Big picture, where this leads is a lot of physical stuff just getting unplugged from the Internet.
It's very easy to see how this goes — one side of the ledger is the cost savings you get from remote monitoring, remote control, automated cloud backups of access logs from employee badges, or whatever dumb reason this system was internet-connected in the first place.
On the other side of the ledger is the potential cost and probability of a shutdown from a cyberattack, whether that's from a belligerent state actor, a malfunctioning or maliciously deployed AI agent swarm, weird accelerationist hackers, or whatever, plus the cost of constantly defending and hardening systems against attack.
Chances are, the cost/benefit analysis will heavily favor just unplugging the thing from the Internet.
Probably, although the technology isn't new to secure these instances. Setup a proxy that uses standard IPsec VPN tunnel into corporate. This isn't rocket science and you would only need to power a device that is completely preconfigured. That way you can create a reasonably safe environment before we even talk about application level security.
Why do we always talk about ai capabilities in the future tense?
What's stopping them from doing these right now? Script kiddies have basically reverse engineered the PS5 at that point, do you think state actors need better models?
State actors could always spy on whoever they want, AI (between hacking into phones even when their country is not big enough to just lean on the Big Tech firms, TTS models, and LLMs) lets them spy on everyone at once.
Various people (not sure if "script kiddies" is fair) may have reverse engineered the PS5, but they don't generally waste time going after Z-list celebrities' own brand of smart light bulbs.
Just as a virus lets you attack all identical computers once you've written it, a sufficiently competent LLM lets you attack basically all computers identical or not.
Based on Bahrain’s AWS region I would expect the first decapitation strike on a country, after defensive systems, would be cloud data centres. Everything we have from hospitals to logistics to power to SCADA to retail seems to be heavily centralised.
We need more distribution for the sake of redundancy. Less large data centres and hyper scalers, more servers in a back office somewhere.
The internet itself is less of a problem. It’s where most of the traffic goes that is the problem.
Data centers are a somewhat difficult target. Not alot of explosive content, highly redundant operations, low staff count to impact operations.
It's much easier to destroy the power generation for those data centers than the center itself, and power generation is much less redundant and more easily impacted. It can be highly visible if you are only hitting a few targets, but the actual impact ends up being pretty low.
Emergency power generation is common onsite for datacenters, even if it is not supposed to run for long time. And I think you are overestimating the redundancy. There was famous infamous "I can't find such option in admin panel" response to news about total loss of Strasbourg datacenter in March 2021 fire, after advice to "execute Disaster Recovery plans". And I doubt it got much better for small companies. How many people even run backup servers in other cloud regions/countries, not just different AZ?
We wish, but that might not be true. Last year a South Korean government data center burned down and some data was lost forever with it. A few days ago, Ukraine attacked Yandex data centers (3 of them I think?) and some services stopped working, one of them a bank, so people can't get to their money, and it's not certain they will in the future.
Power generation generally seems to be much more redundant in that war. In part because Ukraine connects to the EU power grid and Russia itself has a huge grid. Sure for a small island country the situation would be different.
There are 12,000+ data centers around the globe including ~1300 "hyper scale" DCs. It seems like at a glance that we are actually fairly distributed physically. Not to say that DCs wouldn't be valuable military targets but I would not call it centralized.
Also, Russia has clearly established itself as a source of failures. In the same way that Europe and Canada should be weaning themselves from the USA for lighter-duty yet valid issues, they should really further disentangle themselves from the Russian economy if possible.
Hence we need alternatives. P2P wireless (and wired) networks Freifunk, Guifi and NYCMesh are three that works today, in practice and in the real world. Contribute to them, learn from them, replicate them elsewhere, where you live.
There was plenty of network hacking going on pre-internet and people still figure out ways to hack air gaped computers. Security is always going to be a problem.
As always, there's a crucial difference between losing your finger in an accident and shoving your entire arm into a woodchipper while screaming that nothing can be done about it.
For me this is a reminder of how you can't really escape technology.
Imagine being a tech luddite. Flip phone, old PC you boot every time you want to use it, no internet presence.
You got to get produce on your bike and there's none because the fucking internet. This is the type of shit that tips people over the edge and go full Kaczynski.
Or if you're like me, maniacally laugh at the absurdity of over complicating basic infra.
Karpathy yesterday posted [1] about the gap between small % of population getting high leverage from AI, and the rest of the world. We have a much more urgent gap between software powering the "physical world", and the digital natives. The digital natives now have 10x leverage with AI, with the ability to rapidly find and deploy exploits. We're now seeing a lot of this - fridges defrosting, access cards for construction workers not working. Next is train and air traffic controls, bank transactions/clearing wiped out, shipping being dismantled and so on. The gap is now being fully exposed.
To be fair, there's enormous technical debt out there stemming from decades of crappy software/firmware that was churned out with little attention to security. Like, where the whole design of the system was effectively flawed.
