thinks exclusivity contracts are illegal or wrong. It seems deye either willfully or negligently ignore their contract they made with sol ark. Or their middle men in other countries did. Deye then punished the end users for deye’s lapses. Where does solark get blame unless the exclusivity contract is what one objects to.
- SoftTalker 2y agoReason #42 that I don't want to own my electric supply equipment. I'm happy to pay a utility to provide AC power to my service panel.
- knappe 2y agoThe same utilities that are already turning off power at even the chance there are red flag warnings? Surely you're joking.
- SoftTalker 2y agoI have never had my utility power cut for any cause other than storm/ice damage. And it's generally back on within a day, without any involvement on my part. If a hailstorm destroys my rooftop panels or a misbehaving vendor remotely shuts off my inverter, these are problems I now have to solve for myself. No thanks.
- knappe 2y agoYour panels are covered by your home insurance, just like your roof. So you'd already be talking to your insurance agent if you had any hailstorm damage to your home. I'm really sure I see the point.
- triceratops 2y agoNot a very productive comment...
- deleted 2y ago[deleted]
- t-3 2y agoCan the firmware still be flashed? I found cloud-free custom firmware exists for these inverters with a quick search, so if the units can still be flashed many may be salvageable.
- lxgr 2y agoI'm almost grateful to the manufacturer for demonstrating the terrifying kind of cyberattack enabled by such remote update/lockout functionality. Just imagine this kind of thing happening in a (probably not so distant) future in which a significant fraction of all electricity is being generated in a decentralized way, using devices such as this...
- _trampeltier 2y agoThere was already a case (many years ago), where something was wrong with an update. All inverters from a country did not start anymore. (You have to set the country or grid code in each inverter, so they know the grid limits).
- joe_the_user 2y agoI'm not sure about this. I know various hackers, back in the day, were congratulated for their "public service" of showing vulnerabilities. The problem is that we've to a network infrastructure that is only secure by piecemeal bug fixes and ad-hoc filtering and moved to situation where hacking is a (maximally shady) business. Will things be different with power grid and other infrastructure because lives depend on it? I don't see any indications. "The society at the stage of the integrated spectacle is characterized by five principal features: incessant technological renewal; fusion of State and economy; generalized secrecy, unanswerable lies; a perpetual present." Guy Debord, Commentaries on Society Of The Spectacle
- rootusrootus 2y agoThat is sort of a silver lining. We can use PR disasters as levers to make regulation happen which will hopefully add some protection in the future.
- deleted 2y ago[deleted]
- tw04 2y agoNot sure why sol-ark is getting blamed. People were buying Chinese inverters meant for the Chinese market off aliexpress on the gray market and shipping them to other countries. Deye decided to crack down on the behavior. There’s nothing indicating this has anything to do with sol-Ark at this point other than them being the approved distributor of rebranded deye inverters in the US.
- stavros 2y agoWhat harm was it to Deye that these were being sold elsewhere, that they couldn't fix by saying "sorry, we only support China"?
- quintushoratius 2y agoTwo possibilities come to mind: 1. They're not properly licensed for other markets. Something equivalent to selling a radio transmitter in the US that's not registered with the FCC. 2. They price units outside of Asian markets much higher and don't want to allow/encourage arbitrage that they don't control. This is definitely a case of "porqué no los dos" (or more).
- KANahas 2y agoFrom a link in the article: > The contracts we sign with all dealers clearly stipulate that products that are not UL certified and listed by local power grid companies may not be sold or used in the United States, because the products do not meet US UL standards. If used in violation of this policy, the devices may pose significant-safety risks. To address this, Deye has built a verification mechanism into the devices. The pop-up alert is automatically triggered by the device’s authorization verification mechanism, rather than by any human intervention.
- myself248 2y agoYeah, which is garbage. UL is a certification body, not a legal requirement. Your insurance might want it, your utility might want it. But there's plenty of ways to use solar inverters where neither of those factors applies. And furthermore, you can buy tons of non-UL-certified junk at Harbor Freight and plug it in yourself. It's not like there's a magic forcefield at the border that these Deye units somehow slipped through. Using that as an explanation for disabling their hardware is so insubstantial as to be just this side of an outright lie. And I'm astonished that the linked article isn't calling them out on it.
