Login
You're viewing the assemblag.es public feed.
  • Eloyeloy@hsnl.social
    Oct 14, 2026, 8:29 AM

    > Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates". It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware". It added that it had long advised supermarkets to update from those models. Danfoss gave no figures of how many systems were affected.

    if I'm reading this correctly, are they saying you needed to replace a _fridge_ because it no longer received firmware updates?

    crazy stuff

    💬 5🔄 4⭐ 10

Replies

  • 💬 0🔄 0⭐ 1
  • 💬 1🔄 0⭐ 2
  • Eloyeloy@hsnl.social
    Oct 14, 2026, 8:47 AM

    I've always wanted to run a snac server or copyparty server on a fridge controller

    cc @jn

    💬 0🔄 0⭐ 0
  • Eloyeloy@hsnl.social
    Oct 14, 2026, 8:39 AM

    > Danfoss
    > looks inside
    > proprietary firmware

    💬 0🔄 0⭐ 3
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Simon Zerafasimonzerafa@infosec.exchange
    Oct 14, 2026, 8:43 AM

    @eloy

    In a commercial or retail environment it would probably be very useful to have remote monitoring and warning of refrigeration temperatures.

    Not doing so securely is of course, not a good idea.

    Assuming that the firmware was properly created and tested then updates should be minimal and only needed in serious cases.

    As long as the fridge mechanism works and is safe to use then there is no real need to replace it.

    💬 0🔄 0⭐ 1
  • Eloyeloy@hsnl.social
    Oct 14, 2026, 8:44 AM

    @simonzerafa Yeah vendors should make hardware/software under the assumption no one is going to replace stuff until it actually breaks

    💬 0🔄 0⭐ 1
  • christian mockcm@chaos.social
    Oct 14, 2026, 8:57 AM

    @eloy @simonzerafa Yes, but to be fair, it certainly is hard for them, because they depend on a long supply chain in an industry that is very fast-paced. Might be the processor in their controller is EOL, might be the (commercial) compiler and tool chain is EOL. They can keep it running (if it doesn't have a license server), but then it only runs on WinXP, which brings them into trouble with their own certifications... Nobody's really got a good solution for this mess.

    💬 1🔄 0⭐ 0
  • christian mockcm@chaos.social
    Oct 14, 2026, 8:58 AM

    @eloy @simonzerafa OK, that was assuming vendors give a fuck, which IME they mostly don't, they'd rather sell you a maintenance contract and not maintain anything.

    💬 0🔄 0⭐ 0
  • christian mockcm@chaos.social
    Oct 14, 2026, 8:50 AM

    @eloy maybe not the fridge itself, but the electronics. Like, with tramways it is expected that the train itself lasts multiple decades, but the electronics will be replace about every ten years; but I've also seen vendors of big machinery that don't even think about this and make it the customer's problem, "not supported anymore, that's it". Actually, I'm currently sitting here at a customer testing some unsupported equipment to see how risky it is...

    💬 0🔄 0⭐ 0
  • christian mockcm@chaos.social
    Oct 14, 2026, 9:07 AM

    @eloy the first question here is: who decided making an OT device directly reachable from the Internet was acceptable, and not criminal negligence?

    💬 0🔄 0⭐ 0