3 ms·
I was going through my Prius's "software license information" a while ago and I noticed the daniel@haxx email. No way would I run software in my car that someo
by pcthrowaway 4y ago
I was going through my Prius's "software license information" a while ago and I noticed the daniel@haxx email.
No way would I run software in my car that someone hacked together in 3 days.
- ddtaylor 4y agoI think this problem is similar to the OpenSSL problem. The idea being that we have a library that has a giant attack surface because it does a LOT of different things and attackers find clever ways to abuse those extra features that most users don't actually want enabled. Your car probably wants to use some relatively pedestrian things like HTTPS, but do you think it should have any capability of doing GOPHER, SMBS, SFTP, POP3, LDAP, IMAP, TELNET, TFTP, SCP or any of the other stuff curl supports out of the box? We can hope that the version of curl used for the car was compiled without support for some of these protocols. I don't even know if we have a good way to verify that. More likely is that whatever the stock configuration (all the protocols) is what is being used in most applications.
- thunky 4y ago> No way would I run software in my car that someone hacked together in 3 days So no Tesla for you then.
- alias_neo 4y agoI was updating my car a few months ago and found it runs Linux for the user-facing systems, and of course uses libcurl, according to the open source licenses.