The capabilities of AI are bringing the power to exploit those a larger audience (where before it was in the limited hands of nation states and other well-funded organizations, hacker groups, and a comparatively few talented individuals).
I agree it's problematic in practice, but I'm hopeful this will catalyze everyone to be a hell of a lot more disciplined in hardening their products and platforms.
Core banking may be more resilient because it runs on software that's so antique and obscure it's
not going to be easy to find the code to attack.
Also banks are more likely to take basic security seriously and not leave core services open to the public internet, even if the code itself is full of bugs.
On the other hand, running old software where the code is publicly available, on hardware connected to the internet - you are cooked
> Also banks are more likely to take basic security seriously and not leave core services open to the public internet
You'd think so but I've seen banks leave compromised systems on their network for months after they were notified about them, including ones being used in botnets. One bank had even been temporarily disconnected by their ISP to stop the spam/hacking leaving their network, but they said they didn't care because it was just their backup connection in case their other ISP went down.
Having worked at various places, I think financial institutions are actually very rigorous when it comes to testing and fixing bugs. It has little to do with whether they're still running COBOL or not.
These cyberattacks are going after systems that barely even needed to exist in the first place, so of course they're insecure. In my opinion, this is a correction that was decades overdue. Either take your software seriously or don't bother at all. I'm surprised it took this long.
ok so we fixed healthcare, how do I access it? If "that" thing is so smart why this post is behind login-wall, posting text on the internet is still beyond its capabilities?
Most organized crime and states were probably already sitting on a very large archive of exploits well before the 2022 launch of chatgpt. Most industrial automation and embedded systems have limited resources and are fairly exposed.
The main thing that changed is geopolitics. Putin is getting desperate and European attacks without full casus belli are getting messier and messier.
We have to assume this the new normal- that APT has moved into an even more advanced, persistent and threatening. And that anybody who has not vigorously secured their infrastrcuture, continuously testing it, and adapting to ongoing threads, will continue to get hosed.
This is going to be another "OMG AI is going to cause all these cyberattacks!11!!1!" thing that turns out to be "any child can find these on Shodan and the hardcoded can't-be-disabled Gott-tier login is admin/admin, isn't it?
Eh. Lots of people write numerals with different code points. There's three flavors of Arabic numerals and most password checkers won't collate them together :p
Even if you do it won't help. You need to be off-grid. The vast majority of solar panels are deliberately designed to shut down when there's a power cut so that they don't feed power back into dead wires (that might be in the middle of being repaired).
The Russia-Ukraine war has all signs to lead the world into world war 3 if its not stopped. All these sabotage acts will continue across the globe to drag more countries into the mix. What is the UN Security council doing?. Nobody hears their efforts to stop anything
What you‘re saying, critically, is only half the story. The fight was between Russia backed separatists and the Ukraine gov. The shelling went both ways. This has been endlessly discussed and investigated by the OHCHR.
What do you expect UN Security Council to do here, really? Two of the permanent members are waging offensive wars without cause, and Russia keeps vetoing anything about Ukraine, and the US keeps vetoing anything about Gaza/Israel and Iran. What exactly could they realistically do, in your opinion?
Russia lashing out beyond Ukraine is a sign of desperation, not of strength. They've destroyed their economy and have little chance of making more progress in Ukraine, and they know it. The predictions of escalation into WW3 don't seem credible to me.
The UN Security council has no effective power over the five permanent members (or those countries a permanent member wishes to protect). Of course it is doing nothing against Russia, USA, China, UK or France; it can't.
Of course it's dysfunctional. Sovereign governments aren't super interested in reducing their sovereignty. The deal for the more powerful governments is they have a venue to legitimize imposing their will on other governments ... if the big 5 can come to consensus.
The deal for the less powerful governments is if they have a dispute with other less powerful governments, they can get it resolved by consensus of the big 5. If they have a dispute with a member of the big 5, there's an imbalance of power that the UN can't solve.
IMHO, this is better than the status quo from before the UN / League of Nations.
It might be nice to have an institution with the responsibility and ability to issue binding resolutions on all governments with regard to authorizing war/etc, but you can't really bind the big 5 (or at least the big 3) without their consent or overwhelming force.
The only superpower of the Security Council is sending nastygrams, and they can't be very nasty anyway, and any of the 5 members can veto it anyway, and any other nuclear power can play an UNO card and ignore the nastygram anyway.
The UN is a discussion forum, imagine "Reddit for countries". It's useful to coordinate some global actions like vaccines and stop small fights, but anyone with nukes can ignore it.
Ukrainian special ops. And good riddance, that pipeline was a stain on the Baltic, and people like Paavo Lipponen should be ashamed for ever pushing for it.
Isn't the EU about to roll out the Cyber Resilience Act? Incidents like this only stress the necessity. And while it might be inconvenient, at least the EU is doing something. The US just let the cyberterrorists run wild, "because it's OK when it's our guy".
They didn't actually hit 50C, right? I read it as setting the thermostat to 50C, which basically would just turn off the cooling compressor entirely - not heat the fridge.
