7 ms·

Neither safety now environment is something you can easily wave at like that. Also, you're completely missing security concerns and legislative. I have worked

Neither safety now environment is something you can easily wave at like that. Also, you're completely missing security concerns and legislative. I have worked in the automotive embedded software industry since 2009 and I have got caught in the safety track in my career. It's a strange place to be, because the basics are extremely simple, yet it takes hundreds if not thousands of man-years to get a modern vehicle reasonable safe just in terms of the electrical system (this includes the software in automotive terms). There are so many ways to make a mistake that could easily result in an accident. Even the window regulators have non-trivial implementation concerns for anti-pinch. Allowing a random hacker to override this is a terrible idea. Now imagine what kind of mess you could do with brakes and steering... Designing a vehicle to be hackable will very likely lead to an unsafe vehicle. I believe what I just wrote applies similarly for security too. Furthermore releasing software for the market, extensive testing is carried out by an independent body to ensure that legislation is followed. Even conceivably simple things such as lighting or headbeam alignment is a pretty large problem domain by itself. Also, so is just the communication standards for diagnostics. I would say that large changes would be required to transform this industry. In some, protected domains there is use of open source, such as Qt/Linux for HMI, but opening the HMI to be fully hackable is unlikely to happen. There is quite some liability to make the HMI non-distracting.

