7 ms·
I would like to see how the decision was justified to implement automated deletion of the onboard snapshot.
by throwanem 1y ago
I would like to see how the decision was justified to implement automated deletion of the onboard snapshot.
- amelius 1y agohttps://en.wikipedia.org/wiki/Tampering_with_evidence https://en.wikipedia.org/wiki/Tampering_with_evidence
- _trampeltier 1y ago.. a person ..
- jeffbee 1y agoThere aren't enough details in the somewhat hyperbolic narrative format to really say, but if I were going to create a temporary archive of files on an embedded system for diagnostic upload, I would also delete it, because that's the nature of temporary files and nobody likes ENOSPACE. If their system had deleted the inputs of the archive that would seem nefarious, but this doesn't, at first scan.
- throwanem 1y ago"Their system" is a car, sold as a consumer product, which has just experienced a collision removing it indefinitely from normal operation. Reconsider your analysis.
- jeffbee 1y agoYes? But the article doesn't say that Tesla deleted the EDR, it says they uploaded the EDR file in an archive format, then deleted the uploaded entity. Which strikes me as totally normal.
- wizzwizz4 1y agoTotally normal for a completely different domain. Very abnormal for what's functionally the car's black box.
- jeffbee 1y agoNo, the car's "black box" is the EDR, the behavior of which is regulated by federal agencies. This article is discussing ephemeral telemetry which accessed the EDR.
- wizzwizz4 1y agoNo, the EDR forms part of the car's "black box" – just like the FDR forms part of an aeroplane's black box. Per the article, the erased* telemetry ("collision snapshot") contained quite a bit more data than just from the EDR. *: I can't work out from the article whether this file was erased, or just unlinked from the filesystem: they quote someone as saying the latter, but it looks like it was actually the former.
- deleted 1y ago[deleted]
- freejazz 1y agoSo? Tesla needs to bear the responsibilities of having deleted its own potentially exculpatory evidence. Not granted an inference that it did so and therefore Tesla is innocent.
- 1970-01-01 1y agoTesla was having issues with log file writes destroying their chips. They can argue they have precedent for deleting data, but not hiding it.
- Hamuko 1y agoWouldn't creating an archive on the filesystem and then deleting the archive cause more writes than just creating it without a delete?
- potato3732842 1y agoI think the goal is to save as much as you can in the interim. Holding onto X bytes of archives is more time worth of data than X bytes of uncompressed. We do that stuff all the time in finance. Stuff gets spewed off to external places and local copies get kept but archived and we simply rotate the oldest stuff out as we go. If the cleanup process is configured separately from the archiving process you can absolutely archive things just to remove them shortly thereafter.
- 1970-01-01 1y agoWear increases when free space is low as there's less overall space to put the data. If you only have 500MB of free space, those blocks take the majority of write hammering until the chip fails. If there's 5000MB free, you can spread the wear.
- LorenPechtel 1y agoNot in the big picture. Fundamentally, flash memory is a bunch of pages. Each page can be read an infinite number of times but there are quite relevant limits on how many times you can write it. In the simplistic system lets say you have 1000 pages, 999 hold static data and the last one keeps getting a temporary file that is then erased. All wear occurs on page 1000 and it doesn't last very long. In the better system it notes that page 1000 is accumulating a lot of writes and picks whatever page has the least writes, copies the data from that page to page 1000 and now uses the new page for all those writes. Repeat until everything's worn down. Note the extra write incurred copying the page over. In the real world a drive with more space on it is less likely to have to resort to copying pages.
- deleted 1y ago[deleted]
- thrill 1y agoWhen a vehicle crash occurs, that embedded system should no longer be treating data as "temporary", but as what it now is, civil and potentially criminal evidence, and it should be preserved. To go to the effort of creating that data, uploading it to a corporate server, and then having programming that explicitly deletes that data from the source (the embedded system), certainly reads as nefarious without easily verifiable evidence to the contrary. The actions of a company that has acted this way in no fashion lends any credibility to being treated as anything other than a hostile party in court. Any investigators in the future involving a company with such a history need to act swiftly and with the immediate and heavy hand of the court behind them if they expect any degree of success.
- insane_dreamer 1y agoMaybe, if this were a toaster or fridge.
