5 ms·

Well, what you're saying is that they wouldn't open source it voluntarily. This is why we have regulations: to make people and companies do things that they wou

Well, what you're saying is that they wouldn't open source it voluntarily. This is why we have regulations: to make people and companies do things that they wouldn't do voluntarily.

radiorental 11y ago
But isn't this analogous to asking Microsoft to open source their OS because of vulnerabilities. I do not disagree with you. These are safety critical systems, I just don't see how companies could be forced to share IP. What is more likely in my view is something similar to the validation standards in aviation: https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B
- msandford 11y ago
  Yes it is. And if hundreds or thousands of people had died from windows vulnerabilities and tremendous environmental damage had been done, that might well have happened. Most of the security breaches are due to people doing stuff really wrong not just a late patch. And even then I haven't heard of anyone dying as a result yet. People have probably died (if you believe public health stats) as a result of increased NOx production of these vehicles. There's also been a lot more pollution. Big, big pollution problems have caused substantial changes to things, like the creation of the EPA here in the US.
  - gambiting 11y ago
    >>if hundreds or thousands of people had died from windows vulnerabilities and tremendous environmental damage had been done Then people would stop using Windows, simple as that.
    - nmrm2 11y ago
      Just like people stop mining for coal or iron when it causes loss of life and environmental damage? The people being harmed by software vulnerabilities are rarely the people who made an informed decision to use a certain piece of software. People who shop at Target can't meaningfully be said to make a choice to trust Target's software -- it's not something the average consumer things about. So although "should" is an understandable prescription, "would" is a bit unrealistic...
      - gambiting 11y ago
        If there were any alternatives to coal or iron that wouldn't cause as large loss of life, then we would have switched to those. If you find out your car is unsafe to use, you switch to a different one, because other cars offer similar functionality - the same with Windows, if it was so full of bugs that it was an actual danger to use, then people would simply switch to Linux,*BSD or MacOS, it's not like there are no alternatives.
        nmrm2 11y ago
        The behavior you're describing is disproved by history. People use demonstrably insecure products that are insecure all the time, even when great secure alternatives exist. Even speaking theoretically, the behavior you're describing isn't even an accurate description of how rational actors without resource constraints and with perfect knowledge would behave (because e.g. there are qualities aside from security and safety that might make it impossible to use an alternative product, and there might be qualities that are impossible to measure directly). And anyways, all three of those assumptions are clearly out-of-touch with reality. Specifically wrt automobile software: * Even with public access to source code, it's impossibly expensive for the average consumer (even the average software engineer; hell, even the average automotive engineer) to make a decision with truly perfect knowledge. Any number of safety constraints boil down to intractable questions if code is designed in a way that isn't amenable to inspection. So even in a purely theoretical setting with completely rational actors, making a fully informed decision might just not be possible. * Many consumers will overlook errors in previous products and plausible errors in current products; Toyota's brand is doing just fine despite the findings of experts in the UA case. And I bet a lot of the software on cars that have sold even this year has some of the same structural problems, because based upon the expert testimony, a lot of that code probably needed to be essentially rewritten, and it's highly unlikely that they've achieved that in a year or two.
        ethbro 11y ago
        The difference, to play da, is that both of your points get solved with greater transparency. Is Linux more secure because everyone (quiet, Gentoo crowd) audits their own source? No, it's more secure because: Anyone can choose to audit the source with minimal roadblocks. Anyone who thinks they've found an issue can trumpet it from the rooftops. Together, this means that even though I might not line-by-line audit my system, I can (with varying levels of paranoia / assurance) obtain a system that I have confidence others have audited. And furthermore, if there are issues found in the future then I can be reasonably sure of hearing about them. Neither of these benefits is possible with closed source embedded systems. (Or, from article "Ninety-nine percent of the buyers would never read anything. But out of the 11 million people whose car was cheating, one of them would have found it,” he said. “And Volkswagen would have been caught in 2009, not 2015.”)
- CWood1 11y ago
  This raises a point that has confused me for a long time. Aerospace engineering is known for its track record of safety (not to say incidents don't happen, but they're rare, and usually self-contained). Why, then, is the same level of rigor not applied to the automotive industry, by government (or even international) mandate? Just as much damange can just as easily be done, and if it was possible to seize control of a Boeing 747 from your living room, you can bet there would be people fired within the hour, and arrested within the day. That said, something tells me that, in light of recent events, there will be a push for the automotive industry to start using things like DO-178, and its companions for mechanical and electronic engineering (whose numbers I don't recall).
  - raisedbyninjas 11y ago
    Air travel is inherently more dangerous than automobile travel. This is intuitively and actually true. People learn from a very young age that falling hurts and falling even 10 meters can be fatal. Falling, flying, great heights tickle the fear centers in your lizard brain. Vehicles are more like incremental improvements to things that are safe like running or riding a horse. Additionally auto accidents are mostly isolated to 2 parties on the roadway they're travelling. So we don't exercise the same caution with cars. Practically, air travel is safer because they are built, maintained, piloted, and continuously monitored by professionals. Conversely a 15 year old can build a kit car and drive it on the highway legally. If they break a dozen traffic laws they may or may not get caught and penalized. If we could get people to assess and respond to risk rationally, we could make a lot of things safer.
  - ScottBurson 11y ago
    The psychology of it is interesting, isn't it? Flying in a plane seems so intuitively unsafe that we go to great efforts to make it safe, while traveling on the ground seems so intuitively safe that we don't worry about it as much. (Remember how hard it was to get most people to wear seat belts?) And yet, far more people die in car crashes than plane crashes.
- ocschwar 11y ago
  While Microsoft's product issues do impose externalities on net users at large, that pales in comparison to letting 2 ton machines travel 60 MPH on the roads, while running closed source software. Simply require source code publication for cars that are to be made street legal.

