5 ms·

To be honest, that is pure populism by the EFF. I am a supporter of EFF and against the DMCA. But that saying is BS. There are many different ECUs within a car

by PinguTS 11y ago

To be honest, that is pure populism by the EFF. I am a supporter of EFF and against the DMCA. But that saying is BS. There are many different ECUs within a car (about 40 in a current Volkswagen Golf). Does EFF really thinks that someone would have found that issue, when everything is OpenSource? Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. We have seen such things in lots of OpenSource software, just reminding of the now legendary Debian bug in the random number generator or Heartbleed and such things. How long where those bugs present? To find this wrongdoing by VW you don't need access to the car. Put a measuring device to the pipe and drive around. The question: why did the engineers implemented a detection of the test environment? Because you need to. You just have to apply a little bit of thinking your self. Such a car is equipped with lots of assistants like traction control, like crash detection, and so on. In a test environment you have your car running on a dynamometer or alike. That means the car detects, that 2 wheels run at 30 mph while 2 wheels are standing still and there is no acceleration. The car now has to classify that situation. The car has to decide if the front wheels are just spinning in the mud and traction control must be applied, or is it a valid situation. So there are lots of those things you have to consider during development and which are valid use cases. Of course this should not be misused.

scrollaway 11y ago
> Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. I would've been interested, and I don't even work in the field... Regardless, the EFF says "could", not "would". And they're right. This sort of code absolutely should have third party reviews. > The question: why did the engineers implemented a detection of the test environment? Yknow, maybe because they knew they didn't have to worry about people reviewing their code.
- PinguTS 11y ago
  >> The question: why did the engineers implemented a detection of the test environment? > Yknow, maybe because they knew they didn't have to worry about people reviewing their code. You read the rest of the comment? You NEED to detect it to apply to correct algorithms for all those safety assistants. Otherwise you could decide to just cool down when a door is open, when the front wheels are spinning, while there is no acceleration, when the distance sensors detect obstacles. But that would make testing impossible.
  - annnnd 11y ago
    The problem is not that they detect the test - the problem is that they modify parameters so that exhaust is within acceptable limits as imposed by law. Hiding this in open source code would be quite a feat (but not impossible [0]). [0] http://www.underhanded-c.org/ http://www.underhanded-c.org/
mkesper 11y ago
Those tests should also be abolished. We all know cars are relatively economic if you're able to ride them at 50km/h constantly. This has nothing to do with real life.
- PinguTS 11y ago
  Yes and no. Yes, it makes no sense to use them for real world. No, they provide a comparable environment to compare different models and different OEMs. It is the same difference like conformance testing and performance testing. A piece of software, a device, a system can be conform to a specification, but can have different performance in different situations.
- Reason077 11y ago
  They're not talking about access to source code here. The issue is whether it should be possible to legally analyze and reversing engineer the compiled binary code on such devices, which is currently not permitted under the DMCA.
IshKebab 11y ago
They didn't mention source code. And the Jeep Cherokee bug was found by analysing firmware, so it can happen. I agree in the case of emmissions it is easier just to measure them.
- PinguTS 11y ago
  First sentence in the article: "Automakers argue that it’s unlawful for independent researchers to look at the code that controls vehicles without the manufacturer’s permission."
  - 9mit3t2m9h9a 11y ago
    Automakers argue that to look at the _binary_ code of a car is a crime under DMCA.
Hermel 11y ago
> Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. I don't think so. There are plenty of car tuning enthusiasts that would find it very interesting to equip their cars with custom firmware.
hvidgaard 11y ago
A bug like heartbleed was not found because no got the idea of how to exploit it. Plenty of people and researches have read that code without seeing the bug. This case with VW, was to my knowledge not a bug, it was deliberately code to work that way. That is quite different from a subtle bug where you need to apply advanced statistical attacks to perform the exploit. Or a random generator bug that simply reduce the randomness. I'm absolutely positive that there is some enthusiasts, that would read and dissect every single line. But even if that wasn't the case, I'm even more certain that multiple competitors would, and this would be reported as fast as you can set up a meeting with the relevant authority.
titanomachy 11y ago
> Does EFF really thinks that someone would have found the issue, when everything is OpenSource? Volkswagen stock dropped massively (20% so far) since this announcement. If you discovered the bug and took a leveraged short position you could make an incredible amount of money.
dandelion_lover 11y ago
>>Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. Perhaps you underestimate peoples' curiosity. Even not so famous software is being checked [0]. [0] "Who actually reads the code?", https://www.fsf.org/blogs/community/who-actually-reads-the-code https://www.fsf.org/blogs/community/who-actually-reads-the-c...
joesmo 11y ago
I guarantee it'd be examined by at least a few VW owners who are interested, not to mention researchers and the government regulators themselves. Especially after this fiasco.

