3 ms·

Absolutely not. Saying this as a huge proponent of open source. If it’s the case, each clown garage shop would be able to modify key characteristics of any car

Absolutely not. Saying this as a huge proponent of open source. If it’s the case, each clown garage shop would be able to modify key characteristics of any car. And oh boy they will do it. Would you fly on aircraft knowing mechanic servicing it last night could have added something funny to the plane you are taking?

reedciccio 3y ago
There is a difference between being able to inspect study and modify software for a car and installing modified versions on your or someone else's car. We already have regulations covering radio emissions, this could be the same: modify all you want but you can't install a modified version unless you validate the modifications with a certification authority. Btw, the cyber resilience act in EU will cover these cases.
chefandy 3y ago
Being closed source doesn’t strike me as an effective mitigation tactic. You can already buy aftermarket ECUs and such, and it’s pretty unlikely the garage would install anything that would invade your privacy more than what the manufacturers have installed. If they were going to do it as a prank or shortcut or misguided enhancement, they can do exactly the same thing with physical parts. I guess I just don’t see the threat vector here. The big benefit seems to be auto manufacturers being able to rely on security through obscurity, which has already failed: https://news.ycombinator.com/item?id=35452963 https://news.ycombinator.com/item?id=35452963
hoseja 3y ago
You give the mechanic an opportunity to cut your brakelines too and they don't do it. It's part of the appliance, it should be accessible. Maybe I was imprecise with open-source, I meant more source-available.
jamesrr39 3y ago
> If it’s the case, each clown garage shop would be able to modify key characteristics of any car. And oh boy they will do it. Car workshops would modify and compile their own distribution of the car source code? I can't say I have ever been to a workshop where I would imagine anything like that. Open source here would clearly be a big win for security and bug identifications in cars. Better quality laws to go along with it to protect researchers would naturally be a big positive as well. For a comparison look to Android. AOSP is open source, and whilst alternative, non-OEM, flavours of Android do exist (GrapheneOS, LineageOS, etc). But you don't see shops that fix or sell phones putting any of these on the phone. And if you did, would it be a security downgrade? I don't think so! > Would you fly on aircraft knowing mechanic servicing it last night could have added something funny to the plane you are taking? But... they could have done. Maybe not the software, but mechanically, of course it's possible. Why doesn't it happen though? I guess the same reasons why in general people act responsibly in society.
rurban 3y ago
As clown garage shop I already have access to the ECU, TCU and so on. And can change lots of internal settings. That's what we all did in the first auto-mechanics course.
- jesterson 3y ago
  You still can’t change many things and that’s great.
  - rurban 3y ago
    If you have the .A2L file everything is accessible. And I had all. Thanksfully the clown garage shop doesn't. But CAN access SW is available for most models
p_l 3y ago
The mechanics absolutely could, though. In fact, it's a core thing in aviation for maintenance, repair, but also modification/changes to be decoupled from vendor. It's pretty normal for a vendor to not exist for a generation or two while the plane is still in productive work.
- jesterson 3y ago
  There’s heavy licensing when it comes to aviation. You can’t buy Boeing parts on ebay sold by chinese vendors and install it on aircraft. At least yet.
  - p_l 3y ago
    ... well, you can. Sometimes it even involves purser walking cap in hand scrounging up cash for a fuel pump replacement in pretty young 787 otherwise it's not going anywhere. The main difference is that it's tracked. Licensed, too, but huge part of that licensing is about maintaining the history of the parts and plane, and that mechanics know given plane. But the only reason you're going to know that a change happened was because the people have been trained to log it down - but there's no physical/computer lockout preventing them.
j-bos 3y ago
Is this a joke? Mechanics can already swap critical parts with substandard replacements or finnagle sensor overrides with some tape. Why should software be so sacrosanct to the manufacturer and not the owner?

reedciccio 3y ago

There is a difference between being able to inspect study and modify software for a car and installing modified versions on your or someone else's car. We already have regulations covering radio emissions, this could be the same: modify all you want but you can't install a modified version unless you validate the modifications with a certification authority. Btw, the cyber resilience act in EU will cover these cases.

chefandy 3y ago

Being closed source doesn’t strike me as an effective mitigation tactic. You can already buy aftermarket ECUs and such, and it’s pretty unlikely the garage would install anything that would invade your privacy more than what the manufacturers have installed. If they were going to do it as a prank or shortcut or misguided enhancement, they can do exactly the same thing with physical parts. I guess I just don’t see the threat vector here. The big benefit seems to be auto manufacturers being able to rely on security through obscurity, which has already failed: https://news.ycombinator.com/item?id=35452963 https://news.ycombinator.com/item?id=35452963

hoseja 3y ago

You give the mechanic an opportunity to cut your brakelines too and they don't do it. It's part of the appliance, it should be accessible. Maybe I was imprecise with open-source, I meant more source-available.

jamesrr39 3y ago

> If it’s the case, each clown garage shop would be able to modify key characteristics of any car. And oh boy they will do it. Car workshops would modify and compile their own distribution of the car source code? I can't say I have ever been to a workshop where I would imagine anything like that. Open source here would clearly be a big win for security and bug identifications in cars. Better quality laws to go along with it to protect researchers would naturally be a big positive as well. For a comparison look to Android. AOSP is open source, and whilst alternative, non-OEM, flavours of Android do exist (GrapheneOS, LineageOS, etc). But you don't see shops that fix or sell phones putting any of these on the phone. And if you did, would it be a security downgrade? I don't think so! > Would you fly on aircraft knowing mechanic servicing it last night could have added something funny to the plane you are taking? But... they could have done. Maybe not the software, but mechanically, of course it's possible. Why doesn't it happen though? I guess the same reasons why in general people act responsibly in society.

rurban 3y ago

As clown garage shop I already have access to the ECU, TCU and so on. And can change lots of internal settings. That's what we all did in the first auto-mechanics course.

jesterson 3y ago
You still can’t change many things and that’s great.
- rurban 3y ago
  If you have the .A2L file everything is accessible. And I had all. Thanksfully the clown garage shop doesn't. But CAN access SW is available for most models

p_l 3y ago

The mechanics absolutely could, though. In fact, it's a core thing in aviation for maintenance, repair, but also modification/changes to be decoupled from vendor. It's pretty normal for a vendor to not exist for a generation or two while the plane is still in productive work.

jesterson 3y ago
There’s heavy licensing when it comes to aviation. You can’t buy Boeing parts on ebay sold by chinese vendors and install it on aircraft. At least yet.
- p_l 3y ago
  ... well, you can. Sometimes it even involves purser walking cap in hand scrounging up cash for a fuel pump replacement in pretty young 787 otherwise it's not going anywhere. The main difference is that it's tracked. Licensed, too, but huge part of that licensing is about maintaining the history of the parts and plane, and that mechanics know given plane. But the only reason you're going to know that a change happened was because the people have been trained to log it down - but there's no physical/computer lockout preventing them.

j-bos 3y ago

Is this a joke? Mechanics can already swap critical parts with substandard replacements or finnagle sensor overrides with some tape. Why should software be so sacrosanct to the manufacturer and not the owner?