A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats • Hacker News Board

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#11

Post by obstinate » Sun, May 28, 2017, 7:22 PM UTC

mabbo wrote: post #9

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. The…

You are correct. "Just following orders," is sometimes an understandable action (in the sense that I understand why someone might not want to refuse an order and risk their job), but that doesn't make it an excusable one.

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#12

Post by jancsika » Sun, May 28, 2017, 7:23 PM UTC

> Firmware images were gleaned from car-tuning forums and from an online portal maintained by Volkswagen for car repair shops. Documentation, in the form of so-called “function sheets,” was harder to come by. The function sheets were necessary to give the binary context, but the sheets are copyrighted by Bosch and generally not shared with the public. The research team ended up turning to the auto-performance tuning community again. These hard-core hobbyists and professionals share leaked function sheets so they can make aftermarket modifications to their cars.

This is crazy. And, as we move toward self-driving cars, dangerous.

Can someone point me to a well-regarded source in the industry that makes a cogent and convincing argument for why all the software running in a car (save maybe for the entertainment panel) should not be required to be open source?

To be clear: I'm not asking for speculation, or even an explanation from an expert based on years of experience. I'm asking for a publicly accessible reference based on research data that explains the security benefits of not releasing the source code for life-critical software in the car.

Edit: clarification

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#13

Post by ebbv » Sun, May 28, 2017, 7:25 PM UTC

mabbo wrote: post #9

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. The…

It depends how drastic. You are talking about people risking their careers. We all have our own moral standards to live by. Maybe they justified it by saying all the other car companies are doing the same thing (and by the way there are some indicators they did.)

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#14

Post by adrianN » Sun, May 28, 2017, 7:26 PM UTC

mabbo wrote: post #9

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. The…

It's imho not so clear cut whether this code is unethical or not. There is a legitimate argument that increasing NOx to reduce CO2 is better in the long term. Remember that the two are inversely related: the hotter and leaner your engine runs, the more NOx you produce, but your fuel efficiency also goes up.

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#15

Post by bosie » Sun, May 28, 2017, 7:26 PM UTC

mabbo wrote: post #9

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. The…

How do you know engineers were involved in writing the software? If there were engineers involved they should have said something if it does endanger the public. After all, it is in their responsibility/regulation to uphold the safety of the public.

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#16

Post by obstinate » Sun, May 28, 2017, 7:28 PM UTC

avar wrote: post #8

I may be missing something here, but if you take a step back this just seems like a tragedy of misaligned economic incentives. Both the US & EU would have wanted this information from day one, and this whole fiasco cost VW billions in fines. There would have been any number of engineers at VW and Bosch that knew exactly how this worked, but there was nothing in it for them to come clear about it. They were never goin…

I don't know for certain whether the concept of a bounty was considered, and if so why it was rejected. But I can think of a few possibly good reasons to not do this. For one thing, it could be thought of as rewarding the engineers who wrote the evil code, maybe even creating an incentive for engineers to add such code in the future. There are precedents for enforcement actions having the unintended consequence of causing more incidents. Another thing is that you may actually wish to prosecute the people who wrote the code, to serve as a disincentive to future engineers considering following management orders on a similar defeat device.

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#17

Post by lazyasciiart » Sun, May 28, 2017, 7:31 PM UTC

adrianN wrote: post #14

mabbo wrote: post #9

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. The…

It's imho not so clear cut whether this code is unethical or not. There is a legitimate argument that increasing NOx to reduce CO2 is better in the long term. Remember that the two are inversely related: the hotter and leaner your engine runs, the more NOx you produce, but your fuel efficiency also goes up.

In the long term, making their cars cause accidents that killed many people would reduce the environmental impact of humanity, so would also be arguably ethical by that logic.

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#18

Post by vinceguidry » Sun, May 28, 2017, 7:32 PM UTC

mabbo wrote: post #9

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. The…

The problem with this is that it localizes the consequences of defiance on the weakest part of the chain, all but guaranteeing failure. You can't even expect engineers to blow the whistle on their soon-to-be-former employer.

Ethics is about protecting the weak from the strong, not offering up the weak to get eaten by the strong. Only heroes put the good of the many over their own needs, and you can't expect everyone to be a hero.

Only within the safe, protecting bosom of a strong professional organization can we place moral obligations on workers. But it will never happen while the idea of a guild / union for software engineers is still anathema.

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#19

Post by rrhyne » Sun, May 28, 2017, 7:32 PM UTC

mabbo wrote: post #9

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. The…

If I were an evil VP tasked with creating this loop hole, I'd tell my project manager we needed a configurable system that let us control emissions for our intneral testing environments or some other plausible and legal requirement. I'd keep the knowledge of the system obscure and communication between dev, testing and deployment sparse. I'd then have only one person change the configuration before deployment. I'm sure it could be arranged so that no single engineer would realize that evil configuration was released and if they did, it could be excused as a mistake.

Re: A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

#20

Post by obstinate » Sun, May 28, 2017, 7:32 PM UTC

jancsika wrote: post #12

> Firmware images were gleaned from car-tuning forums and from an online portal maintained by Volkswagen for car repair shops. Documentation, in the form of so-called “function sheets,” was harder to come by. The function sheets were necessary to give the binary context, but the sheets are copyrighted by Bosch and generally not shared with the public. The research team ended up turning to the auto-performance tuning…

I would be very surprised if such a thing exists. Are there any industries, safety critical or otherwise, where the default is open source? If not, why would anyone think to justify the decision to not open source code, and especially why would anyone think to make such a memo or piece of research public?