I don't know about these particular fridges that got hacked, but most supermarket fridges I've seen around the world either have no doors, or if they do, their doors have wide gaps and no seals (they'd only make it harder for the shoppers to shop, and given the usual foot traffic, they'd wear out completely after a week).
Exceptions I've seen: some top-opened supermarket freezers (particularly with hinged, heavy doors), and most fridges in small shops. I've seen a few that could turn into pressure bombs this way, but I very much doubt these had any networking/remote control capabilities.
The enemy of the (perceived) enemy's economy. There is a war in Europe, and the EU and the USA are mostly involved economically. Causing economic damage to the financiers of the enemy is a standard Cold War pattern. Oil-embargo warfare is a double-edged sword: while it hits the EU hard, it also causes pain for Russia. This is most likely one in a series of low-hanging-fruit attacks intended to cause economic damage to Ukraine's financiers.
Assuming the Russia speculation is correct, what is their motivation? General chaos in Europe? It seems pretty reckless knowing this would be ascribed to them, and I don't see how they benefit here.
Part of the goal is to be a nuisance so Europeans pay a price for supporting Ukraine, in the hopes that we decide it's not worth the heat. Russia is banking on the west's refusal to face a conflict and the sacrifices it causes, kinda like a game of chicken.
We're about to hit a series of important elections as well (Spain, France, I think Germany soon as well?), hybrid warfare is supposed to influence in favor of extreme parties.
It's a major issue. On paper NATO can mop the floor with Russia even without the US backing, but nobody in a first world country wants to die in a ditch, and the endgame there is also unclear because Russia can play the nuke card if they're too threatened.
> On paper NATO can mop the floor with Russia even without the US backing,
I think that was true a two years ago, but Russia has been forced to adapt to the drone warfare of Ukraine as much as Ukraine has been forced to adapt to the drone warfare of Russia.
I suspect that right now, both Ukraine and Russia have independently got armed forces which could wipe the floor with the rest of non-naval NATO forces. And I'm only giving a "possibly" for the naval exception because of their limited production rate of long-rage drones so saturation attacks may be harder, not that it's impossible: we can already see the US navy being forced into a much longer distance stand-off range vs. Iran.
That said, I'm getting this position mainly from watching Anders Puck Nielsen videos, so take with the usual scepticism/pinch of salt for "internet commenter/armchair general".
This is where my mind goes too. They're not even outright blaming Russia here either, just planting the seed by referring to intelligence assessments that are for some reason made public. I hesitate to use the term because of the connotations, but considering the ever-increasing ease by which such cyberattacks can be conducted and the actors' identity obscured, this and similar incidents seem ripe for some kind of a false flag type deal. Some non-zero number of these incidents have to be exactly that.
This isn't to excuse Russia's abhorrent conduct elsewhere either, I'm just not entirely convinced by the boogeyman lazy journalists seem perfectly content to keep trotting out.
Retaliation for Ukrainian attacks on Yandex datacenters most likely - it communicates to EU states that Russia has capabilities to physically impact their infrastructure via cyberattack, which should act as a deterrent for sending aid or admitting Ukraine into the EU.
As long as they can avoid loss of life (or significant loss of life) and direct attribution, but the rumors are still that it's Russia, this is a way to reduce popular support for Ukraine. The attacks aren't severe enough to make people want to support Ukraine to spite Russia, and it makes it apparent that there is a cost for the current support.
How does firebombing the British PMs home benefit Russia? How does flying explosive laden drones into European airports benefit them? How does bombing Kiev benefit them? Russia still does it
> President of the Danish Council for Digital Security, Henning Mortensen, does not rule out that the incident may have to do with a hybrid war. In recent weeks, Danish services have warned of possible cyber attacks from Russia and raised the degree of threat to "high."
Fear, uncertainty and doubt. Russia’s modus operandi. They want to make us paranoid and suspect them every time something suspicious happens, painting a picture of some kind of super powerful actor, while always retaining plausible deniability about everything.
As in "promote linking every attack of uncertain origin to Russia thus creating the fear of widespread hybrid warfare, while focusing actual attacks on Ukraine's weapon suppliers if possible"?
It fuels the “look how the government sucks at doing its job, vote for us to “fix” the government” narrative for whoever they are propping up with money and bot farms.
Any disruption is an opportunity to inject corruption.
Fun fact, BSI has that sending out security emails when they find a security hole. A client once got that and was on the edge. It was a bit odd, cause the article they linked to literally said this wasn't affected (so no patches existed). Really wished they didn't do that. It was OpenSSH on OpenBSD.
There were other laughable things like that.
But in a world dominated by FUD (that HTTPS connection that only allows one fingerprint needs to go over VPN, that SSH port cannot allowed to be reachable (but that gaping hole on HTTP(S) is fine), without a firewall that server is insecure, ...) that's not exactly surprising.
Surprising how many of the 1000,000 males coming from rich Ukrainian families and vacationing permanently in Germany or France have time to correct European Union citizens.
