https://www.claroty.com/team82/research/freeze-the-controlle...

You'll find that these are quite complex control systems and their data may not be integrated into an operational or security control centre. So if they are not configured for, or resourced (in terms of operators), to handle anomalies, how do they notice and respond?

Without knowing anything about the attack it may be that the controllers were not connected directly to the public Internet, but an on-site VPN that became compromised some other way. Or with a compromised laptop of a technician that connected.

So while you are thinking about fridges today, think about how you would secure and operate control systems across tens of thousands of stores. Would that be easier without Internet connectivity? How do you get qualified and experienced technicians into each (air gapped) store? Another complexity is that many of these systems are part of facilities management systems (HVAC, lighting, security, fire control) and managed or owned by a completely different organisation that is not going to share their data.

The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.

The biggest issue is that many of these IoT devices are badly secured. I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.

Doing it insecurely by, for example, having a device with a web server on the fridge is problematic. Not being able to deploy firmware updates. Having too much of the control loop exposed (as opposed to monitoring only), can lead to issues.

Service-oriented industries with costly assets will look to Internet connectivity for competitiveness and efficiency. It needs to be done better.

Water use in electricity generation is significant. In the England we are in the middle of a drought and it is surprising to realise that electricity generation uses 2.5x more ('environmentally extracted') water than public supply and 10x more than agriculture.

Rejection (or fear) of AI translating into rejection of the physical infrastructure that supports it is perfectly reasonable.

If there is one thing I miss about the Internet that I grew up with, it is the trust and self-policing. We were on forums (even usenet) and got along. Now it is all walled gardens, rage bait, racism, and people shouting at each other.

I will get downvoted by people suspicious of handing over a lot of personal data, but we do have GDPR laws, and they're not getting me to install a proctopod (tm). Giving someone my email address to verify my age is not a big deal. They're getting my email address to create an account anyway.

The practicalities of implementing 'good enough' age verification, where the website can prove that they conformed to an acceptable approach, do not require giving up all or significant freedoms. Maybe we get to something similar to DNS verification where you need to create a dummy TXT record in an already verified account.