7 ms·

Isn't it about time all software/hardware in cars should be required to be open-source? There should be no room for secret functionality on something as pervasi

by deogeo 7y ago

Isn't it about time all software/hardware in cars should be required to be open-source? There should be no room for secret functionality on something as pervasive and dangerous as cars and trucks. Especially if it's also kept secret from their supposed owners.

thepangolino 7y ago
Absolutely this. I’m still one of those who think that what Volkswagen did wasn’t cheating anything. They basically “studied for the test” in order to pas it.
- Ihfhcub 7y ago
  Yea that's why 6 executives are being charged with criminal fraud because all they were doing was studying for a test
  - VBprogrammer 7y ago
    While I think that 'studying for a test' is a pretty charitable interpretation of events I think the parent has a point. While making it clear to car makers that there is a line which they can't cross is a good thing; I think serious though should have gone into making the test less easy to game in the first place. I suspect similar cheats are employed all over the industry. For example my motorcycle has a dead spot which people have been known to bypass the clutch switch to avoid. The reason for the dead spot is that the noise test is carried out at a specific speed and by programming a dead zone in the fuel map they can make it pass the test. The only real difference between this an the VW emissions scandal is that everyone has to suffer the consequences of cheating the test!
    - vageli 7y ago
      > While I think that 'studying for a test' is a pretty charitable interpretation of events I think the parent has a point. While making it clear to car makers that there is a line which they can't cross is a good thing; I think serious though should have gone into making the test less easy to game in the first place. > I suspect similar cheats are employed all over the industry. For example my motorcycle has a dead spot which people have been known to bypass the clutch switch to avoid. The reason for the dead spot is that the noise test is carried out at a specific speed and by programming a dead zone in the fuel map they can make it pass the test. Can you go into more specifics about this? I used to ride and am embarrassed that I have no idea about this "dead spot" you are referring to.
      - VBprogrammer 7y ago
        Just a little dip in the power output. I can't say I've ever noticed it but it's apparently visible on a Dyno trace. It only happens in first and second gear from what I remember.
  - dang 7y ago
    "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - arbitrage 7y ago
      Oh shit, you quoted the rules! You'll definitely get an apology, now.
- toss1 7y ago
  That is just the sort of thing could come down to the details of how the law was written. Example A: "Each model of this type of car must pass Test X with numbers lower than listed in Table Y" Example B: "The cars must have emissions lower than listed in Table Y. The standard test may be Test X" If it is written like Example A, then sure, the entire specification is the test, they merely designed to the rule. But if it's more like Example B, then they are toast. The cars clearly don't ordinarily have emissions lower than Table Y, they are merely engineered to appear to do so during the specific conditions of Test X. If there is one thing I've learned about the law from the excellent attny who will soon also be my wife, it is that you cannot reason about the law without reading it. Logic and assumptions will not help you -- you have to look at the law itself. It is actually a lot like software. Our guesses about the behavior might be OK for very limited purposes, but we really don't know jack until we trace it in a debugger or read the source. (tracing & reading source might be considered analogous to reading the cases and reading the law & regs)
- JaRail 7y ago
  That's like only installing airbags in the cars you send to accident testing.
  - dsfyu404ed 7y ago
    More like having airbags that only go off at forces at or above the test forces. Consumers are happy because of reduced cost of ownership but the regulators and the safety crowd hand wring over the unnecessary black eyes it causes.
- hef19898 7y ago