- MortyWaves 2y agoActions like this should forever ban an organisation and its executives from operating in anyway in the countries affected.
- metalman 2y agooff grid here,off and on since the early 90's current iteration uses US made charge controller and inverter, midn9ght and magnum both capable of firmware updates, but continue to function after 10 years without coms.The midnight controller did pop up a cheeky message of "got coms?" for years, but for some reason , gave up. The thing with both of these pieces of equpiment is that they are designed by bad ass electrical engineers to survive and continue to function under the worst conditions..... and then some, which I have personaly tested. I believe that a firware update could be done with any old laptop, and that while as a new owner I did go all ocd watching all of the data(did learn a lot), now I sometimes forget that the system exists, ......its that reliable
- Schiendelman 2y agoWhat products would you recommend today?
- Filligree 2y agoNot GP, but Victron makes some serious beasts. Their whole system is modular, so easy to expand, and it’s local-only by default.
- Schiendelman 2y agoThank you for the excellent Saturday investigation topic!
- Shog9 2y agoSecond this recommendation. They also publish a bunch of their software on GitHub: https://github.com/victronenergy https://github.com/victronenergy - makes it much, much easier to figure out what the hardware is capable of even if you never venture beyond cabling various boxes together. I helped a neighbor replace his Magnum system with Victron a couple years back; sadly, the former company has abandoned its roots and produces hardware that is neither well-designed nor robust. The documentation still smells like it was written based on some EE's napkin notes though.
- cenamus 2y agoInteresting to see China do the same thing as the US did to China so many times. Only now it's wrong
- Cheer2171 2y agoExport controls =! Remotely disabling already-purchased hardware
- _trampeltier 2y agoAs far I know, software like CADs also just stopped in russia after the war started.
- suraci 2y ago<holding-hands> Whoa, we don't talk about that here </holding-hands>
- zrail 2y agoAs a consumer and homeowner I try my hardest to buy "smart" things that only have local control, especially for important systems like power and HVAC. Our standby generator has a manufacturer supplied wifi pod that I never set up. Instead I use an RS485-to-USB dongle and monitor it myself with open source software. Our HVAC is the same to the greatest extent possible. When shopping for a new robot vacuum Valetudo[1] compatibility is an overriding concern. If/when we have solar installed it will not be connected to the manufacturer or distributor's cloud systems. [1]: https://valetudo.cloud https://valetudo.cloud
- nunez 2y agoI love the idea of Valetudo but flashing devices with it is a hell of a lot of work (if you can at all) and projects like these aren't entirely safe from takeovers from malicious actors either.
- deleted 2y ago[deleted]
- greenthrow 2y agoTitle is a bit misleading and makes it sound like Sol-Ark did this. They did not. Title should be "Deye manufacturer reportedly disables all Deye inverters in the US". They are the same entity but this wording avoids confusion about Sol-Ark being responsible.
- api 2y agoIf it depends on the cloud to operate it's not yours.
- greenthrow 2y agoThese devices do not depend on the cloud. If I want to take my Sol-Ark inverter offline I can just take the wifi dongle off it. Dunno about the bootleg Deye one.
- tibbydudeza 2y agoI presume they locked out the solar recharging of the battery and home supply but do not stop mains grid power to the home ???.
- jchw 2y agoIt is extremely frustrating to watch "connected" "smart" devices repeatedly do exactly what we knew they would do, and yet nobody ever learns a damn thing. People will keep on buying Internet-connected devices, manufacturers will keep making them, this sort of thing will keep happening, and the rest of us will struggle to even find mass-manufactured things that are not Internet-connected and "smart". Even devices that are pretty much for "self-hosting" are increasingly trying to sneak in cloud-connected back doors, like Synology DSM trying to sneak in cloud authentication to your local NAS. Stop trying to make the devices I bought for the purposes of having locally-managed devices depend on cloud services! My local network is not just a fucking gateway to cloud services!
