12 ms·
I read the article from tip to tail and as a professional engine mechanic, It reminds me of Fords "myford touch" platform. the system was rolled out across new
by nimbius 8y ago
I read the article from tip to tail and as a professional engine mechanic, It reminds me of Fords "myford touch" platform.
the system was rolled out across newer fleets without much testing, and in some models controls practically every single feature in the vehicle from climate control to the onstar SOS. There was a recall for platinum model F150 trucks because the system could glitch out after so many hours of continuous operation and trigger a fault in the 4 wheel brake force distribution system. This in turn either completely arrested the brakes, or caused them to quietly apply themselves at around 15%...you couldnt undo this unless you pulled the fuse. Even worse, collision detection would be disabled because the system thought you were aware of a potential crash and were braking.
If a certain bluetooth phone were paired, it could cause the trailer load and position sensor to erroneously predict grade downshifts. The result was that incoming calls on the highway would either wreck the rear differential or put the truck on the side of the road.
- pjmlp 8y agoOn the latest ADB Podcast, they mention that certain car infotaiment systems just go "blue screen" if you feed them a more recent Bluetooth version than what they have hardcoded. http://androidbackstage.blogspot.com/2018/08/episode-97-bluetooth.html http://androidbackstage.blogspot.com/2018/08/episode-97-blue...
- colejohnson66 8y agoWhy is the infotainment system even on the same computer as the brakes!?
- Sileni 8y agoThe trend towards monolithic hub systems is baffling. Didn't we learn those lessons while we were struggling with mainframes and timesharing? You don't lock critical systems, ever. You don't even directly interact with them, you send them messages and if they don't receive them they should continue to function as the operator would expect. The collision avoidance system failing to function correctly is no where near as dangerous as arbitrarily applying the brakes.
- ModernMech 8y ago> Didn't we learn those lessons while we were struggling with mainframes and timesharing? I feel like there are really three kinds of programmers today: those who learned first-hand the aforementioned lessons, those who were taught second-hand these lessons, and those who are destined to learn these lessons first-hand. There are very few people relatively who experienced the lessons first hand. They taught the lesson to a larger group, who will hopefully do their best to heed its warning. But what's happened? A whole lot of people came into programming in the last couple of decades. I feel like there literally aren't enough "elders" in the field to teach the influx of new programming ability. They're making the same mistakes again because for everyone one you tell not to, there are 10 more who are willing to try. And to some of them we're giving millions of dollars and they're forming companies with it, who go on to sell products about which exactly 0 people have asked "Is this a good idea? Has it been tried before? What was the result? What can we learn from that? Has anything changed since then that would lead to a different result?"
- PurpleBoxDragon 8y agoI'd say a bigger problem from my perspective is all the non-programmers who get into management and project management roles who never learned these lessons and who refuse to listen to programmers trying to teach them. They'll ignore you, and if you don't 'be a team player' you'll end up replaced by someone who will.
- setr 8y agoThats pretty much the same story as usenet’s eternal september: as the rate of newcomers increases, it eventually outpaces the rate of teaching. At that point, no culture can be sustained longer than a year; a new batch will arrive, and learn things from scratch, and come up with their own solutions... until the next batch, which overrides any lessons learned by the prior At the very least, here, the knowledge learned is sustained by individuals, and acknowledged (so you still have “experts” and “elders”), but as a general community, you can safely assume that everything is forgotten very rapidly. Another example of it I’ve seen in video games, where modern designers seem to have forgotten that games existed before 2005: the same design mistakes solved in 1990 crop up again in 2018. My preferred example being star control 2 vs mass effect: very similar games in design and spirit, two decades apart, and mass effect features many of the same mistakes, and even mistakes solved in star control. As if they had started the design from scratch.
- java-man 8y agoincompetence. let me explain. attaching a non-essential sub-system with a large attack surface to a mission-critical network is not malicious (I hope) it is incompetence. I would accept a unidirectional serial link with a validated protocol as a sole connection between the two. I think it is the same kind of thinking that goes into other bad ideas: flickering stop lights, red turn signals. The auto makers just don't really care or think. This is something I don't understand.
- chooseaname 8y agoEither the engineers thought it was a good idea or the engineers could not convince management that it was a bad idea.
- Someone1234 8y agoIt is cheaper.
- dtech 8y agoModern electronic cars use a single bus (CAN bus) that connect all electrical systems. The brakes, the engine, the wipers, the stereo... Luckily it is a very well-tested system, it was one the first commercial use cases for QuickCheck [1], but still... One of the bugs that John Hughes found was an integer overflow that transformed a lowest-priority message into a highest-priority message. [1] https://www.cs.tufts.edu/~nr/cs257/archive/john-hughes/quviq-testing.pdf https://www.cs.tufts.edu/~nr/cs257/archive/john-hughes/quviq...