  There is a difference so. Other car makers used temperature based exceptions in their motor control software. All of them also optimize for fuel consumption tests using different tires, barebone cars, tire pressure etc... Thing is all this test optimization is actually legal and covered by the rules. Since everyone is doing it test results are comparable as well. VW did something different. They installed defeat devices that are explicitly illegal. And they knew it as shown in documents and mails. VW also pled guilty in the US already. So, while both things are on the surface similar they are yet fundamentally different.
  - rurban 7y ago
    No, VW did nothing. They have no business with engine control software, they get their engines from the mothership: Audi. And if you still don't know it, every single Diesel engine with this most common Bosch ECU has this cheating SW. The problem is only if you use it or not. 80% do use it. From all European cars only Fiat didn't use it, if I remember correctly. Most Asians did use it also. You are saying VW installed it. No, Bosch installed it on their devices. And it was written by Audi.
    - Xixi 7y ago
      Audi belongs to Volkswagen Group. That makes Volkswagen Group ultimately responsible for everything it ships, whether it's done internally, by Bosch, or by an outsourcing firm in Elbonia.
      - rurban 7y ago
        Now who's the owner of the Volkswagen Group? For some time there was a struggle between Audi and Porsche, but eventually Audi won. They are the mothership. Who's responsible? You still are of the impression that only VW uses this cheating device. Everyone is using it. Responsible for this device is Bosch.
        hef19898 7y ago
        Audi is, and was for a long time now, a 100% subsidiery from VW. The struggle you mention was one between Porsche SA and VW as much as it was one between the two Porsche family branches, Porsche and Piech. In the end VW kind of won and Porsche the automaker joined the VW group while the Porsche Holding became the (biggest) shareholder of VW group (including brands like Audi, Bugatti, Skoda, Seat, VW, Scania and MAN). Audi was a major supplier of Diesel engines for the whole group, especially the larger ones which also ended up in Porsche Cayennes. The smaller Diesel engines came AFAIK from VW. True, the software came from Bosch and can arguably be used for development purposes. The exact role of Bosch in all of this is still not clear. The only companies found to be using the Bosch supplied software as an illegal cheat device is VW so far. Maybe Mercedes did as well. BMW was, as if now, more or less cleared of illegal wrong doing. They still had to pay fines, so. Other car makers are, as far as we now today, "only" using the legal loop holes. Still shitty behavior but at least legal. PSA (Peugeot, Citroen, DS and as of last year Opel) are themselves a major Diesel engine supplier and while they paid fines as well, if I remember correctly, they didn't use defeat devices. EDIT: For clarity, PSA wasn't found to use defeat devices. They had to pay fines in France AFAIK.
londons_explore 7y ago
Yes, but that won't solve the issue. The issue is regulators write regulations for one thing, but want a subtly different thing. If you and I start a game of poker, but rather than winning through skill, I call the FBI and get them to search all your cards, have I broken the rules of poker? It wasn't a written rule not to call the FBI... Regulators across the world have similar gaps in the rules, and both humans and automated design tools will start to exploit them, possibly unknowingly. Instead they need to make far more watertight rules. They should simply require all cars to measure their own emissions, and bill the companies for any cars which either mis-measure emissions, or measure more emissions in their lifetime than an allowed limit. Then manufacturers will have an incentive to upgrade cars in the field.
- adrianN 7y ago
  That's a good idea, but as far as I know many (most?) emissions are a bit tricky to measure. You need fairly bulky equipment.
  - losteric 7y ago
    They're bulky because there is no demand for smaller devices.
    - vageli 7y ago
      > They're bulky because there is no demand for smaller devices. Since when is demand sufficient to bring something into existence?
- thefounder 7y ago