- gdjskshh 2y agoI gave up on Ubiquiti because of the cloud nonsense. Altium is pushing cloud hard (and pushing me to KiCAD). I'm a weirdo for using a mac w/ only a local account (no apple id). I can't buy any new or electric vehicles because they're all 'smart'. The cloud is artificial, so it must be chemtrails, which explains why modern software feels like its giving me cancer. Wake up sheeple. /s
- Matheus28 2y agoCan’t you use ubiquiti fully locally? I haven’t tested my setup but I can access the web ui directly through the device ip
- correnos 2y agoIirc they've got a one-year timeout for updates, after which they'll make you sign in with a unifi web account in order to update. Deeply frustrating.
- CuriousCosmic 2y agoIf you want an electric truck (or potentially an SUV), consider looking at an Edison Motors pickup truck retrofit. They are technically Diesel Electric instead of pure electric but you can customize the battery load if you want to run full electric. They don't do all the stupid cloud connected software stuff and they are all about repairability/self maintenance. Probably the only electric vehicle manufacturer that isn't egregiously tech-bro-y and dripping in dark patterns.
- sandeepthroat 2y ago[flagged]
- nunez 2y agoI feel for customers impacted by this but hate that the only real choices customers have are local, but expensive, equipment or affordable, but outsourced equipment. This is endemic in the home automation space. Nearly everything is made and operated on Chinese soil. Like security cameras, or, in my case, our LiDAR and camera augmented robot vacuums. Some components, like lights and switches, have (very) expensive American alternatives. Some support ZigBee or Matter and can be controlled locally. Many many others require cloud infrastructure operated outside of the US and become bricks without it. I would love to see the US mandate ITAR for all IoT devices sold in the US. If anything, that will help prop up local alternatives like Matter since that will be way cheaper than building compliant cloud-connexted devices.
- joe_the_user 2y agoThe question is whether a customer has to actually connect these things to the net.
- nunez 2y agoThey do in many cases. Example: GE CYNC Wi-Fi lights require a connection to Savant's servers, which I believe are split between US and CN. They are one of few vendors that make BR30 smart lights. Philips and LIFX aside, all of the other vendors require an Internet connection.
- deleted 2y ago[deleted]
- hippich 2y agoRegarding solark statement about using their own backend. I am pretty sure they transitioned to it around May 2024. Before that it was different site, which I am pretty sure was shared by all deye customers. I wonder if this event was planned well in advance...
- anon84873628 2y agoIt is possible that Deye waited to pursue this blunt remedy until Sol-Ark customers would no longer be caught up in it. Doesn't mean Sol-Ark knew what they intended.
- deleted 2y ago[deleted]
- mastazi 2y agoHere's what I want: by law, any device that is connected to the internet needs to have a warning on the box, similar to the one that's on cigarettes packaging, stating the risks of that device being online (bricking/loss of service, data might be compromised in a cyberattack, etc.)
- ronsor 2y agoThat will end up being as effective as California prop 65, better known as "that cancer warning everyone ignores."
- deleted 2y ago[deleted]
- morningsam 2y agoFor it to be effective, all it needs is its complement: An easily recognizable green label saying "Doesn't connect to the internet", which is only allowed on the boxes of devices for which this is the case. Maybe some more levels in the middle like "only connects to the internet for firmware updates" (yellow) and "doesn't require internet access for core functionality" (orange). Basically Nutri-Score [1] for hardware. [1]: https://en.wikipedia.org/wiki/Nutri-Score https://en.wikipedia.org/wiki/Nutri-Score
- echelon 2y agoHard to enforce those laws across international borders. Especially if there's an escalation of geopolitical tensions. Imagine if a country could turn off power to US homes during a conflict. This is critical infrastructure we should be making at home.
- Xelbair 2y agoHere's what I want: by law, any device that i own should work perpetually until broken by me. If it requires 3rd party servers, let me configure alternatives. and if you sunset the servers completely you are mandated to release either: complete documentation how to create your own service to keep device working, or a full binary that supports ALL the features that were available throughout device's lifecycle. If you go bankrupt you are mandated to just open source your software in that case. and that's a minimum I'll settle on.
