Hacker News Reader

Comment by paxys | Hacker News Reader

Related to the opening of this article – it is interesting to see how one can get completely soured on certain products or experiences because, by virtue of their profession, they see the dirty underbelly of how things in that industry actually work.

Someone who has read cruise contracts in detail will never want to go on one. Cooks with experience in commercial kitchens never want to eat at a restaurant again. Someone who is familiar with standards of bridge inspections in most towns hesitates every time they drive over one. A computer security expert keeps their most valuable information under lock and key in a physical safe rather than online.

My conclusion ultimately is – everything is running on goodwill and duct tape, and ignorance is bliss.

View on HN

Most people who work in restaurant kitchens eat far more from restaurant kitchens, not less. I did for quite a few years and I’m still very happy to eat at any diner, drive through, or Michelin star restaurant.

I think the kitchen thing is mostly a myth. Although it's true that often the refrigerators used during meal service tend not to be as cold as they are supposed to be, because the door is constantly being opened.

I think the main thing I learned from my commercial kitchen work is how similar they all are behind the scenes - the equipment and often skill of the line cooks at your local truck stop and the local fancy dining are closer than you expect.

The difference being the type of prep work being done, how good and consistent their ingredients and recipes are, and the presentation. Mechanically, yes they are all similar.

Unless of course, you are at a steakhouse, and they don't have a salmander broiler. Run away!

It's probably true in fast food, not all commercial kitchens.

Agreed. I was going to say that I bet this a myth that endures only because it is repeated endlessly. I've never seen data to prove it and my anecdotal experience is the opposite.

> Cooks with experience in commercial kitchens never want to eat at a restaurant again.

Having done such work, this is absolutely untrue. I got a renewed appreciation for the hard work kitchen staff put in and the stringent requirements on cleanliness that kitchen staff has. I suppose this will change based on the country you are in, if you are in a country with bad sanitary checking you will have a bad time.

Totally agree, though it seems differ quite a bit between different kinds of kitchens here in Sweden. Producing stuff sold in stores means super-stringent checks where for example you have to swap your clothes before entering and exiting the area where you prepare the foodstuff. Now school kitchens on the other hand... sure they are checked but not at all with the same strictness it seems.

I have ten years in kitchens and while I do eat out I also know how disgusting kitchens are. I have a stomach for it but if you were a regular person and knew what I knew you'd refrain from eating out.

We pay back of house staff as little as we can get away with to work every weekend and holiday in hellish conditions. They just don't give a crap and who can blame them.

> I also know how disgusting kitchens are [...]

They're disinfected literally every day, and during the day all surfaces are regularly cleaned. If this isn't mandatory where you live, you live in a country with bad hygiene laws.

> We pay back of house staff as little as we can get away with to work every weekend and holiday in hellish conditions.

This doesn't match where I live at all, FWIW.

> If this isn't mandatory where you live, you live in a country with bad hygiene laws.

Are drugs illegal in your country? Do people still do them?

If you spend a little time thinking about the amount of restaurants versus the amount of actual people there are in a country, you will realise one is relatively easy to enforce compared to the other.

Furthermore, the conversation was about the average. It is not the case that the average human being goes around snorting coke in the toilet every day, just as it is not the case that the average restaurant is some bastion of filth. Moving around the goalposts in such a way is not a way to have a conversation in good faith, so please stop doing so.

Having worked in them for a decade I know how it works in practice. Perhaps whatever country you are from has sparking clean restaurants full of well paid, sober people but in the US, they are disgusting as a rule. My peers in the UK reported the same.

We had to call a ambulance for our health inspector once beacuse they overdosed in the bathroom. Check out Kitchen Confidential if you want to see this backed up, and even that's about the highest end restaurants in the country.

https://www.amazon.com/Kitchen-Confidential-Adventures-Culin...

> in the US, they are disgusting as a rule

Sanitation is enforced at the local level. Making blanket statements about the U.S. carries little information.

Restaurants in New York (county) are spotless. Restaurants in San Francisco, less reliably so. The broader point holds, however--people in the restaurant industry tend to go out to restaurants.

> Restaurants in New York (county) are spotless.

