Project ideas from Hacker News discussions.

Water system controllers don't belong on the internet, says ex-NSA chief

📝 Discussion Summary (Click to expand)

Theme 1 – Security vs. Connectivity
Many commenters argue that exposing critical infrastructure (e.g., water PLCs) directly to the Internet is inherently unsafe and should be avoided or heavily mediated.
- “If it’s connected, it’s compromised. Or will be.” – grebc
- “You can't have both secure infrastructure and Internet exposed infrastructure.” – 27183
- “Don't put your PLCs directly on the internet.” – Kim_Bruning

Theme 2 – Cost and Practical Trade‑offs
Air‑gapping or other hardened solutions are seen as effective but often prohibitively expensive; the current state persists because security investments clash with budget realities.
- “Taking things offline and properly airgapped can also work, but wouldn't the cost of that exceed making specialized things and maintaining them?” – sublinear
- “The physical cost of installing definitely dominates the conversation…” – baby_souffle
- “We got into this situation due to cost, not ignorance.” – sublinear

Theme 3 – Organizational and Human Factors
Even when better practices exist, inertia, insufficient expertise, and a “if it ain’t broke, don’t fix it” mindset prevent timely upgrades and proper maintenance of critical infrastructure.
- “Keeping things up to date and holding critical infrastructure to higher standards than consumer tech is not a bad idea.” – sublinear
- “Critical infrastructure is rarely properly maintained… ‘If it ain't broke, don't fix it' is the motto of governments…” – Jtsummers
- “Problem is, a lot of these systems are not built by IT people… they tend to lack the necessary paranoia.” – Kim_Bruning


🚀 Project Ideas

Generating project ideas…

[AirGapped PLC Bridge]

Summary

  • Provide an inexpensive hardware appliance that sits between legacy PLCs and a secure VPN, enforcing a whitelist of commands and isolating PLCs from direct internet exposure.
  • Enables safe remote maintenance without exposing legacy control systems.

Details

Key Value
Target Audience Municipal water utilities, power substations, industrial plant operators
Core Feature Air‑gap VPN gateway with command‑validation driver and encrypted tunnel
Tech Stack Embedded Linux on ARM, OpenVPN/WireGuard, custom command whitelist engine, Modbus/TCP adapter
Difficulty Medium
Monetization Revenue-ready: Subscription SaaS ($15/mo per gateway)

Notes

  • HN commenters repeatedly ask for practical ways to “do something in between” air‑gap and internet‑connected devices; this fills that niche.
  • Potential to spark discussion on retrofitting costs and adoption barriers.

[LadderLogic Guard]

Summary

  • A cloud‑based verifier that parses PLC ladder logic and enforces predefined safety constraints, automatically flagging non‑deterministic or unsafe patterns.
  • Gives operators confidence when updating firmware or adding new logic, reducing the risk of hidden bugs.

Details

Key Value
Target Audience PLC programmers, maintenance engineers, security auditors
Core Feature Automated constraint checking and regression testing of ladder programs
Tech Stack Python back‑end, ANTLR grammar for ladder files, Dockerized analysis service, React dashboard
Difficulty High
Monetization Revenue-ready: Tiered usage plans (Free up to 2 projects, $30/mo for unlimited)

Notes

  • Commenters lament the lack of standards and verification in PLC code; this offers a concrete tool to enforce best practices.
  • Likely to generate debate on certification vs. self‑service verification.

[Edge Secure Relay]

Summary

  • A managed service where municipalities deploy hardened Raspberry Pi or similar edge devices that collect sensor data locally and push it only over an encrypted WireGuard tunnel to a hosted dashboard.
  • Guarantees no open ports, automatic firmware updates, and built‑in access‑control policies.

Details

Key Value
Target Audience Small‑to‑mid‑size utilities, rural water districts
Core Feature Secure telemetry relay with one‑click deployment and compliance logging
Tech Stack Raspberry Pi OS, WireGuard, MQTT over TLS, Flask API, PostgreSQL
Difficulty Low
Monetization Hobby

Notes

  • Directly addresses concerns about cost of dedicated fiber and need for remote monitoring without exposing infrastructure.
  • Likely to attract discussion from HN participants who cited RF‑leak risks and “air‑gap vs. private network” trade‑offs.

Read Later