Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automakers try to scuttle Massachusetts ‘right to repair’ law

techdirt.com

Post reply on HN
Print view View original

21–30 of 137 posts

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#21

Post by 1970-01-01 »

RealityVoid wrote: post #4

Current cybersecurity standards enforced in the automotive industry will probably completely kill the possibility of after-market car parts and the usage of used parts in cars. I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.

It's an ongoing battle. Giants such as the FTC are able and willing to fight these battles. Other large orgs such as SEMA are also pushing back, for both the right to repair and the right to modify. Additionally, OEMs don't want us to realize how they are putting themselves on top of a slippery slope. If we look at the NACS example, when one or two break away from a 'gentleman's alliance' it quickly creates a domino effect.

https://www.ftc.gov/system/files/documents/reports/nixing-fi...

https://www.sema.org/news-media/enews/2023/28/right-repair-a...

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#22

Post by hooverd »

RealityVoid wrote: post #8
technofiend wrote: post #5

Earlier quoted context omitted.

From the article: "federal regulators claim that malevolent third parties could "utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently." Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity? If so, that's the real problem. The vulnerabilities described should not be there in the…

It's an open secret in the industry that the CAN bus is not authenticated. If you connect, you can read the data on the bus and inject the data on bus. But, that does require physical access to the car and hooking to the wires. Nobody complains that if you hook to the buses on a PC you can own it. Now they have this security concept where every ECU on the car will have their own private key in their own secure enclav…

I hate computers. Seems like lately they're only used to make our lives worse.

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#24

Post by lifeisstillgood »

tkfu wrote: post #10
technofiend wrote: post #5

Earlier quoted context omitted.

From the article: "federal regulators claim that malevolent third parties could "utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently." Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity? If so, that's the real problem. The vulnerabilities described should not be there in the…

It's not about security by obscurity. A better analogy would be the fight over "tivoization". In safety-critical and highly-regulated systems like automotive and health care, there's a meaningful regulatory interest in ensuring that the devices as sold and authorized to be on the road (or in patients' hospital rooms) don't get modified in dangerous ways. That means that the software and firmware running on each of th…

Could you expand, or point to a good primer on the issues?

I love "it's a complicated trade off" - it's way more interesting than whatever slogans end up defining "sides" in a debate

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#25

Post by VectorLock »

Loughla wrote: post #7
forgetfreeman wrote: post #6

Here's a hot take: legislate an airgap between operation control and infotainment/convenience horseshit.

Exactly. The infotainment bullshit should be in zero way connected to the actual operation of the vehicle. There is zero reason why the laggy, nonsensical software that controls my radio should control my engine. Someone correct me if I am wrong, please.

Because people want things like remote start, remote climate control, etc. that they can control from phone apps.

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#26

Post by VectorLock »

axus wrote: post #23

The car keys should probably contain the master private key , and the mechanic could use that to authorize third-party components and modifications to the car.

There is no simple and secure technical reason car makers can't do this, they just want to fight it because they make tons of money off making fragile cars, charging exorbitant fees at their dealers service department and for parts, and they see MA's Right to Repair bill as a threat to their revenue stream and how much they can extract from customers while providing no value back to them.

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#27

Post by VectorLock »

RealityVoid wrote: post #11
harambae wrote: post #9

Earlier quoted context omitted.

I also work in the industry and tend to agree. Right now if you get an official replacement ECU on a secured CAN network the device comes from the OEM already set up with the matching SecOC (AES-128) key that the OEM recorded in their backend database at time of manufacturing. But how would this work with a 3rd party ECU?

I suspect that auto makers are fully aware of this and are salivating at the idea of extra income with upgrade and repair fees. So far this has eluded public consciousness, but I expect it will hit the users hard at some point in the near future.

"Authorized parts" and "Authorized repair centers only" would be allow them to extract massive profits while providing no consumer benefit. That then incentivizes them to create even more fragile, unreliable vehicles.

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#28

Post by forgetfreeman »

VectorLock wrote: post #25
Loughla wrote: post #7

Earlier quoted context omitted.

Exactly. The infotainment bullshit should be in zero way connected to the actual operation of the vehicle. There is zero reason why the laggy, nonsensical software that controls my radio should control my engine. Someone correct me if I am wrong, please.

Because people want things like remote start, remote climate control, etc. that they can control from phone apps.

Do they though? I mean if it's there sure people will mess with it but I don't recall any public outcry for either center dash ADHD factories or keyless anything.

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#29

Post by vlovich123 »

markdeloura wrote: post #18

Insurance companies should get behind Right to Repair. We've so far waited three months and have an $11,0000 price tag to the insurance company on a minor collision that bent our car's front fascia and broke a sensor -- no frame or metal damage. I would have happily repaired on my own if possible just to avoid being without the car for so long. If only I could get those parts and have a decent service manual.

Insurance companies (of any kind) are not incentivized to find the cheapest service. Anything they pay out is passed on via premiums. Indeed, the more expensive service is better because a 2% profit on $1000 makes them 10x more profit than 2% profit on $100.

There’s some competition here in that a marketplace of insurance companies can compete on the premiums so there can be downward pressure, sometimes. But for things that impact all insurance companies like this equally, then insurance companies would also be opposed because more expensive repairs = more money in their pocket.

That’s why you see things like medical insurance not being aligned with lowering medical costs.

Re: Automakers try to scuttle Massachusetts ‘right to repair’ law

#30

Post by speed_spread »

markdeloura wrote: post #18

Insurance companies should get behind Right to Repair. We've so far waited three months and have an $11,0000 price tag to the insurance company on a minor collision that bent our car's front fascia and broke a sensor -- no frame or metal damage. I would have happily repaired on my own if possible just to avoid being without the car for so long. If only I could get those parts and have a decent service manual.

Insurance companies will just follow the money like they do in (USA) healthcare. Expensive repairs create a world where there are two kind of people, those who are insured, and those who aren't. A high cost of repair guarantees you _really_ don't want to be in the latter group, so you'll pay whatever is asked to be in the first part. On their end, the insurance companies will use their weight to negotiate much lower prices on parts and service, increasing their margins.
Post reply on HN