- rthomas6 8y agoIMO there should be separate infotainment and hi-speed system CAN buses. It's lunacy to place engine control on the same bus as something with internet access that doesn't get upgraded, like, ever. I don't care how well it's tested.
- Declanomous 8y agoThat's how it is on my car, but at the same time my car basically has no fancy electronics. I understand software engineers pulling stunts like this, because there isn't actually a regulated engineering license, but I'd honestly have expected automotive engineers to be vehemently opposed to putting the stereo on the same system as the brakes.
- meguest 8y agoI wonder if some of this is to do with weight reduction. To have seperate buses must add a lot of extra equipment and wiring. This means more weight and more power required to operate the electrics and in turn means lower MPG, higher fuel consumption and a more expensive car to design and manufacture. The net outcome is a less competitive car in a competitive market.
- swirepe 8y agoIt looks like a CAN bus hub weights about a pound. That's negligible, considering I have about twice that weight in garbage sitting in my cup holders. [1]: https://www.autozone.com/electrical-and-lighting/can-bus-hub/msd-can-bus-hub/500411_0_0 https://www.autozone.com/electrical-and-lighting/can-bus-hub...
- logfromblammo 8y agoBecause car companies have always built cars, not secure networks. Those executives have never been to DefCon; they have no idea what level of risk they face from the unsecured electronics components in their cars. They are not just unaware that putting critical systems and non-critical systems on the same bus is a bad idea, but they are also completely ignorant of the difference between real-time systems and the operating systems on their phones and computers. They need to hire some folks with aviation backgrounds, who can explain to them why the plane does not fall out of the sky when the in-flight entertainment system chokes on a scratched DVD. Even when they get it wrong, it is still less wrong than the auto-makers. [Edit:] Aviation people are the only outsiders they're likely to listen to. They're not perfect. But they are better. They at least have an awareness that security is an issue, even if the ways they handle it are... well... let's just say they're not ideal. Even though the tech folks who frequent this site are knowledgeable, the people who build stuff don't always respect our expertise. Sometimes they don't even realize that our expertise might apply to their problems. This is how we get black-box electronic voting machines and CANBUS2 and wi-fi light bulbs or security cameras that inadvertently open a back door into your LAN.
- monocasa 8y agoI'd be surprised if aviation systems are much better. They're really into putting everything on the same physical network too, but employing these things called "data diodes". As if that's a real thing, practically speaking.
- crististm 8y agoYou can even imagine that Dilbert manager telling you to put those diodes back...
- Dylan16807 8y agoThe problem is having virtual 'data diodes', or doing things like vlans on shared complex switches. A real data diode is easy. You hook up half a serial port.
- 8y ago
- jgrip 8y agoIn most cars this is not the case. For example, in my 2005 Opel Astra (Saturn Astra for US) there are three buses. High-speed CAN used for critical systems, Low-speed single wire CAN used for other vehicle systems and a mid-speed CAN for the entertainment and climate control stuff. All traffic between these buses are "firewalled" by CAN bridges that should only forward relevant frames between the nets. VW for example have a firewall in front of the OBD connector, only allowing traffic for the diagnostic addresses to pass. However, I expect that in newer "cloudy" cars, they need so much data that these "firewalls" have become very permissive. Remote start via Apps, triggering signal horns from the Internet, OnStar telemetry reporting etc. Traditionally the car makers have been completely terrible at tech security but they are slowly improving on this front. In fairness they've also been to some degree hampered on this front by regulations protecting local small garages, stating that the diag stuff cannot be locked down too hard.
- LeifCarrotson 8y agoThe other comments have effectively lambasted the manufacturers for their incompotence and foolishness in putting these on the same system, so I'll skip that bit. The practical reason is that the big central touchscreen is a convenient place to put stuff. On an old truck, you selected 4WD by moving a big transfer case lever, which indicated you were in 4WD by its position. No computer to get in the way. Slightly newer trucks have physical buttons with lights that connect to electrical solenoids, often directly. Tractors have brake pedals for each wheel, but old trucks don't have a similar braking force distribution system - you got locking diffs or dragged all the brakes and hoped it helped. With a touchscreen and a computer in place, it's easy to make compelling sales pitches for putting complex features there instead of on expensive, complicated physical controls. Complicated on a per-unit basis, that is - I understand that a computer has far more moving parts than any plastic-and-wires assembly, but when it works it's easier to draw buttons and graphics than to make mechanical actuators. Whether or not the processing happens on the same CPU or communication happens on the same physical bus doesn't matter that much when you have the ability to make selections that affect the engine and drivetrain on the main display.
