10 ms·

The Internet of Criminal Things

134 points by rvense 11y ago

frozenport 11y ago
Okay you make the software open source, then the cheating will take place in hardware. At the heart of the emission testing problem lies a poorly designed emissions test. We need better test coverage.
- angelbob 11y ago
  That would at least be more expensive. Moving the cheating to harder and harder chunks of the entire system is a fine start. You can't have perfect security. You can have security that makes bad actors pay more for the privilege of being bad actors.
  - frozenport 11y ago
    How about testing them on the road? Worst that could happen is requiring the car maker to revert to those sub-optimal settings.
    - stavrianos 11y ago
      This is how the arms race begins. Soon the manufacturers will know how much the equipment weighs, and if the car's total weight is within tolerance for that plus a test driver, the mechanisms activate. Or whatever - the point isn't the methods, it's the pattern of one-upsmanship.
      - TeMPOraL 11y ago
        True, but there shouldn't be an arms race to begin with - one of the parties has men with guns, the other has not. VW should be sued to the ground for fucking with society like that. They should be turned into an example of what happens when you try to pull off highly damaging criminal stunts like that.
        tormeh 11y ago
        Problem is that you don't get the people responsible if you do this. Punishing corporations only work if you do it in real time as the crimes are committed so that it has consequences for the individuals responsible.
        MikeNomad 11y ago
        Taking VW to court now, while the cars with the software mods in question are currently in the wild, is as Real Time as it gets.
        TeMPOraL 11y ago
        Indeed. Also, it may sound brutal but even if all the responsible evaded the hard punishment that came upon the company, the next time someone would think about pulling such a stunt off, he'd be opposed by the rest. You just need to make the consequences hard enough to bubble up the ladder and ruin the day for someone at the top.
        Ankaios 11y ago
        The buck stops with the shareholders.
  - Spivak 11y ago
    But this is just a band-aid fix. Personally, I would just put the user in control. Let the user decide whether they want to run their car in high mileage low emissions mode or high performance mode. Now automakers can "cheat" all they want and it makes everyone better off.
    - semi-extrinsic 11y ago
      Tht sounds like a very bad idea. When buying a car, you already have to make a tradeoff between performance, practicality and environmental impact, but at the very least you have discrete choices and you know the car will be usable. If remapping the ECU at will becomes standard, what is to stop manufacturers from basing MPG figures on a map that does 0-60 in 40 seconds? Where would you draw the line for the definition of misleading consumers? Or what's to stop rednecks from constantly running sky-high NOx and CO2 emissions?
      - ghaff 11y ago
        Your implicit argument that it's really not up to consumers to decide whether to bypass emission requirements is fine. That it's "rednecks" who would do this is not.
        semi-extrinsic 11y ago
        My sincere apologies if this offended anyone. What would be an appropriate term in this context? Edit: I'm not a native speaker and have heard this term in use in the media to the point where I did not believe it to be a "racial slur" as wikipedia says it is. So, say I want, for instance, to represent the stereotype person who rolls coal on their diesel pickup and believes global warming is a left-wing conspiracy. Look it up on youtube if you don't know what rolling coal is. (We can get into a whole debate on whether stereotypes are inherently good or bad, but that's not the point. They're a very effective commumication tool, which is why humans are so quick to label and group other humans, but obviously they're only to be used when not offensive.)
