netflixandkill

It was the answer to "how many people can I get in on this joke?" while playing around with litecoin.

The notion that SCADA systems are air gapped, closed ecosystems is 40 years out of date.

I've had hundreds of plant engineers and SCADA operators tell me that their systems were "not connected to anything" and every single one of them was wrong.

Whether it's an old 2400 baud modem on a spare port on the RTU or "serial" comms being multiplexed across IP or MPLS networks or the unlicensed TeamViewer install for vendor support, there is always a "well except ..."

We work with Dragos fairly regularly, they're solid. The main problem is that people who even consider the security or integrity of these systems are brought in years after they were specced, built, and more or less abandoned as built.

The contractor and integrators then move on to the next project and copy what they did last time. Rinse , repeat.

We've been actively pressing for realistic security and access control planning in the contract stage, but that's slow going in and of itself and still only affects new or upgraded installations -- on facilities with an expected lifetime of 10-30 years.

Except everyone already does it and that toothpaste is never going back in the tube.

We're fighting to keep these people from using unlicensed copies of TeamViewer for their primary access.

I even have a pixel3 and forgot Lens existed; the first time I was exposed to it by the phone it looked like yet another Google scans all your stuff and gives you questionable suggestions feature. It never occurred to me it would do something as straightforward as decode QRs.

It's easy to be nostalgic for the days of big iron servers or clusters that were around for years as a sort of network landmarks. We used to have dev and QA clusters named after movie monsters and you'd get some great hallway conversations about who was using Godzilla that week.

Made for great mascot toys and posters on the rack doors.

Probably not, it felt a lot like an experiment that was picked to win and then still didn't. Almost like a reverse i960, which ended up being really good at a few niche applications that certain problem spaces kept it in at least some demand long after it was effectively abandoned.

Depending on where you are there are bespoke jewelers that can take industrially made "perfect" stones including diamonds and emeralds and make rings to spec for like 500 USD equivalent or less. In the US, the renaissance fair crowd almost always has a bunch of jewelers who's work you can preview.

Gems and workable gold allows are not that expensive.

Yes, although a significant issue with that is there is no spinning mass to "borrow" inertia from, so while modern inverters at solar sites are good at shaping output phases, they have very little capability to absorb significant frequency deviations.

Grid scale battery systems are often used for voltage or frequency stability as opposed to deep discharging as generation offsets, although that will change eventually if batteries get better enough or really cheap LNG stops being a thing.

It remains something of a testament to human stupidity and avarice that chat to most of the world in most languages with pretty good security and even some video support was basically a solved problem in like 2008 and a complete clusterfuck again by 2016.

Almost every power plant is effectively internet connected even if it has old control equipment that predates IP as the vast majority of SCADA systems have IP connected HMIs or other core components.

There may be steps involved in getting your RDP exploit to send commands over vendor proprietary RS-485 protocols, but except for certain nuclear plants that are truly air gapped, but it's fewer than you'd sleep soundly knowing about.

I once had a network admin at a major US transmission utility tell me with a straight face that all of their SCADA was pure serial as I was telnetting into the Zhone mux doing those serial channels via a WiFi connection.

I've been running freebsd my primary home and work platforms for almost 20 years and the only time I've had crashes that would have dumped to swap were when I was doing some driver development for early flash storage cards and a few times with the early ZFS merges.

None of my FreeBSD systems have swapped anything out in years. Most of the VMs get half gig of "I guess it might by used by something" swap space.

Somewhat ironically NVME would be insanely good for historical swap use cases but anything that cares about performance hasn't swapped in the better part of a decade.

In many ways this seems to have replaced diaries as a way of organizing your thoughts prior to screaming them into the void, with the bonus of spam and random racist diatribes.

Perhaps bonus is the wrong word there.

All of your communications, sure probably not, but for all the ones that are already for government purposes, with government entities, and other basic purposes it's a good place to start.

At least some uniquely identified email address is better than hoping things like court documents with legal implications get paper mailed to some previously known physical address you may or may not still have any access or relationship with.

For a decade or so it pretty much did just work. Alas, nothing gold (or metallic shades of white in this case) can stay.

Public transit in Austin is laughably bad unless you're on a small set of travel paths, mostly to the university and a narrow part of the city center.

As an example it takes about 20 minutes to drive from my house to the airport, and 3 hours to get there by bus, not counting the walk to the bus stop. The light rail line goes nowhere near the majority of the city.

If we're doing any sort of event downtown or ACL or whatever, I rent a condo nearby instead of dealing with taxis or busses despite only living 15 minutes from the city center and very much "in Austin."

Nobody deals with publix transit if they can afford not to.

An insider got them access to a trusted signing certificate would be my first guess.

PKI remains a pain in the ass and very few organizations do it well.

It's possible but you're limiting yourself to 2 or 4 UDB drive mirrors. If you just want a zfs storage pool and aren't too picky about anything else, it works, but if your list of expectations goes beyond a place to dump data, you're setting yourself up to be frustrated later.

My home net has several pi3 and pi4 systems that boot off a small SD card and then mounts working storage via iSCSI, which works great for how I use them. There's no reason I couldn't serve that off a pi, but their limited IO and memory makes them a poor choice.