  Well we know how self regulation worked for Boeing. Now I could see software that registers less emissions than they actually produce and we are back to square one.
- legulere 7y ago
  The problem simply is that most things are very hard to measure directly if not impossible. "When a measure becomes a target, it ceases to be a good measure." https://en.wikipedia.org/wiki/Goodhart%27s_law https://en.wikipedia.org/wiki/Goodhart%27s_law
arendtio 7y ago
Actually, I would not limit it to cars and trucks. In my opinion, every consumer device that contains software should come with the source code for the software that is installed by default (aka required to use it). But I doubt that any popular politician will have the guts to push such a bill against all the industry lobbies :-/
- thfuran 7y ago
  Should all consumer devices also be required to ship with complete schematics and manufacturing and assembly instructions?
  - arendtio 7y ago
    Well, I don't think there is much value for consumers in manufacturing instructions, but assembly instructions could be useful to repair the devices. I am so tired of replacing devices just because you can't fix broken software that I see very few alternatives to forcing the manufacturers by law. Just to give an example: The Samsung Galaxy S3 was shipped with a firmware bug [1] that killed the memory occasionally (just the layout of some internal table so the hardware was completely okay). Sure, when it happened during the warranty period, it wasn't good for Samsung but afterward, you thought your hardware was broken when in fact just the software was broken (and a factory reset doesn't fix firmware internals). The reason we even know about that bug is that someone disassembled the firmware years after the device had a relevant market share. If the source code for the firmware would have been available, the bug probably would have been made public much earlier and a lot of broken devices would have been repairable. So I totally understand that manufacturers want to keep some things secret about their products but as a consumer, I feel betrayed when the devices I buy contain time bombs encoded within their software... And since the manufacturers fail to bring recent updates to the devices even during the warranty period, I think it might be a valid option to enable consumers to care for their devices. [1]: https://media.ccc.de/v/34c3-8784-emmc_hacking_or_how_i_fixed_long-dead_galaxy_s3_phones https://media.ccc.de/v/34c3-8784-emmc_hacking_or_how_i_fixed...
    - mindslight 7y ago
Glawen 7y ago
What will be the differentiation between cars then ? The car industry is highly competitive. The first cars introduced by a company are bought by competitors who tear them down to see how it is made. However, with SW, they are not sure how it works, and usually the attempts to copy a functionality are bad compared to the original.
- MuffinFlavored 7y ago
  > they are not sure how it works Some (maybe most?) Mercedes units use a Bosch ECU. I'm pretty sure you can dump the firmware from them and figure out how they work fairly easily?
  - Glawen 7y ago
    They are not oblivious to what happens in tech. The firmware are encrypted and protected, it is not so easy, and they would need specialist for this. It is however much easier to do some social engineering or hire a bosch employee :). Mercedes, porsche and bosch all have their HQ in Stuttgart, I think it is quite easy for them to know what happens with competitors. Moreover now with Autosar, they scatter vehicle functionalities through ECUs, with each ECU doing a part of the functionality. It's getting really complex now. To understand the issue with reverse engineering, one needs to understand that there is no standard in car. Each brand and car has its own communication matrix and electrical architecture, which get periodically overhauled. So even if you manage to identify the meanings of the CAN frames for a make, it is useless for the next generation. That's why you do not find the communication matrix on internet for recent cars, you only find them somehow for old cars. Also because very few people know how to read CAN network and want to invest timr in this reverse engineering
    - MuffinFlavored 7y ago
      > The firmware are encrypted and protected, it is not so easy Excuse me if I sound ignorant but... aren't you able to put the ECUs into a special bootloader mode where you can dump the encryption/protection?

