9 ms·

I will take malicious improper analogy for 100

by ky738 9y ago

michaelmcmillan 9y ago
Please point out the discrepancy. A Tesla has ~ 100.000.000 [1] lines of code. Considering this post, do you think we are sufficiently educated in software security to produce secure self-driving cars? Elon Musk: "I think one of the biggest risks for autonomous vehicles is somebody achieving a fleet wide hack" [2]. [1] https://bit.ly/KIB_linescode https://bit.ly/KIB_linescode [2] https://www.youtube.com/watch?v=4G1Boh-URIM https://www.youtube.com/watch?v=4G1Boh-URIM
- abestic9 9y ago
  These companies have completely different operating systems, network ACLs, software update policies and subsystems that affect certain mechanical features. By your logic, we should not fly any modern commercial or military aircraft or spacecraft, live within a certain radius of any power or hazardous chemical plant, place any dependency on any first world country's health care network, including life support, or invest in any company or stock. Like most things in life it comes down to a security/convenience risk/benefit compromise.
  - michaelmcmillan 9y ago
    > These companies have completely different operating systems, network ACLs, software update policies and subsystems that affect certain mechanical features. Are you claiming that this could not have happened with Tesla? If so, please explain why. > By your logic, we should not fly any modern commercial or military aircraft or spacecraft, live within a certain radius of any power or hazardous chemical plant, place any dependency on any first world country's health care network, including life support, or invest in any company or stock. Up until now the benefits have clearly outweighed the risks, but that does not mean it will continue to do so.
- deleted 9y ago
  [deleted]
- jessriedel 9y ago
  This is a much more interesting comment than your initial quip. Next time, consider leading with this rather than unnecessarily antagonizing people.
- mikeash 9y ago
  How much of that code is safety critical? I occasionally see misbehavior from my Tesla's center screen, like the network connection failing, or audio glitches, or even the occasional spontaneous reboot. This can be mildly annoying but it doesn't worry me because I know that the center screen is separate from the stuff where bugs can actually get me killed.
  - michaelmcmillan 9y ago
    "On Thursday October 24, 2013, an Oklahoma court ruled against Toyota in a case of unintended acceleration that lead to the death of one the occupants. Central to the trial was the Engine Control Module's (ECM) firmware. Embedded software used to be low-level code we'd bang together using C or assembler. These days, even a relatively straightforward, albeit critical, task like throttle control is likely to use a sophisticated RTOS and tens of thousands of lines of code. " [1] [2] [1] https://www.edn.com/design/automotive/4423428/Toyota-s-killer-firmware--Bad-design-and-its-consequences https://www.edn.com/design/automotive/4423428/Toyota-s-kille... [2] https://www.embedded.com/electronics-blogs/barr-code/4214602/Unintended-acceleration-and-other-embedded-software-bugs https://www.embedded.com/electronics-blogs/barr-code/4214602...
    - mikeash 9y ago
      Sure. My point is just that you can't bring up the total number of lines of code here, because most of those lines aren't in any way related to any safety-critical system. If you want to talk about how much code there is which puts you at risk, you need to look at that particular subset of code.
      - michaelmcmillan 9y ago
        I think it is safe to assume that complexity is highly correlated with number of lines of code. And with complexity grows bugs. On the surface, this particular exploit on macOS seems to be caused by a totally unrelated subsystem (security vs. GUI).
        9y ago
deleted 9y ago
[deleted]

I will take malicious improper analogy for 100

by ky738 9y ago

I will take malicious improper analogy for 100

Please point out the discrepancy. A Tesla has ~ 100.000.000 [1] lines of code. Considering this post, do you think we are sufficiently educated in software security to produce secure self-driving cars? Elon Musk: "I think one of the biggest risks for autonomous vehicles is somebody achieving a fleet wide hack" [2]. [1] https://bit.ly/KIB_linescode https://bit.ly/KIB_linescode [2] https://www.youtube.com/watch?v=4G1Boh-URIM https://www.youtube.com/watch?v=4G1Boh-URIM

abestic9 9y ago
These companies have completely different operating systems, network ACLs, software update policies and subsystems that affect certain mechanical features. By your logic, we should not fly any modern commercial or military aircraft or spacecraft, live within a certain radius of any power or hazardous chemical plant, place any dependency on any first world country's health care network, including life support, or invest in any company or stock. Like most things in life it comes down to a security/convenience risk/benefit compromise.
- michaelmcmillan 9y ago
  > These companies have completely different operating systems, network ACLs, software update policies and subsystems that affect certain mechanical features. Are you claiming that this could not have happened with Tesla? If so, please explain why. > By your logic, we should not fly any modern commercial or military aircraft or spacecraft, live within a certain radius of any power or hazardous chemical plant, place any dependency on any first world country's health care network, including life support, or invest in any company or stock. Up until now the benefits have clearly outweighed the risks, but that does not mean it will continue to do so.
deleted 9y ago
[deleted]
jessriedel 9y ago
This is a much more interesting comment than your initial quip. Next time, consider leading with this rather than unnecessarily antagonizing people.
mikeash 9y ago
How much of that code is safety critical? I occasionally see misbehavior from my Tesla's center screen, like the network connection failing, or audio glitches, or even the occasional spontaneous reboot. This can be mildly annoying but it doesn't worry me because I know that the center screen is separate from the stuff where bugs can actually get me killed.
- michaelmcmillan 9y ago
  "On Thursday October 24, 2013, an Oklahoma court ruled against Toyota in a case of unintended acceleration that lead to the death of one the occupants. Central to the trial was the Engine Control Module's (ECM) firmware. Embedded software used to be low-level code we'd bang together using C or assembler. These days, even a relatively straightforward, albeit critical, task like throttle control is likely to use a sophisticated RTOS and tens of thousands of lines of code. " [1] [2] [1] https://www.edn.com/design/automotive/4423428/Toyota-s-killer-firmware--Bad-design-and-its-consequences https://www.edn.com/design/automotive/4423428/Toyota-s-kille... [2] https://www.embedded.com/electronics-blogs/barr-code/4214602/Unintended-acceleration-and-other-embedded-software-bugs https://www.embedded.com/electronics-blogs/barr-code/4214602...
  - mikeash 9y ago
    Sure. My point is just that you can't bring up the total number of lines of code here, because most of those lines aren't in any way related to any safety-critical system. If you want to talk about how much code there is which puts you at risk, you need to look at that particular subset of code.
    - michaelmcmillan 9y ago
      I think it is safe to assume that complexity is highly correlated with number of lines of code. And with complexity grows bugs. On the surface, this particular exploit on macOS seems to be caused by a totally unrelated subsystem (security vs. GUI).
      - 9y ago

deleted 9y ago

[deleted]