The spelling changed in 2022 and is hard to remember for those who don't make a living harassing EU citizens while blackmailing them for more money. You know what? Russia and Ukraine are really made for each other.
Rich Ukrainians are mostly beneficiaries of corrupt Russian system. You dont remove such things overnight, all countries that were in Soviet orbit have hiccups due to that to this day.
At the same time it's clear that it's not hopeless for those nations that choose to do something about it. Which is it for Ukraine remains to be seen. They are doing the correct first steo though. So there is that.
I do trust critique on this stuff from throwaways. The utter cheapness of manufacturing provocateurs against EU interests, mean you need to bring your reputation to be taken seriously with the potshots imho
Big picture, where this leads is a lot of physical stuff just getting unplugged from the Internet.
It's very easy to see how this goes — one side of the ledger is the cost savings you get from remote monitoring, remote control, automated cloud backups of access logs from employee badges, or whatever dumb reason this system was internet-connected in the first place.
On the other side of the ledger is the potential cost and probability of a shutdown from a cyberattack, whether that's from a belligerent state actor, a malfunctioning or maliciously deployed AI agent swarm, weird accelerationist hackers, or whatever, plus the cost of constantly defending and hardening systems against attack.
Chances are, the cost/benefit analysis will heavily favor just unplugging the thing from the Internet.
Or maybe connect it to an air-gapped intranet
Air-gapping means some admin will make a mistake at some point and you're back to square zero.
Much smaller chance but still.
Probably, although the technology isn't new to secure these instances. Setup a proxy that uses standard IPsec VPN tunnel into corporate. This isn't rocket science and you would only need to power a device that is completely preconfigured. That way you can create a reasonably safe environment before we even talk about application level security.
Danish source: https://www.dk-sundhed.dk/ritzau/1f0b6211-3397-4869-98aa-a2e...
AI will exponentially increase the number of cyberattacks. The likely outcome is
1. Legacy firmware will be a bloodbath, leading to a consolidation of firms
2. All digital infrastructure will have an always on AI "shield" of agents that monitor and defend against attacks
3. The attacks that survive will depend on human points of failure, leading to less control for humans being the default
Why do we always talk about ai capabilities in the future tense?
What's stopping them from doing these right now? Script kiddies have basically reverse engineered the PS5 at that point, do you think state actors need better models?
Scale.
State actors could always spy on whoever they want, AI (between hacking into phones even when their country is not big enough to just lean on the Big Tech firms, TTS models, and LLMs) lets them spy on everyone at once.
Various people (not sure if "script kiddies" is fair) may have reverse engineered the PS5, but they don't generally waste time going after Z-list celebrities' own brand of smart light bulbs.
Just as a virus lets you attack all identical computers once you've written it, a sufficiently competent LLM lets you attack basically all computers identical or not.
Possibly that anything more substantial than defrosting some fridges is basically equivalent of a military strike, and will be treated as such.
Just updated my openwrt firmware yesterday. I was a minor point release behind but I'm no longer risking it.
What if they poisoned the repository and pulled a Jia Tan where only new versions were affected?
Now you don't know what the hell to do.
Put a decoy Fritzbox in front of it. Defense in depth!
Fritzbox is a terrible name for hardware, as "fritz" is American slang for machinery that is malfunctioning/broken.
Not everything needs to be targeted towards the american market.
it's def a risk, but the latest point release was out for a bit
very doubtful it will be exponential, considering that blue teams can use it too, and backend engineers are using it for security too.
[dead]
The internet became a single point of failure for all of civilization years ago and we're only realizing it now.
Based on Bahrain’s AWS region I would expect the first decapitation strike on a country, after defensive systems, would be cloud data centres. Everything we have from hospitals to logistics to power to SCADA to retail seems to be heavily centralised.
We need more distribution for the sake of redundancy. Less large data centres and hyper scalers, more servers in a back office somewhere.
The internet itself is less of a problem. It’s where most of the traffic goes that is the problem.
Data centers are a somewhat difficult target. Not alot of explosive content, highly redundant operations, low staff count to impact operations.
It's much easier to destroy the power generation for those data centers than the center itself, and power generation is much less redundant and more easily impacted. It can be highly visible if you are only hitting a few targets, but the actual impact ends up being pretty low.
Emergency power generation is common onsite for datacenters, even if it is not supposed to run for long time. And I think you are overestimating the redundancy. There was famous infamous "I can't find such option in admin panel" response to news about total loss of Strasbourg datacenter in March 2021 fire, after advice to "execute Disaster Recovery plans". And I doubt it got much better for small companies. How many people even run backup servers in other cloud regions/countries, not just different AZ?
> highly redundant operations
We wish, but that might not be true. Last year a South Korean government data center burned down and some data was lost forever with it. A few days ago, Ukraine attacked Yandex data centers (3 of them I think?) and some services stopped working, one of them a bank, so people can't get to their money, and it's not certain they will in the future.