frenchie4111 3y ago
I think their point / the general FOSS argument is that those 1000 of man-years would be turned into 10000 man-years if these things were open sourced. A similar security concern could be waived at things like openssl, but it seems pretty inarguable that openssl is a net-positive for security.
- svorakang 3y ago
  I'm all for open access to the code for the sake of safety. On the other hand, I'm completely against hobbyists accidently bypassing a safety mechanism. Open access, but secure access to software download could make sense, at least for commodity parts. When it comes to features with competitive advantage, though, I don't see that OEMs or its suppliers have anything to gain.
  - jacquesm 3y ago
    > On the other hand, I'm completely against hobbyists accidently bypassing a safety mechanism. Accidentally. Besides that: it should be fairly obvious that hobbyists are not going to 'accidentally bypass a safety mechanism', they can cut their brake lines as well and they don't generally do this. What you'd see is that the aftermarket would finally be able to produce stuff without dealers in between and people with the 'right' kind of tooling (authorized by the manufacturer) to get your replacement to be recognized by the firmware. Because of course absolutely none of this would ever be used to protect the bottom line. Right? Also: if anything open sourcing this stuff would likely result in more rather than less safe vehicles, maybe at the expense of a couple of embarrassments. Because I have absolutely no illusion about the people working on these systems professionally to be somehow magically better than the ones that work on them for themselves, after all, they have a pretty big stake in the outcome. Imagine that, working on your car in a safety related way... replacing brakes, steering housing components, linkages, suspension components tires and so on is all at least - if not more - risky than working on software. FWIW one of those 'safety features' tried to kill me twice and caused me to let go of my recent car and switch to a 1997 issue vehicle that has behaved quite predictable compared to that modern one. Whose 'safety features' could not be disabled.
    - lm28469 3y ago
      > Besides that: it should be fairly obvious that hobbyists are not going to 'accidentally bypass a safety mechanism', they can cut their brake lines as well and they don't generally do this. I can already picture the YouTube videos on "how to gain 15% hp" explaining you how to "hack" your car with a 1s "it will severely reduce your engine life expectancy" message at the end. Thousands of people would run this patch without thinking twice Also how would you pass the controls most countries do every other year on cars ? I don't expect people checking my brake pads to know how to review the random piece of code I deployed to my car
      - jacquesm 3y ago
        Well, that's sort of the point: this is already possible, so in that sense nothing would change. Changing the mapping (essentially the amount of fuel injected based on a bunch of parameters) is regularly done by 'tuners' (between quotes because they don't really tune anything, they mostly burn more fuel for questionable gains). But that's really not what I would care about. I'd like to read that code to figure out what the failure modes are and what might impact my safety in a negative way.
jacquesm 3y ago
Oh dear, I wonder how I'll ever be able to use the code I wrote over the years that controls uncounted lathes, mills, plasmacutters, lasers and a whole raft of other industrial tools. Obviously the only people that can be trusted with our safety are the manufacturers, because the people whose lives are on the line are irresponsible madmen. > Designing a vehicle to be hackable will very likely lead to an unsafe vehicle. Vehicles are hackable, but they're not documented which makes them more dangerous, not less dangerous. Witness comma.ai and others.
- adhesive_wombat 3y ago
  I'm all for open things, but that's a false equivalence. You don't use those tools on a public road around unsuspecting others. In the same way you can't just merrily hack about with a plane. The FAA don't really care that much if you die in your experiment. They do care if the burning wreckage falls on someone minding their own business.
  - jacquesm 3y ago
    And what makes you think that the current crop of automotive software written in either asm or unsafe C is going to be any better than what you or I would produce? I've had a very recent model Mercedes C-class nearly kill me twice on account of buggy software. So much for that 'stellar' (pun intended) reputation. My current car is as dumb as it possibly could be. I'd expect that if any ECU software was to be released that we'd finally realize how bad things really are and that there would be a massive amount of work done on making sure these pieces of critical software would be as safe as they could possibly be. Note that the norm is 'a subset of C deemed to be safe' but that what I've seen of such development would not pass my personal threshold for quality work. In fact, rather the opposite. On the plus side, the hardware people usually know their stuff and realize what is dangerous to pass to the software people so with some luck your vehicle will use an FPGA for any kind of really safety critical stuff (or processors embedded with the relevant hardware, such as ABS and so on).
    - formerly_proven 3y ago
thomastjeffery 3y ago
Hackable does not mean crackable. The best security implementations in the world are free software. I'm not even a tiny bit convinced that making cars hackable would be a detriment to safety. Give me one example of that happening in literally any other sector.
- svorakang 3y ago
  You might have a point there, but I struggle to find any completely hackable product that is also safety-critical. Some airplane, nuclear reactor or some train, perhaps?
  - jacquesm 3y ago
    Any old car will do.
    - DennisP 3y ago
      And new experimental aircraft, which are owner-built.
bboygravity 3y ago
Why would it (legally) be on the car manufacturer if someone hacks his own car and causes an accident because of modifications to the ECU (firmware)? This doesn't intuitively make sense to me. At the very least there are probably huge differences between countries when it comes to this? Aside from the fact that some people would likely love to modify their car in every way possible to use it on the racetrack or whatever private property?
- jacquesm 3y ago
  Or maybe to make it safer.
debatem1 3y ago
> I believe what I just wrote applies similarly for security too. Automotive security is nearly an oxymoron. The reasons for that are simple: the difficulty and expense of attacking a vehicle exceeds the bored grad student/curious tinkerer threshold, and the automotive industry has collectively the worst attitude towards security I've ever encountered. The depressingly predictable result is that third party automotive security testing is a sport reserved for people who are extremely disinterested in disclosing their methods to you, aka the actual attackers.
lo_zamoyski 3y ago
And someone could respond "Okay, fine, tampering with the onboard software voids the warranty and shifts responsibility to the tinkerer." But that's a liability issue. The safety concern is still there regardless of who is held responsible. A change that seems innocuous may, in fact, be breaking safety regulations. This is a big deal and a matter of public concern.
- mikrotikker 3y ago
  If you clutch those pearls any harder they'll turn to dust.
yjftsjthsd-h 3y ago
Okay, so for the moment leave aside the safety critical bits (only for a moment) - what's the excuse for not opening up the center console? That generally is already segregated and only handles non critical functions.
- jacquesm 3y ago
  Center consoles have been used quite successfully as beachheads by hackers to be able to get into more important systems because car manufacturers are typically utterly clueless when it comes to security. So obscurity is a very large part of their security. Of course that doesn't really work with the most motivated parties (car thieves and their captive techies) having a field day with this. Hyundai and Kia are reportedly so bad that they ended up paying out a large amount of money to compensate owners. https://www.reuters.com/legal/hyundai-kia-agree-200-million-settlement-over-car-thefts-lawyers-2023-05-18/ https://www.reuters.com/legal/hyundai-kia-agree-200-million-... But don't worry, it's been fixed now. Probably.
  - yjftsjthsd-h 3y ago
    If it's security critical, it definitely needs to be FOSS and user patchable; obscurity is not a reasonable strategy.
    - jacquesm 3y ago
      Agreed, but that won't happen until some regulator wises up to this being a way to reduce vehicle theft considerably.
matheusmoreira 3y ago
> Allowing a random hacker to override this is a terrible idea. It should be a basic right no matter how "terrible" a idea it is. We bought it, we should have full control. Void the warranty or something.
- dack 3y ago
  I'm thinking through the ethics of this myself, but I think it's a reasonable argument that you can have the freedom to do what you want with things that you own _assuming you don't impact others_. The issue with a dangerous car is that it puts others at danger.
  - jacquesm 3y ago
    Agreed, and that's an argument for open source, not against.
  - matheusmoreira 3y ago
    Responsibility. If I modify my car and that's determined to be the causal factor of an accident, it's on me.
    - lm28469 3y ago
      That'll make the hypothetical parents of the hypothetical kid you just ran over very happy I'm sure. "I fucked up but it's on me!" and they lived happily ever after
      - jacquesm 3y ago
        Somebody please think of the children. Really, come on: you can do much better than this. The hypothetical kid might be the one that was saved because some random hacker figured out why the latest generation radar based cars keep phantom braking. That argument works both ways, and typically what is fixed stays fixed. And of course none of these hotshot programmers would ever be seen near the following bit of code[1], which probably impacted a lot of actual children and their health in a very direct way: // in case of an emissions test ensure that we pass // with flying colors if (emissions_test_detected()) { // we're sooo environmentally conscious lean_burn(); } else { // roll that coal regular_burn(); } [1] cribbed from VW/Porsche AG's internal repository ;)
pests 3y ago
> Even the window regulators have non-trivial implementation concerns for anti-pinch Tesla just got hit by this a few months back. They had to remove the auto roll-up-windows when you walk away after parking. Apparently they didn't have the sensors or hardware to do it safely.

