4 ms·

Porsche Will Stop Selling Boxster, Cayman in Europe Due to Anti-Hacking Law

28 points by jyunwai 3y ago

deleted 3y ago
[deleted]
CamperBob2 3y ago
They are also ending ICE-powered Macan sales earlier than otherwise required in the EU for the same reported reason. Unlike Boxster/Cayman, the Macan is their cash cow. It doesn't make any sense; this is going to cost them billions. How hard could it be to fix whatever is causing it to fail the legal requirements, compared to the cost of terminating multiple product lines in a key market? There must be more to this than what is being reported. Why are none of the news articles going into detail about the exact nature of the problem?
- yread 3y ago
  I guess it's a bit like if Linux Kernel suddenly needed to pass ISO 27001 certification.
- nradov 3y ago
  It's not something that can really be fixed retroactively. The rule impacts not just the final product but the entire process used to develop it, including the supply chain. In order to comply, Porsche would have to redo parts of the development process and probably make some vehicle design changes. That isn't economical for a platform with only a few years of life left so it's cheaper just to kill it. From a political perspective I am surprised that Germany didn't insist on delaying the deadline to minimize impact on their domestic car industry. Maybe something has them spooked about cyber security risks?
  - CamperBob2 3y ago
    So what's different about Porsche? Why are none of the other VW brands, or any other European brands in general, affected? What are the specific cybersecurity risks in question? And if it's as you say, then who ratified such a ridiculous rule, and why? The UN is not supposed to be a legislative body. At least, that's what I've been saying when I find myself going toe-to-toe with conspiracy theorists.
    - RealityVoid 3y ago
      Speaking as someone who implemented UNECE features on ECU's, UNECE basically requires signed binaries on update, some sort of secure authentication for the vendor when entering elevated privilege and a hash on stored on different entity flash content to "authenticate" the integrity. The last one is silly in my view, the other ones are kind of reasonable, the main problem is that you have very small MCU's that have constrained resources. Implementing ECDSA on some 16 bit MCU can prove hairy in some cases or even impossible in others. The MCU's used in these systems are very often pushed to the limit with resource consumption hovering at 80% of flash and RAM. Ram is usually from then to hundreds of kilobytes. Bigger systems could be retrofitted with some effort. Small systems you need to redesign, highly likely having to replace them MCU. Highly likely you'll have to then redesign the whole board layout. At that point you're essentially just doing a new ECU and we'll... For previously existing lines of products it's probably not worth it. There are probably _some_ options though if you get creative. I'd honestly suggest killing the software update capabilities of established lines, then the UNECE class can be switched to something that doesn't require these things and call it a day?
      - CamperBob2 3y ago