- ryao 2y agoI have a solar edge inverter. I never connected it to the Internet out of concern that this was possible. While it is a different company, this vindicates my concern.
- zbrozek 2y agoDo you have some other mechanism for getting telemetry?
- pclmulqdq 2y agoWhy do people insist on having remote telemetry from these kinds of appliances?
- baby_souffle 2y agoBecause that's easiest for a very broad set of customers. If you're comfortable with a datasheet, logic analyzer and know how modbus works, you're 60% of the way to a local telemetry solution... And you're also probably not representative of the typical customer. But if your tec
- starspangled 2y agoSurely the easiest is to not get telemetry.
- justsid 2y agoWhy would you not want to see how your solar system runs? You can’t easily verify that it’s actually generating energy as you expect it to if you don’t look at the data
- CoastalCoder 2y agoI think the distinction here is how the data are made available to the owner. E.g., it could have an embedded web server accessible only on the owner's local network, a local display panel, some USB thingy, etc.
- RA2lover 2y agoI own a Guangzhou Sanjing R5-8K-S2 inverter that had issues shortly after installation where it was generating far less power than expected. The web telemetry panel had multiple gaps throughout the day where energy generation dropped to 0, but having datapoints logged every 10 minutes didn't give out enough information to determine why that was happening. It also had a current status endpoint which updated every 10 seconds. I wrote a python script to log those updates into a file, and eventually discovered the inverter was shutting down itself and waiting 5 minutes every time it found its grid voltage to be greater than 241V. Installer wanted utility to lower the house's grid transformer tap, but needed authorization from Utility, who declined claiming it was already on the lowest tap possible. Cynically, i think they declined because lowering further would lower grid voltage at night below minimums they're contractually required to maintain. Tried going into the manufacturer's website to see if a firmware update could solve this. Couldn't find firmware updates, but i did find a manual for their local monitoring app, including a password for installer-only settings, set to "123456". The app doesn't include any functionality to change said password to something else, so i assume it's hardcoded. There was one change i could still legally do without violating anything - raising the grid shutdown threshold voltage from 241 to 242V. This change did get reflected in subsequent logs, so the settings panel is functional. I could technically increase that further (to a maximum of 275V), but that would expose me to liability. Parents suggest contacting the inverter's distributor for support, and they asked for a password i was never given. Apparently the manufacturer is suppopsed to create accounts for installers/distributors buying directly from them, and i somehow bypassed that process when creating an account for myself, without even realizing it. Some more clarification later, it turns out they can still remotely access the inverter with its serial number. After doing so, they "fixed" the issue without explaining how. Checking the installer settings interface, it turns out they just increased the grid overvoltage shutdown threshold to 275V right off the bat. At least i got them on record saying they did that, so i'm technically in the clear. Still, having that kind of access was scary enough to want to make me disconnect the inverter from the internet. Turns out its warranty (which only expires in 2036) has terms requiring it to stay connected to the internet. That's enough time to trigger WW3 and a resulting horus scenario (https://horusscenario.com/ https://horusscenario.com/). Until then, the best i can do is to throttle the inverter's internet connection to something like 10kbps, which isn't enough to prevent someone persistent enough from uploading new firmware. Stories like this make me reconsider keeping it connected. I'm surprised we haven't seen inverter ransomware yet.
- thot_experiment 2y agoTo most of us HN denizens it's obvious that OTA updates and internet connectivity generally leads to the things we rely on being worse. It sucks to have something that works when you go bed and is broken the next morning because of some idiotic update. What can we do to modify capitalism so that this externality is correctly captured? I think most people, especially those who rely on these systems to do their jobs would tell you "I would gladly pay a premium to prevent outside influences from being able to brick my tractor (or whatever), if it's broken I want to be the one who has broken it." Is this something that could simply be solved by aggressive anti-trust? Surely this isn't the best future we can come up with.
- anon84873628 2y agoFirst we need an industry certification that encapsulates all the end user requirements. Then we need consumers to vote with their dollars, or regulation to enforce compliance.
