4 ms·

You have to feel for the developer here, they knew they were taking a risk in using an unauthorized API, but they went for it anyway and now they are facing the

You have to feel for the developer here, they knew they were taking a risk in using an unauthorized API, but they went for it anyway and now they are facing the music. I understand Apple's position here, especially with APIs that control vehicles. It's just a sad fact that Tesla hasn't provided a safe public API to control their cars.

dylan604 6y ago
> to control their cars. This sentence scars the bejeebus out of me to think this could even be a thing. If you mean to control things like entertainment system, then maybe i'm okay with that. But I would not consider that controlling the car
- vaidhy 6y ago
  IIRC, GMC was hacked using an exploit in their Bluetooth stack in the entertainment system through which they got access to OBD controller. All parts of the car are more interconnected than what people generally think. From a security standpoint, remote opens up a wide attack surface.
  - tinus_hn 6y ago
    Allowing the API to exist but not allowing people to use it does not close that attack surface.
- tonyedgecombe 6y ago
  Imagine some malware infecting the fleet that decides to take them all out for a joy ride on the same day.
  - dzhiurgis 6y ago
    Yeah, imagine
- nick_kline 6y ago
  It's not driving it. It's controlling the entertainment system, which includes things like AC/heater, charging or not (you have to be plugged in), closing or cracking the sunroof, looking at the state of charge. You can also unlock the doors. You have to get an otp token based on your name and password. People reverse engineered the tesla api from looking at what the app does. There are two concerns I have with the tesla system. 1. They only allow for tokens that take a very long time to expire, it's something like 3 months. 2. Although a few of these apps allow you to get the token on your own and send it to them (thus not exposing your password), that's too technically demanding for most users and so most of the apps have you get a token by giving your email/password, thus you expose it to them. For those that don't know, Tesla pays people for security vulnerabilities, welcomes hacker attempts, they disclose things after they fix them, there's a list of the things and people who found them at their website, etc. There is a separate computer system for the drive train that is not accessible through this system.
dawnerd 6y ago
What exactly is unsafe about their API now? It's not like you can drive the car with it.
- lalo2302 6y ago
  I think you are underestimating what the electronics on the car control. The speed, the breaks and how they behave. when you crash, the airbags, the cooling system, how the steering wheel moves, etc... It might not be able to drive itself, but it can definitely control how fast and its direction, which would be super scary for some random dev to have any impact on.
  - dawnerd 6y ago
    I use the api and there’s none of that in the api which is why I ask. It sounds like you’re just guessing it’s something it can do. The only thing that allows the car to be driven with is summon mode but that requires you to be within a set range and as far as I know hasn’t been reverse engineered.
    - nick_kline 6y ago
      That's correct, the drivetrain is completely separate from what you can access from the outside.
paul_f 6y ago
Tesla did not create, nor "owns" the API. And if the API is open such that anyone can use, it seems the developer does have permissions to use the API. If we require that every single entity between a mesh of APIs and all of the data or systems they control must give permission, this is simply unworkable. It's APIs all the way down. Frankly, this is Apple arbitrarily choosing apps they don't like and findng a loophole to block it.

dylan604 6y ago

> to control their cars. This sentence scars the bejeebus out of me to think this could even be a thing. If you mean to control things like entertainment system, then maybe i'm okay with that. But I would not consider that controlling the car

vaidhy 6y ago
IIRC, GMC was hacked using an exploit in their Bluetooth stack in the entertainment system through which they got access to OBD controller. All parts of the car are more interconnected than what people generally think. From a security standpoint, remote opens up a wide attack surface.
- tinus_hn 6y ago
  Allowing the API to exist but not allowing people to use it does not close that attack surface.
tonyedgecombe 6y ago
Imagine some malware infecting the fleet that decides to take them all out for a joy ride on the same day.
- dzhiurgis 6y ago
  Yeah, imagine
nick_kline 6y ago
It's not driving it. It's controlling the entertainment system, which includes things like AC/heater, charging or not (you have to be plugged in), closing or cracking the sunroof, looking at the state of charge. You can also unlock the doors. You have to get an otp token based on your name and password. People reverse engineered the tesla api from looking at what the app does. There are two concerns I have with the tesla system. 1. They only allow for tokens that take a very long time to expire, it's something like 3 months. 2. Although a few of these apps allow you to get the token on your own and send it to them (thus not exposing your password), that's too technically demanding for most users and so most of the apps have you get a token by giving your email/password, thus you expose it to them. For those that don't know, Tesla pays people for security vulnerabilities, welcomes hacker attempts, they disclose things after they fix them, there's a list of the things and people who found them at their website, etc. There is a separate computer system for the drive train that is not accessible through this system.

dawnerd 6y ago

What exactly is unsafe about their API now? It's not like you can drive the car with it.

lalo2302 6y ago
I think you are underestimating what the electronics on the car control. The speed, the breaks and how they behave. when you crash, the airbags, the cooling system, how the steering wheel moves, etc... It might not be able to drive itself, but it can definitely control how fast and its direction, which would be super scary for some random dev to have any impact on.
- dawnerd 6y ago
  I use the api and there’s none of that in the api which is why I ask. It sounds like you’re just guessing it’s something it can do. The only thing that allows the car to be driven with is summon mode but that requires you to be within a set range and as far as I know hasn’t been reverse engineered.
  - nick_kline 6y ago
    That's correct, the drivetrain is completely separate from what you can access from the outside.

paul_f 6y ago

Tesla did not create, nor "owns" the API. And if the API is open such that anyone can use, it seems the developer does have permissions to use the API. If we require that every single entity between a mesh of APIs and all of the data or systems they control must give permission, this is simply unworkable. It's APIs all the way down. Frankly, this is Apple arbitrarily choosing apps they don't like and findng a loophole to block it.