        I hear you, and that's quite informative, and I agree with your suggestion that there are likely workaround(s) that meet the letter of the law at a much lower cost than killing production prematurely. But it doesn't answer my question: why is Porsche getting dunked on to the apparent exclusion of everyone else? They don't do any of this stuff themselves, and haven't for a very long time. They share control units, gateways, and peripherals with multiple manufacturers. Yet nobody else in the EU seems to be catching all this grief. I don't really care, because my Macan and Boxster are 4 and 11 years old respectively and aren't going anywhere. They no longer make anything I want at a price within my toy budget. But there just seems to be an element of unfairness here that doesn't make sense, and I'm curious to hear the real story.
        RealityVoid 3y ago
        The answer is... I don't know. But I can take an educated guess. The volume and margins calculations are likely different for Porsche and VW (lower volume, higher margins for Porsche). This might affect their projected spend/gain balances. They might also have _other_ projects in the pipeline that they would rather spend the resources on . Lose some income from existing lines but make it up with the others kind of deals. And the third possible alternative is they got caught with their pants down. They might not have taken this UNECE thing seriously and not made contingency plans and simply... Not have enough time to execute before they are not able to sell any more cars of that kind untill they fix it. If it's _that_ important for you, I can ask around at friends in the industry and let you know what I find out what is going on there. You can drop me an email at my contact I have in the profile.
- kennethrc 3y ago
  > will largely be unavailable for sale in the manufacturer's home market I've heard a (credible) stat that there's more Mercedes-Benzes sold in California alone than in the entirety of Germany; if these numbers hold up (outside the EU) for Porsche I could understand them giving up on the EU
  - giobox 3y ago
    > I've heard a (credible) stat that there's more Mercedes-Benzes sold in California alone than in the entirety of Germany This is probably not far from true for Porsche too today, honestly. The Porsche Macan/Cayenne are increasingly mass-selling mass-produced mainstream luxury family car products much like BMW/Mercedes used to dominate in 90s/2000s, and they sell really, really well. We've reached the stage sadly Porsche is an SUV company that happens to sell some sports cars. 2023 North American sales: 86,059 2023 German sales: 32,430 A very large chunk of that 86k will have been CA. > https://newsroom.porsche.com/en/2024/company/porsche-deliveries-2023-34942.html https://newsroom.porsche.com/en/2024/company/porsche-deliver...
- adolph 3y ago
  If you look at section 3.2 it says: [Application for approval] shall be accompanied by the undermentioned documents *in triplicate* Porsche is holding the line on killing trees. https://unece.org/sites/default/files/2023-02/R155e%20%282%29.pdf https://unece.org/sites/default/files/2023-02/R155e%20%282%2...
adolph 3y ago
Text of regulation is in docx/pdf links on the right side: https://unece.org/transport/documents/2021/03/standards/un-regulation-no-155-cyber-security-and-cyber-security https://unece.org/transport/documents/2021/03/standards/un-r... See also: UN extends its cyber security management regulation to motorcycles and scooters 26 January 2024 UNECE’s Working Party on Automated/Autonomous and Connected Vehicles today decided to include motorcycles, scooters and electric bicycles with speed exceeding 25 km/h in the scope of the UN Regulation No. 155 on cyber security and cyber security management. https://unece.org/media/transport/Vehicle-Regulations/press/387828 https://unece.org/media/transport/Vehicle-Regulations/press/...