        11y ago
  - zby 11y ago
    And also it would require more people in on the conspiracy.
- lordnacho 11y ago
  I think the problem with the emissions test is it tries to be precise. The authorities seem to think that if we lock down all the variables, we get a good guess as to the actual figures. Which wouldn't be a bad way to do things if you were doing a science experiment. If we're trying to avoid gaming the system, wouldn't it be better to drive around a bunch of cars, using the natural variability of the conditions to defeat the cheaters? Sure, it's not as precise, but you get better accuracy because people can't trick the system.
  - kardos 11y ago
    How will you handle all of the "its not fair" complaints that claim competitors were tested under better conditions? And also, how will you ensure that certain manufacturers aren't actually given better conditions?
    - lordnacho 11y ago
      Have a large number of tests, let the law of large numbers rule (eg let 1000 random people borrow each type of car). Have a think about whether there's some bias between the manufacturers built in and adjust your sampling accordingly. Make the data available to scrutiny.
      - kardos 11y ago
        That doesn't sound expensive
        Dylan16807 11y ago
        I agree. Paying people to do comprehensive tests in a few locations will probably cost less than a single brand new car, of which they're making thousands to millions. Even a thousand test drives is not that much; 20 cars borrowed for a month is more than enough to do those.
    - Dylan16807 11y ago
      >How will you handle all of the "its not fair" complaints You look at them with disbelief and ask why they designed it to skirt the edge of illegal levels of pollution and be so likely to fail.
- SideburnsOfDoom 11y ago
  The need for testing is the problem, and the realisation that car makers - all of them - are working on the test score over everything else, and that the test scores (which should represent emissions and air quality) have been getting "better" to the extent that that they are increasingly diverging from the real world. I suspect that in a few decades time this will be regarded as a heavy blow to the internal combustion engine - or at least against Diesel. It is an inflection point at which a scandal pushes into public conciousness and mass media the mounting evidence against Diesel engines and the health effects of smog, and the insufficient actual progress fixing it. Meanwhile electric cars are gaining fast. The politicians are in "something must be done" mode, which is the usual reaction to a problem that has been ignored for a while and now is in the news. e.g. https://uk.news.yahoo.com/france-consider-phasing-diesel-tax-breaks-minister-190957251--finance.html#KtU0MEl https://uk.news.yahoo.com/france-consider-phasing-diesel-tax... http://uk.reuters.com/article/2015/10/03/uk-volkswagen-emissions-cameron-idUKKCN0RX0VB20151003 http://uk.reuters.com/article/2015/10/03/uk-volkswagen-emiss... http://www.theguardian.com/business/2015/oct/01/uk-government-wrong-to-subsidise-diesel-says-former-minister http://www.theguardian.com/business/2015/oct/01/uk-governmen...
conradev 11y ago
I don't understand why people talk about open-source as means of guaranteeing software integrity. For most software projects these days, it's impossible to verify that a binary blob came from a given set of source code. It's possible to do, though. Bitcoin, tor and a large number of Debian packages build reproducibly: https://wiki.debian.org/ReproducibleBuilds/About https://wiki.debian.org/ReproducibleBuilds/About https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details https://blog.torproject.org/blog/deterministic-builds-part-t...
