Of course its "possible" for it to be secure, but the people involved are not experts.

The grocer likely has the least expertise. The HVAC company has more, but as evidenced by the article, not enough.

Now obviously, these companies have internal "information systems experts" but again, how does the banana guy interview a CIO ? Grocery store CIO might have gotten the job because he made the banana guy comfortable by talking about sports.

Each party was confident in a successful outcome, until the 15 year old kid across the globe pulled the rug.

The processes that created this situation were inadequate, because glad handing and name dropping cost less than formal systems validation.

Of course, the other way to view all of this is ... they just completed formal systems validation, found 1 bug, and paid whatever the food spoilage cost was for it, because no matter how much preperation one does on a project, at some point the power switch gets flipped, and its wait and see.

In a group project, noone is ever sure if Poindexter over there in the corner is quiet because he's quiet, or is quiet because he knows the code is crap and his boss ordered him to ship it anyway.

We're likely dealing with at least 4 companies here, if not more:

contracted programmers <-> fridge equipment maker <-> HVAC sales/service group <-> grocer

3 of the 4 companies could have all said to themselves "Project ships on Monday, no matter what" because who carries the risks for any flaws ? The grocer(s).

▲

dns_snek 9 hours ago | parent [-]

> Of course its "possible" for it to be secure, but the people involved are not experts.

They're selling network-accessible equipment so it's their duty to make it secure within some well-defined envelope. How's that any different from any other part of engineering and product development?

> "Project ships on Monday, no matter what" because who carries the risks for any flaws

Soon that will be the OEMs, per the EU Cyber Resilience Act [1]:

> Directive (EU) 2024/2853 [on liability for defective products] of the European Parliament and of the Council (16) is complementary to this Regulation. That Directive sets out liability rules for defective products so that injured persons can claim compensation when a damage has been caused by defective products. It establishes the principle that the manufacturer of a product is liable for damages caused by a lack of safety in their product irrespective of fault (strict liability). Where such a lack of safety consists in a lack of security updates after the placing on the market of the product, and this causes damage, the liability of the manufacturer could be triggered. Obligations for manufacturers that concern the provision of such security updates should be laid down in this Regulation.

[1] https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

	▲	Kevin_Flynn 8 hours ago \| parent [-]
		Given the potential service contract nature of this particular situation, where the grocers signed a service agreement with HVAC companies, one would think the contract included clauses addressing this very situation, where a significant loss of inventory occurs. After all, the service being paid for is refrigeration. With floor planning, the loss itself could be spread across multiple companies, under multiple insurance policies. With that said, this particular hack could easily be a systems / networking "configuration error" and not any particular piece of softwares fault ( as in a bug, or hardcoded backdoor password. )