m4x

Indeed, I agree that it's better to have the control systems separate from the telemetry systems and that absolutely does prevent certain types of attack. It's dangerous to think that prevents all types of attack, however.

Yes, this is exactly the kind of approach I'm referring to when I say it's possible (though not trivial to implement), but it still doesn't prevent attacks. Air France 447 crashed with extraordinary loss of life because the pilots responded incorrectly to reported sensor readings. Any scenario where authorised staff are able to affect changes in a control system is vulnerable. The attack vectors just change to suit the target system.

Sure, but as stated in reply to a sibling comment, you then just hack the read-only system to mis-report sensor state and interfere with operations that way instead. Or use one of a million other approaches. Attacks won't follow your rules.

Sure, but think through the details. There are ways to expose telemetry through an otherwise air gapped system, but it is actually not easy to implement correctly.

My position is that if there's any connection, of any practical type, between the control system and the outside world, an attacker will be able to find ways to break things.

Even if it just boils down to "an attacker made our dashboards report numbers wrong and so we closed a valve to prevent an issue that didn't exist, and inadvertently destroyed our own product", the outcome is the same.

> The laptop class doesn't always grok that the shift-work labor class ...

I think it's more than this. Industrial control system upgrades are serious business and (at least if you're doing them properly) require a lot of planning and consideration. Particularly when the subsystem being replaced is decades old already.

I think the overwhelming majority of people (including on hn) have no understanding of how complex industrial systems are - even as-built, but particularly after decades of evolution. Doing proper engineering in these spaces is expensive.

You can reasonably blame supermarket chains for being insecure, but we certainly aren't currently enabling them (or anybody else) when it comes to fixing these issues.

How does this actually work, in practice? If you have read access to sensors, then there's a non-air-gapped network between the control systems and the internet.

If your network isn't air gapped, then it's vulnerable, and attackers will side step the "read only" path to affect control system changes.

"Simply"? You might as well say the same thing about creating a doomsday virus.

Most of us effectively function as next-token predictors, in my experience. Some of us are trained not to dereference null pointers, but there's always a non-zero probability that we do so anyway. To reduce that risk I use the same tools an LLM would, i.e. code review, automated testing and verification, etc. There isn't obviously much difference between humans and LLMs in that sense.

Like you I would not vibe code something important, but I think that's primarily because I want to have a deep understanding of a system before I accept responsibility for it. An LLM would still be useful during implementation and likely to increase the quality of the result.

It seems very likely that AIs will become capable enough that they can take complete responsibility for development, deployment and maintenance of the systems we're used to building. Further, it seems likely they'll end up much more capable than humans have been. I think that's an eventuality we need to be prepared for.

A well-utilised AI tool can probably already build a much safer and more robust security/legal/user related system than you or I can, in any given time budget. There's a question around what happens as humans are required less for the "well utilised" part, and who is responsible when humans are not really involved anymore.

The study looks at forms of AI that have existed for a long time, as well as newer LLMs. From the article: "Their dataset included 41.3 million English-language papers published between 1980 and 2025 in ..."

Earlier studies looked at the effect of web search on research. This is all covered near the beginning of the article.

I'm genuinely curious how you think we should avoid it? If I had to buy a household appliance tomorrow, or a new car, I cannot think of a single company I'd feel safe purchasing from.

There are many beautiful parks and it's wonderful to spend time in them. But at some point you have to return to domesticity, and if you can't live that part of your life without being repeatedly screwed over by greedy corporations that don't even bother to provide a good service for the money you pay them, I think it's understandable people are starting to rage.

What do you do when the expensive options are also junk? Relatively few manufacturers actually focus on quality today.

> you're trying to compete with millions of square miles of naturally sun-lit dirt

You're begging the question with this statement. Indoor growing is used when you don't have access to this kind of resource. There are many locations where access to land or suitable conditions is restricted.

CEA has been used profitably for a long time, and the most valuable crops are mushrooms and leafy greens, not exotic or illegal plants.

There currently isn't a effective treatment for varroa that doesn't also kill the hive. It is not a solved problem, and there is certainly room for more research in this space.

I agree with your point, but to play devils advocate: doesn't a competitor arguably need access to these beyond-frontier models to even become an effective competitor to OpenAI and Anthropic?