5 ms·

The only thing holding me back from a yes vote is the availability of detailed location data to 3rd parties. Can a mechanic sell this data? Can it be subpoenaed

The only thing holding me back from a yes vote is the availability of detailed location data to 3rd parties. Can a mechanic sell this data? Can it be subpoenaed by police?

hprotagonist 6y ago
would you prefer that only centralized data warehouses like Officially Sanctioned Dealerships have access to this data instead? That seems worse.
- geophile 6y ago
  I prefer that they don't have it either, but that's not a choice. But if every garage in the state has access to this data, it seems like a much bigger risk.
  - munk-a 6y ago
    I don't know - it seems like you're assuming that authorized dealerships are a lot more trustworthy than general repair shops. That authorization is usually more "expensive" rather than "difficult" to acquire so a lot of the smaller shops have struggled to secure it. I think one way to read the decrease in volume is that - yea it'd sure be nice if six fewer dealerships had access to this information, so why don't we make sure they all get forced to close their doors because the automakers don't want competition - there would be fewer in count, but that doesn't really speak to the security of that data at all (additionally, most of the sensitive data you probably care about doesn't appear to be on the table for this bill - specifically telemetry about driving habits doesn't appear to be under consideration)
  - elihu 6y ago
    The bill only requires the auto manufacturer to make the data available to a third party if they have consent from the vehicle owner to do so. https://ballotpedia.org/Massachusetts_Question_1,_%22Right_to_Repair_Law%22_Vehicle_Data_Access_Requirement_Initiative_(2020) https://ballotpedia.org/Massachusetts_Question_1,_%22Right_t...
  - hprotagonist 6y ago
    centralized warehousing is a security threat, not a bonus. It just paints a big fat target on Toyota that screams "compromise us, we have so much PII it's almost embarrasing"
    - mindslight 6y ago
      I don't know that centralized warehousing is relevant here, given that the systems seemingly rely on centralized silos regardless. But keeping the system dealership-only will encourage security by obscurity (eg one master login per dealership that can then access any car), whereas opening it up will force automakers to design their system for fine grained security.
  - mangoman 6y ago
    There's not a database of location data that all garage's can access. It's mainly about making it so that car manufacturers can't design car computers in a way that in a way that impedes independent shops from doing repairs without paying the manufacturers for access (think like custom data access protocols, or obfuscation that's only readable after paying Honda a monthly massive fee). This is the battle that farmers are fighting against john deere. Actually, if the data is only accessible to a few authorized shops, that's when the data is especially likely to be sold. Data is really only valuable in aggregate - if more shops can service cars, then each shop really gets less access to aggregated car data. More choice means less centralization of the data which means it's more difficult to collect enough data for it to be sold. I think the car manufacturers are the ones who are hoping to monetize the data, and that's why they're trying to restrict access.
- nerdponx 6y ago
  This. Most arguments against 1 that I've seen are arguments against telematics in general.
teeray 6y ago
Also in the same vein...can insurance companies get it? Progressive has been trying to hawk that OBD-II spy box for ages now, and this would seem to be a gold mine for all of them.
dmqctx 6y ago
What use is location based information to a repair shop? Is it simply that opening up this dealer-only content to 3rd parties will in turn share the location data? I can't see any benefit in sharing location specific info to a shop. Why not have the bill insulate that type of data...walled off, for dealer and owner only to access.
- jrumbut 6y ago
  Of no use to them, but perhaps a valuable thing they can sell to others (insurance companies, marketers, spies, etc). I'd really rather my car not gather that much data to start with. My phone provides all the mobile compute and navigation (and privacy invasion) I need. I don't think historical telemetry data of any kind is going to deliver extra value to me, the car owner. Every extra feature in a car is just another thing that breaks.
  - bbarnett 6y ago
    This. This, this, this. Worse, it doesn't give you extra value, it detracts value. It's info about you, out of your control, yet unlike gmail, which is free, you've paid cold hard cash to be tracked. I think what we need is just an "everything" bill. If you pay ANYTHING for the hardware, then you control EVERYTHING. The full stack. You can't sell it, the code isn't yours, but by rights you get the full dev kit for the entire OS. This is the only way forward. The only way to stop all spying, show everything malicious being done to end users, and ensure I can repair anything borked down the road.
    - bbarnett 6y ago
      Amusing, IMMEDIATE downvote by closed-source advocates.
      - nkurz 6y ago
        More likely, it's your phrasing and typography that is causing downvotes rather than your ideology. Using capitals for emphasis violates the guidelines (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html), and for many people, starting with repeated this's pattern-matches to a low quality comment. You might ask yourself if your style is conducive to the message you are trying to convey.
lsllc 6y ago
I'm not really sure I understand what location data has to do with right to repair? Do you mean because now some OnStar type API must be documented "for repair"? (if so, I'd argue that security through obscurity is little to no security at all and I'd hope that your API is properly secured. For example just because the Google email API is documented doesn't mean people suddenly can read my email!)

