6 ms·

To me it's all-too-understandable how this is possible. Maybe they've got a test fleet, but it accepts code signed with the test build key. Maybe they've got

To me it's all-too-understandable how this is possible. Maybe they've got a test fleet, but it accepts code signed with the test build key. Maybe they've got a watchdog timer, but it doesn't get configured until later in the boot process. Maybe they've got A/B boot partitions, but trouble counting their boot attempts - maybe they don't have any writable storage that early in the boot process. I wouldn't be surprised if, as a newer company, they'd made a 'Minimum Viable Product' secure boot setup & release procedure, and the auto-fallback and fat-finger-protection were waiting to get to the top of the backlog.

psunavy03 3y ago
Exhibit A of why a Minimum Viable Product still needs a proper Definition of Done which includes quality standards.
qmarchi 3y ago
So, using Polestar as a reference as it's both a vehicle that I've worked on, and one that I personally drive. > Maybe they've got a test fleet, but it accepts code signed with the test build key. Polestar solves this by only delivering signed updates to their vehicles. The vehicle headunit will refuse to flash a partition that isn't signed by the private key held by Polestar. Pulls double duty to prevent someone from flashing a malicious update, as well as corruption detection. > Maybe they've got a watchdog timer, but it doesn't get configured until later in the boot process. Based on what the Rivian reports are showing (Speedometer, cameras, safety systems are working), they likely are running their infotainment as a "virtual machine" within their systems. Again, something that Polestar does. Implementation of a watchdog with a "sub-system" like this is relatively braindead simple. > Maybe they've got A/B boot partitions, but trouble counting their boot attempts - maybe they don't have any writable storage that early in the boot process. Generally, A/B partitioning is part of the bootloader, the first program that executes after the reset (on many modern processors) pin is released. This also leads to reboot counters and such being stored as part of the NVRAM that is available at boot. Opinion: Maybe I'm biased, but maybe if you can't develop something yourself, there's reason for you to get an off the shelf option that handles a lot of these things. Disclaimer: Former Googler, Worked closely with Automotive.
- refulgentis 3y ago
  Opinion: I'm a little confused as to how you're confused as to how test might not match prod sometimes. Observation: "[if you write buggy software], there's reason for you to get an off the shelf option" Question: Are you saying if they used Android Automotive this could never have happened? Reference: similar event for Android, last week: https://linustechtips.com/topic/1538248-pixel-phones-using-multiple-profiles-are-being-soft-bricked-by-newest-os-update/ https://linustechtips.com/topic/1538248-pixel-phones-using-m... Disclaimer: Former Googler, did not Work closely with Automotive, Worked closely with Android.
  - qmarchi 3y ago
    Answer: To clarify, more that a company should stick to their core competencies unless there's a drastic need or opening in the market that could be filled (and to build a new competency). In this particular case, there's nothing particularly unique that Rivian is doing with their Infotainment system that couldn't already be handled by an incumbent in the space, (Android Automotive, QNX, etc.) especially given how modular the systems themselves are. As State Farm says, "We know a thing or two because we've seen a thing or two".
    - hermitdev 3y ago
      > As State Farm says, "We know a thing or two because we've seen a thing or two". That's Farmers, delivered by J.K. Simmons, not State Farm. State Farm is Jake, in his khakis.
    - bo1024 3y ago
      Rivian thinks of itself as a software company. The first thing you sign when you go to buy a vehicle is a software copyright notice IIRC. The first thing in the owner's manual is a notice that the software copyrights and intellectual property belong to Rivian, etc etc.
      - jacquesm 3y ago
        I'm not in the market but I would laugh all the way to the door if that happened.
LoganDark 3y ago
> Maybe they've got A/B boot partitions, but trouble counting their boot attempts - maybe they don't have any writable storage that early in the boot process. You do not report a successful boot until and unless the entire system loads up successfully. You will definitely have writable storage by then.

psunavy03 3y ago

Exhibit A of why a Minimum Viable Product still needs a proper Definition of Done which includes quality standards.

qmarchi 3y ago

So, using Polestar as a reference as it's both a vehicle that I've worked on, and one that I personally drive. > Maybe they've got a test fleet, but it accepts code signed with the test build key. Polestar solves this by only delivering signed updates to their vehicles. The vehicle headunit will refuse to flash a partition that isn't signed by the private key held by Polestar. Pulls double duty to prevent someone from flashing a malicious update, as well as corruption detection. > Maybe they've got a watchdog timer, but it doesn't get configured until later in the boot process. Based on what the Rivian reports are showing (Speedometer, cameras, safety systems are working), they likely are running their infotainment as a "virtual machine" within their systems. Again, something that Polestar does. Implementation of a watchdog with a "sub-system" like this is relatively braindead simple. > Maybe they've got A/B boot partitions, but trouble counting their boot attempts - maybe they don't have any writable storage that early in the boot process. Generally, A/B partitioning is part of the bootloader, the first program that executes after the reset (on many modern processors) pin is released. This also leads to reboot counters and such being stored as part of the NVRAM that is available at boot. Opinion: Maybe I'm biased, but maybe if you can't develop something yourself, there's reason for you to get an off the shelf option that handles a lot of these things. Disclaimer: Former Googler, Worked closely with Automotive.

refulgentis 3y ago
Opinion: I'm a little confused as to how you're confused as to how test might not match prod sometimes. Observation: "[if you write buggy software], there's reason for you to get an off the shelf option" Question: Are you saying if they used Android Automotive this could never have happened? Reference: similar event for Android, last week: https://linustechtips.com/topic/1538248-pixel-phones-using-multiple-profiles-are-being-soft-bricked-by-newest-os-update/ https://linustechtips.com/topic/1538248-pixel-phones-using-m... Disclaimer: Former Googler, did not Work closely with Automotive, Worked closely with Android.
- qmarchi 3y ago
  Answer: To clarify, more that a company should stick to their core competencies unless there's a drastic need or opening in the market that could be filled (and to build a new competency). In this particular case, there's nothing particularly unique that Rivian is doing with their Infotainment system that couldn't already be handled by an incumbent in the space, (Android Automotive, QNX, etc.) especially given how modular the systems themselves are. As State Farm says, "We know a thing or two because we've seen a thing or two".
  - hermitdev 3y ago
    > As State Farm says, "We know a thing or two because we've seen a thing or two". That's Farmers, delivered by J.K. Simmons, not State Farm. State Farm is Jake, in his khakis.
  - bo1024 3y ago
    Rivian thinks of itself as a software company. The first thing you sign when you go to buy a vehicle is a software copyright notice IIRC. The first thing in the owner's manual is a notice that the software copyrights and intellectual property belong to Rivian, etc etc.
    - jacquesm 3y ago
      I'm not in the market but I would laugh all the way to the door if that happened.

LoganDark 3y ago

> Maybe they've got A/B boot partitions, but trouble counting their boot attempts - maybe they don't have any writable storage that early in the boot process. You do not report a successful boot until and unless the entire system loads up successfully. You will definitely have writable storage by then.