The internet seems like the easy solution, not the obvious solution. For years, we have used the internet for things that didn't need it because it was easier and it seemed safe enough. I think that the coming months and years are going to see a lot of companies burned by that decision and scrambling to undo it.

The fact was that it was never safe, it was never secure, but that taking advantage of those problems was hard, and generally not monetarily worth it, meant we ignored the issues. That's no longer the case.

As for low quality software, the floor for the quality that internet connected software needs to have is now dramatically higher than the quality that non-connected software needs. I think that in many applications, it may no longer be economically worth it, or maybe even possible at all, to hit the necessary quality.

> it lies with low quality software.

Nearly all software is low quality software. The programmers at the fridge company are likely 4 underpaid engineers in Pennsylvania or some other equivalent.

Saying the problem here is bad code is like saying the problem with gun violence is humans are too squishy to deflect bullets.

The audit trail (status in general) could be read only. Enabling remote defrost (control in general) is an optional convenience which requires better quality software.

Those regulations need an update.

And the simplest solution is to air gap these systems, then figure out how everything else should work.

In NL we use paper and pencils for elections because it makes fraud incredibly hard. It makes the process harder as well but the baseline is that it breaks nation-scale attacks. Why this level of thinking isn't applied to *our foodchain* is beyond me.

What if high quality software exists, but the supermarkets did not pay to install the last 10 years of updates?

So then you have a connection going one way (freezer to data-logging endpoint) and not the other.

You should only ever have hardware visible in the internal network, no need to put them on the Internet at all.

These need to have an audit trail. Making it centralized is an addition, no?

Have the freezer connected to an air gapped grocery local server. Fixed

Which is easier, getting the audit trail from non-internet-connected devices, or keeping all the devices patched?

The right answer isn't forever patching freezer software. The answer is either to not have them on the internet, or to have something in front of them, and keep that thing very up-to-date. (Or maybe several layers of "something" in front of them.)

[dead]

> What is the store to do, employ full-time knob-turners?

How often do you think the knobs would need to be turned? You think someone or something is constantly fiddling with the temperature knobs of each individual freezer?

Monitoring doesn't require anything more than read-only access to fridge data.

Ironically, were the monitoring system competently made, not only would it have been unable to cause this problem, but it would have also been able to alert about it in time to prevent significant loss.

Why do they need to change the temperature? I thought it was supposed to be constant.