Power generation generally seems to be much more redundant in that war. In part because Ukraine connects to the EU power grid and Russia itself has a huge grid. Sure for a small island country the situation would be different.
I'm guessing countries are now starting to realize this. I bet new datacenters will start being built underground or reinforced concrete bunkers
There are 12,000+ data centers around the globe including ~1300 "hyper scale" DCs. It seems like at a glance that we are actually fairly distributed physically. Not to say that DCs wouldn't be valuable military targets but I would not call it centralized.
And then there’s AWS us-east-1
Also, Russia has clearly established itself as a source of failures. In the same way that Europe and Canada should be weaning themselves from the USA for lighter-duty yet valid issues, they should really further disentangle themselves from the Russian economy if possible.
It's as if this whole cloud thing is BS and we should stop putting our stuff on other people's computers.
Not only has that ship sailed, our own computers are at risk.
> we're only realizing it now
Hence we need alternatives. P2P wireless (and wired) networks Freifunk, Guifi and NYCMesh are three that works today, in practice and in the real world. Contribute to them, learn from them, replicate them elsewhere, where you live.
Oh, this predates Internet. It happened as soon as we started connecting computer networks together.
See "The Cuckoo's Egg" by Cliff Stoll
There was plenty of network hacking going on pre-internet and people still figure out ways to hack air gaped computers. Security is always going to be a problem.
As always, there's a crucial difference between losing your finger in an accident and shoving your entire arm into a woodchipper while screaming that nothing can be done about it.
Luckily the Internet itself has never failed. The worst that has happened is some large regional outages due to BGP problems.
For me this is a reminder of how you can't really escape technology.
Imagine being a tech luddite. Flip phone, old PC you boot every time you want to use it, no internet presence.
You got to get produce on your bike and there's none because the fucking internet. This is the type of shit that tips people over the edge and go full Kaczynski.
Or if you're like me, maniacally laugh at the absurdity of over complicating basic infra.
Karpathy yesterday posted [1] about the gap between small % of population getting high leverage from AI, and the rest of the world. We have a much more urgent gap between software powering the "physical world", and the digital natives. The digital natives now have 10x leverage with AI, with the ability to rapidly find and deploy exploits. We're now seeing a lot of this - fridges defrosting, access cards for construction workers not working. Next is train and air traffic controls, bank transactions/clearing wiped out, shipping being dismantled and so on. The gap is now being fully exposed.
[1] https://x.com/karpathy/status/2109361546505966046?s=20
To be fair, there's enormous technical debt out there stemming from decades of crappy software/firmware that was churned out with little attention to security. Like, where the whole design of the system was effectively flawed.
The capabilities of AI are bringing the power to exploit those a larger audience (where before it was in the limited hands of nation states and other well-funded organizations, hacker groups, and a comparatively few talented individuals).
I agree it's problematic in practice, but I'm hopeful this will catalyze everyone to be a hell of a lot more disciplined in hardening their products and platforms.
Core banking may be more resilient because it runs on software that's so antique and obscure it's not going to be easy to find the code to attack.
Also banks are more likely to take basic security seriously and not leave core services open to the public internet, even if the code itself is full of bugs.
On the other hand, running old software where the code is publicly available, on hardware connected to the internet - you are cooked
> Also banks are more likely to take basic security seriously and not leave core services open to the public internet
You'd think so but I've seen banks leave compromised systems on their network for months after they were notified about them, including ones being used in botnets. One bank had even been temporarily disconnected by their ISP to stop the spam/hacking leaving their network, but they said they didn't care because it was just their backup connection in case their other ISP went down.
Having worked at various places, I think financial institutions are actually very rigorous when it comes to testing and fixing bugs. It has little to do with whether they're still running COBOL or not.
These cyberattacks are going after systems that barely even needed to exist in the first place, so of course they're insecure. In my opinion, this is a correction that was decades overdue. Either take your software seriously or don't bother at all. I'm surprised it took this long.
ok so we fixed healthcare, how do I access it? If "that" thing is so smart why this post is behind login-wall, posting text on the internet is still beyond its capabilities?
You need an agent to give you the xcancel version of the link, duh
> XCancel service is suspended.
here is your super intelligence
I don't like X either, but Karpathy isn't a "that thing", he's a developer, and free to post behind paywalls if he wants to.
He can trivially use "that" thing to post text on the internet. Should be even easier than tapping stuff inside x mobile app.
> Should be even easier than tapping stuff inside x mobile app.
I wouldn't know, I don't use it.
Also, wouldn't know if he was on the mobile app rather than website. Which I also don't use, because I don't use X.
But it's up to him what he does, the mutual dislike you and I have of X has no sway over him.
Most organized crime and states were probably already sitting on a very large archive of exploits well before the 2022 launch of chatgpt. Most industrial automation and embedded systems have limited resources and are fairly exposed.
The main thing that changed is geopolitics. Putin is getting desperate and European attacks without full casus belli are getting messier and messier.
