Car companies are in a billion-dollar software war • Hacker News Board

Re: Car companies are in a billion-dollar software war

#21

Post by PeterStuer » Sun, May 11, 2025, 6:41 PM UTC

cosmicgadget wrote: post #4

> These legacy companies have poached big hitters from Apple, Tesla and Google. They’ve sunk billions into it. Part of the problem might be poaching high title people from embedded tech companies while not doing anything for developer compensation.

Old car is massive amounts of mechanotechnical engineering, with some software for keeping the beast under control and provide some basic entertainement.

New car is basically a computer on a simple chassis with an equally simple drive train. Software and battery tech is everything.

Re: Car companies are in a billion-dollar software war

#22

Post by miohtama » Sun, May 11, 2025, 6:45 PM UTC

School-Cotton wrote: post #11

AlotOfReading wrote: post #7

Earlier quoted context omitted.

It's not practical to produce a car that never needs updates. That would be a bug-free system, which is impossible. Since they're going to ship updates anyway, a lot of focus is on minimizing the cost and hence OTA. For what it's worth, I work in this industry and the general rule of thumb is that every increase in validation from QM (standard quality) up to the various levels of safety critical code has up to 10x th…

> It's not practical to produce a car that never needs updates Exactly that was done for decades.

But those cars are no longer competitive. There is only a marginal buyer group who wants to drive these "bricks", which would also unlikely pass the requirements set for new cars.

Re: Car companies are in a billion-dollar software war

#23

Post by gjsman-1000 » Sun, May 11, 2025, 6:46 PM UTC

rjsw wrote: post #19

AlotOfReading wrote: post #7

Earlier quoted context omitted.

It's not practical to produce a car that never needs updates. That would be a bug-free system, which is impossible. Since they're going to ship updates anyway, a lot of focus is on minimizing the cost and hence OTA. For what it's worth, I work in this industry and the general rule of thumb is that every increase in validation from QM (standard quality) up to the various levels of safety critical code has up to 10x th…

Updating the software in the computers that control the car has traditionally been combined with providing diagnostic support for it through the dealerships, not done OTA. Having an OBDII connector has been mandated in vehicles for a long time, you plug something into it that lets you either listen to CAN bus traffic or reprogram an individual Electronic Control Unit (ECU). Now that all vehicles have entertainment sy…

> The first use case of connecting entertainment systems to a vehicle bus that I can remember was to read some engine settings and turn up the volume on the radio at higher speeds.

Is anyone actually begging for this though? And why do you need a full bus? This feels like a luxury car problem that could be solved over I2C or something.

I’m reading this whole SDV thing, and outside of using less ECUs, it seems like an overengineered solution to what was hardly a problem. If we can update ECUs already with OBD-II, step 1 is just making a virtualized OBD-II port that the infotainment system can talk to. Everything else can then stay unchanged until later.

Re: Car companies are in a billion-dollar software war

#24

Post by kjkjadksj » Sun, May 11, 2025, 6:46 PM UTC

Jiocus wrote: post #10

The author mentions "military grade firewall", as a must have in a vehicle. Genuine question; What's a military grade firewall?

A stupid requirement.

Consider this. Almost every car on the road today has an unsecured bus going back to like the 1980s. However you need to actually access the car to do something malicious so the threat vector is zero; since if you have access to the car you can also just cut brakes or put in a pipe bomb.

The only reason why this paradigm changes in the EV era is because the insistence on having EVs phone home. Now you can concievably hack all EVs of this model at once and that is now realistic and even attractive to do. But again not a necessity for running a car. Just something that modern software focused companies want to see that leads to a host of expensive security issues that didn’t exist before. The car could be airgapped with the dealer network used to flash software updates like they do with most other cars before EV era.

Re: Car companies are in a billion-dollar software war

#25

Post by bronson » Sun, May 11, 2025, 6:47 PM UTC

School-Cotton wrote: post #11

AlotOfReading wrote: post #7

Earlier quoted context omitted.

It's not practical to produce a car that never needs updates. That would be a bug-free system, which is impossible. Since they're going to ship updates anyway, a lot of focus is on minimizing the cost and hence OTA. For what it's worth, I work in this industry and the general rule of thumb is that every increase in validation from QM (standard quality) up to the various levels of safety critical code has up to 10x th…

> It's not practical to produce a car that never needs updates Exactly that was done for decades.

Until 1994, the year of the first software-only recall, maybe. Things have changed.

Heck, manufacturers were issuing service bulletins to fix the fuel maps in their cars in the 1980s.

