4 ms·

I prefer that they don't have it either, but that's not a choice. But if every garage in the state has access to this data, it seems like a much bigger risk.

munk-a 6y ago
I don't know - it seems like you're assuming that authorized dealerships are a lot more trustworthy than general repair shops. That authorization is usually more "expensive" rather than "difficult" to acquire so a lot of the smaller shops have struggled to secure it. I think one way to read the decrease in volume is that - yea it'd sure be nice if six fewer dealerships had access to this information, so why don't we make sure they all get forced to close their doors because the automakers don't want competition - there would be fewer in count, but that doesn't really speak to the security of that data at all (additionally, most of the sensitive data you probably care about doesn't appear to be on the table for this bill - specifically telemetry about driving habits doesn't appear to be under consideration)
elihu 6y ago
The bill only requires the auto manufacturer to make the data available to a third party if they have consent from the vehicle owner to do so. https://ballotpedia.org/Massachusetts_Question_1,_%22Right_to_Repair_Law%22_Vehicle_Data_Access_Requirement_Initiative_(2020) https://ballotpedia.org/Massachusetts_Question_1,_%22Right_t...
hprotagonist 6y ago
centralized warehousing is a security threat, not a bonus. It just paints a big fat target on Toyota that screams "compromise us, we have so much PII it's almost embarrasing"
- mindslight 6y ago
  I don't know that centralized warehousing is relevant here, given that the systems seemingly rely on centralized silos regardless. But keeping the system dealership-only will encourage security by obscurity (eg one master login per dealership that can then access any car), whereas opening it up will force automakers to design their system for fine grained security.
mangoman 6y ago
There's not a database of location data that all garage's can access. It's mainly about making it so that car manufacturers can't design car computers in a way that in a way that impedes independent shops from doing repairs without paying the manufacturers for access (think like custom data access protocols, or obfuscation that's only readable after paying Honda a monthly massive fee). This is the battle that farmers are fighting against john deere. Actually, if the data is only accessible to a few authorized shops, that's when the data is especially likely to be sold. Data is really only valuable in aggregate - if more shops can service cars, then each shop really gets less access to aggregated car data. More choice means less centralization of the data which means it's more difficult to collect enough data for it to be sold. I think the car manufacturers are the ones who are hoping to monetize the data, and that's why they're trying to restrict access.

munk-a 6y ago

I don't know - it seems like you're assuming that authorized dealerships are a lot more trustworthy than general repair shops. That authorization is usually more "expensive" rather than "difficult" to acquire so a lot of the smaller shops have struggled to secure it. I think one way to read the decrease in volume is that - yea it'd sure be nice if six fewer dealerships had access to this information, so why don't we make sure they all get forced to close their doors because the automakers don't want competition - there would be fewer in count, but that doesn't really speak to the security of that data at all (additionally, most of the sensitive data you probably care about doesn't appear to be on the table for this bill - specifically telemetry about driving habits doesn't appear to be under consideration)

elihu 6y ago

The bill only requires the auto manufacturer to make the data available to a third party if they have consent from the vehicle owner to do so. https://ballotpedia.org/Massachusetts_Question_1,_%22Right_to_Repair_Law%22_Vehicle_Data_Access_Requirement_Initiative_(2020) https://ballotpedia.org/Massachusetts_Question_1,_%22Right_t...

hprotagonist 6y ago

centralized warehousing is a security threat, not a bonus. It just paints a big fat target on Toyota that screams "compromise us, we have so much PII it's almost embarrasing"

mindslight 6y ago
I don't know that centralized warehousing is relevant here, given that the systems seemingly rely on centralized silos regardless. But keeping the system dealership-only will encourage security by obscurity (eg one master login per dealership that can then access any car), whereas opening it up will force automakers to design their system for fine grained security.

mangoman 6y ago

There's not a database of location data that all garage's can access. It's mainly about making it so that car manufacturers can't design car computers in a way that in a way that impedes independent shops from doing repairs without paying the manufacturers for access (think like custom data access protocols, or obfuscation that's only readable after paying Honda a monthly massive fee). This is the battle that farmers are fighting against john deere. Actually, if the data is only accessible to a few authorized shops, that's when the data is especially likely to be sold. Data is really only valuable in aggregate - if more shops can service cars, then each shop really gets less access to aggregated car data. More choice means less centralization of the data which means it's more difficult to collect enough data for it to be sold. I think the car manufacturers are the ones who are hoping to monetize the data, and that's why they're trying to restrict access.