We have to assume this the new normal- that APT has moved into an even more advanced, persistent and threatening. And that anybody who has not vigorously secured their infrastrcuture, continuously testing it, and adapting to ongoing threads, will continue to get hosed.
I think air gapping will be a necessity soon.
This is going to be another "OMG AI is going to cause all these cyberattacks!11!!1!" thing that turns out to be "any child can find these on Shodan and the hardcoded can't-be-disabled Gott-tier login is admin/admin, isn't it?
It is, isn't it?
Again.
Password is "123456", same as my luggage.
On the plus side, that password is user friendly and language independent.
Eh. Lots of people write numerals with different code points. There's three flavors of Arabic numerals and most password checkers won't collate them together :p
This reminds me I need to get to work storing a weeks worth of water in my basement and stashing a little bit of cash in the house.
time to download wikipedia again
Do you have solar panels? Otherwise it won't do you much good?
i have one of those usb batteries with a tiny panel on it will that power my house?????
Even if you do it won't help. You need to be off-grid. The vast majority of solar panels are deliberately designed to shut down when there's a power cut so that they don't feed power back into dead wires (that might be in the middle of being repaired).
> a weeks worth of water in my basement
Eh, that'll take care of itself when the sump pump loses power.
It looks like this wave of cyberattacks happened hours after the attack to Russian datacenters. Am I right?
The Russia-Ukraine war has all signs to lead the world into world war 3 if its not stopped. All these sabotage acts will continue across the globe to drag more countries into the mix. What is the UN Security council doing?. Nobody hears their efforts to stop anything
>The Russia-Ukraine war has all signs to lead the world into world war 3 if its not stopped.
Russia can withdraw today and all the fighting would stop immediately.
>All these sabotage acts will continue across the globe to drag more countries into the mix.
Russia can choose to stop these sabotage acts immediately.
>What is the UN Security council doing?. Nobody hears their efforts to stop anything
Russia doesn't need anyone's permission to stop the war immediately.
(But also, Russia is a founder and permanent member of the UNSC, so...)
The US has invaded 3 countries this year so far. Seems many countries could choose to stop doing things if they wanted to.
Sadly, if WWIII happened now the US probably won't be the good guys.
The problem being, of course, that if they stop any of what they're doing, in their own heads, they're no longer Russia.
And to them, that's a bad thing.
I think it would be wonderful if people read this:
https://euvsdisinfo.eu/report/western-media-are-not-reportin...
The russian disinfo was flagged so I'm posting it here.
Full disclaimer: I'm in contact with the NAFO leadership. ;)
[flagged]
What you‘re saying, critically, is only half the story. The fight was between Russia backed separatists and the Ukraine gov. The shelling went both ways. This has been endlessly discussed and investigated by the OHCHR.
[flagged]
Russia's control of Donbas is part of the war. It didn't start in 2022. If Russia withdrew, including from the Donbas and Crimea, the war would stop.
> What is the UN Security council doing?
What do you expect UN Security Council to do here, really? Two of the permanent members are waging offensive wars without cause, and Russia keeps vetoing anything about Ukraine, and the US keeps vetoing anything about Gaza/Israel and Iran. What exactly could they realistically do, in your opinion?
Russia has a permanent seat and an absolute veto on all UN Security Council actions.
Russia lashing out beyond Ukraine is a sign of desperation, not of strength. They've destroyed their economy and have little chance of making more progress in Ukraine, and they know it. The predictions of escalation into WW3 don't seem credible to me.
Or maybe it’s the Iranians this time? Whoever it is, getting good at cybersecurity seems more useful than going to war over it.
What does Iran have to gain from provoking the Europeans?
> What is the UN Security council doing?
Echoing what everyone else is saying:
The UN Security council has no effective power over the five permanent members (or those countries a permanent member wishes to protect). Of course it is doing nothing against Russia, USA, China, UK or France; it can't.
That seems rather dysfunctional & kinda making the institution itself useless ?
Of course it's dysfunctional. Sovereign governments aren't super interested in reducing their sovereignty. The deal for the more powerful governments is they have a venue to legitimize imposing their will on other governments ... if the big 5 can come to consensus.
The deal for the less powerful governments is if they have a dispute with other less powerful governments, they can get it resolved by consensus of the big 5. If they have a dispute with a member of the big 5, there's an imbalance of power that the UN can't solve.
IMHO, this is better than the status quo from before the UN / League of Nations.
It might be nice to have an institution with the responsibility and ability to issue binding resolutions on all governments with regard to authorizing war/etc, but you can't really bind the big 5 (or at least the big 3) without their consent or overwhelming force.
What can the UN do if countries like Russia, China and the USA can simply ignore them?
Let me guess, we have to war now to... prevent... a war?
US wouldn't need to join the war for Ukraine to prevail. Not trying to force them to unconditionally surrender would be a good start.
The only superpower of the Security Council is sending nastygrams, and they can't be very nasty anyway, and any of the 5 members can veto it anyway, and any other nuclear power can play an UNO card and ignore the nastygram anyway.