Re: Car companies are in a billion-dollar software war

#26

Post by AlotOfReading » Sun, May 11, 2025, 6:47 PM UTC

School-Cotton wrote: post #11

AlotOfReading wrote: post #7

Earlier quoted context omitted.

It's not practical to produce a car that never needs updates. That would be a bug-free system, which is impossible. Since they're going to ship updates anyway, a lot of focus is on minimizing the cost and hence OTA. For what it's worth, I work in this industry and the general rule of thumb is that every increase in validation from QM (standard quality) up to the various levels of safety critical code has up to 10x th…

> It's not practical to produce a car that never needs updates Exactly that was done for decades.

It was not. Recalls have included software updates (sometimes via component replacement) since ECUs became common in the 1980s. Reverse engineering the binaries and flashing updated parameters is actually how ECU tuning used to be done.

Re: Car companies are in a billion-dollar software war

#27

Post by [deleted] » Sun, May 11, 2025, 6:47 PM UTC

School-Cotton wrote: post #11

AlotOfReading wrote: post #7

Earlier quoted context omitted.

It's not practical to produce a car that never needs updates. That would be a bug-free system, which is impossible. Since they're going to ship updates anyway, a lot of focus is on minimizing the cost and hence OTA. For what it's worth, I work in this industry and the general rule of thumb is that every increase in validation from QM (standard quality) up to the various levels of safety critical code has up to 10x th…

> It's not practical to produce a car that never needs updates Exactly that was done for decades.

[deleted]

Re: Car companies are in a billion-dollar software war

#28

Post by maldev » Sun, May 11, 2025, 6:49 PM UTC

tonetegeatinst wrote: post #15

FrankWilhoit wrote: post #2

Embedded-systems programming is not taught, and no one is willing to pay for training. The result is that development is outsourced to entities that claim, falsely, to have the knowledge. Eventually the consequences of the fact that they do not have the knowledge surface in an undeniable manner, and the only way to cover is to make a great show of a fresh start. (This affects all industries, not just automotive, but…

This is all the more frustrating as I'm in the security side if IT, and have been trying to teach myself C and assembly for embedded development and understanding how malware and vulnerability exist in this ecosystem and how I can help address these issues.

You can find router firmware sourcecode online and find pretty egregious vulnerabilities if you're really trying to learn.

Alot of embedded stuff is outsourced and doesn't want to waste the computing power for stuff like stack canaries. I recall the following from making a tool for a dlink? router?

//Reads a file name foo ReadFilePath() { // Get file name // TICKET 21321: Fixed crash by increasing buffer size char FilePath[100]; ReadFileName(&FilePath); }

It sticks out to me, since the crash was clearly from a buffer overflow, and they had this documented in the source code that increasing the buffer size fixes it. What they didn't realize was that the bug would still happen and you could get a buffer overflow from this and do whatever you wanted. This is the level of programmer you're dealing with who's writing embedded software in an overseas sweatshop. And the talent isn't even there domestically since they're severely underpaid compared to someone writing simple javascript.

Re: Car companies are in a billion-dollar software war

#29

Post by tcmart14 » Sun, May 11, 2025, 6:49 PM UTC

FrankWilhoit wrote: post #2

Embedded-systems programming is not taught, and no one is willing to pay for training. The result is that development is outsourced to entities that claim, falsely, to have the knowledge. Eventually the consequences of the fact that they do not have the knowledge surface in an undeniable manner, and the only way to cover is to make a great show of a fresh start. (This affects all industries, not just automotive, but…

I took an embedded course in university where we programmed the AVR AtMega 328p on the Arduino UNO not using the Arduino libraries and compiler. Make files and setting up an environment.

But yea, a single class probably isn't sufficient and also I image a lot of embedded companies have a preference to hire someone already familiar with the chip they are targeting and the toolchain for the stack. I also see a lot of asking for experience with RTOS, which in my class, we didn't use an RTOS.

Re: Car companies are in a billion-dollar software war

#30

Post by smartmic » Sun, May 11, 2025, 6:51 PM UTC

So I have serious thoughts about driving “software defined vehicles” in the future. I mean, and the article has confirmed this sufficiently, the core competence of the established car manufacturers is not software. I don't trust the newcomers like Tesla or the Chinese manufacturers for the time being. In my opinion, the same standards should apply to software in motor vehicles as in the aviation industry. And there can't be things like permanent internet connectivity, on-the-fly updates or anything else that is suitable for consumer entertainment devices. So I'm seriously considering whether my next car should be an “analog” one - but it's going to be difficult, a Lada [1] (not so exotic in Germany, where I live) is only available second-hand because of the Russia sanctions. I'm happy to accept alternative suggestions!

[1] https://en.wikipedia.org/wiki/Lada_Niva