frenchie4111 3y ago

I think their point / the general FOSS argument is that those 1000 of man-years would be turned into 10000 man-years if these things were open sourced. A similar security concern could be waived at things like openssl, but it seems pretty inarguable that openssl is a net-positive for security.

svorakang 3y ago
I'm all for open access to the code for the sake of safety. On the other hand, I'm completely against hobbyists accidently bypassing a safety mechanism. Open access, but secure access to software download could make sense, at least for commodity parts. When it comes to features with competitive advantage, though, I don't see that OEMs or its suppliers have anything to gain.
- jacquesm 3y ago
  > On the other hand, I'm completely against hobbyists accidently bypassing a safety mechanism. Accidentally. Besides that: it should be fairly obvious that hobbyists are not going to 'accidentally bypass a safety mechanism', they can cut their brake lines as well and they don't generally do this. What you'd see is that the aftermarket would finally be able to produce stuff without dealers in between and people with the 'right' kind of tooling (authorized by the manufacturer) to get your replacement to be recognized by the firmware. Because of course absolutely none of this would ever be used to protect the bottom line. Right? Also: if anything open sourcing this stuff would likely result in more rather than less safe vehicles, maybe at the expense of a couple of embarrassments. Because I have absolutely no illusion about the people working on these systems professionally to be somehow magically better than the ones that work on them for themselves, after all, they have a pretty big stake in the outcome. Imagine that, working on your car in a safety related way... replacing brakes, steering housing components, linkages, suspension components tires and so on is all at least - if not more - risky than working on software. FWIW one of those 'safety features' tried to kill me twice and caused me to let go of my recent car and switch to a 1997 issue vehicle that has behaved quite predictable compared to that modern one. Whose 'safety features' could not be disabled.
  - lm28469 3y ago
    > Besides that: it should be fairly obvious that hobbyists are not going to 'accidentally bypass a safety mechanism', they can cut their brake lines as well and they don't generally do this. I can already picture the YouTube videos on "how to gain 15% hp" explaining you how to "hack" your car with a 1s "it will severely reduce your engine life expectancy" message at the end. Thousands of people would run this patch without thinking twice Also how would you pass the controls most countries do every other year on cars ? I don't expect people checking my brake pads to know how to review the random piece of code I deployed to my car
    - jacquesm 3y ago
      Well, that's sort of the point: this is already possible, so in that sense nothing would change. Changing the mapping (essentially the amount of fuel injected based on a bunch of parameters) is regularly done by 'tuners' (between quotes because they don't really tune anything, they mostly burn more fuel for questionable gains). But that's really not what I would care about. I'd like to read that code to figure out what the failure modes are and what might impact my safety in a negative way.

jacquesm 3y ago

Oh dear, I wonder how I'll ever be able to use the code I wrote over the years that controls uncounted lathes, mills, plasmacutters, lasers and a whole raft of other industrial tools. Obviously the only people that can be trusted with our safety are the manufacturers, because the people whose lives are on the line are irresponsible madmen. > Designing a vehicle to be hackable will very likely lead to an unsafe vehicle. Vehicles are hackable, but they're not documented which makes them more dangerous, not less dangerous. Witness comma.ai and others.

adhesive_wombat 3y ago
I'm all for open things, but that's a false equivalence. You don't use those tools on a public road around unsuspecting others. In the same way you can't just merrily hack about with a plane. The FAA don't really care that much if you die in your experiment. They do care if the burning wreckage falls on someone minding their own business.
- jacquesm 3y ago
  And what makes you think that the current crop of automotive software written in either asm or unsafe C is going to be any better than what you or I would produce? I've had a very recent model Mercedes C-class nearly kill me twice on account of buggy software. So much for that 'stellar' (pun intended) reputation. My current car is as dumb as it possibly could be. I'd expect that if any ECU software was to be released that we'd finally realize how bad things really are and that there would be a massive amount of work done on making sure these pieces of critical software would be as safe as they could possibly be. Note that the norm is 'a subset of C deemed to be safe' but that what I've seen of such development would not pass my personal threshold for quality work. In fact, rather the opposite. On the plus side, the hardware people usually know their stuff and realize what is dangerous to pass to the software people so with some luck your vehicle will use an FPGA for any kind of really safety critical stuff (or processors embedded with the relevant hardware, such as ABS and so on).
  - formerly_proven 3y ago

thomastjeffery 3y ago

Hackable does not mean crackable. The best security implementations in the world are free software. I'm not even a tiny bit convinced that making cars hackable would be a detriment to safety. Give me one example of that happening in literally any other sector.