The UN is a discussion forum, imagine "Reddit for countries". It's useful to coordinate some global actions like vaccines and stop small fights, but anyone with nukes can ignore it.
[flagged]
Yes, who destroyed the Nord Stream pipelines? Biden and Nuland told us. Who developed Stuxnet? Same entities who are behind these false flags.
Ukrainian special ops. And good riddance, that pipeline was a stain on the Baltic, and people like Paavo Lipponen should be ashamed for ever pushing for it.
They won't be, though.
[flagged]
[flagged]
btw, Fehmarnbelt tunnel is one of Europe's biggest infrastructure project now. It's longer than Øresund tunnel/bridge (between Copenhagen and Malmø).
Isn't the EU about to roll out the Cyber Resilience Act? Incidents like this only stress the necessity. And while it might be inconvenient, at least the EU is doing something. The US just let the cyberterrorists run wild, "because it's OK when it's our guy".
There was a cyberattack in France with 350-400 supermarkets having its fridges heated to 50C, instantly defrosting and spoiling food.
When your fridges hit 50C, that’s not a bug... thats a hotfix
Hackers activate automatic defrosting in supermarket fridges across Europe - https://news.ycombinator.com/item?id=50055304 - Oct 2026 (971 comments)
Meanwhile, inside your odd sandboxed environment there's an agent changing a folder name to "zz_thermostat-disabled_answerkey_not_in_carrefour"
They didn't actually hit 50C, right? I read it as setting the thermostat to 50C, which basically would just turn off the cooling compressor entirely - not heat the fridge.
I read somewhere else that they activated a quick defrost function and as those were industrial fridge, it seems they can heat to 50C
Wouldn't surprise me if they could go all the way to 200C as part of self-cleaning/self-sterilizing cycle.
Well, if there's water (or ice/frost) inside, you probably don't want to go above 100C. You'd turn it into a boiler, and pressure-test the door seals.
I don't know about these particular fridges that got hacked, but most supermarket fridges I've seen around the world either have no doors, or if they do, their doors have wide gaps and no seals (they'd only make it harder for the shoppers to shop, and given the usual foot traffic, they'd wear out completely after a week).
Exceptions I've seen: some top-opened supermarket freezers (particularly with hinged, heavy doors), and most fridges in small shops. I've seen a few that could turn into pressure bombs this way, but I very much doubt these had any networking/remote control capabilities.
So far as I can tell, the thermostat was set to 150 C, and it actually reached 50 C.
Though given how easy it is to make the error, "150" may have been a fat-finger typo for "50".
Are we aware if these attacks are actually connected?
“Once is happenstance. Twice is coincidence. Three times is enemy action.”
Largest supermarket in The Netherlands was hacked yesterday: https://nltimes.nl/2026/10/13/albert-heijn-outage-likely-cyb...
Empty shelves, no online ordering.
The enemy of supermarkets?
The enemy of the (perceived) enemy's economy. There is a war in Europe, and the EU and the USA are mostly involved economically. Causing economic damage to the financiers of the enemy is a standard Cold War pattern. Oil-embargo warfare is a double-edged sword: while it hits the EU hard, it also causes pain for Russia. This is most likely one in a series of low-hanging-fruit attacks intended to cause economic damage to Ukraine's financiers.
Russia probably. There is a war, you know.
badum-tsch
Assuming the Russia speculation is correct, what is their motivation? General chaos in Europe? It seems pretty reckless knowing this would be ascribed to them, and I don't see how they benefit here.
Part of the goal is to be a nuisance so Europeans pay a price for supporting Ukraine, in the hopes that we decide it's not worth the heat. Russia is banking on the west's refusal to face a conflict and the sacrifices it causes, kinda like a game of chicken.
We're about to hit a series of important elections as well (Spain, France, I think Germany soon as well?), hybrid warfare is supposed to influence in favor of extreme parties.
It's a major issue. On paper NATO can mop the floor with Russia even without the US backing, but nobody in a first world country wants to die in a ditch, and the endgame there is also unclear because Russia can play the nuke card if they're too threatened.
> On paper NATO can mop the floor with Russia even without the US backing,
I think that was true a two years ago, but Russia has been forced to adapt to the drone warfare of Ukraine as much as Ukraine has been forced to adapt to the drone warfare of Russia.
I suspect that right now, both Ukraine and Russia have independently got armed forces which could wipe the floor with the rest of non-naval NATO forces. And I'm only giving a "possibly" for the naval exception because of their limited production rate of long-rage drones so saturation attacks may be harder, not that it's impossible: we can already see the US navy being forced into a much longer distance stand-off range vs. Iran.
That said, I'm getting this position mainly from watching Anders Puck Nielsen videos, so take with the usual scepticism/pinch of salt for "internet commenter/armchair general".
I don't have any insight into this situation, but I feel like the incentives to blame Russia for any problem must be tremendous.
It's a perfect 'get out of jail free' card for any sufficiently complicated screw up.