They most assuredly are not. At least the ones I've worked in. I did a few months at a sandwich place where the owner would smoke while assembling sandwiches with his bare hands. I've never worked in SF so I can't comment on what it's like there.

Don't even get me started on those takeout only ghost kitchens. A lot of times they are running out of people's houses, rinsing lettuce in bathtubs.

If you think that's gross you should see how it's handled on the distribution end. Pallets of chicken breast sitting for hours in the summer sun and then served that evening.

We go out to eat beacuse you get desensitized to it after a while not beacuse it's clean.

With respect, I had this to say about your situation:

> [...] if you are in a country with bad sanitary checking you will have a bad time.

Lo and behold, you have a bad time.

It's legend because of Down and Out in Paris and London, by George Orwell — a book from a different era.

https://archive.org/details/DownAndOutInParisAndLondonGeorge...

> Roughly speaking, the more one pays for food, the more sweat and spittle one is obliged to eat with it.

That legend is true in some products. Medicine, the lower the absolute cost, the higher the quality. Not totally in every way, but in general. Especially for pills, that hot new patented pill that solves all your problems is worthless, it can only compete with the out-of-patent miracle drug because of P-hacking statistics and super super hot pharma reps "calentando la sopa" to the doctors prescribing it. Like if Ratipooson tm brags about being 41.3% effective instead of 40% effective and requires a team of cheerleaders to get your doctors to prescribe it, and the pill from the 50's has a grouchy fatass with a mustache that only goes in person every three years to check up on stock, obviously the old pill is categorically superior. The statistics are lies, and anyway, the doctors ought to think of how good the patient's money is for him, what he has to do to get that money, the impact of that money on his health versus that (fictional) 1.3% improvement.

I suppose I have to translate that. "Calentando la sopa" means heating up the broth. Like sexual innuendo, teasing, they're super super particular about wearing clothes that get the doctors thinking about sex without admitting they want the doctors thinking about sex.

I'm so relieved to hear you say that, because OP is spot on about anybody with any knowledge of how software is developed not trusting it to do anything right.

It varies a lot. Quite a long time ago, I worked at a pizza place in a regional chain. That location was kept quite clean, as were most of them. However, sometimes they'd give us the chance to pick up a shift at another location if they couldn't arrange one of their own employees on that day (usually because they called in sick). One such location was absolutely filthy. That location was since closed (grapevine says the chain fired the GM and couldn't find anyone to replace them).

What helps is that there are signs of this sort of thing, if you know what to look for. E.g you should prefer places where you can see into the kitchen (which is most of them these days), places where the customer service workers tuck in their shirts, and places that keep their bathrooms and parking lots clean. Places where police and EMS folks eat really tend to be good bets (they usually also get a discount, but lots of places offer such discounts).

That's the system working as intended. Clean kitchens not only don't get their customers sick, but taste better too. Filthy kitchens go out of business. Most kitchens are clean, because the people who work there keep them clean, the rule in a manual does none of the cleaning, the people do all of it. And people know, come on, people are wise to this shit, they've been told not to trust their sense of taste in order to accept medicine that is clearly bad for them, but they don't believe 100% in the gaslighting, get real.

As a developer, I was shocked when at a friend's house saw that Alexa not only operated lights, but door locks and blinds. Or when another friend takes hands off the steering wheel to test lane keep assist.

I don't think I can trust any software at that level.

I agree with the IoT stuff, would never trust or want that...

Taking hands off steering wheel. Depends on where done, but straight or slightly curving highway with no significant other traffic sure. Why not try how well it works, just be ready to grab and correct if needed.

I even try how well my car goes straight line in similar conditions...

I use a voice assistant for lightning control, it’s amazing when I’m walking in with hands full or lay down and want the lights off.

I occasionally use it for weather but it’s annoying with such suggestions.

I should know better but in this case the convenience is worth it.

I wouldn't mind blinds so much, but it'd have to be via a button; I dislike talking on a good day, let alone to a machine.

That said, my lights are operated via RF remote(s) (two systems, one working on plugs, the other from ikea), pretty convenient without needing an internet connection. Just an awkwardly sized battery.