Well, what you're saying is that they wouldn't open source it voluntarily. This is why we have regulations: to make people and companies do things that they wouldn't do voluntarily.

radiorental 11y ago

But isn't this analogous to asking Microsoft to open source their OS because of vulnerabilities. I do not disagree with you. These are safety critical systems, I just don't see how companies could be forced to share IP. What is more likely in my view is something similar to the validation standards in aviation: https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B

msandford 11y ago
Yes it is. And if hundreds or thousands of people had died from windows vulnerabilities and tremendous environmental damage had been done, that might well have happened. Most of the security breaches are due to people doing stuff really wrong not just a late patch. And even then I haven't heard of anyone dying as a result yet. People have probably died (if you believe public health stats) as a result of increased NOx production of these vehicles. There's also been a lot more pollution. Big, big pollution problems have caused substantial changes to things, like the creation of the EPA here in the US.
- gambiting 11y ago
  >>if hundreds or thousands of people had died from windows vulnerabilities and tremendous environmental damage had been done Then people would stop using Windows, simple as that.
  - nmrm2 11y ago
    Just like people stop mining for coal or iron when it causes loss of life and environmental damage? The people being harmed by software vulnerabilities are rarely the people who made an informed decision to use a certain piece of software. People who shop at Target can't meaningfully be said to make a choice to trust Target's software -- it's not something the average consumer things about. So although "should" is an understandable prescription, "would" is a bit unrealistic...
    - gambiting 11y ago
      If there were any alternatives to coal or iron that wouldn't cause as large loss of life, then we would have switched to those. If you find out your car is unsafe to use, you switch to a different one, because other cars offer similar functionality - the same with Windows, if it was so full of bugs that it was an actual danger to use, then people would simply switch to Linux,*BSD or MacOS, it's not like there are no alternatives.
      - nmrm2 11y ago
        The behavior you're describing is disproved by history. People use demonstrably insecure products that are insecure all the time, even when great secure alternatives exist. Even speaking theoretically, the behavior you're describing isn't even an accurate description of how rational actors without resource constraints and with perfect knowledge would behave (because e.g. there are qualities aside from security and safety that might make it impossible to use an alternative product, and there might be qualities that are impossible to measure directly). And anyways, all three of those assumptions are clearly out-of-touch with reality. Specifically wrt automobile software: * Even with public access to source code, it's impossibly expensive for the average consumer (even the average software engineer; hell, even the average automotive engineer) to make a decision with truly perfect knowledge. Any number of safety constraints boil down to intractable questions if code is designed in a way that isn't amenable to inspection. So even in a purely theoretical setting with completely rational actors, making a fully informed decision might just not be possible. * Many consumers will overlook errors in previous products and plausible errors in current products; Toyota's brand is doing just fine despite the findings of experts in the UA case. And I bet a lot of the software on cars that have sold even this year has some of the same structural problems, because based upon the expert testimony, a lot of that code probably needed to be essentially rewritten, and it's highly unlikely that they've achieved that in a year or two.
        ethbro 11y ago
        The difference, to play da, is that both of your points get solved with greater transparency. Is Linux more secure because everyone (quiet, Gentoo crowd) audits their own source? No, it's more secure because: Anyone can choose to audit the source with minimal roadblocks. Anyone who thinks they've found an issue can trumpet it from the rooftops. Together, this means that even though I might not line-by-line audit my system, I can (with varying levels of paranoia / assurance) obtain a system that I have confidence others have audited. And furthermore, if there are issues found in the future then I can be reasonably sure of hearing about them. Neither of these benefits is possible with closed source embedded systems. (Or, from article "Ninety-nine percent of the buyers would never read anything. But out of the 11 million people whose car was cheating, one of them would have found it,” he said. “And Volkswagen would have been caught in 2009, not 2015.”)
CWood1 11y ago
This raises a point that has confused me for a long time. Aerospace engineering is known for its track record of safety (not to say incidents don't happen, but they're rare, and usually self-contained). Why, then, is the same level of rigor not applied to the automotive industry, by government (or even international) mandate? Just as much damange can just as easily be done, and if it was possible to seize control of a Boeing 747 from your living room, you can bet there would be people fired within the hour, and arrested within the day. That said, something tells me that, in light of recent events, there will be a push for the automotive industry to start using things like DO-178, and its companions for mechanical and electronic engineering (whose numbers I don't recall).
- raisedbyninjas 11y ago
  Air travel is inherently more dangerous than automobile travel. This is intuitively and actually true. People learn from a very young age that falling hurts and falling even 10 meters can be fatal. Falling, flying, great heights tickle the fear centers in your lizard brain. Vehicles are more like incremental improvements to things that are safe like running or riding a horse. Additionally auto accidents are mostly isolated to 2 parties on the roadway they're travelling. So we don't exercise the same caution with cars. Practically, air travel is safer because they are built, maintained, piloted, and continuously monitored by professionals. Conversely a 15 year old can build a kit car and drive it on the highway legally. If they break a dozen traffic laws they may or may not get caught and penalized. If we could get people to assess and respond to risk rationally, we could make a lot of things safer.
- ScottBurson 11y ago
  The psychology of it is interesting, isn't it? Flying in a plane seems so intuitively unsafe that we go to great efforts to make it safe, while traveling on the ground seems so intuitively safe that we don't worry about it as much. (Remember how hard it was to get most people to wear seat belts?) And yet, far more people die in car crashes than plane crashes.
ocschwar 11y ago
While Microsoft's product issues do impose externalities on net users at large, that pales in comparison to letting 2 ton machines travel 60 MPH on the roads, while running closed source software. Simply require source code publication for cars that are to be made street legal.