- AlotOfReading 1y agoThe main reasons to store data are for safety and legal purposes first, diagnostics second. Collision data are all three. They need to be prioritized above virtually everything else on the system and if your vehicle has had so many collisions that the filesystem is filled up, that's a justifiable reason to have a service visit to delete the old ones. If I were implementing such a system (and I have), I could see myself deleting the temporary without much thought. I would still have built a way to recreate the contents of the tarball after the fact (it's been a requirement from legal every time I've scoped such a system). Tesla not only failed to do that, but avoided disclosing that any such file was transferred in the first place so that the plaintiffs wouldn't know to request it.
- adolph 1y agoThe tar file is a convenient transport mechanism for files that presumably exist in original form elsewhere within the system. (All bets off if sources for the tar were changed afterward.) Given storage is a finite resource, removing the tar after it was confirmed in the bucket is pure waste.
- AlotOfReading 1y agoI'm not sure whether you're saying that the tar should or shouldn't be deleted. Regardless, my point isn't that it was intentionally deleted. I can easily imagine someone writing a function to upload the data using something like std::tmpfile (which silently deletes the file when it's closed) without thinking about the full implications of that for the broader context the code exists in. Even in that case though, you would still have a way to produce the data because it would have been specced in the requirements when you were thinking about the broader organizational context.
- eptcyka 1y agoFor enospace, I’d put telemetry data on an entirely different partition or even device, as to isolate the rest of the filesystem.
- detourdog 1y agoWhat about not handing the tar ball to the police looking for data. Do you see that as a problem?
- jeffbee 1y agoThat's obviously problematic. I am only commenting on the belief in a conspiracy of programmers here. The overwhelmingly most likely reason that a temporary file would be unlinked after use is that is what any experienced systems programmer always does as a matter of course.
- throwanem 1y agoWhat "belief in a conspiracy of programmers?" I've made no contention, but if I had, it would be that whoever signed off on this design had better not have a PE license that they would like to keep, and we as an industry would be wise not to keep counting on our grandfather-clause "fun harmless dorks" cultural exemption now that we manufacture machines which obviously kill people. If that by you is conspiracy theory, you're welcome.
- jeffbee 1y agoThere are not PEs signing software changes for ancillary equipment in consumer vehicles. ETA: Restate your conspiracy theory in the hypothetical case that they had used `tar | curl` instead of the intermediate archive file. Does it still seem problematic?
- throwanem 1y ago"Ancillary" is quite a term for crash reporting after a crash. That is, for a system responding as designed to a collision which disabled the vehicle. I'm not going to argue with someone who throws gratuitous insults. Rejoin me outside the gutter and we'll continue, if you like. But the answer to your question is trivially yes, that is as professionally indictable, as might by now have been clarified had you sought conversation rather than - well, I suppose, rather than whatever this slander by you was meant to be. One hopes we'll see no more of it.
- int0x29 1y agoI would love to see what you need so much disk space for after the car is crashed and airbags are deployed. If that event fires the car is going in to the shop to have its airbags replaced at a minimum. Adding a service step to clear up /tmp after a crash is fairly straitforward.
- LorenPechtel 1y agoYou're assuming that it's a separate routine. It could very well be simply a routine that uploads any incident.
- deleted 1y ago[deleted]
- einarfd 1y agoAnd deleting the file would have been perfectly fine, if Tesla had given out the file when asked for it. Instead of what they did.
- LorenPechtel 1y agoWhat was deleted was the compiled file sent to Tesla, not all the bits of data that it came from. Nothing malicious in that, just code not leaving trash around.
- throwanem 1y agoWell, thank goodness for that. Wouldn't want to die in a car crash with an untidy filesystem, just like Mama always said.
- pnt12 1y agoThis is baffling. Those files are the most important information the car contains after an accident. Let's not be naive, or deceptive, about a malpractice from a multi billion company owned by a multi billionaire.
- LorenPechtel 1y agoThey did not erase the original data, only the compiled file that was sent. That's just proper coding, clean up your temporary files!
- danso 1y agoThe file was reportedly named "snapshot_collision_airbag-deployment.tar", which indicates that the developers are able to know that this particular event is a terminal one. Is it really necessary to be mindful of a few GB of storage space on a device that will likely never again to record data for its host vehicle?
- LorenPechtel 1y agoWhatever named the file knew it was a bad event, but that doesn't mean the routine to transmit an incident had a special case for this.