3 ms·

> The vest won't tell you it's functional and then stop working while you ride. The functionality and payment check happens before you ride, if you read their p

by g_p 5y ago

> The vest won't tell you it's functional and then stop working while you ride. The functionality and payment check happens before you ride, if you read their product description. https://www.klim.com/Ai-1-Airbag-Vest-3046-000 https://www.klim.com/Ai-1-Airbag-Vest-3046-000 Given it connects to an external server on the internet (even indirectly), it presumably has updatable firmware. Are you confident enough this company understands secure boot chains well enough to prevent a rogue firmware being flashed? And that they have protected their Bluetooth stack (?) well enough to prevent a firmware being flashed that way? It's likely (but impossible to tell without doing a teardown) that you could indicate the device is functional via firmware, while not being armed and ready to deploy, if the LED or indicator is on a separate GPIO. If this was to happen in the supply chain (like used to happen with grey market mobile phone imports getting loaded with adware), that could become a real problem...

dahart 5y ago
What you're bringing up now is a general engineering safety concern that applies to any product at all. You should be equally scared of your car's airbag and other safety systems. This is a straw man in this context, and has nothing to do with the payment plan. Because the designers are making a safety product, unless there is evidence otherwise, I would speculate/assume that they have thought about whether it's possible to indicate protection and then not provide it. But, no engineered product is 100% safe, I'm not under any misconceptions about that.
- g_p 5y ago
  When you introduce the functionality to disable a traditional safety product, you have to think about the dependency chain and how you design that system to prevent issues. Vehicles with a switchable airbag tend to display a fairly prominent red light when the airbag disable switch is used. I'm pretty sure that on some vehicles I've had, it's hard-wired to light up when the switch is used to disable the airbag. You'd have to break the light to "override" that warning. It is possible the makers of this product have done likewise, and the arming of their system is done with the same signal that's used to display a green light. But given the sheer complexity of it (Bluetooth, app Integration, server side checks), it seems likely this won't be the case - maybe the light is only momentary, in which case such hardware failsafes won't be in place. Nonetheless, adding complexity to a safety critical product should be scrutinized and held to the level of engineering as any other safety critical product. A safety critical product which will cease to function in its safety role without the ability to call home to a server seems to fail at some early hurdles of being engineered as a safety product, so I would respectfully disagree with your starting point that they've thought about this and engineered their lockout as a safety system (since it fails unsafe, rather than safe).
  - dahart 5y ago
    Sure, I completely agree with everything you said about engineering and safety in general. I don't understand the speculation on your part about it seeming likely to you that they're making obviously and absurdly bad safety critical design decisions just because it's complex and you haven't looked for or seen any evidence that they're not doing that. I'm saying there is evidence they're considering this issue, because they wrote about it in the product page's FAQ. They at least intended to design the system so that lapses in the financing plan do not compromise safety in any way, and they wrote about that intention explicitly. That is evidence to indicate they've thought about it. All speculation otherwise is just FUD.
    - setr 5y ago
      Because the safe thing is to not do something unnecessarily dangerous in the first place. You don't secure your core system by being very careful with your backdoor access -- you secure it by not introducing a backdoor in the first place. A critical safety device should have absolutely no way to be disabled, intended or not, without severe intervention or total and complete failure of the device. They've introduced greater potential for absolute disaster in their edge cases. And more likely than not, very little has to go wrong for a user to end up dead. Also of note: why is the battery LED on the back of the suit? If the battery dies mid-route (or a bug disables the vest), there's no way to tell? They don't note any audio cues.
      - dahart 5y ago
        I agree about everything you said about safety design, but Vice and uninformed comments have guided you into being mad about this today, and it is not the safety issue you think it is. The article was spreading FUD with the idea that the subscription lapse could cause a fatal crash. The product was designed to prevent that. Yes, there are reasons to be careful with electronic control of safety critical systems, but despite that fact, we are completely surrounded by safety critical systems with electronic control. Every vehicle you own, use or ride in has them.
        5y ago

by g_p 5y ago

dahart 5y ago

What you're bringing up now is a general engineering safety concern that applies to any product at all. You should be equally scared of your car's airbag and other safety systems. This is a straw man in this context, and has nothing to do with the payment plan. Because the designers are making a safety product, unless there is evidence otherwise, I would speculate/assume that they have thought about whether it's possible to indicate protection and then not provide it. But, no engineered product is 100% safe, I'm not under any misconceptions about that.

g_p 5y ago
When you introduce the functionality to disable a traditional safety product, you have to think about the dependency chain and how you design that system to prevent issues. Vehicles with a switchable airbag tend to display a fairly prominent red light when the airbag disable switch is used. I'm pretty sure that on some vehicles I've had, it's hard-wired to light up when the switch is used to disable the airbag. You'd have to break the light to "override" that warning. It is possible the makers of this product have done likewise, and the arming of their system is done with the same signal that's used to display a green light. But given the sheer complexity of it (Bluetooth, app Integration, server side checks), it seems likely this won't be the case - maybe the light is only momentary, in which case such hardware failsafes won't be in place. Nonetheless, adding complexity to a safety critical product should be scrutinized and held to the level of engineering as any other safety critical product. A safety critical product which will cease to function in its safety role without the ability to call home to a server seems to fail at some early hurdles of being engineered as a safety product, so I would respectfully disagree with your starting point that they've thought about this and engineered their lockout as a safety system (since it fails unsafe, rather than safe).
- dahart 5y ago
  Sure, I completely agree with everything you said about engineering and safety in general. I don't understand the speculation on your part about it seeming likely to you that they're making obviously and absurdly bad safety critical design decisions just because it's complex and you haven't looked for or seen any evidence that they're not doing that. I'm saying there is evidence they're considering this issue, because they wrote about it in the product page's FAQ. They at least intended to design the system so that lapses in the financing plan do not compromise safety in any way, and they wrote about that intention explicitly. That is evidence to indicate they've thought about it. All speculation otherwise is just FUD.
  - setr 5y ago
    Because the safe thing is to not do something unnecessarily dangerous in the first place. You don't secure your core system by being very careful with your backdoor access -- you secure it by not introducing a backdoor in the first place. A critical safety device should have absolutely no way to be disabled, intended or not, without severe intervention or total and complete failure of the device. They've introduced greater potential for absolute disaster in their edge cases. And more likely than not, very little has to go wrong for a user to end up dead. Also of note: why is the battery LED on the back of the suit? If the battery dies mid-route (or a bug disables the vest), there's no way to tell? They don't note any audio cues.
    - dahart 5y ago
      I agree about everything you said about safety design, but Vice and uninformed comments have guided you into being mad about this today, and it is not the safety issue you think it is. The article was spreading FUD with the idea that the subscription lapse could cause a fatal crash. The product was designed to prevent that. Yes, there are reasons to be careful with electronic control of safety critical systems, but despite that fact, we are completely surrounded by safety critical systems with electronic control. Every vehicle you own, use or ride in has them.
      - 5y ago