HGST remains my preference for "enterprise-y" stuff on home and small business setups. Slightly pricier but if you value your time it pays for itself easily.

Upping the block size to more than whatever SMR overlaps on the drives works for workflows that don't care about consistent random rewrite performance. Can get 120 MB/s sequential writes on the cheap seagate SMR drives in my big slow pool which is enough for clients on gigabit or less networks.

Although frankly at this point if you care about performance you're on NVME anyway.

In these escalation scenarios either both sides commit to non-escalation or it doesn't matter. I don't know if current US policy had a nuclear retaliation for a strike against a carrier group, but it is such a high probability that any adversary likely considers is as true.

China or whomever attacking a carrier to destroy it with anything other than 1945 style surface warfare tactics leads to nuclear war, even if it's not the final decision point. The response to such an attack leads to nuclear war in enough projections.

The scenario in which both China and the US are trying to minimize escalation to avoid all out nuclear war while still countering some regional moves or proxy wars.

US wargaming had repeatedly found that escalation to nuclear exchanges is all but a given if serious attempts are made by either side to destroy naval and air base capability, and it's safe to assume their PLA counterparts reached similar conclusions.

As an example, in a Chinese move against Taiwan or Japan, anything that crossed into attack range would get destroyed, but there would be no counter-attacks against Chinese facilities and bases. Does that play out in reality? Let's hope we don't find out.

Overloading, sure, destroying, no.

I would bet millions of Euros there have been islanding plans in place for years in the event of wide scale disconnects or voltage/frequency collapse. The aftermath wouldn't be fun but most of western Europe at least would only be enduring planned rotating blackouts at worst.

I use MSI laptops almost exclusively although they're definitely wiped and reinstalled to win10 ltsc or freebsd.

In as much as I love the Mac touchpad for kanji/hanzi input the 2015 pro will probably be my last.

I'm sure some clever executive figured out they'd increase revenue enough before they were hit by a regulator or lawsuit to more than cover the subsequent apologies and announcement of their new firmware that loves free markets and customers SO MUCH that it accepts other cartridges again (but HP can't guarantee quality! So sad!).

I generally print things on the order of single digit pages per year, but some people do things like print PDFs to read them or still live in fax land, etc. E-ink is making some inroads, but a fair portion of the population does like text on something physical and highlightable and pen-markable.

Industrial automation that runs the world at large in thousands of ways isn't 100% safe under normal circumstances, much less "all" and yet we have almost entirely automated elevators, high voltage relays, medical equipment, nuclear reactors, autopiloted airplanes, and gas powered furnaces, to name just a few.

Most of this automation operates under certain assumptions about its environment and in some cases shuts itself down in a controlled fashion to fail safe in ways that may not be available to cars on roads, but these are not new ethical dilemmas.

But to pick just one example, automated saw stops and controllers aren't 100% effective at preventing injuries, but they're still a huge safety improvement over the human population at large just winging it.

The generator wasn't sped up beyond tolerances, the safety system that kept it synchronized with the wider grid deliberately brought it in out sync, like ramming a car engine into a much lower gear at high speed. The force has to go somewhere, and from the perspective of the generator the mass of the grid might as well be infinite.

As for better architectures, we're working on that, but industry is lethargic, lazy, and often organizationally dumb.

But there are limits to isolation. AC grid frequency and voltage and load flows are changing constantly, if normally by small degrees, and propagate at effectively the speed of light. It's impossible to have purely static immutable protection schemes for all but the most trivial of equipment.

Not to say it can't be a lot better.

Directly? Low.

Indirectly through serial concentrators and RTUs and Scada access, almost 100%.

The FERC / NERC security standards that fell out of this event are largely a bad joke, but had the benefit of at least requiring North American utilities to do something at all.

Any transmission operator of size and most generation operations effectively require real time Scada for anything of meaningful capacity and they're sure not paying someone to sit next to it reading numbers off over a phone. They may not be IP addressed individually but to put it in perspective, I had a communication engineer tell me with a straight face that the fiber mux I telneted into over their local wifi wasn't internet connected, and thus the protection relays on the 500 kv substation the next building over were serial only -- over said fiber cables.

Data diodes exist and have been used in high security or other risky cases when one circuit or bus absolutely has to be isolated except for one way communication.

In practice it's not typically necessary to go quite that far if a trusted communication processor is able to pass messages or set registers but only ever takes logic control flow input from the "safe" side. Plenty of equipment that wants to broadcast state over radio but never accepts any sort of input back beyond acks or whatever has done this for a long time.

To addresses? Mostly pointless. To a larger number space that had non-numeric representation, genius and probably inevitable.

If we allow for the representation to be 0-9 and then another ten letters selected for uniqueness and clarity, overlapped with appropriate non-roman pictographs, etc, the same 16 characters jumps to 600 quintillion range, or about 60 bits by napkin math.

That's more than realistically enough for hundred billion people to each have millions of real payment IDs with millions more one-time use ones that contained some sort of transaction hash for authorization.

Which conveniently fits in a 64 bit word with some left over. I suspect someone involved in the payment space already figured that out a long time ago, but no cataclysmic event has yet happened to de-rail the existing money train.

If you wanted to do that in IPv6 you'd still have the upper 64 bits left over :)