3 ms·

Uh, that still doesn't paint Tesla in a good light, so this guy bought a car running special experimental firmware by mistake? What if there was a bug and he cr

Uh, that still doesn't paint Tesla in a good light, so this guy bought a car running special experimental firmware by mistake? What if there was a bug and he crashed?

a-dub 5y ago
then the firmware is downgraded again before anyone gets sued/fired or the hackers who hacked the manufacturer cover their tracks. duh. one big reason why i'm not particularly thrilled at the prospect of one day owning a car that is actively managed/controllable by the manufacturer. in the days of the audi 5000 sudden acceleration syndrome, they could take a production car and study it. how would a third party/government agency trustlessly investigate "brake lose control" when the manufacturer has root and remote access on the vehicle?
- canada_dry 5y ago
  > not particularly thrilled at the prospect of one day owning a car that is actively managed/controllable by the manufacturer Ditto. So many examples of companies shoving half-baked software updates down our throats... and worse... companies with half-baked security that are compromised with no consequences/little liability and effect the consumer.
- bredren 5y ago
  An audit system? Presumably, regulators will require software and system and component behavior change logs. Is this not already the case?
  - a-dub 5y ago
    i'd love to see any computer system that can provide a crytographically tamper proof log that comes with cryptographic proofs that: a) a specific set of source code was used to generate the logs... so cryptographic security from source text files through compilation to execution on the hardware. b) that specific set of software was run on a specific machine at a specific time. it's hard... but beyond that, pretty much all audit logs are just security theater anyhow. sometimes can be mitigated by sending them to multiple places, but they're still meaningless unless you have a proof of what exactly generated them.
    - bredren 5y ago
      I don’t think they need to be tamper proof, but I do think they need to be held criminally liable if they are tampered with. Volkswagen tampered with regulated measurements and got away with it for a while. But it was discovered and they paid a huge price for it. With that precedent, it should create incentive to deal with mistakes transparently. It does also mean transportation authorities will need to create some amount of leeway for mistakes. But I think there has been plenty of that given to traditional auto manufacturers.
      - a-dub 5y ago
        that sort of inches at my point. how exactly would this criminal liability work? it would be comprised of two classes of evidence: 1) unassured/untrusted digital evidence that can be fabricated to say anything, leaving no trace of its previous state. (unless digital forensics has advanced well beyond what i know to be possible) 2) personal testimony that can also be fabricated. i suppose what's new here is that in a digital world, bits can be set however one likes with no trace of their previous state, where physical evidence left behind physical manifestations of itself. imagine rootkits that seek not to steal or hide their existence, but rather exist to plant fabricated evidence or hide actual evidence. in today's untrusted computer systems, this is all possible, and terrifying.

Uh, that still doesn't paint Tesla in a good light, so this guy bought a car running special experimental firmware by mistake? What if there was a bug and he crashed?

a-dub 5y ago

then the firmware is downgraded again before anyone gets sued/fired or the hackers who hacked the manufacturer cover their tracks. duh. one big reason why i'm not particularly thrilled at the prospect of one day owning a car that is actively managed/controllable by the manufacturer. in the days of the audi 5000 sudden acceleration syndrome, they could take a production car and study it. how would a third party/government agency trustlessly investigate "brake lose control" when the manufacturer has root and remote access on the vehicle?

canada_dry 5y ago
> not particularly thrilled at the prospect of one day owning a car that is actively managed/controllable by the manufacturer Ditto. So many examples of companies shoving half-baked software updates down our throats... and worse... companies with half-baked security that are compromised with no consequences/little liability and effect the consumer.
bredren 5y ago
An audit system? Presumably, regulators will require software and system and component behavior change logs. Is this not already the case?
- a-dub 5y ago
  i'd love to see any computer system that can provide a crytographically tamper proof log that comes with cryptographic proofs that: a) a specific set of source code was used to generate the logs... so cryptographic security from source text files through compilation to execution on the hardware. b) that specific set of software was run on a specific machine at a specific time. it's hard... but beyond that, pretty much all audit logs are just security theater anyhow. sometimes can be mitigated by sending them to multiple places, but they're still meaningless unless you have a proof of what exactly generated them.
  - bredren 5y ago
    I don’t think they need to be tamper proof, but I do think they need to be held criminally liable if they are tampered with. Volkswagen tampered with regulated measurements and got away with it for a while. But it was discovered and they paid a huge price for it. With that precedent, it should create incentive to deal with mistakes transparently. It does also mean transportation authorities will need to create some amount of leeway for mistakes. But I think there has been plenty of that given to traditional auto manufacturers.
    - a-dub 5y ago
      that sort of inches at my point. how exactly would this criminal liability work? it would be comprised of two classes of evidence: 1) unassured/untrusted digital evidence that can be fabricated to say anything, leaving no trace of its previous state. (unless digital forensics has advanced well beyond what i know to be possible) 2) personal testimony that can also be fabricated. i suppose what's new here is that in a digital world, bits can be set however one likes with no trace of their previous state, where physical evidence left behind physical manifestations of itself. imagine rootkits that seek not to steal or hide their existence, but rather exist to plant fabricated evidence or hide actual evidence. in today's untrusted computer systems, this is all possible, and terrifying.