My position is that if there's any connection, of any practical type, between the control system and the outside world, an attacker will be able to find ways to break things.

Even if it just boils down to "an attacker made our dashboards report numbers wrong and so we closed a valve to prevent an issue that didn't exist, and inadvertently destroyed our own product", the outcome is the same.

I think it's more than this. Industrial control system upgrades are serious business and (at least if you're doing them properly) require a lot of planning and consideration. Particularly when the subsystem being replaced is decades old already.

I think the overwhelming majority of people (including on hn) have no understanding of how complex industrial systems are - even as-built, but particularly after decades of evolution. Doing proper engineering in these spaces is expensive.

You can reasonably blame supermarket chains for being insecure, but we certainly aren't currently enabling them (or anybody else) when it comes to fixing these issues.

If your network isn't air gapped, then it's vulnerable, and attackers will side step the "read only" path to affect control system changes.

Like you I would not vibe code something important, but I think that's primarily because I want to have a deep understanding of a system before I accept responsibility for it. An LLM would still be useful during implementation and likely to increase the quality of the result.

It seems very likely that AIs will become capable enough that they can take complete responsibility for development, deployment and maintenance of the systems we're used to building. Further, it seems likely they'll end up much more capable than humans have been. I think that's an eventuality we need to be prepared for.

A well-utilised AI tool can probably already build a much safer and more robust security/legal/user related system than you or I can, in any given time budget. There's a question around what happens as humans are required less for the "well utilised" part, and who is responsible when humans are not really involved anymore.

Earlier studies looked at the effect of web search on research. This is all covered near the beginning of the article.

You're begging the question with this statement. Indoor growing is used when you don't have access to this kind of resource. There are many locations where access to land or suitable conditions is restricted.

CEA has been used profitably for a long time, and the most valuable crops are mushrooms and leafy greens, not exotic or illegal plants.

What I did say is that in a hypothetical world where Apple did invest in their own fabs, they'd have much better access to memory and could be selling machines with vastly more memory than their competitors today. Should they be doing this? I'm making no statement either way.

> a very wise man took me to dinner and counseled me to never post mortem my decisions on the outcomes, but only on the decision process

I appreciate this wisdom on one hand, but on the other it's comically misguided. You have no way to evaluate the decision process if the outcomes are not considered. Don't post mortem your decisions in a way that leads to self-blame or paralysis, but certainly post mortem them to see whether the process was suboptimal.

In this case, any board laughing at the idea of investment in memory 3.5 years ago should instead have been looking more closely at likely memory needs over the then-near-future, given the quite obvious upcoming demand for GPU memory. There's no magic bullet and they wouldn't have been able to make perfect decisions regardless, but clearly the process they followed at that time was suboptimal.

You're talking about the "best" things Apple could do with their money, in terms of investment returns, but I think that misses the point that Apple literally can't buy enough memory at any price.

I would guess LLMs are limited in their ability to be genuinely novel because they are trained on a fixed language. It makes research into the internal languages developed by LLMs during training all the more interesting.

Letting companies train LLMs on the "classics" is very different to training on contemporary media where the creator still depends on it.