28 points by jyunwai 3y ago

deleted 3y ago

[deleted]

They are also ending ICE-powered Macan sales earlier than otherwise required in the EU for the same reported reason. Unlike Boxster/Cayman, the Macan is their cash cow. It doesn't make any sense; this is going to cost them billions. How hard could it be to fix whatever is causing it to fail the legal requirements, compared to the cost of terminating multiple product lines in a key market? There must be more to this than what is being reported. Why are none of the news articles going into detail about the exact nature of the problem?

yread 3y ago
I guess it's a bit like if Linux Kernel suddenly needed to pass ISO 27001 certification.
nradov 3y ago
It's not something that can really be fixed retroactively. The rule impacts not just the final product but the entire process used to develop it, including the supply chain. In order to comply, Porsche would have to redo parts of the development process and probably make some vehicle design changes. That isn't economical for a platform with only a few years of life left so it's cheaper just to kill it. From a political perspective I am surprised that Germany didn't insist on delaying the deadline to minimize impact on their domestic car industry. Maybe something has them spooked about cyber security risks?
- CamperBob2 3y ago
  So what's different about Porsche? Why are none of the other VW brands, or any other European brands in general, affected? What are the specific cybersecurity risks in question? And if it's as you say, then who ratified such a ridiculous rule, and why? The UN is not supposed to be a legislative body. At least, that's what I've been saying when I find myself going toe-to-toe with conspiracy theorists.
  - RealityVoid 3y ago
    Speaking as someone who implemented UNECE features on ECU's, UNECE basically requires signed binaries on update, some sort of secure authentication for the vendor when entering elevated privilege and a hash on stored on different entity flash content to "authenticate" the integrity. The last one is silly in my view, the other ones are kind of reasonable, the main problem is that you have very small MCU's that have constrained resources. Implementing ECDSA on some 16 bit MCU can prove hairy in some cases or even impossible in others. The MCU's used in these systems are very often pushed to the limit with resource consumption hovering at 80% of flash and RAM. Ram is usually from then to hundreds of kilobytes. Bigger systems could be retrofitted with some effort. Small systems you need to redesign, highly likely having to replace them MCU. Highly likely you'll have to then redesign the whole board layout. At that point you're essentially just doing a new ECU and we'll... For previously existing lines of products it's probably not worth it. There are probably _some_ options though if you get creative. I'd honestly suggest killing the software update capabilities of established lines, then the UNECE class can be switched to something that doesn't require these things and call it a day?
    - CamperBob2 3y ago
      I hear you, and that's quite informative, and I agree with your suggestion that there are likely workaround(s) that meet the letter of the law at a much lower cost than killing production prematurely. But it doesn't answer my question: why is Porsche getting dunked on to the apparent exclusion of everyone else? They don't do any of this stuff themselves, and haven't for a very long time. They share control units, gateways, and peripherals with multiple manufacturers. Yet nobody else in the EU seems to be catching all this grief. I don't really care, because my Macan and Boxster are 4 and 11 years old respectively and aren't going anywhere. They no longer make anything I want at a price within my toy budget. But there just seems to be an element of unfairness here that doesn't make sense, and I'm curious to hear the real story.
      - RealityVoid 3y ago
        The answer is... I don't know. But I can take an educated guess. The volume and margins calculations are likely different for Porsche and VW (lower volume, higher margins for Porsche). This might affect their projected spend/gain balances. They might also have _other_ projects in the pipeline that they would rather spend the resources on . Lose some income from existing lines but make it up with the others kind of deals. And the third possible alternative is they got caught with their pants down. They might not have taken this UNECE thing seriously and not made contingency plans and simply... Not have enough time to execute before they are not able to sell any more cars of that kind untill they fix it. If it's _that_ important for you, I can ask around at friends in the industry and let you know what I find out what is going on there. You can drop me an email at my contact I have in the profile.
kennethrc 3y ago
> will largely be unavailable for sale in the manufacturer's home market I've heard a (credible) stat that there's more Mercedes-Benzes sold in California alone than in the entirety of Germany; if these numbers hold up (outside the EU) for Porsche I could understand them giving up on the EU
- giobox 3y ago
  > I've heard a (credible) stat that there's more Mercedes-Benzes sold in California alone than in the entirety of Germany This is probably not far from true for Porsche too today, honestly. The Porsche Macan/Cayenne are increasingly mass-selling mass-produced mainstream luxury family car products much like BMW/Mercedes used to dominate in 90s/2000s, and they sell really, really well. We've reached the stage sadly Porsche is an SUV company that happens to sell some sports cars. 2023 North American sales: 86,059 2023 German sales: 32,430 A very large chunk of that 86k will have been CA. > https://newsroom.porsche.com/en/2024/company/porsche-deliveries-2023-34942.html https://newsroom.porsche.com/en/2024/company/porsche-deliver...
adolph 3y ago
If you look at section 3.2 it says: [Application for approval] shall be accompanied by the undermentioned documents *in triplicate* Porsche is holding the line on killing trees. https://unece.org/sites/default/files/2023-02/R155e%20%282%29.pdf https://unece.org/sites/default/files/2023-02/R155e%20%282%2...

adolph 3y ago

Text of regulation is in docx/pdf links on the right side: https://unece.org/transport/documents/2021/03/standards/un-regulation-no-155-cyber-security-and-cyber-security https://unece.org/transport/documents/2021/03/standards/un-r... See also: UN extends its cyber security management regulation to motorcycles and scooters 26 January 2024 UNECE’s Working Party on Automated/Autonomous and Connected Vehicles today decided to include motorcycles, scooters and electric bicycles with speed exceeding 25 km/h in the scope of the UN Regulation No. 155 on cyber security and cyber security management. https://unece.org/media/transport/Vehicle-Regulations/press/387828 https://unece.org/media/transport/Vehicle-Regulations/press/...