this post was submitted on 01 Aug 2026
152 points (98.7% liked)
Technology
86764 readers
4109 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
LOL why are those systems even exposed to the internet? This is fucking inane, making sure those systems can't connect to the internet is basic security, and whoever decided to cut corners here should get fired, sued, sentenced and fined, all of this into eternity because their decision was fucking braindead. VPNs are NOT a new technology.
Seriously, you can setup VPNs to only allow specific trusted devices. With critical infrastructure it should be a whitelist only security model.
VPNs are too complex for non-technical people. I used to work in IT for a big university. When I managed the installation of a large research cluster they insisted it be publicly accessible so that traveling professors, etc. would have easy access to it. Long story short, I found it had been compromised by an IP address in China within hours of it being on-line.
Non-technical people should not have a say in security at all. Just as the opinions of Joe Shmoe should be disregarded in sectors like public health, science, law and politics. We have to start to purge the people knowing shit in all important areas. Crap like a shitstorm on X (aka nazi central) or something should be used to target the participants in those campaigns to mark them as unreliable bums.
Edit: more extreme people than me might propose a system that is close to the Black Mirror episode "Hated in the Nation", but not with killing the fuckers participating, but by taking away their talking rights on online platforms. Humanity would be better off this way.
A lot of our critical infrastructure is connected. From power generation to water to sewer. All have been subject to hacking attempts, some successful.
I have also been saying for quite a long time that these things should not be connected in a way that they can be damaged or disabled by internet.
But y’know, put it all on the web and write controller software for centralized remote operation and monitoring so you can fire people and run the system with less people for more profit.
Ooh I do security stuff.
I'm willing to bet that there are a core of talented systems engineers that built out the control systems for water plants. They are smart people that care deeply about what they do.
Their "leadership" however is usually made up of a loose group of interchangeable clowns that cycle in and out based on connections, nepotism and financial incentives. Their job is to do stuff to impress other important people and that usually means cutting costs. Sometimes it means getting into bed with a vendor or other company so they can profit from the relationship.
They will direct the engineers to use stupid shit, turn off controls, use platforms that are wholly inappropriate.
They will make a mess out of a system that was designed well to the point where fixing all the problems is impossibly expensive. They will declare that its good enough and then take their next job.
I have watched this cycle happen over and over. Current company has about 10+ years of problems stacked up and it would cost more to fix them than the company makes in revenue for a few years. They won't be fixed.
When it comes to SCADA systems they should never be connected to the internet and should be air gapped to prevent intrusions. If connecting from a remote location it should be secured with a VPN, 2fa and be read-only. SCADA systems are almost constantly monitored 24/7 and someone onsite should be able to handle any emergencies