The only thing holding me back from a yes vote is the availability of detailed location data to 3rd parties. Can a mechanic sell this data? Can it be subpoenaed by police?

hprotagonist 6y ago

would you prefer that only centralized data warehouses like Officially Sanctioned Dealerships have access to this data instead? That seems worse.

geophile 6y ago
I prefer that they don't have it either, but that's not a choice. But if every garage in the state has access to this data, it seems like a much bigger risk.
- munk-a 6y ago
  I don't know - it seems like you're assuming that authorized dealerships are a lot more trustworthy than general repair shops. That authorization is usually more "expensive" rather than "difficult" to acquire so a lot of the smaller shops have struggled to secure it. I think one way to read the decrease in volume is that - yea it'd sure be nice if six fewer dealerships had access to this information, so why don't we make sure they all get forced to close their doors because the automakers don't want competition - there would be fewer in count, but that doesn't really speak to the security of that data at all (additionally, most of the sensitive data you probably care about doesn't appear to be on the table for this bill - specifically telemetry about driving habits doesn't appear to be under consideration)
- elihu 6y ago
  The bill only requires the auto manufacturer to make the data available to a third party if they have consent from the vehicle owner to do so. https://ballotpedia.org/Massachusetts_Question_1,_%22Right_to_Repair_Law%22_Vehicle_Data_Access_Requirement_Initiative_(2020) https://ballotpedia.org/Massachusetts_Question_1,_%22Right_t...
- hprotagonist 6y ago
  centralized warehousing is a security threat, not a bonus. It just paints a big fat target on Toyota that screams "compromise us, we have so much PII it's almost embarrasing"
  - mindslight 6y ago
    I don't know that centralized warehousing is relevant here, given that the systems seemingly rely on centralized silos regardless. But keeping the system dealership-only will encourage security by obscurity (eg one master login per dealership that can then access any car), whereas opening it up will force automakers to design their system for fine grained security.
- mangoman 6y ago
  There's not a database of location data that all garage's can access. It's mainly about making it so that car manufacturers can't design car computers in a way that in a way that impedes independent shops from doing repairs without paying the manufacturers for access (think like custom data access protocols, or obfuscation that's only readable after paying Honda a monthly massive fee). This is the battle that farmers are fighting against john deere. Actually, if the data is only accessible to a few authorized shops, that's when the data is especially likely to be sold. Data is really only valuable in aggregate - if more shops can service cars, then each shop really gets less access to aggregated car data. More choice means less centralization of the data which means it's more difficult to collect enough data for it to be sold. I think the car manufacturers are the ones who are hoping to monetize the data, and that's why they're trying to restrict access.
nerdponx 6y ago
This. Most arguments against 1 that I've seen are arguments against telematics in general.

teeray 6y ago

Also in the same vein...can insurance companies get it? Progressive has been trying to hawk that OBD-II spy box for ages now, and this would seem to be a gold mine for all of them.

dmqctx 6y ago

What use is location based information to a repair shop? Is it simply that opening up this dealer-only content to 3rd parties will in turn share the location data? I can't see any benefit in sharing location specific info to a shop. Why not have the bill insulate that type of data...walled off, for dealer and owner only to access.

jrumbut 6y ago
Of no use to them, but perhaps a valuable thing they can sell to others (insurance companies, marketers, spies, etc). I'd really rather my car not gather that much data to start with. My phone provides all the mobile compute and navigation (and privacy invasion) I need. I don't think historical telemetry data of any kind is going to deliver extra value to me, the car owner. Every extra feature in a car is just another thing that breaks.
- bbarnett 6y ago
  This. This, this, this. Worse, it doesn't give you extra value, it detracts value. It's info about you, out of your control, yet unlike gmail, which is free, you've paid cold hard cash to be tracked. I think what we need is just an "everything" bill. If you pay ANYTHING for the hardware, then you control EVERYTHING. The full stack. You can't sell it, the code isn't yours, but by rights you get the full dev kit for the entire OS. This is the only way forward. The only way to stop all spying, show everything malicious being done to end users, and ensure I can repair anything borked down the road.
  - bbarnett 6y ago
    Amusing, IMMEDIATE downvote by closed-source advocates.
    - nkurz 6y ago
      More likely, it's your phrasing and typography that is causing downvotes rather than your ideology. Using capitals for emphasis violates the guidelines (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html), and for many people, starting with repeated this's pattern-matches to a low quality comment. You might ask yourself if your style is conducive to the message you are trying to convey.

lsllc 6y ago

I'm not really sure I understand what location data has to do with right to repair? Do you mean because now some OnStar type API must be documented "for repair"? (if so, I'd argue that security through obscurity is little to no security at all and I'd hope that your API is properly secured. For example just because the Google email API is documented doesn't mean people suddenly can read my email!)