3 ms·

The aviation/automotive code doesn't get deployed on to millions of personal computers of tons varieties and locals and probed by professional hackers endlessly

The aviation/automotive code doesn't get deployed on to millions of personal computers of tons varieties and locals and probed by professional hackers endlessly for vulnerabilities. The aviation/automotive code runs in very well defined environment, almost completely locked down and unavailable for user interaction for most parts. Its unfair to compare them with open ended applications like browsers which has to handle tons of formats, extensibility APIs and very complex and often incomplete protocols with numerous versions and compatibility issues. Two very different worlds.

kbenson 9y ago
The problem with security through obscurity (which is what this approach is analogous to), is that obscurity can't really be guaranteed, and you usually can't be sure exactly how your code will be implemented in the future. Here's some somewhat recent examples of that, where a Jeep was remotely controlled because the system's bus wasn't correctly segregated[1], and where an avionics messaging channel may be exploitable to send bogus information between planes and air traffic control[2]. 1: https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... 2: https://defcon.org/images/defcon-22/dc-22-presentations/Polstra/DEFCON-22-Phil-Polstra-Cyber-hijacking-Airplanes-Truth-or-Fiction-Updated.pdf https://defcon.org/images/defcon-22/dc-22-presentations/Pols...