This is where my mind goes too. They're not even outright blaming Russia here either, just planting the seed by referring to intelligence assessments that are for some reason made public. I hesitate to use the term because of the connotations, but considering the ever-increasing ease by which such cyberattacks can be conducted and the actors' identity obscured, this and similar incidents seem ripe for some kind of a false flag type deal. Some non-zero number of these incidents have to be exactly that.
This isn't to excuse Russia's abhorrent conduct elsewhere either, I'm just not entirely convinced by the boogeyman lazy journalists seem perfectly content to keep trotting out.
Retaliation for Ukrainian attacks on Yandex datacenters most likely - it communicates to EU states that Russia has capabilities to physically impact their infrastructure via cyberattack, which should act as a deterrent for sending aid or admitting Ukraine into the EU.
As long as they can avoid loss of life (or significant loss of life) and direct attribution, but the rumors are still that it's Russia, this is a way to reduce popular support for Ukraine. The attacks aren't severe enough to make people want to support Ukraine to spite Russia, and it makes it apparent that there is a cost for the current support.
Tension, division and chaos - preferably along the lines of testing limits of article 5 cohesion.
Though the US did most of the heavy lifting on undermining NATO for Russia already, so these grey zone attacks are just building on that.
How does firebombing the British PMs home benefit Russia? How does flying explosive laden drones into European airports benefit them? How does bombing Kiev benefit them? Russia still does it
[flagged]
> President of the Danish Council for Digital Security, Henning Mortensen, does not rule out that the incident may have to do with a hybrid war. In recent weeks, Danish services have warned of possible cyber attacks from Russia and raised the degree of threat to "high."
https://www.rmf24.pl/fakty/swiat/news-wojna-hybrydowa-cybera...
What could be the Russia’s interest in this type of short disruption? What do they gain from this?
Fear, uncertainty and doubt. Russia’s modus operandi. They want to make us paranoid and suspect them every time something suspicious happens, painting a picture of some kind of super powerful actor, while always retaining plausible deniability about everything.
As in "promote linking every attack of uncertain origin to Russia thus creating the fear of widespread hybrid warfare, while focusing actual attacks on Ukraine's weapon suppliers if possible"?
Yes, quite.
Scaring the european public, to be less willing to support Ukraine.
With quite some this is working.
It fuels the “look how the government sucks at doing its job, vote for us to “fix” the government” narrative for whoever they are propping up with money and bot farms.
Any disruption is an opportunity to inject corruption.
They just do what they can. Any nuisance is a win for them.
They want the electorate to be scared and vote in incompetent, corrupt, compromised, anti-EU, and divisive government. And then divide et impera.
It is like reading The Onion:
[x] Outsourcing identification to Internet companies (likely US).
[x] Outsourcing operational state of equipment to Internet companies (likely US).
[x] Displacing German and Danish workers with cheaper Poles.
[x] Cyber council member floats hybrid war rather than addressing its own incompetence.
[x] News comes from Kiev instead of Copenhagen.
> [x] Displacing German and Danish workers with cheaper Poles.
I beg you pardon. I'm not cheap, but I'm also not employed. You want cheap so you get it.
Polska Gurom
Last one is uncalled for. Here is your CPH source if you can Danish: https://news.ycombinator.com/item?id=50074900
I wonder if the Eastern European workers on the German part of the tunnel are paid below minimum wage or if that is only allowed for agriculture.
[dead]
[x] BSI certified security
(Joking)
Fun fact, BSI has that sending out security emails when they find a security hole. A client once got that and was on the edge. It was a bit odd, cause the article they linked to literally said this wasn't affected (so no patches existed). Really wished they didn't do that. It was OpenSSH on OpenBSD.
There were other laughable things like that.
But in a world dominated by FUD (that HTTPS connection that only allows one fingerprint needs to go over VPN, that SSH port cannot allowed to be reachable (but that gaping hole on HTTP(S) is fine), without a firewall that server is insecure, ...) that's not exactly surprising.
>created: 1 hour ago
>Kiev
ок
Surprising how many of the 1000,000 males coming from rich Ukrainian families and vacationing permanently in Germany or France have time to correct European Union citizens.
The spelling changed in 2022 and is hard to remember for those who don't make a living harassing EU citizens while blackmailing them for more money. You know what? Russia and Ukraine are really made for each other.
Rich Ukrainians are mostly beneficiaries of corrupt Russian system. You dont remove such things overnight, all countries that were in Soviet orbit have hiccups due to that to this day.
At the same time it's clear that it's not hopeless for those nations that choose to do something about it. Which is it for Ukraine remains to be seen. They are doing the correct first steo though. So there is that.
I'm a EU citizen who would rather the likes of you be deported.
General repatriation sounds good.
[flagged]
I do trust critique on this stuff from throwaways. The utter cheapness of manufacturing provocateurs against EU interests, mean you need to bring your reputation to be taken seriously with the potshots imho
Yes, listen to established NAFO accounts!
well, shit.