3 ms·

I've been involved with the software side at a few companies producing autonomous vehicles and took a look at SSG-39 to see how much better nuke standards are.

I've been involved with the software side at a few companies producing autonomous vehicles and took a look at SSG-39 to see how much better nuke standards are. They're pretty dang similar to automotive standards (UL4600, SOTIF, etc). The difference is in the regulatory environment and execution. Automotive software is not well-regulated and most OEMs don't think either the software or the people that produce it are worth investing in. I regularly have disagreements with systems folks about whether we should focus on actual sources of quality issues like memory safety or the checklist items that regulators are going to look at like whether the compiler is verified.

alerighi 4y ago
Automobile software has good standard for critical parts. The problem is all the software never considered a remote attack, since it was not connected to the internet. The CAN bus was local and the only way to interact was to physically connect to the bus, thus it has no security built in (every device can send any command since every device is trusted). Now to enable all the smart stuff there is a connection between the car bus and the internet, of course indirectly trough the entratainment system, but if for example the entratainment system (for which coding standards are bad) is exploited, you have full access to the bus and thus can send commands to various parts of the car, which is very bad!
- AlotOfReading 4y ago
  That's not how any car I know of works. Infotainment stuff can't go on the CAN bus due to bandwidth limitations. It's usually on its own network. Historically that was MOST, now it's usually Ethernet (or A2B for some specific components). That network may be bridged to other networks like CAN with a locked down gateway module, but frankly even that design is out of style due to security issues. If you know a manufacturer putting radio devices on the CAN bus, by all means name and shame. I'd be morbidly curious because of how obviously terrible an idea that is.

alerighi 4y ago

Automobile software has good standard for critical parts. The problem is all the software never considered a remote attack, since it was not connected to the internet. The CAN bus was local and the only way to interact was to physically connect to the bus, thus it has no security built in (every device can send any command since every device is trusted). Now to enable all the smart stuff there is a connection between the car bus and the internet, of course indirectly trough the entratainment system, but if for example the entratainment system (for which coding standards are bad) is exploited, you have full access to the bus and thus can send commands to various parts of the car, which is very bad!

AlotOfReading 4y ago
That's not how any car I know of works. Infotainment stuff can't go on the CAN bus due to bandwidth limitations. It's usually on its own network. Historically that was MOST, now it's usually Ethernet (or A2B for some specific components). That network may be bridged to other networks like CAN with a locked down gateway module, but frankly even that design is out of style due to security issues. If you know a manufacturer putting radio devices on the CAN bus, by all means name and shame. I'd be morbidly curious because of how obviously terrible an idea that is.