Why not just automatic? Maybe plus a button for privacy/needing darkness for a film or whatever depending on the room, but mostly I just want curtains & blinds to open in the morning and close in the evening.

Because they provide privacy in addition to light blocking. I don't have a 100% reliable schedule on when I'm going to need my windows to be blocked.

At least with Alexa, you don’t need to talk to a device to manipulate smart-home devices. The mobile app has controls in it for you to use.

Pretty sure that's the case with all voice-assisted smart home tech

It's not just trusting the software, but the implicit policy around its implementation and use and even more implicit social norms around what it is expected to do that develop and evolve in interesting ways as products and services entrench further and further into the woodwork.

Say an attacker captures enough of a homeowner's voiceprint to build a language model good enough to get past Google's or Amazon's voiceprint matching, then pipes "<hotword>, open the front door" through a wall or window (possibly ultrasonically).

What happens now?

Who is to blame?

Is it the homeowner's fault for using a product according to the use cases included in the instructions?

"Oh, no, that was just a serving suggestion! You shouldn't use <product> to lock your doors unless the doors were an effectively unnecessary decoration to begin with."

So then you have Buy N' Large and Big Brother getting into the home and contents insurance industry.

No. No you don't. The only reason this use-case got cleared by Legal is because someone figured out the circle of plausible deniability (weaponized portmanteau of "circle of competence") is currently wide enough to fit a lawsuit defence through. :(

It's like with Tesla and the whole self-driving thing. The implementation *happens* to be able to drive asleep "drivers" down highways at 100 miles an hour, and the company has somehow been able to corral itself into the evil-genius legal position of being 50% "always keep hands on the wheel" and 50% "look self-driving AI go brrrt" and somehow combine the liability protections of the former with the societal expectations of the latter. Solely in terms of overpromising and underdelivering and then wrangling the legal status quo to declare that okay, I do think it's a bit... not great.

Crucially, this problem is most definitely not limited to Tesla, Google or Amazon; it's an endemic permeability in the legal systems of ostensibly-developed countries that makes a joke of the proof-of-work foundation of good-faith technical investment, and institutes a fraudulent social contract that the infrastructure we increasingly depend on is fundamentally reliable and trustworthy ("set in stone") when it is not. To adopt these technologies is to adopt the ever-changing tech stacks that underpin them, and the risks associated with upgrading the proverbial engines on ever-larger digital airplanes while they're in flight. I think it's dangerous and irresponsible to dispel the tenuous fabric of social perception around these risks and give unsuspecting passersby the impression things are safer than they are.

Hmm.

I'm reminded of http://bash.org/?4753:

  <xterm> The problem with America is stupidity. I'm not saying there should be a capital punishment for stupidity, but why don't we just take the safety labels off of everything and let the problem solve itself?

Maybe that's what's happening here?

Why would you be even a little bit concerned over software door locks?

Most traditional locks can be picked open in seconds. There's no meaningful way to do any worse than that. The only fit-for-purpose way to use locks is in keeping honest people honest. They are utter rubbish at keeping bad guys out of your house.

I presume the Alexa Argument ist against the service and not against automation. Running your whole life on self hosted home automation is Stil awesome and the way to go. Just ensure that data never leaves your home premises and you have enough resiliency.

I would say trusting any kind of software with door locks(!) is a terrible idea. Yes, if you use home automation you should self host. No, if you secure your home you should not needlessly expand the attack surface.

I use a "smart" lock, even with BT/wifi/GPS based automatic unlocking which seems to freak my fiancee out. I see it as stealing my phone is not different from stealing my key. The more sinister ability is to unlock remotely via the "cloud" which I am still a bit shocked that it just seems to work, and no complaints AFAIK from insurance companies. I just happen to know that locks aren't really a deterrent if you really want to get inside a house....

On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home.

> On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home.

The threat isn't a competent hacker targeting you directly.

The threat is a competent hacker targeting the lock's vendor, getting their whole database, then selling address, entry code and occupancy times for $20 per home on the darknet.

It boils down to assessing the threat level and the risk level.