- vilhelm_s 11y ago
  The article explicitly mentions reproducible builds.
- lifeisstillgood 11y ago
  Open source is the only means to guarantee software integrity. What surprises me is the fear that not enough eyeballs will look. But for VW, the scrutinising eyeballs will be employed by GM, Toyota etc. The incentive to catch your competition in cheating and thus collapse their business is enormous. We should encourage more of it. Maybe give the competitors a factory each.
  - roymurdock 11y ago
    Or they will collude, as they probably did with the emissions testing. There's no way GM and Toyota saw VW's numbers and just blindly believed they were plausible. They were probably scared of calling VW out because it would bring an industry-wide crackdown, which it is. Now things are going to be more expensive for all auto manufacturers.
  - drdaeman 11y ago
    To be precise the first half of Freedom One [1] is the requirement (and not a guarantee), not "Open Source" or "Free Software". And the requisites for that requirement are decriminalization of research including sharing results of those, and possibility of said research, i.e. absence of technical measures that prevent access to the software. This may work with politicians. I fear, persuading them to grant users other freedoms (like a freedom to change program or distribute your changes) is very unlikely to happen. [1]: "The freedom to study how the program works, and change it so it does your computing as you wish"
noonespecial 11y ago
I'm not so sure that governments are too concerned with the 11 million cheating cars so long as they have a nice easy target to blame, fine, and play politics with. I have a feeling they'd much rather have one company and 11 million violations than 10,000 backyard mechanics helping themselves to 15 extra horsepower after reading an article on Hackaday. Politically, DRM is still a feature not a bug.
- lifeisstillgood 11y ago
  I see nothing whatsoever incompatible with hardware refusing to run anything other than a small list of signed binaries, and publishing the source code and makefiles (etc) to create said binaries. Hackers turning their / your car into a socially offensive mechanism should be treated similarly to putting firing pins back in decommissioned handguns.
  - tormeh 11y ago
    Let's keep, or at least not further erode, respect for guns. There are few things civilians will ever touch that deserve more respect than guns, and I suggest we don't cloud that message. Hey downvoters, why don't you take that attitude to the army and see how they react? Professional gun-handlers tend to have a lot more respect for guns than you have. That ought to make you pause for thought.
    - shawn-furyan 11y ago
      Automobiles do not require less care than guns. A lot more people accidentally kill and/or injure themselves and others with the former than the latter. Between cars and guns, I would say that cars are more due for a bump in respect. At least guns aren't so widely used so recklessly.
      - Nyetan 11y ago
        Not sure if I'm reading this right but per the NCHS (via the CDC)[1][2][3], in 2013, for people aged 15-24, ~6500 died relating to motor vehicle injuries whereas ~6000 died relating to firearms (although ~2000 of those were suicides -- not sure how that factors in, but it's probably important). Anyways, it seems like an awful lot of people kill themselves with guns, so perhaps we should just consider it a binary: if something is lethal, treat it with all the care you can muster. Edit: drat, and the site you can use to get more stats: http://webappa.cdc.gov/sasweb/ncipc/leadcaus10_us.html http://webappa.cdc.gov/sasweb/ncipc/leadcaus10_us.html [1]: http://tinyurl.com/qfqn5oz http://tinyurl.com/qfqn5oz [2]: http://tinyurl.com/on9lyfc http://tinyurl.com/on9lyfc [3]: http://tinyurl.com/ov5je39 http://tinyurl.com/ov5je39