by PinguTS 11y ago

scrollaway 11y ago

> Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. I would've been interested, and I don't even work in the field... Regardless, the EFF says "could", not "would". And they're right. This sort of code absolutely should have third party reviews. > The question: why did the engineers implemented a detection of the test environment? Yknow, maybe because they knew they didn't have to worry about people reviewing their code.

PinguTS 11y ago
>> The question: why did the engineers implemented a detection of the test environment? > Yknow, maybe because they knew they didn't have to worry about people reviewing their code. You read the rest of the comment? You NEED to detect it to apply to correct algorithms for all those safety assistants. Otherwise you could decide to just cool down when a door is open, when the front wheels are spinning, while there is no acceleration, when the distance sensors detect obstacles. But that would make testing impossible.
- annnnd 11y ago
  The problem is not that they detect the test - the problem is that they modify parameters so that exhaust is within acceptable limits as imposed by law. Hiding this in open source code would be quite a feat (but not impossible [0]). [0] http://www.underhanded-c.org/ http://www.underhanded-c.org/

mkesper 11y ago

Those tests should also be abolished. We all know cars are relatively economic if you're able to ride them at 50km/h constantly. This has nothing to do with real life.

PinguTS 11y ago
Yes and no. Yes, it makes no sense to use them for real world. No, they provide a comparable environment to compare different models and different OEMs. It is the same difference like conformance testing and performance testing. A piece of software, a device, a system can be conform to a specification, but can have different performance in different situations.
Reason077 11y ago
They're not talking about access to source code here. The issue is whether it should be possible to legally analyze and reversing engineer the compiled binary code on such devices, which is currently not permitted under the DMCA.

IshKebab 11y ago

They didn't mention source code. And the Jeep Cherokee bug was found by analysing firmware, so it can happen. I agree in the case of emmissions it is easier just to measure them.

PinguTS 11y ago
First sentence in the article: "Automakers argue that it’s unlawful for independent researchers to look at the code that controls vehicles without the manufacturer’s permission."
- 9mit3t2m9h9a 11y ago
  Automakers argue that to look at the _binary_ code of a car is a crime under DMCA.

Hermel 11y ago

> Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. I don't think so. There are plenty of car tuning enthusiasts that would find it very interesting to equip their cars with custom firmware.

hvidgaard 11y ago

A bug like heartbleed was not found because no got the idea of how to exploit it. Plenty of people and researches have read that code without seeing the bug. This case with VW, was to my knowledge not a bug, it was deliberately code to work that way. That is quite different from a subtle bug where you need to apply advanced statistical attacks to perform the exploit. Or a random generator bug that simply reduce the randomness. I'm absolutely positive that there is some enthusiasts, that would read and dissect every single line. But even if that wasn't the case, I'm even more certain that multiple competitors would, and this would be reported as fast as you can set up a meeting with the relevant authority.

titanomachy 11y ago

> Does EFF really thinks that someone would have found the issue, when everything is OpenSource? Volkswagen stock dropped massively (20% so far) since this announcement. If you discovered the bug and took a leveraged short position you could make an incredible amount of money.

dandelion_lover 11y ago

>>Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. Perhaps you underestimate peoples' curiosity. Even not so famous software is being checked [0]. [0] "Who actually reads the code?", https://www.fsf.org/blogs/community/who-actually-reads-the-code https://www.fsf.org/blogs/community/who-actually-reads-the-c...

joesmo 11y ago

I guarantee it'd be examined by at least a few VW owners who are interested, not to mention researchers and the government regulators themselves. Especially after this fiasco.