Threat: Hacker owning vendor and selling info on darknet Threat likelyhood: 1%

Risk: All valuables being stolen. Risk value: High if you keep a few kilograms of gold in your home. But basically depends on your possessions.

When we were burglared while sleeping a few years back the perp entered through a window. It was the last window not switched to a new one more secure. It took him around 15 seconds to enter. He left with the DSLR, a TV, clothes, a few valuables lying around and my SO's purse. Additionally, because traditionally her car keys were by the door on ground level he could grab them and put everything into her car and leave.

Nowadays our purses and keys never stay downstairs when we go to sleep.

I think the risk profile for traditional break ins is way higher than the risk from a smart lock (not that we have any).

Schlage doesn't know where I live, though, nor do they get any status updates from my home assistant. It isn't software that is the problem you're referring to, it's involving a third party unnecessarily.

Maybe for your smart lock - but sandos has "GPS based automatic unlocking" so his lock vendor probably knows exactly where he lives.

That doesn't require your lock vendor to know anything about your location. Homekit for example can do this with your bridge doing the work, and any cloud-required data being e2e encrypted.

But then what? Somebody still has to take the risk of actually burgling your house, getting passed the dog, alarm systems, lights, neighbors, etc.

And if they're going to do that, it's quite likely easier to pop a window lock than it is to buy a darknet database of API keys.

> then selling address, entry code and occupancy times

What locks are you referring to where locally configured entry codes are stored in a cloud DB? That's not the case for any of the ones I've installed.

That you are savvy enough to know this is a suggestion that "locks you've installed" might not be a general sample.

> I am not going to be targeted by [...]

This reminds me strongly of an ex-employer of mine, whose response to a security vulnerability was inevitably "our customers won't do that". It's one thing to have a threat model, it is quite another to dismiss low-hanging fruit (and trust me, whatever "smart" lock you have is very low-hanging) as not a big concern.

Unless you have a door specifically designed to withstand burglary a crowbar will always be an easier door hack than figuring out a backdoor to your automation.

There is no perfect security, only risk profiles. I would argue the risk profile of door lock automation is low enough not to be worthy of concern in most cases.

> Unless you have a door specifically designed to withstand burglary a crowbar will always be an easier door hack than figuring out a backdoor to your automation.

If your home is targeted specifically, yes. However, if a group hacks a cloud lock provider and then hits several homes using that without having to do something that looks supicious like physically breaking the door then it could be a lot safter and thus profitable for them.

And so they what, rob a few houses which statistically probably won't be yours before their hack gets discovered? Sounds like way more effort than just breaking the door or picking the lock.

You should probably update your threat model.

Why, is it out of date? Am I missing the latest security updates?

My generic answer (not being the guy who replied to you) is to look at probabilities. AFAIK in most places theft from homes is opportunistic. Garage doors left open, for example, is extremely common. Thieves just drive around looking for them, it's such a reliable occurrence. Other times, they just try the door and walk in if it's unlocked and they think nobody is home.

I.e. automating your door locks may very well increase your actual security rather than reduce it, if it causes your doors to be locked more often than you'd remember otherwise.

In what little experience I have with burglars, they aren't exactly the type who will be hacking your smart locks to get into your house. They're just going to break the door or window.

I like being able to check the status of my door locks remotely, and lock them if necessary. I like being able to make sure all locks and garage doors are secure automatically before bedtime. I'm not at all worried about someone sitting out in front of my house hacking the Z-Wave lock. By the time they figured it out, the neighbors will have already called the police anyway.

Connecting all my door locks (and garage doors too) to HA has measurably increased the security of my home.

My problem was not with Alexa specifically, it was a general feeling of "if software controls both locks and blinds it can lock you not only outside but inside as well". Of course I was immediatelly told that there's a physical workaoround in case anything goes wrong.

I cited this example not as something that is objectively bad, but as something subjective, more about my gut reaction.

Funny thing is both my friend and I have electrical engineering education. I went to build software for a living, he more or less moved to sales/management. His job is to hype tech. My job is to make the saussage. There's a popular meme which I heard some time after the anecdote above:

Tech enthusiasts: My entire house is smart.

Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don't recognize.

