3 ms·

If they took this seriously, they wouldn't have their cars connect to anything, or at the very least, the connected parts would be fully air-gapped. How is it

If they took this seriously, they wouldn't have their cars connect to anything, or at the very least, the connected parts would be fully air-gapped. How is it that we can be repeating the exact same mistakes made in software over the past 40 years, without anyone questioning whether the dangers of cloud-enabling cars is remotely justified by the features provided?

chambo622 11y ago
What makes you think that nobody is questioning it? I'm sure some people are, but the fact that informed consumers are purchasing these cars speaks for itself.
- teacup50 11y ago
  What does that fact speak for?
  - chambo622 11y ago
    It indicates that "the dangers of cloud-enabling cars" are in fact "justified by the features provided" for a nontrivial number of people.
    - teacup50 11y ago
      That's a nonsensically trivial analysis: 1) The features provided by Tesla extend far beyond those provided by "cloud-enablement"; the fact that "informed consumers" are buying the cars does not indicate that their purchasing decision came down to isolating cloud-enablement relative to cloud-features. 2) Your hypothetical informed consumers don't really exist, unless the only people buying cloud-enabled cars are computer scientists.
      - chambo622 11y ago
        1) Sure - it's one factor among many in the purchasing decision. Never said otherwise. It would also be incorrect to assume that this was not a factor at all. 2) Ever looked at a tech company parking lot in South Bay? A lot of people with CS background are buying the Model S. Not all buyers are computer scientists but informed buyers most definitely do exist.
- Silhouette 11y ago
  How do we know how well-informed or otherwise the people purchasing these vehicles are? There are relatively few people in the world who fully appreciate the implications of security issues and who can make rational risk assessments and take reasonable measures to limit those risks. Of course, even being informed isn't going to help if this sort of poorly secured connectivity becomes the norm for new vehicles, which seems to be happening disturbingly quickly. If you rely on the independence offered by having a car but all cars have similar dangers, you might have only bad alternatives to choose between, but they're still bad. [Edit: That last sentence was ambiguous. My intended meaning was that the alternatives to using a car at all might also be bad, for example incurring significant costs and disruption moving to live somewhere with viable public transport instead.]
maratd 11y ago
> anyone questioning whether the dangers of cloud-enabling So let me get this straight ... They were able to plug in a laptop into the car and gain control. In fact, physical access is necessary. Tesla used the cloud connected features to update the software, removing the physical vulnerability. Yes, the connected nature of the car is an attack vector. But it seems there are other attack vectors which are far worse and the connected nature can be used to protect the vehicle.
- Silhouette 11y ago
  Yes, the connected nature of the car is an attack vector. But it seems there are other attack vectors which are far worse and the connected nature can be used to protect the vehicle. We need to be careful with this kind of risk assessment. If Microsoft or Google messes up a Windows or Chrome update that is automatically installed, or a malicious actor compromises the update mechanism, maybe a few thousand PCs belonging to people who accepted the risk get broken and there will be some hassle restoring normal functionality afterwards. If a car manufacturer messes up a firmware over-the-air update that is automatically installed, or a malicious actor compromises the update mechanism, maybe a few thousand cars belonging to people who accepted the risk get run into walls at 100mph. It is far from clear that providing a mechanism for remotely initiated updates of fundamental system software is a win in this context. As we've seen with automatically updating PC software in recent years, not all updates work as intended, and as we've seen with modern malware, reprogrammable firmware is not always a blessing.

chambo622 11y ago

What makes you think that nobody is questioning it? I'm sure some people are, but the fact that informed consumers are purchasing these cars speaks for itself.

teacup50 11y ago
What does that fact speak for?
- chambo622 11y ago
  It indicates that "the dangers of cloud-enabling cars" are in fact "justified by the features provided" for a nontrivial number of people.
  - teacup50 11y ago
    That's a nonsensically trivial analysis: 1) The features provided by Tesla extend far beyond those provided by "cloud-enablement"; the fact that "informed consumers" are buying the cars does not indicate that their purchasing decision came down to isolating cloud-enablement relative to cloud-features. 2) Your hypothetical informed consumers don't really exist, unless the only people buying cloud-enabled cars are computer scientists.
    - chambo622 11y ago
      1) Sure - it's one factor among many in the purchasing decision. Never said otherwise. It would also be incorrect to assume that this was not a factor at all. 2) Ever looked at a tech company parking lot in South Bay? A lot of people with CS background are buying the Model S. Not all buyers are computer scientists but informed buyers most definitely do exist.
Silhouette 11y ago
How do we know how well-informed or otherwise the people purchasing these vehicles are? There are relatively few people in the world who fully appreciate the implications of security issues and who can make rational risk assessments and take reasonable measures to limit those risks. Of course, even being informed isn't going to help if this sort of poorly secured connectivity becomes the norm for new vehicles, which seems to be happening disturbingly quickly. If you rely on the independence offered by having a car but all cars have similar dangers, you might have only bad alternatives to choose between, but they're still bad. [Edit: That last sentence was ambiguous. My intended meaning was that the alternatives to using a car at all might also be bad, for example incurring significant costs and disruption moving to live somewhere with viable public transport instead.]

maratd 11y ago

> anyone questioning whether the dangers of cloud-enabling So let me get this straight ... They were able to plug in a laptop into the car and gain control. In fact, physical access is necessary. Tesla used the cloud connected features to update the software, removing the physical vulnerability. Yes, the connected nature of the car is an attack vector. But it seems there are other attack vectors which are far worse and the connected nature can be used to protect the vehicle.

Silhouette 11y ago
Yes, the connected nature of the car is an attack vector. But it seems there are other attack vectors which are far worse and the connected nature can be used to protect the vehicle. We need to be careful with this kind of risk assessment. If Microsoft or Google messes up a Windows or Chrome update that is automatically installed, or a malicious actor compromises the update mechanism, maybe a few thousand PCs belonging to people who accepted the risk get broken and there will be some hassle restoring normal functionality afterwards. If a car manufacturer messes up a firmware over-the-air update that is automatically installed, or a malicious actor compromises the update mechanism, maybe a few thousand cars belonging to people who accepted the risk get run into walls at 100mph. It is far from clear that providing a mechanism for remotely initiated updates of fundamental system software is a win in this context. As we've seen with automatically updating PC software in recent years, not all updates work as intended, and as we've seen with modern malware, reprogrammable firmware is not always a blessing.