by deogeo 7y ago

thepangolino 7y ago

Absolutely this. I’m still one of those who think that what Volkswagen did wasn’t cheating anything. They basically “studied for the test” in order to pas it.

Ihfhcub 7y ago
Yea that's why 6 executives are being charged with criminal fraud because all they were doing was studying for a test
- VBprogrammer 7y ago
  While I think that 'studying for a test' is a pretty charitable interpretation of events I think the parent has a point. While making it clear to car makers that there is a line which they can't cross is a good thing; I think serious though should have gone into making the test less easy to game in the first place. I suspect similar cheats are employed all over the industry. For example my motorcycle has a dead spot which people have been known to bypass the clutch switch to avoid. The reason for the dead spot is that the noise test is carried out at a specific speed and by programming a dead zone in the fuel map they can make it pass the test. The only real difference between this an the VW emissions scandal is that everyone has to suffer the consequences of cheating the test!
  - vageli 7y ago
    > While I think that 'studying for a test' is a pretty charitable interpretation of events I think the parent has a point. While making it clear to car makers that there is a line which they can't cross is a good thing; I think serious though should have gone into making the test less easy to game in the first place. > I suspect similar cheats are employed all over the industry. For example my motorcycle has a dead spot which people have been known to bypass the clutch switch to avoid. The reason for the dead spot is that the noise test is carried out at a specific speed and by programming a dead zone in the fuel map they can make it pass the test. Can you go into more specifics about this? I used to ride and am embarrassed that I have no idea about this "dead spot" you are referring to.
    - VBprogrammer 7y ago
      Just a little dip in the power output. I can't say I've ever noticed it but it's apparently visible on a Dyno trace. It only happens in first and second gear from what I remember.
- dang 7y ago
  "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - arbitrage 7y ago
    Oh shit, you quoted the rules! You'll definitely get an apology, now.
toss1 7y ago
That is just the sort of thing could come down to the details of how the law was written. Example A: "Each model of this type of car must pass Test X with numbers lower than listed in Table Y" Example B: "The cars must have emissions lower than listed in Table Y. The standard test may be Test X" If it is written like Example A, then sure, the entire specification is the test, they merely designed to the rule. But if it's more like Example B, then they are toast. The cars clearly don't ordinarily have emissions lower than Table Y, they are merely engineered to appear to do so during the specific conditions of Test X. If there is one thing I've learned about the law from the excellent attny who will soon also be my wife, it is that you cannot reason about the law without reading it. Logic and assumptions will not help you -- you have to look at the law itself. It is actually a lot like software. Our guesses about the behavior might be OK for very limited purposes, but we really don't know jack until we trace it in a debugger or read the source. (tracing & reading source might be considered analogous to reading the cases and reading the law & regs)
JaRail 7y ago
That's like only installing airbags in the cars you send to accident testing.
- dsfyu404ed 7y ago
  More like having airbags that only go off at forces at or above the test forces. Consumers are happy because of reduced cost of ownership but the regulators and the safety crowd hand wring over the unnecessary black eyes it causes.
hef19898 7y ago
There is a difference so. Other car makers used temperature based exceptions in their motor control software. All of them also optimize for fuel consumption tests using different tires, barebone cars, tire pressure etc... Thing is all this test optimization is actually legal and covered by the rules. Since everyone is doing it test results are comparable as well. VW did something different. They installed defeat devices that are explicitly illegal. And they knew it as shown in documents and mails. VW also pled guilty in the US already. So, while both things are on the surface similar they are yet fundamentally different.
- rurban 7y ago
  No, VW did nothing. They have no business with engine control software, they get their engines from the mothership: Audi. And if you still don't know it, every single Diesel engine with this most common Bosch ECU has this cheating SW. The problem is only if you use it or not. 80% do use it. From all European cars only Fiat didn't use it, if I remember correctly. Most Asians did use it also. You are saying VW installed it. No, Bosch installed it on their devices. And it was written by Audi.
  - Xixi 7y ago
    Audi belongs to Volkswagen Group. That makes Volkswagen Group ultimately responsible for everything it ships, whether it's done internally, by Bosch, or by an outsourcing firm in Elbonia.
    - rurban 7y ago
      Now who's the owner of the Volkswagen Group? For some time there was a struggle between Audi and Porsche, but eventually Audi won. They are the mothership. Who's responsible? You still are of the impression that only VW uses this cheating device. Everyone is using it. Responsible for this device is Bosch.
      - hef19898 7y ago
        Audi is, and was for a long time now, a 100% subsidiery from VW. The struggle you mention was one between Porsche SA and VW as much as it was one between the two Porsche family branches, Porsche and Piech. In the end VW kind of won and Porsche the automaker joined the VW group while the Porsche Holding became the (biggest) shareholder of VW group (including brands like Audi, Bugatti, Skoda, Seat, VW, Scania and MAN). Audi was a major supplier of Diesel engines for the whole group, especially the larger ones which also ended up in Porsche Cayennes. The smaller Diesel engines came AFAIK from VW. True, the software came from Bosch and can arguably be used for development purposes. The exact role of Bosch in all of this is still not clear. The only companies found to be using the Bosch supplied software as an illegal cheat device is VW so far. Maybe Mercedes did as well. BMW was, as if now, more or less cleared of illegal wrong doing. They still had to pay fines, so. Other car makers are, as far as we now today, "only" using the legal loop holes. Still shitty behavior but at least legal. PSA (Peugeot, Citroen, DS and as of last year Opel) are themselves a major Diesel engine supplier and while they paid fines as well, if I remember correctly, they didn't use defeat devices. EDIT: For clarity, PSA wasn't found to use defeat devices. They had to pay fines in France AFAIK.

londons_explore 7y ago

Yes, but that won't solve the issue. The issue is regulators write regulations for one thing, but want a subtly different thing. If you and I start a game of poker, but rather than winning through skill, I call the FBI and get them to search all your cards, have I broken the rules of poker? It wasn't a written rule not to call the FBI... Regulators across the world have similar gaps in the rules, and both humans and automated design tools will start to exploit them, possibly unknowingly. Instead they need to make far more watertight rules. They should simply require all cars to measure their own emissions, and bill the companies for any cars which either mis-measure emissions, or measure more emissions in their lifetime than an allowed limit. Then manufacturers will have an incentive to upgrade cars in the field.

