Hacker News Reader

Comment by kotaKat | Hacker News Reader

Is it actually Bluetooth, or did they get their hands on keys or remotes for the dispenser?

The dispensers have constant real-time communication to the forecourt controller and the attendant inside. What are they showing when this "hack" happens? Are the attackers taking the RS485 line down (which would show the pump offline immediately inside) and forcing the pump to manually dispense?

I'd kill to see some more actual information than this. I am not aware of a single pump on the market with Bluetooth right now but I do remember some IR-based remotes for some old Wayne pumps.

View on HN

In the article one of the attendants says "I hit stop on Pump 3 and nothing happens" so they are at least seeing the pump is on and running. Whatever is happening must be either locking the attendant out or is leaving the attendants machine in a bad state with the pump running switch "on" so to speak. I wonder if it's actually NFC. It'd be interesting to see what a Flipper Zero would come up with.

I can imagine a lot of Flipper Zero owners heading out to explore pumps now.

Agree, sounds like some kind of poorly-protected function has been discovered that's putting the pump into a "maintenance" or "test" mode where it will dispense fuel without a prepay having been completed.

> "Every time we push Pump Three stop, it wasn’t doing anything," he said. "We have to shut off the whole pumps - we have emergency stops."

Whew - sanity prevails! When I read the part about not stopping, I was a bit worried that the e-stop somehow was not a simple mechanical failsafe.

I've seen people getting ready for a day of working on yards fill up 30 different things each on multiple trucks. The quantity might not stand out, and the attendant(s) might not be allowed to intervene if they think something looks suspicious. A "better to lose some money than risk losing a longtime customer over a mistake or an attendant getting shot playing hero" policy makes a lot of sense.

> “an attendant getting shot playing hero" policy makes a lot of sense

In the post-apocalypse or some other lawless society perhaps

Here in British Columbia, Grants law was passed requiring all gas purchases to be prepaid after a gas station worker named Grant was ran over and killed as he tried to stop someone attempting to gas and dash. Back then gas was much cheaper so someone died over like $50. Doesn’t need to be a lawless society just one where someone makes a stupid choice. And we have lots of stupid people out there.

"The Law was named for Grant De Patie, a gas station worker who was killed in 2005 by an underage drunken driver ... Grant was dragged 7.5 kilometers before his body was dislodged from the white Chrysler LeBaron."

"Grant was writing down the license plate number as Darnell ran over him while stealing $12 worth of gasoline."

https://en.wikipedia.org/wiki/Grant%27s_Law#:~:text=Grant%20....

You understand you took that quote out of context right?

I think the OP meant:

>better to lose some money than risk losing a longtime customer...[as a] policy makes a lot of sense

I’m not sure what you mean. It sounds like you’re implying that in the ideal lawful society, the gas station clerk is supposed to be the one defending the gas station against theft?

In an ideal lawful society, a disagreement over gas won't escalate into a violent confrontation. So the attendent can intervene, because they aren't in physical danger.

Of course in this sort of society no one is stealing gas in the first place, so the attendant has no reason to intervene.

Yeah, if we're dismissing the possibility of direct physical violence with the wave of a hand, why not wave the hand a second time and dismiss the possibility of gasoline theft?

A robbery there would go something like: (Note: for some reason this seems to work best in a New Zealand accent)

“Listen up, sir. I intend to steal the contents of that till. Be a good pal and hand it over.”

“I’m afraid not. As you know, I’m duty-bound to protect this till, and I’m not about to hand it over to you.”

“I’m afraid I must insist. I intend to take it, all of it. Don’t make this uncomfortable. I don’t want to use harsh language, but I’m serious.”

“I’m sorry, but it’s simply out of the question. There’s policies and regulations. I can’t just give this money out to you. If we did that, do you know how many people would be in here robbing us every day? There wouldn’t really be a gas station at all, would there? May as well shut the whole thing down then.”

sigh “No, I’m sorry. I should have expected you weren’t about to give me the cash. I’ll leave. Obviously I’m not about to use physical force, and it’s clear you’re not budging on this one.”