- crististm 8y agoMakes sense. And it makes sense also to step back a little and see how this design may fail and change it in ways that makes it robust.
- macintux 8y agoJohn Hughes likes to talk about the CAN bus when discussing Quickcheck and test generation. Learning about the crazy complexity and potential for unforeseen interactions made me very unhappy when security researchers remotely controlled a car on the highway as a publicity stunt. There’s simply no way they can know with absolute certainty what might happen.
- ryanmarsh 8y agoThat’s horrifying. Are there any comprehensive write ups on this you can share? I’d like to read more about this.
- vvanders 8y agoThat's pretty spectacular, I'd love to read some more sources on it. Makes me glad Tesla did their stuff the way they did. You can reboot the cenelter console and/or days while driving and not much happens other than A/C turning off for about 20s.
- antongribok 8y agoTesla really scares me. They released an OTA update to the brakes with less than 2 weeks from first reports to code being pushed to the entire fleet of cars on public roads.
- jclulow 8y agoMove fast on brake things?
- slg 8y agoToyota had a similar brake software issue in 2010 [1]. They had a fix available 3 days after the NHTSA announced the issue. Toyota issued a voluntary recall for over 130,000 cars in the US. Since the recall was voluntary, it likely took years until some cars received that update when they were serviced for other unrelated issues. I have no idea if Tesla is doing things the best way, but Toyota having the ability to push that update out immediately would have indisputably prevented accidents and possibly saved lives. [1] - https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls#Anti-lock_brake_software_recall https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle...
- Someone1234 8y agoTesla pushed out a software update to AutoPilot (Lane Centering) that caused a fatality[0], I hardly think they should be held up as an example of good software hygiene. [0] https://www.mercurynews.com/2018/03/29/tesla-crash-victims-family-claims-he-complained-about-autopilot/ https://www.mercurynews.com/2018/03/29/tesla-crash-victims-f...
- FussyZeus 8y ago
- Someone1234 8y agoChrysler has had similar issue[0] this last year, their Pacifica Minivan had a software crash that would cause the engine management computer to crash and the vehicle to completely lose power while operating (inc. at highway speed). In effect you'd have complete loss of electrical power and even power steering, brake assist, and hazard warning lights(!) would be lost. Took them six or more months to fix it as they weren't able to reproduce the software glitch. [0] https://www.nytimes.com/2018/01/12/business/chrysler-pacifica-recall.html https://www.nytimes.com/2018/01/12/business/chrysler-pacific...
- DoofusOfDeath 8y agoI've noticed the occasional posting in HN from people who aren't [aspiring] professional software developers, which surprises me. If you don't mind me asking, what brings someone in your line of work to a site like this? [edit: I just realized that ^ sounds like a tragically bad pickup line.]
- soared 8y ago~30% of submissions are software-dev-only (new typescript 3.0 release), but most submissions are just high quality, interesting posts. And the level of discussion is excellent - no memes, no jokes. Its like the opposite of reddit.
- zitterbewegung 8y agoHN is not a monoculture the appropriate stuff on the site can interested anyone and no one is required to be a software developer to get on this website.
- setr 8y agoNobody is required to be anything on any public forum; that doesn’t change the fact that communities exist, and the vast majority of people on a forum are there due a particular taste, and share a common preference for discussion. That anyone of any interest can visit the webpage is not a sufficient explanation as to why anyone of any interest do visit it. The question is whats so special about HN that draws such a varied background, despite it clearly having its strongest preference towards software engineering (on any given day, if you counted by category, it would be surprising to find software engineering / programming not as the highest). A reddit forum has the same public property, but the software engineering channels presumably do not draw such varied backgrounds. So why?
- saudioger 8y agoUhh that's kind of terrifying. I'm due for a new car after 10 years, and I think I might specifically try to avoid the systems that centralize things like breaks with entertainment systems...
- lanius 8y agoYikes. I'm not a prepper, but there is something to be said for older vehicles without this unnecessary computer nonsense.
- thrillgore 8y agoWhy aren't these systems just plain air gapped?
- jacobush 8y agoThis is just ... outlandish. You couldn't make this shit up with a straight face.
- samstave 8y agoQuestion from the ignorant: What % of a 24-hour day is any given commercial airliner in service, vs. sitting completely turned off in a "parking" spot?
- sitkack 8y agoMost modern things don't ever "turn off".