I don't trust commodity-manufacturers who need to keep rapidly iterating their products to maintain profits to supply me with something intended to be affixed for the long term.

Even though Apple might do a better job than many vendors, they still release products that stop receiving updates and other maintenance long before the physical hardware is worn out. Something that's going to be with me for a very long time, like something permanently installed in my house, or something integrated into my car, is not something that I want from a commodities-supplying tech firm.

Reading his wiki entry he reminds me of Bergholt Stuttley Johnson.

I could not speak to the cost/benefit ratio in Europe, but in the United States, 1.544Mb on a Frame Relay would cost more than 1Gb on a Metro Ethernet fiber connection. I know because I retired a Nortel Meridian telephone system using T1 links specifically because it was costing more than the 1Gb and later 10Gb Metro Ethernet L2 MPLS connection and had far, far less flexibility. We migrated over to VOIP phones and saved a ton of money on the ~75 service entrances we were taking care of, and the VOIP traffic was a drop in the bucket on that network.

The only thing I could think of after my original post would be to contract with a cellular provider for a private APN (think similar to a VLAN or VRF for a subscriber with a ton of individual cellular endpoints, doesn't route to the outside like normal cell carriers' endpoints can) and then bringing that APN into a cloud instance with firewalling to prevent unauthorized traffic from the Internet from being able to hit the APN in the first place, but that still requires IT security practices.

The annoying thing about a private APN and using cellular is when the carriers change-up their gear it becomes necessary to replace the cellular endpoint equipment. I've seen this happen with security system cellular (no private APN) where the 2G gear had to be replaced, they went with 3G gear, only for that to also have to be replaced when the carrier wanted to go to a minimum of 4G LTE.

I expect that Yandex is hiding behind statements in their contracts and Russian laws governing liability due to armed conflict to try to skate any responsibility to their customers.

Given how quickly America came to disliking datacenters, seemingly as a real grassroots thing through hatred of techbros, hatred of higher energy prices to their own households, and hatred to water scarcity, seems like any complaint that Trump would make about it would simply lead to more backlash upon him.

I could see a fire starting in an electrical distribution panel if, once the problem was discovered, someone set all of the fridges in the building back down to proper temp and the startup demands exceeded the panel's ability to supply power, but that's more of an electrical equipment fault in being faulty or undersized rather than an IT fault.

I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?

This is realistically where the failure sits, but it's unlikely that in an IPv4 network, that the IPs of the IoT endpoints would be directly exposed to the Internet as they'd normally be RFC1918 addresses and would require someone to explicitly set up inbound NAT rules to forward to those endpoints for them to be directly exposed. So the question then becomes, what as the method of exposure? Were they on Internet-routable IPv6 addresses where someone screwed up setting up security? Was some other method used to get into a private network, and from there they hopped through to these endpoints? Was the network security for the LAN the fridges were on actually done right, but the vendor's management tool breached and the tampering from "the cloud"?

We don't really know if they actually got to 50C, just that they were set to that. For all we know they just shut off when the actual thermostat realized that the commanded temperature was higher than the actual temperature. But the point about liability still stands, and we don't know if they have any sort of privilege escalation based on type of administrator.

I did give it a skim. It looks to me like despite this being a supposedly industrial system, the company behind it neither understands IT security practices, no do their customers. This isn't exactly surprising, as HVAC technicians who are used to troubleshooting blown fuses, bad compressor pumps, and clogged heat exchangers are busy and the nature of IT security is shifting. It sounds like both the company behind the products and the customers made serious errors, very likely in the guise of keeping costs down by simply not addressing vulnerabilities.

I'm personally against industrial controls that connect back via normal outbound NAT like any other internal endpoint would that use destination port 443 for their communications. This is becoming increasingly common as BACnet traffic (typically on port 47808 and up) is replaced by BACnet Secure, which just uses normal SSL. Don't get me wrong, the old way on BACnet isn't exactly secure even when an enterprise customer sets up a VPN tunnel and forces all traffic from the particular equipment to the management cloud tool that traffic is unencrypted on the customer's network, but the SSL model along with cloud endpoints' IPs changing regularly as their various cloud hosts switch between AWS, Azure, and other providers means it's more difficult to determine if someone's internal endpoint is communicating with the only hosts that it should, or if it's compromised and connecting to some command-and-control server that looks superficially the same as normal traffic.

If I were investigating this, I'd start by getting the operational topology from the vendor that made the equipment and presumably the control software, and I'd start at the point most in-common among the victims. If the vendor itself was compromised then there's the problem. If the vendor wasn't compromised, I'd start to look at how the protocols on these systems work and what sort of opportunity there was for interception to learn of the endpoints in order to build out the profile used for the attack. I'd then want to review the actual faults that the vendor supposedly warned their customers about.