Yes. It is part of the job requirement and the essential character of a good wage slave for an hourly, minimum-wage employee to lay down their life with joy and zeal in defense of their employer's profits and property.

It's pretty standard policy in most retail places.

Stories abound of staff at Walmart and Target being fired for attempting to enforce store shoplifting policies (https://www.ksl.com/article/14319284/4-walmart-employees-fir...). Broadly speaking, the risk of injury to other employees and customers, the risk of lawsuit if their staff misinterpret the law in the moment and overstep the authority each state gives them (a patchwork of law that stores are not interested in training its staff on), and mostly, the risk of brand harm if these stores gain a reputation for being a place where fights break out between employees and the public, regardless of reason, are far costlier than the opportunity cost of being unable to sell lossage.

Instead, companies just track lossage and sales, and if a given neighborhood proves to have too many shoplifters, they pull up stakes and close the store.

Its not necessarily good that they just losses happen and close up store.

I guess it gives room for small business owners, who are willing to shield themselves behind bullet barriers, willing to defend their own property with guns, and don't care whatsoever about bad PR.

I think it has to get really bad before they pull the store (a store takes a lot of money to install).

Usually they just offset the losses by raising prices.

Yes, but it’s 100% that bad and they are closing stores because of it: https://www.kiro7.com/news/local/90-target-workers-be-displa...

The Walmart next to me closed due to rampant looting, and it was the only real store in a several mile radius.

I was in there once and people were just taking stuff off the shelves and walking straight out with it like it wasn't shit.

That's very strange. If it's happening enough you can pay a cop to come stand there, can't you?

There was a cop SUV parked outside the door and I never saw them do anything.

They watch trends. If the store isn't making money - losses is only a part of this - they will not invest. The building and parking lot is only expected to last 20 years or so - they will stop maintaining them to milk out more profit until they fall apart and then pull up shop. Stores that are making money get remodeled and the parking lot repaved.

Precisely. And when everyone knows that the commercial lifeblood of a town is so hinged on multiple factors outside people's control, well... Might as well get those underpants while they're still in town, right? If you don't steal them and then Walmart pulls up stakes next month anyway because it makes more sense to invest in Tallahassee than your poor neck of the woods, you'll just feel like a sucker.

My local big-box stores have taken to putting half the store's inventory in locked glass cabinets. Started with liquor, then detergent, socks, electric sawblades, car batteries, regular batteries, flashlights, bike parts, medicine, Monster drinks...if it's something you'll need to survive the apocalypse, it's behind glass.

It's unshoppable; nobody is ever around to unlock them.

Yeah, I feel like policies like the locked racks were thought up before the great decrease in retail staffing levels. At current staffing levels, a lot of places are operating on what would have been considered a light skeleton crew, all the time. I bet there were more workers on the graveyard shift of a 24-hour Walmart 20 years ago, than there are at most stores during the day today (not counting pickers for delivery/pickup orders).

Not to mention that small business owners can sometimes change dynamics, depending on why people steal.

It is, sometimes, one thing if it's Susan's shop (you know Susan; she lives in the apartment down on the corner of Fourth and Mission, stealing from Susan would be like stealing from your own aunt) and another if it's Walmart (you will never meet Sam Walton in your life, or any of the management of that company. There isn't even a franchisee).

  > In the post-apocalypse or some other lawless society perhaps
    > Detroit man steals 800 gallons
      > Detroit

Jokes aside, it's common policy pretty much everywhere for cashiers and other employees who are not specifically security personnel to never confront shoplifters or other thieves, always comply with robbers, etc. Insurance covers material losses as long as reasonable precautions are taken.

Detroit has really come up in the past 5 years. I recommend folks visit and check it out. Motor City's downtown actually has decent public transit via bus and light rail, and it's very walkable* during the nice season. Lots of entertainment.