The biggest tech enthusiasts I know are tech workers, though. It's the normies in my life that couldn't care less about this stuff. I've been a developer for 30 years and I love my home automation toys.

But I do make sure that all of it fails gracefully to 'normal' when something interrupts HA. My software can (and does, every day) lock the door. But the deadlock still has a key on the outside and a standard twist knob on the inside. All the light switches work just fine without their wireless connection. Thermostat is indistinguishable from an old school Honeywell if you ignore the Z-Wave logo. etc.

I do keep my hands on the wheel, though ;-). The whole 'dying in a ball of twisted metal' failure mode is pretty convincing.

> But I do make sure that all of it fails gracefully to 'normal' when something interrupts HA.

This is why interest and trust don't have to go together. Sometimes the people who are most adventurous are simply the ones who are comfortable with a lower level of trust, because they can manage their risk.

I'm comfortable playing with new or niche technology because I'm able to keep it low stakes. My most tech-phobic family members, on the other hand, act like they have complete faith in the software they use even when they say they have zero faith. They don't have the savoir-faire to do things that limit their risk, like withholding sensitive data and backing up important data in different places, so they resent technology as chronically treacherous and agonize over whether they can "trust" individual pieces of tech in an absolute yes/no way.

I don’t know if I agree with this. My experience working for a federal judge made me much more confident in the criminal justice system. In the media we only see the situations where the justice system got something wrong—which is inevitable in a country of 330 million people. Looking behind the scenes made me understand that for every case where there is a conviction on shaky evidence, there are dozens of cases where a conviction or guilty plea is supported by a mountain of electronic evidence.

For example, my wife handled a murder trial where the government prosecutors not only had closed circuit video of the defendant shooting the victim, but of him getting in his car and driving home through town back to his house. They just cut from one closed circuit camera to the next and the next showing the entire journey.

Did your wife's case actually go to trial, or was it also plea-bargained? If the former, why would the defendant not take the plea in such clear-cut case?

One of those hypotheses is easily testable: bridges can collapse and you will hear about it.

And yet.. it rarely happens? There was one in Italy and one in the US recently but, to a decent approximation, it’s a non-issue.

Maybe we should have more trust in people and their work. Maybe our bridges are fine, our food is kosher, but what’s rotting on the inside is society, eaten alive by cynicism and distrust.

Bridges are usually massively over-engineered for safety.

Not over, just engineered. That's what safety is. I don't mean to be snarky, the built-in buffer is part of what makes it safe.

That sounds like the road to complacency. The reality is that there are many backup systems that work much of the time. Have complacency in all of them and forget society.

The bridge has engineers and architects who know material stats and add tolerances. The restaurant has patrons with immune systems that survived worse times in human history, usually, unless the patron is undergoing serious medical treatment or something.

I’d also like to see some evidence that people familiar with bridge construction actually avoid bridges or hesitate before using them. I suspect they might say something like that if the conversation goes in that direction, but I doubt they actually modify their behavior.

There was very nearly one in central London a couple of years back (Hammersmith) and it’s still closed to traffic.

But nearly is good, the situation is being rectified before it turned into a disaster. From the noises coming out of TfL this was a little close for comfort though.

The experts probably know which bridges to avoid. Those likely have sufficient number of visual clues of things like discolouring, cracks and so on.

"Maybe our bridges are fine"

I think thus can and perhaps should be refuted as the bridges are not fine. The 2019 report of bridges in WA found 6.6% to be in poor condition and more than half of the approximate 8000 bridges need repair. https://infrastructurereportcard.org/state-item/washington/

Seattle has about 6 or 7 very major bridges. One of the largest, the west seattle bridge has been closed for over a year because it was suddenly in danger of collapse. This is a bridge that carried over 100k cars per day. (https://www.seattle.gov/transportation/projects-and-programs...)

I think the point of grimacing while crossing a bridge is that the engineers know the problems and how pervasive they are. As a user of websites, you may think some are really solid. Having worked for one (a website virtually everyone has used), when you see the bug queues, all the outages, and all the problems, you realize it's not the steel fortress that it would appear to be from the native outsider

They're only fine until they're not; there's plenty of instances of rotting infrastructure that one day will fail, and it's not like these issues are unknown, there's just not enough money or people to fix it.

