5 ms·
Vulnerability in Tesla Website Used to Find Details of 8500 Cars in US Inventory
- Proven 8y agoHow is that a "vulnerability?" It doesn't let you do anything with it (except short the failed company's stock, but who didn't know Tesla is dead man walking) and a little bit of extra transparency may make Mr Must more honest.
- yellow24 8y agoNice! Great job just posting all of this online and not privately disclosing this to Tesla to fix. Keep up the good work on moving security back 2 steps.
- syntaxing 8y agoI wonder if you can use this to predict the Tesla stock price for Q1 (or Q2) of 2019. For instance, does a large influx of inventory mean that there's a good chance that they will beat their estimated earnings within Q1 or Q2? Since they converted their cash flow to so many assets, once the asset gets converted back into cash, Tesla's number should look great for that particular quarter (?). E: Hmm, Tesla sells over 16000 cars a month so these numbers might be insignificant.
- jason_slack 8y agobut shouldn't one backtest this with data from other quarters just to see if there are any technical indicators? :-) Nice thought, btw. Let's explore it. I shorted Tesla back in April and October 2018.
- Arzh 8y agoIs an open api really a vulnerability?
- Something1234 8y agoYes, if it goes against corporate policy... Security is like 90% policy.
- fenwick67 8y agoDo they really know these are actually sitting in inventory and "available for delivery"? You can't know if the API is actually giving you info on actual cars that were created and are sitting around.
- teej 8y agoI'll say this much as a new Tesla owner - they have at least 3 systems. Their internal system which drives anything you see on tesla.com or the app, Salesforce for tracking customer interactions and the source of truth for some order state, and third party freight platforms used for shipping cars around. These systems do not automatically sync and require human intervention to keep up to date. I originally test drove in Boston and placed my order there. I informed them I would take delivery on the west coast and they set that up for me. I later found out about the three systems when my car was weeks late for delivery. No one seemed to know where it was or where it was headed. Tesla's internal system said it was en route to Hayward, CA. Salesforce said it was headed to a different location that turned out doesn't do deliveries. The shipping company said the car was headed to New York. The car's GPS pinged it to a railroad track in Georgia. My experience is an outlier, but it does indicate that these APIs might not always be correct.
- tdhz77 8y agoI really don’t understand the hate towards Elon / Tesla on Twitter? Can somebody explain? I understand finding truth, but some of these truth finders seem like they go into the extremes to knit pick everything as evidence of their theory.. am I wrong? What am I not seeing? $Tesla vs TE$LAQ?
- rconti 8y agoGuy "joined twitter December 2018". eyeroll.
- newnewpdro 8y agoShort sellers bet on a stock like TSLA being severely overvalued, thus are incentivized to dig up all the dirt they can to compel the market to sell off their shares and drive down the stock price.
- compstricken 8y agoYeah, those few guys and all their FUD. As opposed to all of the institutional investors, VCs, employees, shareholders, car owners and Elon Musk himself (with the biggest pay package in history) who have a stake in saying, "Business is great, nothing to see here!"
- __blockcipher__ 8y agoBeware this narrative. There are many with legitimate concerns around fraudulent activity (SCTY acquisition, “funding secured” tweet), as well as Musk’s highly unstable behavior (pedophilia accusations, etc etc). It’s not solely those with financial incentive. And no, I’m not a Tesla hater. Just someone who wishes Tesla lived up to their own image.
- newnewpdro 8y agoIt's not like I said shorts invent illegitimate claims. They're just the most incentivized to dig it up and make it as visible as possible. In my experience it's quite often legitimate, though frequently blown out of proportion for obvious reasons.
- danhak 8y agoSo...about 1.5 weeks of production at current levels? https://www.bloomberg.com/graphics/2018-tesla-tracker https://www.bloomberg.com/graphics/2018-tesla-tracker ...and significantly less than that when subtracting display models, test drive and loaner fleet. The 8,500 figure doesn't seem alarming to me. Can anyone shed light on why OP is spiking the football as if he's uncovered some huge scandal?
- dajohnson89 8y agoweird -- when i first read "spiking the football" i thought you were referring to the clock-stopping spike [0]. But clearly you meant the celebratory spike. I wonder if there's a better verb for the celebration spike. :-) [0]: https://en.wikipedia.org/wiki/Spike_(gridiron_football) https://en.wikipedia.org/wiki/Spike_(gridiron_football)
- giarc 8y agoLikely has to do with the tweet most of the way down [0]. However, that tweet has to do with used models and the rest of the tweet storm seems to deal with new models... unless I'm missing something. https://twitter.com/JakeLangford6/status/1097688650035462144 https://twitter.com/JakeLangford6/status/1097688650035462144
- reitzensteinm 8y agoThey stopped producing US cars on Jan 2 (resuming relatively recently), so if the data is real, it means that they haven't been able to clear the backlog in the last 1.5 months, even after dropping prices across the board $3100 (almost matching the tax credit reduction). If the data is real, that's really not great. They're in real danger of building too many cars. The cars are going to get $3750 more expensive over the next nine months. But Tesla still has two demand levers left: leases and the standard range. Personally I think they'll be fine, but they're skating very close to the edge and a single mistake from here on in (as big as the SC acquisition or the fully automated factory walkback) could prove fatal.
- omarforgotpwd 8y agoAverage for other companies is 65 days of production. Currently at 69
- Dirlewanger 8y agoWhy would anyone own any Internet-connected vehicle in their current states? New vulnerabilities are found every other week. Why are there 0 safety standards around this? You'd think regulatory bodies would take something like connecting metal death boxes to the Internet more seriously, but it doesn't help when they're staffed either with useless idiot boomers who struggle with opening Excel files or uncaring lobbyists who were working in the private sector the year before.
- dang 8y ago> useless idiot boomers In addition to what I just asked you (https://news.ycombinator.com/item?id=19210265 https://news.ycombinator.com/item?id=19210265), please don't post slurs like this to HN.
- rconti 8y agoNotice this guy joined Twitter in December. There was a similar "order site" hack back when we were waiting for delivery of our car. I can't remember precisely, but there was a way of finding some hidden status info in the JSON. I'm extremely suspicious of his conclusions -- particularly the one saying there are tons of RWD Long Range cars just sitting around for... reasons. It doesn't pass the sniff test. They stopped making them last year -- he says October, I thought it was even earlier. You're telling me, at the end of the summer, when they were just catching up with demand, they discontinued the LR, and just haven't bothered to try to sell any of them since then? Nobody's willing to pay a few thousand more than the MR for the LR battery? Nobody's willing to save a few thousand on an AWD LR, by dropping the 2nd motor? Let's be really clear here -- Tesla is NOT SELLING an RWD LR 3 in the US at this stage. The claim that they have them in inventory but aren't selling them just beggars belief. To what end? To drive slightly higher margins on the AWD LR 3? At the cost of having inventory just sitting around rotting? I also wonder if he's sure they're US cars. For 3 weeks solid I saw at least one transporter full of Euro-spec 3s going up 101 to SF to be shipped overseas. Some days I saw 2 or even 3 transporters, which is impressive since I only spend maybe 30mins a day on 101. I'm sure as US demand softened, they built up inventory of cars to ship to Europe where there's still pent-up demand, so maybe that's what the inventory was? Clearly the tweeter is claiming demand is so soft that they can't sell them, and I certain't don't think this purported excess of LR RWD inventory holds water.