* oh but watch out for bird/lime/lyft/uber scooters literally everywhere and everyone's drunk

Detroit downtown is nice, the Lions win games, what alternate reality is this?

pendulum swings back it seems

I'm really into driving and all, but I've been in Detroit a year ago and it sucked. The only good thing about it was the Henry Ford Museum and the fact that Canada is just across the border.

You probably don't know how it used to be (which is also very different from my grandfather's idea of "how it used to be"). I was there last year, but I was also there for 25 of the past 30 years and the change from when I was a kid is startling. "I recommend folks visit and check it out" is not something someone would have said about Detroit unironically for a long while.

The Henry Ford Museum isn't in Detroit...

It's metro detroit and less than 5 minutes from Detroit itself.

I want to believe, but I also remember 2007-2014 $1 houses, GM bankrupcy and such - is it really different?

It's different, and it's not like it's without its problems. Of course there are still depressed neighborhoods, but there are a ton of development projects going up, lots of new restaurants, bars, nightlife venues, and arts and sports programming. By "coming up" I mean on the upswing, and you can definitely see the difference from a few years back.

Detroit hasn't, downtown has.

Downtown has improved wildly since when even when I was growing up near there in the 80s/90s, but people don't realize how large Detroit is. It's nearly 140 square miles. Downtown is, charitably, 2sqmi, and that's including all the way up to Wayne State. The light rail is the People Mover loop downtown plus a trolley up Woodward, within that range.

The theft mentioned in the article occurred at 8 Mile and Wyoming, which is a 20 minute highway drive from Campus Martius in no traffic. "Clean Downtown" that happened when the city hosted the super bowl and other related efforts have very lopsidedly focused on the downtown area.

Exactly. That theft is only ~50 nano-Enrons. Not worth a life.

Love "Enron" as a unit of theft, haha. Did you just make that up?

Yes. I'm in favor of comparing blue collar crime in units of white collar crime so that punishments are proportionate.

Maybe a nitpick, but I think it would be more accurate to say that it has, in recent years, become policy to not confront thieves, even verbally and non-violently because so many of them are now willing to escalate to lethal force on the most trivial of provocations, effectively giving them a heckler's veto[1] on any measure except locking them up or asking the police if they'll find time to arrest.

I know in my grocery store training c. 1998 they definitely told us to give verbal warnings to thieves that we saw what they did, but now, even that much is dangerous.

>Insurance covers material losses as long as reasonable precautions are taken.

No one would get insurance to cover small, regular losses. And even so, insurance isn't some magic pot of gold that restores the losses that lead to closure, it just means the impact is absorbed over everyone. It's still there.

[1] Recent discussion of the concept here https://news.ycombinator.com/item?id=37688954

When I worked at a grocery store in the early 90s we were instructed to not intervene. So the trend isn’t as linear as you propose

There's a video [0] back from 1984 or 1985 with a small up-and-coming band Metallica stealing from a store.

[0] https://www.youtube.com/watch?v=XnPXn19Li6A

Napster: never forget

"insurance" for small losses == higher prices for everyone. Some amount of "shrinkage" whether due to shoplifting, employee theft, or unknown reasons is built into the economics of a retail store.

Where did this insurance myth come from?

Why do people think there's some kind of insurance that has anything to do with people shoplifting from a standard retail store?

Like that's not a thing. There's insurance for catastrophic losses and out of the ordinary stuff but there's not an insurance policy that's paying for people stealing from gas pumps, or grabbing a TV from an electronic store and running out the door.

Of course it's covered. You can insure anything (with very few exceptions protected by law for obvious reasons). An individual case is likely not worth claiming when considering the deductible. 800 gallons might be. But, it can definitely be covered.

You actually can’t insure everything. And you definitely can’t insure everything for less than the cost of just suffering the loss.

There’s no viable or common policies that cover run of the mill retail shrinkage. It’s not a thing. Stores just have to eat it.

Before you argue this point try to consider how such a policy could possibly work.

You just total up what you think shoplifting is costing and tell the insurance company and they give you money? What business model is going on there exactly? How does the overall market work, where does the money come from that is reimbursing you for those losses?

