4 ms·

There are a ton of trade secrets in the interesting parts of a car (ECUs) that will basically never be released. But for infotainment, there are competing effor

There are a ton of trade secrets in the interesting parts of a car (ECUs) that will basically never be released. But for infotainment, there are competing efforts to standardize on that front but it's slow from what I've observed. Decisions about components + software are made way in advance of the car being made, so softwarey type things are outdated by the time they come out. That is changing though

AnthonyMouse 7y ago
The trade secret argument is silly. As if it really matters if it takes your competitors a month to reverse engineer it from disassembling a binary instead of a week if you publish the source code. You can't mass produce something with a secret in it and expect it to stay a secret. > Decisions about components + software are made way in advance of the car being made, so softwarey type things are outdated by the time they come out. They're doing this wrong. You have an infotainment system which is basically a PC/tablet built into the dash. It should be completely open. Like you should be able to rip it out and replace it with an actual PC or tablet running entirely third party software and it should still be able to do everything. Then it should talk to all the other parts of the car over ethernet using published standards, no secret APIs. Not publishing the code for the ECU is silly but that allows them to do it and not have that infect everything else in the car, because its internals can be a black box but all the public interfaces aren't. Then it doesn't matter how outdated your infotainment system is because anybody can install the latest version after the fact or replace it with an entirely third party one and all you need is a "driver" that translates the API version used by the ECU and other vehicle components into something that infotainment system can work with.
- ehnto 7y ago
  There is already a standard for this called CANBUS, we just need auto manufacturers to use it more extensively so aftermarket devices can talk to it.
- ironman1478 7y ago
  You actually can mass produce tons of stuff with trade secrets! A lot of systems aren't easy to access and wouldn't necessarily be debuggable with normal tools, depending on th age of the car. For new cars, they are work on basically building devices with no interface except the communication channel, and to access it you'd have to reverse engineer the protocol, which is not trivial I can assure you. For infotainment, its not actually as easy as you think. Its definitely rated QM or maybe ASIL-A because it can do things like control climate or on some cars put it into different modes. Failures in these systems might not be catastrophic, but they need to be correct to some degree and failure or poor design, can lead to this https://www.google.com/amp/s/www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/amp https://www.google.com/amp/s/www.wired.com/2015/07/hackers-r... Granted, should they have connected everything the way they did? No, but car companies are barely engineering firms, they are just basically assembly firms that contract out all their components except for things like the ECUs. If they don't know how to specify security requirements to a vendor, it won't happen. They are learning though and it takes time.

AnthonyMouse 7y ago

The trade secret argument is silly. As if it really matters if it takes your competitors a month to reverse engineer it from disassembling a binary instead of a week if you publish the source code. You can't mass produce something with a secret in it and expect it to stay a secret. > Decisions about components + software are made way in advance of the car being made, so softwarey type things are outdated by the time they come out. They're doing this wrong. You have an infotainment system which is basically a PC/tablet built into the dash. It should be completely open. Like you should be able to rip it out and replace it with an actual PC or tablet running entirely third party software and it should still be able to do everything. Then it should talk to all the other parts of the car over ethernet using published standards, no secret APIs. Not publishing the code for the ECU is silly but that allows them to do it and not have that infect everything else in the car, because its internals can be a black box but all the public interfaces aren't. Then it doesn't matter how outdated your infotainment system is because anybody can install the latest version after the fact or replace it with an entirely third party one and all you need is a "driver" that translates the API version used by the ECU and other vehicle components into something that infotainment system can work with.

ehnto 7y ago
There is already a standard for this called CANBUS, we just need auto manufacturers to use it more extensively so aftermarket devices can talk to it.
ironman1478 7y ago
You actually can mass produce tons of stuff with trade secrets! A lot of systems aren't easy to access and wouldn't necessarily be debuggable with normal tools, depending on th age of the car. For new cars, they are work on basically building devices with no interface except the communication channel, and to access it you'd have to reverse engineer the protocol, which is not trivial I can assure you. For infotainment, its not actually as easy as you think. Its definitely rated QM or maybe ASIL-A because it can do things like control climate or on some cars put it into different modes. Failures in these systems might not be catastrophic, but they need to be correct to some degree and failure or poor design, can lead to this https://www.google.com/amp/s/www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/amp https://www.google.com/amp/s/www.wired.com/2015/07/hackers-r... Granted, should they have connected everything the way they did? No, but car companies are barely engineering firms, they are just basically assembly firms that contract out all their components except for things like the ECUs. If they don't know how to specify security requirements to a vendor, it won't happen. They are learning though and it takes time.