- rstat1 2y agoI feel like stuff like this shouldn't be anywhere near the internet. Partly because of reasons like this where the manufacturer can just randomly decide to disable it, but also because its usually the software equivalent of Swiss cheese.
- forgetfreeman 2y agoI feel the same way about cars, lightbulbs, and thermostats.
- echoangle 2y agoI’m not saying those things are safe but isn’t the attack surface pretty limited if you are behind NAT/a pretty basic firewall? The only connection to the internet should be the device reaching out to a server and asking for an update from time to time, it shouldn’t really be reachable from the outside. Unless the update server is compromised too, I don’t really see what can happen.
- shakna 2y agoOnly if that attack surface doesn't include employees, household members, contractors, shared spaces, etc. That is, a small business may be fairly safe if they're no cohabiting. A corporation probably isn't.
- relistan 2y agoIn this case the manufacturer was the one that triggered it. Even if it weren’t, how secure their servers are, or which foreign legislation they are subject to is a total unknown.
- tgsovlerkhgsel 2y agoThese kind of things will stop when they start getting treated as malicious attacks (similar to ransomware), i.e. the perpetrators become wanted people and if caught, see significant jail time. This goes both for the malicious bricking of normal consumer devices, and attacks on critical infrastructure like this, except of course the punishment for the latter should be correspondingly more severe.
- hedora 2y agoAssuming that one of these inverters is in North Carolina, they’re facing a $250,000 fine (hopefully per inverter), and second degree murder/40 years if anyone died: https://pemc.coop/bill-protecting-critical-infrastructure-signed-into-law/ https://pemc.coop/bill-protecting-critical-infrastructure-si...
- tgsovlerkhgsel 2y agoOnly if this actually gets treated as an attack though, which I haven't seen happen in similar cases in the past. Sony BMG with the hidden DRM rootkit malware on their music CDs got some civil penalties but no criminal prosecution. Sony with the Playstation OtherOS removal had to pay a ridiculously low class action, no criminal prosecution. Lenovo got a slap on the wrist for putting an adware firmware bootkit into the machines, again civil only. A lot of companies are still getting away with exfiltrating memory dumps by default as part of their error reporting, selling your location data, etc. The only criminal prosecution (as in "butt in jail") for similar behavior that I'm aware of is Volkswagen's Dieselgate, and that was only prosecuted because it was seen as screwing over the US government, not consumers.
- hedora 2y agoThis law is specifically for attacks against energy production infrastructure, and it’s state level. If there are other similar laws, they have to buy off multiple prosecutors to avoid charges.
- aldousd666 2y agoTrade wars have casualties. This is the first in a long line to come.
- ggm 2y agoIf you sold equipment which wasn't certified for connection to another economies electricity grid, and discovered resellers were selling it into that economy, what would you do? Calling this trade war invokes issues which may exist, but ignores more present dangers. Selling unlicensed radio equipment (--for example) into different economies has massive financial risks.
- ajross 2y agoYour position is that "selling unlicensed equipment" is a liability risk for Deye but... deliberately disabling equipment you don't even own is not?! All they need to do is the same thing any manufacturer whose stuff ends up on a gray market does: "We're very sorry and we don't know how this happened. We'll work with regulators to better audit our export shipments in the future." This kind of thing happens all the time.
- walterbell 2y ago10 years ago, https://www.finnegan.com/en/insights/articles/u-s-supreme-court-holds-that-books-printed-and-sold-abroad-may.html https://www.finnegan.com/en/insights/articles/u-s-supreme-co... > U.S. Supreme Court Holds that Books Printed and Sold Abroad May Be Freely Resold in the U.S. Because the Copyrights Are Exhausted Under the First-Sale Doctrine.. The Kirtsaeng decision is significant to copyright owners, and it may also have important ramifications for patent owners who make and sell goods abroad that practice a U.S. patent. https://www.iveticlaw.com/owning-vs-controlling-understanding-the-first-sale-doctrine-in-copyright-law https://www.iveticlaw.com/owning-vs-controlling-understandin... > The first sale doctrine is a legal principle that limits the copyright owner's control over a particular copy of their work after it's been lawfully sold. This doctrine, in essence, acts to cut off the copyright owner's rights in the created work after the product is first sold (ie. when the copyright owner releases their work into the marketplace). Another way to describe it is that the copyright holder's right to control the distribution of their work goes away after the “first sale” of the work,(hence the name). In more straightforward and more practical terms, once you buy a book, CD, DVD, artwork or any other authorized copy of a copyrighted work, the copyright owner generally loses the right to control what you do with that specific copy. You can resell it, lend it, give it away, or even destroy it, without their permission. Remote bricking requires software, which is sold under copyright law.