134 points by rvense 11y ago

Okay you make the software open source, then the cheating will take place in hardware. At the heart of the emission testing problem lies a poorly designed emissions test. We need better test coverage.

angelbob 11y ago
That would at least be more expensive. Moving the cheating to harder and harder chunks of the entire system is a fine start. You can't have perfect security. You can have security that makes bad actors pay more for the privilege of being bad actors.
- frozenport 11y ago
  How about testing them on the road? Worst that could happen is requiring the car maker to revert to those sub-optimal settings.
  - stavrianos 11y ago
    This is how the arms race begins. Soon the manufacturers will know how much the equipment weighs, and if the car's total weight is within tolerance for that plus a test driver, the mechanisms activate. Or whatever - the point isn't the methods, it's the pattern of one-upsmanship.
    - TeMPOraL 11y ago
      True, but there shouldn't be an arms race to begin with - one of the parties has men with guns, the other has not. VW should be sued to the ground for fucking with society like that. They should be turned into an example of what happens when you try to pull off highly damaging criminal stunts like that.
      - tormeh 11y ago
        Problem is that you don't get the people responsible if you do this. Punishing corporations only work if you do it in real time as the crimes are committed so that it has consequences for the individuals responsible.
        MikeNomad 11y ago
        Taking VW to court now, while the cars with the software mods in question are currently in the wild, is as Real Time as it gets.
        TeMPOraL 11y ago
        Indeed. Also, it may sound brutal but even if all the responsible evaded the hard punishment that came upon the company, the next time someone would think about pulling such a stunt off, he'd be opposed by the rest. You just need to make the consequences hard enough to bubble up the ladder and ruin the day for someone at the top.
        Ankaios 11y ago
        The buck stops with the shareholders.
- Spivak 11y ago
  But this is just a band-aid fix. Personally, I would just put the user in control. Let the user decide whether they want to run their car in high mileage low emissions mode or high performance mode. Now automakers can "cheat" all they want and it makes everyone better off.
  - semi-extrinsic 11y ago
    Tht sounds like a very bad idea. When buying a car, you already have to make a tradeoff between performance, practicality and environmental impact, but at the very least you have discrete choices and you know the car will be usable. If remapping the ECU at will becomes standard, what is to stop manufacturers from basing MPG figures on a map that does 0-60 in 40 seconds? Where would you draw the line for the definition of misleading consumers? Or what's to stop rednecks from constantly running sky-high NOx and CO2 emissions?
    - ghaff 11y ago
      Your implicit argument that it's really not up to consumers to decide whether to bypass emission requirements is fine. That it's "rednecks" who would do this is not.
      - semi-extrinsic 11y ago
        My sincere apologies if this offended anyone. What would be an appropriate term in this context? Edit: I'm not a native speaker and have heard this term in use in the media to the point where I did not believe it to be a "racial slur" as wikipedia says it is. So, say I want, for instance, to represent the stereotype person who rolls coal on their diesel pickup and believes global warming is a left-wing conspiracy. Look it up on youtube if you don't know what rolling coal is. (We can get into a whole debate on whether stereotypes are inherently good or bad, but that's not the point. They're a very effective commumication tool, which is why humans are so quick to label and group other humans, but obviously they're only to be used when not offensive.)
        11y ago
- zby 11y ago
  And also it would require more people in on the conspiracy.
lordnacho 11y ago
I think the problem with the emissions test is it tries to be precise. The authorities seem to think that if we lock down all the variables, we get a good guess as to the actual figures. Which wouldn't be a bad way to do things if you were doing a science experiment. If we're trying to avoid gaming the system, wouldn't it be better to drive around a bunch of cars, using the natural variability of the conditions to defeat the cheaters? Sure, it's not as precise, but you get better accuracy because people can't trick the system.
- kardos 11y ago
  How will you handle all of the "its not fair" complaints that claim competitors were tested under better conditions? And also, how will you ensure that certain manufacturers aren't actually given better conditions?
  - lordnacho 11y ago
    Have a large number of tests, let the law of large numbers rule (eg let 1000 random people borrow each type of car). Have a think about whether there's some bias between the manufacturers built in and adjust your sampling accordingly. Make the data available to scrutiny.
    - kardos 11y ago
      That doesn't sound expensive
      - Dylan16807 11y ago
        I agree. Paying people to do comprehensive tests in a few locations will probably cost less than a single brand new car, of which they're making thousands to millions. Even a thousand test drives is not that much; 20 cars borrowed for a month is more than enough to do those.
  - Dylan16807 11y ago
    >How will you handle all of the "its not fair" complaints You look at them with disbelief and ask why they designed it to skirt the edge of illegal levels of pollution and be so likely to fail.
SideburnsOfDoom 11y ago
The need for testing is the problem, and the realisation that car makers - all of them - are working on the test score over everything else, and that the test scores (which should represent emissions and air quality) have been getting "better" to the extent that that they are increasingly diverging from the real world. I suspect that in a few decades time this will be regarded as a heavy blow to the internal combustion engine - or at least against Diesel. It is an inflection point at which a scandal pushes into public conciousness and mass media the mounting evidence against Diesel engines and the health effects of smog, and the insufficient actual progress fixing it. Meanwhile electric cars are gaining fast. The politicians are in "something must be done" mode, which is the usual reaction to a problem that has been ignored for a while and now is in the news. e.g. https://uk.news.yahoo.com/france-consider-phasing-diesel-tax-breaks-minister-190957251--finance.html#KtU0MEl https://uk.news.yahoo.com/france-consider-phasing-diesel-tax... http://uk.reuters.com/article/2015/10/03/uk-volkswagen-emissions-cameron-idUKKCN0RX0VB20151003 http://uk.reuters.com/article/2015/10/03/uk-volkswagen-emiss... http://www.theguardian.com/business/2015/oct/01/uk-government-wrong-to-subsidise-diesel-says-former-minister http://www.theguardian.com/business/2015/oct/01/uk-governmen...