adrianN 7y ago
That's a good idea, but as far as I know many (most?) emissions are a bit tricky to measure. You need fairly bulky equipment.
- losteric 7y ago
  They're bulky because there is no demand for smaller devices.
  - vageli 7y ago
    > They're bulky because there is no demand for smaller devices. Since when is demand sufficient to bring something into existence?
thefounder 7y ago
Well we know how self regulation worked for Boeing. Now I could see software that registers less emissions than they actually produce and we are back to square one.
legulere 7y ago
The problem simply is that most things are very hard to measure directly if not impossible. "When a measure becomes a target, it ceases to be a good measure." https://en.wikipedia.org/wiki/Goodhart%27s_law https://en.wikipedia.org/wiki/Goodhart%27s_law

arendtio 7y ago

Actually, I would not limit it to cars and trucks. In my opinion, every consumer device that contains software should come with the source code for the software that is installed by default (aka required to use it). But I doubt that any popular politician will have the guts to push such a bill against all the industry lobbies :-/

thfuran 7y ago
Should all consumer devices also be required to ship with complete schematics and manufacturing and assembly instructions?
- arendtio 7y ago
  Well, I don't think there is much value for consumers in manufacturing instructions, but assembly instructions could be useful to repair the devices. I am so tired of replacing devices just because you can't fix broken software that I see very few alternatives to forcing the manufacturers by law. Just to give an example: The Samsung Galaxy S3 was shipped with a firmware bug [1] that killed the memory occasionally (just the layout of some internal table so the hardware was completely okay). Sure, when it happened during the warranty period, it wasn't good for Samsung but afterward, you thought your hardware was broken when in fact just the software was broken (and a factory reset doesn't fix firmware internals). The reason we even know about that bug is that someone disassembled the firmware years after the device had a relevant market share. If the source code for the firmware would have been available, the bug probably would have been made public much earlier and a lot of broken devices would have been repairable. So I totally understand that manufacturers want to keep some things secret about their products but as a consumer, I feel betrayed when the devices I buy contain time bombs encoded within their software... And since the manufacturers fail to bring recent updates to the devices even during the warranty period, I think it might be a valid option to enable consumers to care for their devices. [1]: https://media.ccc.de/v/34c3-8784-emmc_hacking_or_how_i_fixed_long-dead_galaxy_s3_phones https://media.ccc.de/v/34c3-8784-emmc_hacking_or_how_i_fixed...
  - mindslight 7y ago

Glawen 7y ago

What will be the differentiation between cars then ? The car industry is highly competitive. The first cars introduced by a company are bought by competitors who tear them down to see how it is made. However, with SW, they are not sure how it works, and usually the attempts to copy a functionality are bad compared to the original.

MuffinFlavored 7y ago
> they are not sure how it works Some (maybe most?) Mercedes units use a Bosch ECU. I'm pretty sure you can dump the firmware from them and figure out how they work fairly easily?
- Glawen 7y ago
  They are not oblivious to what happens in tech. The firmware are encrypted and protected, it is not so easy, and they would need specialist for this. It is however much easier to do some social engineering or hire a bosch employee :). Mercedes, porsche and bosch all have their HQ in Stuttgart, I think it is quite easy for them to know what happens with competitors. Moreover now with Autosar, they scatter vehicle functionalities through ECUs, with each ECU doing a part of the functionality. It's getting really complex now. To understand the issue with reverse engineering, one needs to understand that there is no standard in car. Each brand and car has its own communication matrix and electrical architecture, which get periodically overhauled. So even if you manage to identify the meanings of the CAN frames for a make, it is useless for the next generation. That's why you do not find the communication matrix on internet for recent cars, you only find them somehow for old cars. Also because very few people know how to read CAN network and want to invest timr in this reverse engineering
  - MuffinFlavored 7y ago
    > The firmware are encrypted and protected, it is not so easy Excuse me if I sound ignorant but... aren't you able to put the ECUs into a special bootloader mode where you can dump the encryption/protection?