- anon84873628 2y agoAnd yet some software licenses do dictate what the user can/must do with regards to further modifying or distributing the code. This also has nothing to do with exclusivity agreements arranged between companies, as seems to be the case here.
- walterbell 2y ago> nothing to do with exclusivity agreements arranged between companies The 2013 U.S. Supreme Court case depended on a plaintiff that was making enough money on textbook arbitrage to fund a legal case all the way to the Supreme Court. It provided new clarity on book distribution and geographical "exclusivity". If software enforcement of device distribution agreements affects a large enough flow of capital, then corner cases will accrue enough economic impact to be tested in courts. Manufacturers do not have carte blanche to manipulate hardware remotely, e.g. they cannot take actions that could injure humans. Where are the limits? For now, we have many opinions and few laws.
- MarkusWandel 2y agoThe root problem, as always, is that it has been normalized that devices in your house, accessed from your house, need cloud access to do this, or even to function all. Metrics from an inverter, once upon a time, would have been a local web server in the device. Maybe with QR code printed on the device so the typical smartphone user could access it. Firmware updates ought to be physically "opt in" - like stick a USB stick or MicroSD card into the device and push a button. Not some mysterious cloud that through legal issues, malice or sheer incompetence, can reach in and modify or delete functionality without warning. My dishwasher has a little nag light to remind me I haven't connected it to my Wifi yet. I never will. It washes dishes just fine.
- brianwawok 2y agoOpt in security updates is generally bad. It means 99% will never ever get one. Opt in for major functionality, that is fine.
- MarkusWandel 2y agoNo security updates needed if the device isn't connected to the internet in the first place!
- doublerabbit 2y agoYes and no. Depends on the exploit. If the washing machine is already vulnerable than you'd want a security update.
- forgetfreeman 2y agoIf the washing machine isn't connected to a network through what mechanism do software vulns become relevant?
- doublerabbit 2y agoIf the washing machine can connect to WiFi then that's already a vector point of transmitting a payload by connecting to it.
- fsckboy 2y agothe word "bricked" was used. are these units actually bricked, as in permanently? or do they perform the same checks every time they start and will simply keep failing till they are in a designated geolocation?
- tehcopec 2y agoI've been using Deye since 2019. I was using those blue grid-tie inverters with limiters to do zero-export and they had the Deye manufacturers sticker on it. So I googled them, found them on Alibaba, and purchased some directly from them. I had no idea that they were related to Sol-Ark until later. Fortunately, I never trusted their dongle/cloud solution and so only ever plugged it in when I requested firmware updates from them. I learned at some point that they were designed with Sol-Ark, and that Sol-Ark put pressure on them to stop selling to the U.S. market, and indeed they stopped selling to anyone directly in the U.S. I get Sol-Ark's position, but there are numerous people that bought them not even knowing the relation nor that they would be considered grey-market (since buying products direct from China is really common). Also, like pretty much everybody I know that screws around with this stuff, none of use would have paid for the Sol-Ark nor were we really aware of them because they so expensive anyways. Even if this decision came purely from Deye, it's a direct result of Sol-Ark putting pressure on them to stop the sell of inverters into the U.S. market, and enough middle-men were getting around that, that they felt the need to do this. Again, I get Sol-Ark's position, but it's just a really bad look for them. I think it's similar to certain media piracy: The people wouldn't have paid for it how you are offering it anyways, and all you're doing is making potential future customers hate you; It would certainly be more profitable to focus those resources on something else.