Risk is calculated on a per incident basis. Deductibles prevent frivolous claims. It's pretty simple really. There's no need to downvote just because you don't understand something. That's just petty.

You can’t insure repeated ordinary course of business losses that you have almost total control over and are a core part of your business function.

You didn’t answer my question because it’s impossible to come up with a reasonable answer.

In insurance the cost of losses is borne by people who did not suffer loss.

So the cost of your car crash is borne by someone who didn’t have a crash. But they’re OK with it because they don’t know if and when it’ll happen to them. And an accident is a major loss, so they’d rather pay a little every month to avoid the uncertainty.

But shoplifting is a week in and week out thing. If you have a shoplifting policy that’s reliably more expensive than the shoplifting why would you keep it?

You wouldn’t because it’s not a thing.

You can insure for major losses, robberies and burglaries and so on. But no retail stores can’t and don’t insure for things like someone driving off with a tank of gas, or pocketing an iPad, or a steak, or something. It’s not an insurable risk.

You're making a straw man argument. That it's inadvisable is something we already agree on. That it's impossible has nothing to do with that. It's POSSIBLE despite being inadvisable. Choose your words more carefully next time.

If you make a claim, then your rates can go up because you're now a higher risk.

This is one aspect of insurance aimed at discouraging fraud.

It has nothing to do with fraud.

Even if every business is completely and scrupulously honest this kind of insurance policy is completely unworkable because it's not an insurable risk, it's just a cost of doing business.

It's like trying to buy insurance to cover your monthly cost of airline travel. Like it's not a thing, that doesn't make sense.

You could insure that though. The cost of the policy would be higher than the cost of just eating the losses, but there are insurance companies willing to write the policy if you are stupid enough to pay for it. For things that happen all the time you are better off self-insuring it - that is eating the loss - than getting a policy. Insurance makes sense for rare events that are high enough loss that you would not want to self insure. Any common loss you should self insure, and the same for small losses. Only for larger losses that are not common are you better off with a pool of people who also might have that loss but probably won't - odds are one of you will but not all so you all limit your costs.

Yes that's my point.

And since literally nobody wants a policy that reliably and predictably costs more than not having the policy it's not a thing. And since it's not a thing anyone wants insurers don't really have it.

Yes somewhere there's like someone that might have something similar for sale, sort of. But the point of the comment is that in general businesses don't have it.

I constantly see people say that retailers don't confront shoplifters because insurance will just cover it and it's not worth it. It's true they often don't, but not for that reason, since it's basically not ever insured short of a more extraordinary event.

There are special insurance companies that will insure anything legal if you pay the price which they will figure out. As you say it wouldn't be cost effective, but it still exists if you want it anyway.

It's about insuring employees, not the items. Businesses have insurance so that if a worker is hurt during work, they don't have to directly pay the related bills. That company will assume the risk that an employee helping a customer put a tv on a cart results in injury, but they absolutely won't assume the risk of confronting a potential thief.

Stores like Walmart and Winn-Dixie used to take out life insurance policies on all their low level employees ("dead peasant" policies) so that every employee who died got them a payout anyway. I wonder if that's changed their policies.

Agreed. On the finance side, typically each store has a shrink allowance as a % of sales. The account is adjusted following the periodic inventory audit (usually annually). It rolls up to cost of goods sold so it is reflected in the margin.

So if shrink was forecast at 0.75% of sales but actually came in lower the store would see better margins on their financials.

I personally know of an incident where Walmart shelf stacker chased shoplifter of $5 hat out of store and got into a tangle with the getaway driver's car and they ended up in a coma for three months which apparently cost Walmart almost $2m in medical bills.

Back when I was a gas station attendant, my manager made it very clear that if you're being robbed, the only correct answer was to offer them smokes and help loading or bagging.

This was not Detroit, or even the USA. Think slightly North.

Or you know... just the united states today. Gas station attendants get shot here without them even trying to play hero. At least a few every year.

