Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Risk of unsafe software in automobiles?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 133 posts

Re: Ask HN: Risk of unsafe software in automobiles?

#121

Post by simonbarker87 »

userbinator wrote: post #80
simonbarker87 wrote: post #70

Thoughts from my wife who has worked in electrical and software for OEM automakers (high volume, luxury sport and start up) for 10 years: (I’m typing while she is, ironically, driving our Volvo) To answer your last question first, buy a car that hasn’t been launched within the last 12 to 18 months. That’s not software specific, that general vehicle safety across the board as they will be working through the initial w…

Nothing is perfect but the safety downsides of an old car are widely considered to be far greater than the threat of hacking or bad code in a new car. "widely considered" by the same industry who would love to sell you a new car...

I take your point but my definition of new in this case is "something under 4 years old or so" - basically a newer car. So you can totally buy a second hand car.

Re: Ask HN: Risk of unsafe software in automobiles?

#122

Post by vel0city »

eimrine wrote: post #120
vel0city wrote: post #98

Earlier quoted context omitted.

> Freedom includes doing things that others don't like --- and tolerating the opposite too. So I should tolerate people driving on public streets without insurance and without a license? I should tolerate people driving the wrong way on the highway? I should tolerate whatever emissions come from the tailpipe of someone's car? I should tolerate sompeone driving a car that nobody has touched the brakes on for a decade…

As far as I have understood, the previous commenter used to talk about FLOSS only (which is rather wise then not if you do value RMS' philosophy) and you have turned the discussion into absurd (kind of driving without license which has nothing to do with wiseness).

To me they brought it to that extreme when referencing authoritarian socialist dystopia when originally talking about carburetors. Hard to not see it going that direction about rights/freedoms when not having the ability to tune your carb means you're encouraging an authoritarian socialist dystopia.

Re: Ask HN: Risk of unsafe software in automobiles?

#123

Post by vel0city »

WirelessGigabit wrote: post #117
Tangurena2 wrote: post #55

Earlier quoted context omitted.

> someone accidentally stomping on both pedals when they meant to hit the brake This happens to me (sometimes) in parking lots where pedestrians walk between cars. Mine (2019 Mazda Miata) does not do this, instead I get an engine rev while standing half on brakes, half on accelerator, full on clutch. I end up feeling embarrassed as I tend to get glared at by the pedestrian ( no, I did not intentionally rev it to scar…

Wait what? You drive a manual and use the left foot to hit the brakes? Recipe for disaster.

Nah, their left is full on clutch, their right foot is between the accelerator and brake pressing both at the same time.

Re: Ask HN: Risk of unsafe software in automobiles?

#124

Post by eimrine »

vel0city wrote: post #122
eimrine wrote: post #120

Earlier quoted context omitted.

As far as I have understood, the previous commenter used to talk about FLOSS only (which is rather wise then not if you do value RMS' philosophy) and you have turned the discussion into absurd (kind of driving without license which has nothing to do with wiseness).

To me they brought it to that extreme when referencing authoritarian socialist dystopia when originally talking about carburetors. Hard to not see it going that direction about rights/freedoms when not having the ability to tune your carb means you're encouraging an authoritarian socialist dystopia.

It has been meant that there is no any car with FLOSS injector software. Every injector hardware devise has proprietary software. How on Earth can I drive an injector car if any proprietary software is not an option for me?

Re: Ask HN: Risk of unsafe software in automobiles?

#125

Post by vel0city »

eimrine wrote: post #124
vel0city wrote: post #122

Earlier quoted context omitted.

To me they brought it to that extreme when referencing authoritarian socialist dystopia when originally talking about carburetors. Hard to not see it going that direction about rights/freedoms when not having the ability to tune your carb means you're encouraging an authoritarian socialist dystopia.

It has been meant that there is no any car with FLOSS injector software. Every injector hardware devise has proprietary software. How on Earth can I drive an injector car if any proprietary software is not an option for me?

They weren't talking about FLOSS here. They weren't talking about free or proprietary software, they wanted no software

> Personally, I prefer no computer control.

They're not arguing for free software controlling their car, they're arguing for no software controlling the car. No software controlling the car means generally less safe cars with higher emissions on the road. Higher emissions hurt the people around them. Not having common safety systems like ABS and traction control make the cars harder to operate on normal roadways, leading to a higher likelihood of collisions.

They're arguing they should be free to operate less-safe cars which emit higher emissions on public roadways, and that everyone around should just accept it. Arguing otherwise is arguing for an authoritarian socialist dystopia.

Re: Ask HN: Risk of unsafe software in automobiles?

#126

Post by Tangurena2 »

vel0city wrote: post #123
WirelessGigabit wrote: post #117

Earlier quoted context omitted.

Wait what? You drive a manual and use the left foot to hit the brakes? Recipe for disaster.

Nah, their left is full on clutch, their right foot is between the accelerator and brake pressing both at the same time.

