4 ms·

> safely ~hack~investigate I was more thinking in terms of: 1. Hacking something close source is inherently "unsafe" as you have to reverse engineer it, fuzz

by theK 3y ago

> safely ~hack~investigate I was more thinking in terms of: 1. Hacking something close source is inherently "unsafe" as you have to reverse engineer it, fuzz it or do something other that could randomly backfire. 2. Hacking something open source is safe(er) as in, you can see the code and the developers intent, maybe even some insightful commentary. Also, there might be an argument about open source projects being more easy to replace pieces of as you typically can see the whole build stack.

eesmith 3y ago
The safety goals you want in your perfect world are so far beyond what is practical that it seems irrelevant in a discussion about a mandate that auto software be open source. Please remember that "open source" means access to the source code, plus the right to modify it, plus the right to redistribute it without requiring additional permissions from the copyright holders, plus no restrictions on who may use the software (other than those required by law). You can have close source with access to the source (often called 'source available'), and even with the right to modify and use those modifications. A license which is "for noncommercial use only" or "not for use by the military" is not open source, even if the source can otherwise be freely used, modified, and redistributed. That said, having the source code in any form does not mean things are no longer 'inherently "unsafe"'. Device drivers are notoriously finicky and depend, for example, on the precise timing of hardware vs. software. Reading the source, even with comments, may not be enough to assume modifications are safe, perhaps because it's obvious to an expert (which you are not) or because the original authors were not aware of the issue. Nor does open source guarantee you can reproduce the build. The auto manufacturer may use a compiler with different behavior than your compilers. But hoseja called for open source, not reproducible builds of the open source software, so inherently accepts there will be some risks. Certainly there's less risk with reproducible builds of the open source software, but as I said, these changes are best done in steps. There's no need for the huge step you want in your perfect world. Instead, mandate open source, get experience, and use that experience to guide future changes to public policy. That's how laws generally work.
- theK 3y ago
  > Reading the source, even with comments, may not be enough to assume modifications are safe Is it enough to say that the user gets a better chance to judge their impact compared to flipping random registers?
  - eesmith 3y ago
    Sure. Just like it's good to have manufacturer's information on how much torque to use on the engine block bolts rather than guessing based on possibly limited experience.

by theK 3y ago

eesmith 3y ago

The safety goals you want in your perfect world are so far beyond what is practical that it seems irrelevant in a discussion about a mandate that auto software be open source. Please remember that "open source" means access to the source code, plus the right to modify it, plus the right to redistribute it without requiring additional permissions from the copyright holders, plus no restrictions on who may use the software (other than those required by law). You can have close source with access to the source (often called 'source available'), and even with the right to modify and use those modifications. A license which is "for noncommercial use only" or "not for use by the military" is not open source, even if the source can otherwise be freely used, modified, and redistributed. That said, having the source code in any form does not mean things are no longer 'inherently "unsafe"'. Device drivers are notoriously finicky and depend, for example, on the precise timing of hardware vs. software. Reading the source, even with comments, may not be enough to assume modifications are safe, perhaps because it's obvious to an expert (which you are not) or because the original authors were not aware of the issue. Nor does open source guarantee you can reproduce the build. The auto manufacturer may use a compiler with different behavior than your compilers. But hoseja called for open source, not reproducible builds of the open source software, so inherently accepts there will be some risks. Certainly there's less risk with reproducible builds of the open source software, but as I said, these changes are best done in steps. There's no need for the huge step you want in your perfect world. Instead, mandate open source, get experience, and use that experience to guide future changes to public policy. That's how laws generally work.

theK 3y ago
> Reading the source, even with comments, may not be enough to assume modifications are safe Is it enough to say that the user gets a better chance to judge their impact compared to flipping random registers?
- eesmith 3y ago
  Sure. Just like it's good to have manufacturer's information on how much torque to use on the engine block bolts rather than guessing based on possibly limited experience.