Live data from Hacker News

Ask HN: Risk of unsafe software in automobiles?

news.ycombinator.com

101–110 of 133 posts

Re: Ask HN: Risk of unsafe software in automobiles?

#101
post #47

Earlier quoted context omitted.

Iso26262 is the safety standard (a slimmed down version of industrial standard by the way). misra are the coding rules recommended to apply for these standard. Autosar is an OS definition to make modular SW

Autosar is a horrible horrible standard that makes SW worse. I am of the oppinion that AUTOSAR based systems are _worse_ and less safe because of it. The API itself is decent but the configuration and the ecosystem is a nightmare.

Working on a ECU that at some point during the development had to switch to Autosar, I cannot agree more on this.

Re: Ask HN: Risk of unsafe software in automobiles?

#102
Vehicle software faults are pretty far down the injury risk depth chart.

Once you've committed to never driving after having had a drink (and surely never more than 1 drink), never driving while tired or on medication, have completed several advanced driving courses/car control clinics, chosen the top cars based on safety and crash testing, only then might it make sense to use software development methods as a tie-breaker to pick a car.

Re: Ask HN: Risk of unsafe software in automobiles?

#103

So the answer is yes, and no. > https://illmatics.com/carhacking.html is a good starting point. But there are a bunch of buses on a modern car, some of them are critical, some less so. Some are firewalled off, others are open. As you know you can get access to a lot of the car's inner workings by plugging into the ODB2 port. Its perfectly possible to brick some cars by fuzzing the ODB2 port. In principle, most things…

OBD is a diagnostic bus. On modern car the access is authenticated on several layers (eg. guest, carmaker, ECU supplier). I would not call that interesting. Accessing a CAN/FlexRay/LIN/Eth bus is better.

Re: Ask HN: Risk of unsafe software in automobiles?

#104
post #51

Earlier quoted context omitted.

I've been out of automotive safety critical software (engine, brake, controllers, etc...) but still have friends in it. Proper best practice is still followed by the likes of Toyota, Jaguar and Ford as the ones I've had experience in. That means the coding standards mentioned. Full requirements->design->implementation with functional unit testing, module unit testing and system testing including using simulators. Mul…

Strange you mention Toyota as manufacturer, as they are the one who fucked up with the unintended acceleration issue mentioned earlier. The thing is that they "forgot" to implement the mechanism which ignore gas pedal when both brake and gas pedal are pressed. This was a recommended safety feature for accelerator by wire implementation (egas norm). Then a few years later they got hit again with one of their suppliers…

Apparently they are still killing people. If owners don't get the airbags replaced, the cars should be impounded.

I just read a story where someone borrowed a car with a Takata airbag in it and was killed.

Re: Ask HN: Risk of unsafe software in automobiles?

#105
post #44

1. Cars have had computers in them for a very long time now. 2. The code, in many cases, is probably an unmaintainable mess. Embedded programming is not always modern programming, for good and bad. 3. Today, the computers in cars are doing more, and the systems are more complex. It's reasonable to expect more serious problems as a result. 4. Companies do safety testing, of course, but there's no such thing as as "100…

Your comment is pretty accurate. Just remove "probably" from point 2.

Re: Ask HN: Risk of unsafe software in automobiles?

#106
post #7

Your link of Sudden unintended acceleration contains a lot of entries related to this issue which don't involve computers at all. It lists pedal misapplication, entrapped pedals, stuck throttles, electrical shorts, and diesel engine runaway as other things which can cause such an issue. A lot of the reported incidents had nothing to do with software. Either way, if you've had a fuel injected car you were still expose…

> It lists pedal misapplication, entrapped pedals, stuck throttles, electrical shorts, and diesel engine runaway as other things which can cause such an issue. And modern cars are much better at handling these types of scenarios. For example, in my late model car, if you apply the accelerator and brake at the same time, the vehicle will ignore the accelerator input. This solves two potential problems from the past: s…

Yeah; my VW Golf does that. Makes it hard to warm up the brakes in icy/condensing weather.

Re: Ask HN: Risk of unsafe software in automobiles?

#107
If it has software in it, it's bad.

As a hacker like any other who realized that all supposedly ultra safe American quality (TM) software in mission critical applications is in fact less secure on average than random amateur projects, I have been worried about software in vehicles for 20 years. I correctly predicted that it will lead to remote control vulnerabilities such as the uConnect vulnerability disclosed a decade later. There are obviously more of such vulnerabilities out there, just nobody is researching this. I also suggest people start looking at HVAC.

In 2015, some security researchers found a vulnerability in the Chrysler Uconnect software which allowed them to connect to the car's IP address (yes, each car had an IP address, which you can't get rid of), and control the vehicle (as in actually control it). There were 1.5 million vehicles IIRC that were vulnerable to this. So if a bad guy found it first he could have controlled all those vehicles at once from the comfort of his home, probably causing 10% of them to crash and kill people (given that 1/10 of your average modern driver would probably panic (or not panic but still fuck up) from the slightest surprise on the road).

I also am of the opinion that people regularly die from software faults in vehicles, but we just haven't figured this out yet.

What is NASA/JPL rules? Some more misra C crap where it's just making the code more "readable"? Most "software engineers" have extremely wide gaps in their understandings of basic things from programming, to math, to physics. The problem has much more to do with this than cute little best practices recommendations.

Re: Ask HN: Risk of unsafe software in automobiles?

#108
post #7

Your link of Sudden unintended acceleration contains a lot of entries related to this issue which don't involve computers at all. It lists pedal misapplication, entrapped pedals, stuck throttles, electrical shorts, and diesel engine runaway as other things which can cause such an issue. A lot of the reported incidents had nothing to do with software. Either way, if you've had a fuel injected car you were still expose…

Yeah yeah, we had to get ECUs because of "problems". It's like how the terrible half working google captcha I get here for signing up with Tor is because "AI breaks text now". In reality it's just a bunch of lazy people going with the flow.

> reduce harmful emissions which hurt my family and my neighbors.

If there was a true problem it could be solved by having less kids. Why do you end your sentence with this dipshit way of arguing? Nobody falls for that. Of course we all know the game here is for someone to call you out being a passive aggressive dipshit and play the victim once that happens.

Re: Ask HN: Risk of unsafe software in automobiles?

#109

Thoughts from my wife who has worked in electrical and software for OEM automakers (high volume, luxury sport and start up) for 10 years: (I’m typing while she is, ironically, driving our Volvo) To answer your last question first, buy a car that hasn’t been launched within the last 12 to 18 months. That’s not software specific, that general vehicle safety across the board as they will be working through the initial w…

> Lives are on the line and the type of devs who work in this field know that.

That wasn't enough to prevent the Uconnect disaster of a bug that only existed because they sold out on two occasions: when ECUs were invented (green and performance marketing), when smart crap was bundled into cars (smart being a word that universally means ostensibly convenient but in practice even layman consumers hate it).

Re: Ask HN: Risk of unsafe software in automobiles?

#110

ISO 26262 is the functional safety standard that automobile manufacturers adhere to. Furthermore, companies with a strong safety culture may also have other safety controls, including MISRA, AUTOSAR, and others. I think reputable car companies take this stuff very seriously, but your concern is also well placed.

I don't know why you would ever think a company takes stuff seriously (well I do, patriotism). What was Dieselgate? Companies are identityless auotmata which simply run amuck until Murphy's Law causes regulators to force them to change.
Post reply on HN