conradev 11y ago

I don't understand why people talk about open-source as means of guaranteeing software integrity. For most software projects these days, it's impossible to verify that a binary blob came from a given set of source code. It's possible to do, though. Bitcoin, tor and a large number of Debian packages build reproducibly: https://wiki.debian.org/ReproducibleBuilds/About https://wiki.debian.org/ReproducibleBuilds/About https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details https://blog.torproject.org/blog/deterministic-builds-part-t...

vilhelm_s 11y ago
The article explicitly mentions reproducible builds.
lifeisstillgood 11y ago
Open source is the only means to guarantee software integrity. What surprises me is the fear that not enough eyeballs will look. But for VW, the scrutinising eyeballs will be employed by GM, Toyota etc. The incentive to catch your competition in cheating and thus collapse their business is enormous. We should encourage more of it. Maybe give the competitors a factory each.
- roymurdock 11y ago
  Or they will collude, as they probably did with the emissions testing. There's no way GM and Toyota saw VW's numbers and just blindly believed they were plausible. They were probably scared of calling VW out because it would bring an industry-wide crackdown, which it is. Now things are going to be more expensive for all auto manufacturers.
- drdaeman 11y ago
  To be precise the first half of Freedom One [1] is the requirement (and not a guarantee), not "Open Source" or "Free Software". And the requisites for that requirement are decriminalization of research including sharing results of those, and possibility of said research, i.e. absence of technical measures that prevent access to the software. This may work with politicians. I fear, persuading them to grant users other freedoms (like a freedom to change program or distribute your changes) is very unlikely to happen. [1]: "The freedom to study how the program works, and change it so it does your computing as you wish"

noonespecial 11y ago

I'm not so sure that governments are too concerned with the 11 million cheating cars so long as they have a nice easy target to blame, fine, and play politics with. I have a feeling they'd much rather have one company and 11 million violations than 10,000 backyard mechanics helping themselves to 15 extra horsepower after reading an article on Hackaday. Politically, DRM is still a feature not a bug.

lifeisstillgood 11y ago
I see nothing whatsoever incompatible with hardware refusing to run anything other than a small list of signed binaries, and publishing the source code and makefiles (etc) to create said binaries. Hackers turning their / your car into a socially offensive mechanism should be treated similarly to putting firing pins back in decommissioned handguns.
- tormeh 11y ago
  Let's keep, or at least not further erode, respect for guns. There are few things civilians will ever touch that deserve more respect than guns, and I suggest we don't cloud that message. Hey downvoters, why don't you take that attitude to the army and see how they react? Professional gun-handlers tend to have a lot more respect for guns than you have. That ought to make you pause for thought.
  - shawn-furyan 11y ago
    Automobiles do not require less care than guns. A lot more people accidentally kill and/or injure themselves and others with the former than the latter. Between cars and guns, I would say that cars are more due for a bump in respect. At least guns aren't so widely used so recklessly.
    - Nyetan 11y ago
      Not sure if I'm reading this right but per the NCHS (via the CDC)[1][2][3], in 2013, for people aged 15-24, ~6500 died relating to motor vehicle injuries whereas ~6000 died relating to firearms (although ~2000 of those were suicides -- not sure how that factors in, but it's probably important). Anyways, it seems like an awful lot of people kill themselves with guns, so perhaps we should just consider it a binary: if something is lethal, treat it with all the care you can muster. Edit: drat, and the site you can use to get more stats: http://webappa.cdc.gov/sasweb/ncipc/leadcaus10_us.html http://webappa.cdc.gov/sasweb/ncipc/leadcaus10_us.html [1]: http://tinyurl.com/qfqn5oz http://tinyurl.com/qfqn5oz [2]: http://tinyurl.com/on9lyfc http://tinyurl.com/on9lyfc [3]: http://tinyurl.com/ov5je39 http://tinyurl.com/ov5je39