Earlier quoted context omitted.
Based on?
Regional (Business) Cultural Norms
Interesting. Any research or other non-anecdotal sources you can point me to?
I hacked my car
81–90 of 142 posts
Re: I hacked my car
#82Most development at very large companies happens by hordes of people who call themselves developers but do not care about development and barely understand anything they are doing. Most coding happens by copying and pasting from Stack* and then restarting the application hundreds of times and tinkering with the code mindlessly until it happens to work. Anything besides getting the "happy path" (sic!) to work is a sec…
> most developers from Asia do not really expect or care about privacy and are super quick to drop any quality standards to meet deadlines
You started a hellish, tedious flamewar with this. That's exactly what we're trying to avoid here.
Please edit general putdowns, casual swipes, and flamebait out of your HN comments, and stick to what you can legitimately say from your own experience.
Re: I hacked my car
#83Most development at very large companies happens by hordes of people who call themselves developers but do not care about development and barely understand anything they are doing. Most coding happens by copying and pasting from Stack* and then restarting the application hundreds of times and tinkering with the code mindlessly until it happens to work. Anything besides getting the "happy path" (sic!) to work is a sec…
Amazing stuff here folks - this big brained developer just generalized a literal continent of billions of individual people and is the top comment on smart people site hacker news dot com
Please don't react to a bad comment by breaking the site guidelines yourself. It just makes everything worse.
Also, while I have you: can you please not use HN primarily for political/ideological arguments? It looks like that's what your account has been doing, and it's not the intended use of the site.
https://news.ycombinator.com/newsguidelines.html
https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
Re: I hacked my car
#84Don't expect much from a manufacturer who until recently didn't use immobilizers.
Well is that a bad thing? Seriously, all they do is make extremely expensive to make a copy of the keys if you loose one. If they want to steal your car, they do it anyway, especially with modern cars that are less safe than older one.
Re: I hacked my car
#85They say that I'm against progress when I say that I'm contrary to all this new things that are adding to cars since they are dangerous. And this article proves my point of view, if who made the software used publicly available encryption keys (one that knows what it's doing knows that to generate them with openssl you take 1 second) how can that software be trusted?
To me self-driving car and all that amount of stuff is simply dangerous, what if someone hacks a million of self-driving cars? What damage can he do? A disaster, worse than hacking a nuclear power plant... and I said coding standard for this kind of vehicle is not minimally comparable to the one of nuclear power plants. We are talking about people that till yesterday did program the offline car radio software that now are programming software that can take the control of the vehicle.
Re: I hacked my car
#86Don't expect much from a manufacturer who until recently didn't use immobilizers.
In what universe is 20+ years "recently"? Actually the Hyundai I had - with an immobilizer - was made in 1995 so 27 years. Is this American thing?
We had them that long too, just like card readers, we just didn't have laws requiring them. No Europe wasn't more advanced than Americans (and still aren't) but they did have better laws for the situation. So you can have that win I suppose.
Re: I hacked my car
#87They say that I'm against progress when I say that I'm contrary to all this new things that are adding to cars since they are dangerous. And this article proves my point of view, if who made the software used publicly available encryption keys (one that knows what it's doing knows that to generate them with openssl you take 1 second) how can that software be trusted? To me self-driving car and all that amount of stuf…
I've been involved with the software side at a few companies producing autonomous vehicles and took a look at SSG-39 to see how much better nuke standards are. They're pretty dang similar to automotive standards (UL4600, SOTIF, etc). The difference is in the regulatory environment and execution. Automotive software is not well-regulated and most OEMs don't think either the software or the people that produce it are worth investing in. I regularly have disagreements with systems folks about whether we should focus on actual sources of quality issues like memory safety or the checklist items that regulators are going to look at like whether the compiler is verified.
Re: I hacked my car
#88The Mac address part stood out to me, has something changed over the year that made changing Mac addresses more complex? Back in college our school had some limitations on the internal networks in our dorms. After doing my normal stuff (you know mega downloading,ftp, limewire etc) my net stopped working. Come to find out they had a bandwidth monitor and would just block you for some time if you used too much and had…
> has something changed over the year that made changing Mac addresses more complex? It just depends on what the driver/hardware lets you do. Some drivers don't support changing it and some hardware/firmware may just be built in a way that doesn't make changing it (easily) possible. Not being able to change it may be more of a WiFi thing though. I've had the displeasure of dealing with one of those cards. Not sure if…
Small shoutout to https://github.com/halo/LinkLiar
> This is an intuitive macOS status menu application written in Swift to help you spoof the MAC addresses of your Wi-Fi and Ethernet interfaces.
Re: I hacked my car
#89I worked on Infotainment for a number of years with an Automotive OEM. I’ve only ever heard insiders use the term IVI, so I’m curious if the author has some exposure to the industry. As for gaining access to the engineering, I’m interested that it was left in. We logged everything of course, but all of our engineering tools were removed during the build process. Essentially, our engineering mode was baked out.
I assume they intend for some of it to be used by dealerships (like firmware updates), which usually aren't done OTA.
Re: I hacked my car
#90One of the things I remember being discussed on m.d.s.policy not so long ago was making a registry (maybe handled by IANA) for example private keys. Turns out Peter Gutmann did the heavy lifting (thank you Peter) to turn that from idle discussion into a draft document: https://datatracker.ietf.org/doc/draft-gutmann-testkeys/ From the point of view of m.d.s.policy the main idea is to require CAs to reject these keys i…
We actually do this in our internal framework. All secrets (passwords, key material, etc) that we have in documentation and example projects are blacklisted for production in the framework itself and applications refuse to start.
Out of curiosity, do you have any tools/processes to avoid a situation like putting real secrets in new docs? Such as this popular story from 2017 [0]. And is there a way to automate publishing a test secret(s) to a doc and also send it to the blacklist?
[0] https://www.reddit.com/r/cscareerquestions/comments/6ez8ag/a...