Unfortunately good IT security is expensive, and I expect that most businesses adopted these supposedly smart commercial refrigerator controls to save money, not to spend more on it. They might well have been better off to just install Internet-connected temperature sensors that had no actual control capability, where a central monitoring room could call the customer if a fridge was being reported as outside of the proper temp range, so that the customer could engage a technician to troubleshoot. But instead they tried to go even cheaper by centralizing all of it, to a fault.

Not sure why this was modded flamebait. I don't see anything grossly inaccurate and any editorializing isn't exactly couched in fantasy.

That largely depends on what the contract actually says, and how the data is 'federated' within Flock's own systems.

It sounds like Flock's business model was to build the massive data-collection system, but since that's expensive, it used contracts with government entities to pay for the build-out. The contracts with each of the entities might well be for the services delivered to them, but since many municipalities have separate contracts for how real estate (and installing something on a light pole counts) then Flock might be maintaining their own contracts separately for the physical placement of their cameras.

So Flock gets agencies/government to pay for the services of license plate data collection with one contract then uses another contract for Flock to pay for the rental for pole space. If the contract to provide data to the polity lapses or is terminated, that doesn't necessarily mean that Flock's permits to maintain equipment on poles is also terminated as they're separate contracts. Granted, operating the cameras is on Flock's dime now, but if they continue to harvest data then they might find takers for that data even if not the original municipality or other agency who paid for the cameras.

The thing that our current interpretation of the Constitution lacks is where the dividing line between one's self and a third-party sits when it comes to the sanctity of one's person, papers, and effects. At the time that the Constitution was written there was no photography, let alone videography, mass-processing of records automatically, etc. Someone had to physically observe someone in public in order to know what they did, and could only repeat with their words what they saw rather than demonstrating it. We don't have good law for 3rd party collection of volumes of data about people and the ability of said 3rd party to provide that data to the government. A ruling, law, or amendment that puts protections on requesting information and establishes some kind of checks and balances system that applies to the government in all its forms is needed. I don't know what the threshold should be either, but clearly right now when we have stories where the justification for a search is, "ASDFG" then something needs to change.

It is possible to put laws into place that require how public-private partnerships work. It would be an imposition upon Flock and upon the police. And that is just fine, and as it should be.

Law enforcement contracting to the private sector should not be allowed to be a bypass of our rights.

The only place I see Al in the legal profession making sense is to do basic caselaw research, where it can cite the sources and the references upstream and downstream to those sources. The lawyer should be responsible to review the claimed caselaw citations to determine the merit of their support for the argument that the lawyer is making, and to pick the particular citations to use that are the strongest for the particular case.

Likewise the same sort of search but inverted, for one's opponent's most likely arguments or rebuttals might be performed, again with the lawyer doing the review based on the citations that the Al tool provided.

There was a television series in the 2010s called Person of Interest where the premise was that one of the main characters had managed to achieve Al, but in order to satisfy legal constraints, the Al was only allowed to spit-out a single phrase about a person, rather than any detail of any sort. It was up to the limited number of persons associated with the Al to figure out why this 'person of interest' had been referenced, whether they were the perpetrator, the victim, a witness, or someone who would suffer downstream effects. While soft science fiction, and pretty clearly taking inspiration from the older series Quantum Leap in having to figure out why they were there, the concept had some merit as to how Al should really be used. It should be treated as untrusted, it should be treated as requiring thorough review. It should be treated as another tool available, but no more trustable or authoritative than any other, and arguably a bit less trustable, a bit less authoritative.

I've seen firsthand in meetings people saying, "Well Claude says..." or "Well ChatGPT says..."

What's bothering me about this is that those running the meeting aren't shutting that crap down immediately.

Except that in basically all of the examples that you cite, the transition was from one proven technology slowly into another technology that was at least approaching some degree of maturity by the time it it mass-market adoption.

In most of those examples. early adopters were nearly all ultrawealthy who were using it for themselves. Those who weren't incredibly rich were technology-enthusiasts of some fashion or another. Those groups initially worked-out most of the showstopper-problems with the technology before widespread adoption, and in many of those industries either compatibility or outright law added extra constraint over time.

AI for the masses has taken a different development path. It's not ready and is misbehaving, to the detriment of many. "Hallucinations" should not be tolerated at this scale of deployment.

Not if you're the police.

Or as it was put nearly two millennia ago, "Quis custodiet ipsos custodes?"

This is why systems like this require human oversight. Arguably if there's a judicial review process for allowing searches, then this system needs to be required to use that process. With a system containing precinct, local court district, municipal, county, state, and federal district jurisdictions, the nature of setting up proper permissions alone should be a mandatory herculean effort, probably the most difficult part of the entire system.

Without such a system requiring judicial oversight to confirm that searches are authorized, all we have is a further slide into a police-state.