Meanwhile the US government is going to spend another trillion on its military.

We know consumer software has bugs – that can make them unreliable, insecure and slow. They can become worse over time with more usage (more data/state accumulation). Unless we proactively find and fix them, they can continue to hurt users. We know this. We know critical software systems (medical, industrial, infra) have specially hardened software that are more reliable (but not yet secure).

We also know buildings, bridges etc – can weaken over time due to material deterioration, foundation shifting, earthquakes, machinery induced vibrations, excess load etc. and fail (fall apart). They need to be monitored for signs of structural stress/failure (cracks, leaks, tilts etc) and corrected/repaired or else they fail. When these maintenances are not done correctly, due to incompetence or corruption, they will fail, no doubt.

Once I learned how airplanes were actually designed and built, I felt much safer on them. Especially the 757, which I worked on.

A layman is shocked to find out it's a tube of pressurized aluminium, but knowing how the sausage is made makes it better.

How about helicopters? I definitely feel less willing to get on one after working near them.

I've never worked near helicopters, but they went on my "never take a job anywhere near these things" list after the third time I accidentally stuck my hands into the whirling blades of the ceiling fan in my living room.

I once had a chance to take a job related to navigation. I got significantly lost on the way to the interview. The job didn't work out, probably for the best.

Helicopters are subject to single failures causing a fatal crash. Hence helicopters rely heavily on rigid, thorough, and very expensive maintenance.

As my dad (combat pilot) said, an airplane wants to fly. It can suffer considerable damage and still make it home. A helicopter, however, wants to crash. It's a constant struggle to keep it in the air.

I've never ridden in a chopper, but I doubt I'd feel safe in one.

Out of curiosity, do you feel comfortable flying on the more recent ones?

Yes. But I like the 757 the best. I'm always happy to see a 757 when I'm getting on board.

737 MAX would like a word.

> Someone who has read cruise contracts in detail will never want to go on one. Cooks with experience in commercial kitchens never want to eat at a restaurant again. Someone who is familiar with standards of bridge inspections in most towns hesitates every time they drive over one...

...someone who writes software for a living is afraid to fly on airplanes (I joke, but only sort of)

On the contrary, as someone with a great interest in aeroplanes and aviation safety, I would choose to travel everywhere by airliner if airports weren't such a depressing experience.

Learning more has made me extremely confident in aviation (737 MAX issue aside but even that is nothing compared to the risk of driving).

> 737 MAX issue aside but even that is nothing compared to the risk of driving

I run the numbers when the second accident happened, and the 737 MAX had a similar risk profile to using a motorcycle in the city. Way higher than driving.

I get your point, but I think your initial conclusions are false. Each of those professions understands that the probability of risk is not 1. Their experience informs them that the risk is quite unlikely and therefore acceptable. They may have a heightened awareness to look for problems, but they don't stop exposing themselves to risk.

Your final conclusion is half-right: ignorance is bliss. But I think it's charitable to say everything is running on goodwill and duct tape. How many people really build systems based on goodwill? And duct tape implies somebody's seen the cracks and decided to patch them. I think everything is running on apathy and incompetence, sitting on the edge of a cliff, waiting for a stiff breeze; over time, the wind wins.

>My conclusion ultimately is – everything is running on goodwill and duct tape, and ignorance is bliss.

And the most infuriating part of it is that everyone acts like subject they don't understand in detail can and should be expected to be perfect.

> Someone who is familiar with standards of bridge inspections in most towns hesitates every time they drive over one.

I don't think this one is true.

> Cooks with experience in commercial kitchens never want to eat at a restaurant again.

Sometimes yes, but definitely not always.

Thank you for the examples of a cruise, kitchen, and building bridges! Analogies are helpful :)

I work as a software engineer. If you asked me to do civil/mechanical/structural engineering, I'd have the same approach:

Build. And run!

"My definition of an expert in any field is a person who knows enough about what's really going on to be scared." - PJ Plauge, Computer Language, March 1983

Reply on news.ycombinator.com