svorakang 3y ago
You might have a point there, but I struggle to find any completely hackable product that is also safety-critical. Some airplane, nuclear reactor or some train, perhaps?
- jacquesm 3y ago
  Any old car will do.
  - DennisP 3y ago
    And new experimental aircraft, which are owner-built.

bboygravity 3y ago

Why would it (legally) be on the car manufacturer if someone hacks his own car and causes an accident because of modifications to the ECU (firmware)? This doesn't intuitively make sense to me. At the very least there are probably huge differences between countries when it comes to this? Aside from the fact that some people would likely love to modify their car in every way possible to use it on the racetrack or whatever private property?

jacquesm 3y ago
Or maybe to make it safer.

debatem1 3y ago

> I believe what I just wrote applies similarly for security too. Automotive security is nearly an oxymoron. The reasons for that are simple: the difficulty and expense of attacking a vehicle exceeds the bored grad student/curious tinkerer threshold, and the automotive industry has collectively the worst attitude towards security I've ever encountered. The depressingly predictable result is that third party automotive security testing is a sport reserved for people who are extremely disinterested in disclosing their methods to you, aka the actual attackers.

lo_zamoyski 3y ago

And someone could respond "Okay, fine, tampering with the onboard software voids the warranty and shifts responsibility to the tinkerer." But that's a liability issue. The safety concern is still there regardless of who is held responsible. A change that seems innocuous may, in fact, be breaking safety regulations. This is a big deal and a matter of public concern.

mikrotikker 3y ago
If you clutch those pearls any harder they'll turn to dust.

yjftsjthsd-h 3y ago

Okay, so for the moment leave aside the safety critical bits (only for a moment) - what's the excuse for not opening up the center console? That generally is already segregated and only handles non critical functions.

jacquesm 3y ago
Center consoles have been used quite successfully as beachheads by hackers to be able to get into more important systems because car manufacturers are typically utterly clueless when it comes to security. So obscurity is a very large part of their security. Of course that doesn't really work with the most motivated parties (car thieves and their captive techies) having a field day with this. Hyundai and Kia are reportedly so bad that they ended up paying out a large amount of money to compensate owners. https://www.reuters.com/legal/hyundai-kia-agree-200-million-settlement-over-car-thefts-lawyers-2023-05-18/ https://www.reuters.com/legal/hyundai-kia-agree-200-million-... But don't worry, it's been fixed now. Probably.
- yjftsjthsd-h 3y ago
  If it's security critical, it definitely needs to be FOSS and user patchable; obscurity is not a reasonable strategy.
  - jacquesm 3y ago
    Agreed, but that won't happen until some regulator wises up to this being a way to reduce vehicle theft considerably.

matheusmoreira 3y ago

> Allowing a random hacker to override this is a terrible idea. It should be a basic right no matter how "terrible" a idea it is. We bought it, we should have full control. Void the warranty or something.

dack 3y ago
I'm thinking through the ethics of this myself, but I think it's a reasonable argument that you can have the freedom to do what you want with things that you own _assuming you don't impact others_. The issue with a dangerous car is that it puts others at danger.
- jacquesm 3y ago
  Agreed, and that's an argument for open source, not against.
- matheusmoreira 3y ago
  Responsibility. If I modify my car and that's determined to be the causal factor of an accident, it's on me.
  - lm28469 3y ago
    That'll make the hypothetical parents of the hypothetical kid you just ran over very happy I'm sure. "I fucked up but it's on me!" and they lived happily ever after
    - jacquesm 3y ago
      Somebody please think of the children. Really, come on: you can do much better than this. The hypothetical kid might be the one that was saved because some random hacker figured out why the latest generation radar based cars keep phantom braking. That argument works both ways, and typically what is fixed stays fixed. And of course none of these hotshot programmers would ever be seen near the following bit of code[1], which probably impacted a lot of actual children and their health in a very direct way: // in case of an emissions test ensure that we pass // with flying colors if (emissions_test_detected()) { // we're sooo environmentally conscious lean_burn(); } else { // roll that coal regular_burn(); } [1] cribbed from VW/Porsche AG's internal repository ;)

pests 3y ago

> Even the window regulators have non-trivial implementation concerns for anti-pinch Tesla just got hit by this a few months back. They had to remove the auto roll-up-windows when you walk away after parking. Apparently they didn't have the sensors or hardware to do it safely.