Correct. Left foot on the clutch as I was (in every one of these situations) backing out slowly. Then I see the pedestrian, lift foot off the gas and jam it on the brake. I guess, in my panic, I don't move the right foot far enough to the left (to get it fully off the gas pedal).

This is part of why I hate nose-in parking.

Re: Ask HN: Risk of unsafe software in automobiles?

#127

Post by uconnectlol »

slt2021 wrote: post #63

There is a risk of automobile security. Nowadays cars have vast attack surface and uplink accesses directly into internal car's CAN/Ethernet bus: OBD-II port, bluetooth, GSM/5G, WiFI, NFC, access via OEM's web portal (these are big piles of unsecure code), via mobile app API, dealer network applications. Plus OEMs have a vast parts and software supply chain that can be compromised. I suspect that in couple years time…

This is the correct take. Also just found yet another problem puiblished a few weeks ago: https://medium.com/@doctoreww/day-2-your-car-is-trackable-by...

This stuff falls completely within any infosec person's expectations. Privacy leaks are expected, as are interference from remote signals.

Re: Ask HN: Risk of unsafe software in automobiles?

#128

Post by uconnectlol »

protortyp wrote: post #10

If you're interested in this topic, you might want to check out ASRG[1]. It's a community of safety and security professionals in the industry working to improve standards. They share their research openly and have regular in-person and online events where you can reach out to people. [1] https://asrg.io/

It's sad that this and many other admirable movements like langsec will never amount to much because of the false dilemma that everything needs to be complicated because of "reasons" (politics, in automobiles, and "the poor user who needs a complicated to implement interface that changes every day" in the case of langsec). That is, most electronics in vehicles are obviously not needed, and if it was up to me infotainment would just be illegal aside from a basic physical knob to change volume of some audio in the 3.5mm jack (and not by sending a digital signal to a system that makes the user readjust it several times after the large input delay). I was being half serious but now that I think of it bluetooth and "smart" tech and such atrocities should just be illegal. They are like what's already accepted as illegal harmful Chinese products.

Re: Ask HN: Risk of unsafe software in automobiles?

#129

Post by eimrine »

vel0city wrote: post #125
eimrine wrote: post #124

Earlier quoted context omitted.

It has been meant that there is no any car with FLOSS injector software. Every injector hardware devise has proprietary software. How on Earth can I drive an injector car if any proprietary software is not an option for me?

They weren't talking about FLOSS here. They weren't talking about free or proprietary software, they wanted no software > Personally, I prefer no computer control. They're not arguing for free software controlling their car, they're arguing for no software controlling the car. No software controlling the car means generally less safe cars with higher emissions on the road. Higher emissions hurt the people around them…

> no software controlling the car.

I understand that my opinion is heavily biased to RMS' philosophy, but if looking the facts, we can see that if the car (engine controller, ABS, comfort controller, pesky notifications about belts/weather/maintenance) would be controlled by FLOSS it is controlled by user (not manufacturer) de-facto. All the cons of software just disappear in FLOSS: if you don't like the pesky notifications or anything else - you just remove few lines from the source code, recompile and replace the binary in your car.

I really prefer driving carburetor Volga with no software goodies just because there is no any car which has a software which let me use the software instead of being used by it. And I really prefer absence of modern safety like ABS if the safety is controlled by software manufacturer only. I know that my car has significant higher emissions (not to mention efficiency and safety) and I am a big fan of global warming movement but all I can do is to use my car as little as possible because using proprietary software is bigger sin for me than to poison our planet.

> They're arguing they should be free to operate less-safe cars which emit higher emissions on public roadways

I also talk about this, but in a slightly different way.

Re: Ask HN: Risk of unsafe software in automobiles?

#130

Post by aeonik »

simonbarker87 wrote: post #70

Thoughts from my wife who has worked in electrical and software for OEM automakers (high volume, luxury sport and start up) for 10 years: (I’m typing while she is, ironically, driving our Volvo) To answer your last question first, buy a car that hasn’t been launched within the last 12 to 18 months. That’s not software specific, that general vehicle safety across the board as they will be working through the initial w…

Cybersecurity is relatively new to the industry in a formal sense. I worked on helping the industry define SAE J3061 as detailed here. https://www.sae.org/standards/content/j3061_201601/

ISO 21434 came out a few years later. https://www.iso.org/standard/70918.html

This was all kicked off after the Jeep Hack. https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...

Overall the people in the field working on security these days seem to be excellent to me. They have crypto experts, kernel experts, and pretty good standards.

Before the Jeep Hack, they still took it seriously, but it was a lot of roll your own crypto types, and they didn't really know what they were doing.

Since then all the automotive companies hired and purchased companies from the traditional Cyber area and have trained up hybrid automotive and cybersecurity experts.

They still aren't perfect, but nobody really is, but cars these days have pretty cool tech in them.

If you are worried I'd recommend trying to hack your own car. You can learn a lot from it, and there are a lot of cool things you can do. In my experience, nothing alleviates fear better than a deep dive into a subject.

comma.ai for example have built an open source self-driving platform from hacking on the internals of vehicles. https://comma.ai/

Post reply on HN