Murder rate in the UK is roughly the same. It's lowest in countries with low immigration rates per capita. Considering the lax immigration process in the US the crime rate is exceptionally low.

Are you sure? I had us murder rate as about 6 per 100k and Uk at 11 per million so much less than us.

[1] https://www.macrotrends.net/countries/USA/united-states/murd....

[2] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand....

Yes. It's 1.6/100k vs 6/100k. That's pretty damn close.

https://en.m.wikipedia.org/wiki/List_of_countries_by_intenti...

And let's not compare a slice of the US the size of the UK or it will be zero. Maybe the better comparison is US vs EU. Or would that be too unfavorable for your argument?

your statement that "the murder rate... is lowest in countries with low immigration rates per capita" is largely bullshit. Even the laziest of googling "crime and immigration rates per capita" shows that.

At best, the relationship is weak, and not well understood.

It's pretty strong in this list.

https://en.m.wikipedia.org/wiki/List_of_countries_by_intenti...

Crime and poverty being linked is not poorly understood. It's pretty well known.

Therefore importing poverty increases crime as it increases poverty, regardless of your moral sentiment.

The US is simply more successful at importing poverty and assimilating class disparity than other countries.

This connection is even more tenuous than your original claim that "the murder rate... lowest in countries with low immigration rates per capita". Now you're talking about crime and poverty, not murder and immigration.

Also, the first paragraph of you link explicitly says: "reliability of underlying national murder rate data may vary". I think k your argument is largely bs, and I'm not interested in researching the citations.

The second paragraph reads "Research suggests that intentional homicide demographics are affected by changes in trauma care, leading to changed lethality of violent assaults, so the intentional homicide rate may not necessarily indicate the overall level of societal violence.[6] They may also be under-reported for political reasons."

I don't think this list even makes the point that you seem to think it does, or, at least, doesn't make the point very well.

A better correlation - Lower inequality countries have much less violent crime.

So the US is less unequal despite having the highest immigration rate from the poorest countries. I agree.

I love that this was downvoted and then all the linked pages in protest agree with me. Did you guys downvote because you don't like to know the truth? Do you wish the US was as horrible as the TV told you?

Or Florida

You can't honestly feel the attendant should run out there and try and stop a thief. You just can't.

This is SOP among most chain stores' loss prevention policies.

Sub out "not worth an employees' life" with "not worth an expensive assault/false imprisonment lawsuit" if you're extra cynical.

Maybe fear of litigation from a liability lawsuit if the employee is injured or killed.

Most pumps I see will only dispense 75 dollars and then cut off. In one case it was 100 and then cut off.

$75 at California's gas prices right now doesn't go very far!

I filled a van with 2 rounds of $75 today. Could have squeezed in a bit more but it was already taking way too long so I left after 2 rounds.

This is set by the card issuer. Different cards will have different limits. I have been told that you can call your bank and have them adjust this limit.

Same card, different stations, different limits.

Yep mine cuts off at $100. Really annoying since I can’t even fill up entirely with that.

maybe its an nfc hack. pretty scary how wide open it is/was: https://www.youtube.com/watch?v=eV76vObO2IM

Bluetooth controlled? The device sure, for all we know it's just kicking over the dispenser. The clerk isn't looking but I'm sure if they look at the pump on the register it's counting.

It's still all serial based comms, but unless the attendant is trained or aware they might just think someone is pumping. It will show up on the daily report when the dispenser report doesn't match the sales report.

If the attack were better understood by people who didn’t perform the hack then it wouldn’t have happened.

I don’t think any engineer in the last 20 years would put IR on the thing. At the same time I wonder “who would put Bluetooth on the embedded controller for such a machine?”

With so many multifunction SOC embedded controllers out there it's possible some one just didn't cut the lines to the radio built into the board that was selected for other reasons. Would not surprise me to see a lot of control boards that expected firmware or dip switches to disable unneeded functionality versus having a different line for similar boards if they weren't being made to a specific end customer anyway.

Reply on news.ycombinator.com