Comment by nullocator
7 hours ago
Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?
In before "but insurance"; yes insurance can in theory mitigate some of this, but I feel like people on HN have no understanding what it's like to deal with a multi-million dollar insurance claim that the insurance company 100% does not want to pay out. The legal battles over such things take years and are on their own incredibly expensive.
> Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?
It happened once. Did you do the maths here? Can you tell us which one was Kore expensive and what percentage chance there was of this hack happening?
Someone did the math. Cost of continual maintenance, versus cost of product loss. They determined it wasnt worth the maintenance cost, and accepted that risk. And that risk manifested.
This happens all the time. Unfortunately, in my experience, most of the risk acceptance happens without even really believing in the cost of the risk, and people just accept everything. it is highly likely someone like that accepted this.
And the people that made the decision largely have moved on and cashed their bonuses from saving all that money. It's now someone else's problem.
Management is never held accountable.
The polite term is 'self-insurance', and it's often the right move.
It's psychology. One option is a guaranteed upgrade bill that's due right now. The other one is a speculative what–if that may never happen.
And that's even assuming anyone who runs these sorts of systems have "hacked to turn on defrost mode" on their bingo cards at all, which probably isn't the case.
On top of that, upgrades carry risks of their own!
It was „what–if that may never happen” before agentic AI.
Nowadays you can be pretty certain it will be exploited.
It is not just run faster than slowest guy to get away from the bear, now it is dozens of bears per runner and bears are stupid enough to chew on anything but also smart enough once they bite something tasty that works will just continue biting that.
That class of risk was just theoretical for decades, so the price on it was basically 0.
Now that we see large scale incidents will there be an actual money value associated with upgrading systems and security for supermarket appliances.
and the price of everything will go up as well to pay for it. Your $2 bag of flour becomes $4 because of security costs
I think it's fair that the price up until now has been mostly zero. On the other hand you can 10+ years of examples on HN of people saying these types of threats with IoT devices and internet connected industrial hardware are not theoretical and it's shocking they weren't being exploited more often.
I can find 10+ years of examples on HN of people saying all kinds of stuff, and it's shocking how outlandish that so much of it is.
It will shortly become a national security issue.
Russia is feeling the pain of having their warehouses blown up.
There will be tons of budget for having things ‘blow up’ themselves.
That is a dangerous game, especially when affecting food supply. Widespread cyber attacks on critical infrastructure are deemed grounds for nuclear response in most national doctrines. This obviously is way out of scale, but concerted widespread efforts by decentralized groups could end up triggering ww3 by accident. Not when they try to play a game of chess, but when they shut down a water treatment plant, and some other unrelated group shuts down gas pumps, and suddenly there are millions of people with no fresh water and no fuel to get it to them...
In my recent experience (last 3 months) with a cyber claim getting insurance to pay out was actually pretty straightforward. It was about a $250K USD loss on a phishing attempt (someone hijacked and rerouted payment details for a wire)