4 ms·

There's no way they're going to keep a modular car functioning for years without relying on frequent software updates.

by esalman 1y ago

tomrod 1y ago
Did it for 100 years. Nkthing changed. They don't need to make cars into surveillance systems. That's a choice.
- verisimi 1y ago
  This is the whole point: putting intermediaries between you and the things you think you own. You think you own your car, phone, appliances, but actually, once this system is in place, you will effectively be on some sort of subscription contract with few traditional ownership rights, with many other parties (the car maker, government agencies) able to turn your car off remotely. Nice and safe.
- calvinmorrison 1y ago
  That's not entirely true. Most cars have revisions to software. Even ones from the 90s had ways to patch the ECU performed by dealers.
  - tomrod 1y ago
    Not without the driver involved in the cycle, either directly or indirectly. Now they are along for the ride no matter what.
achierius 1y ago
Concretely, why not? If you don't get updates, there's nothing to break the thing -- and if you don't have a network connection, you don't need the security updates.
- deleted 1y ago
  [deleted]
- pabs3 1y ago
  You might need security updates for security systems, like immobilisers, keyless entry etc.
  - fc417fc802 1y ago
    I'm happy to manually apply updates for my immobilizer as necessary. Keyless entry is already broken (recent front page) and can't be fixed via update AFAIK at least without leaving behind all current fobs. Given that it's still using a proprietary encryption scheme from the mid 80s it doesn't seem the manufacturers were particularly concerned about security to begin with.
    - deleted 1y ago
      [deleted]
  - M95D 1y ago
    The only security update for those is removal. Immobilizers via RFID chip were never broken AFAIK.
    - pabs3 1y ago
      Couldn't RFID relay work against those?
      - M95D 1y ago
        Not likely, because they're extremely short range (one centimeter or so). The attacker would need to turn the duplicate key in the ignition exactly at the time the other attacker bumps into the owner, exactly on the correct side where the pocket with the key is, and precisely match the position of the key in the pocket with the antenna in the attacker's pocket/bag/whatever. And if the key is in a handbag, then good luck trying to get a reader close to it. But then, how would they get a duplicate of the ignition key?
        pabs3 1y ago
- 0xEF 1y ago
  I would be on board with this if the system was not touching the outside world, but it does every time you hook a smartphone to it or if you have an optional data network. Just like with our smartphones, there's nothing stopping a car company from pushing system-damaging updates when they want to steer us toward buying a new vehicle since that one is too outdated/no longer supported. What you say can be true about a static isolated system, though. My employer has a Windows XP computer still running a machine in our factory. The PC was built built in 2006, connected to the Internet once upon deployment then disconnected thereafter. It has been running the software and machine more or less untouched since, receiving zero updates, performing it's duty as it was built to.
  - M95D 1y ago
    I'm not opposed to a player connected to a phone or other network, but that player doesn't need to be on the CAN bus, or any other car bus. Car speed for volume control, steering wheel buttons, lights, etc. can be communicated from the car to the player via dedicated wires (on/off, pwm, voltage ladder, etc.) like they did it in the early 2000s.
- kube-system 1y ago
  That is, if it wasn't already broken. Part of the rationale for updates is to fix problems that shipped with the vehicle.
general1726 1y ago
You can just not connect to the internet and then it does not matter if software in your car is 1 month or 20 years old.
- netsharc 1y ago
  "Cannot communicate with battery, TLS certificate expired". I think something like this happens to Macbooks if you set the date too far into the future: https://discussions.apple.com/thread/251100942?sortBy=rank https://discussions.apple.com/thread/251100942?sortBy=rank I suppose then you can change the date on the car's computer so it's still 2014 or something, at least the car would remain a non-fascist place with Obama still president...

There's no way they're going to keep a modular car functioning for years without relying on frequent software updates.

tomrod 1y ago

Did it for 100 years. Nkthing changed. They don't need to make cars into surveillance systems. That's a choice.

verisimi 1y ago
This is the whole point: putting intermediaries between you and the things you think you own. You think you own your car, phone, appliances, but actually, once this system is in place, you will effectively be on some sort of subscription contract with few traditional ownership rights, with many other parties (the car maker, government agencies) able to turn your car off remotely. Nice and safe.
calvinmorrison 1y ago
That's not entirely true. Most cars have revisions to software. Even ones from the 90s had ways to patch the ECU performed by dealers.
- tomrod 1y ago
  Not without the driver involved in the cycle, either directly or indirectly. Now they are along for the ride no matter what.

achierius 1y ago

Concretely, why not? If you don't get updates, there's nothing to break the thing -- and if you don't have a network connection, you don't need the security updates.

deleted 1y ago
[deleted]
pabs3 1y ago
You might need security updates for security systems, like immobilisers, keyless entry etc.
- fc417fc802 1y ago
  I'm happy to manually apply updates for my immobilizer as necessary. Keyless entry is already broken (recent front page) and can't be fixed via update AFAIK at least without leaving behind all current fobs. Given that it's still using a proprietary encryption scheme from the mid 80s it doesn't seem the manufacturers were particularly concerned about security to begin with.
  - deleted 1y ago
    [deleted]
- M95D 1y ago
  The only security update for those is removal. Immobilizers via RFID chip were never broken AFAIK.
  - pabs3 1y ago
    Couldn't RFID relay work against those?
    - M95D 1y ago
      Not likely, because they're extremely short range (one centimeter or so). The attacker would need to turn the duplicate key in the ignition exactly at the time the other attacker bumps into the owner, exactly on the correct side where the pocket with the key is, and precisely match the position of the key in the pocket with the antenna in the attacker's pocket/bag/whatever. And if the key is in a handbag, then good luck trying to get a reader close to it. But then, how would they get a duplicate of the ignition key?
      - pabs3 1y ago
0xEF 1y ago
I would be on board with this if the system was not touching the outside world, but it does every time you hook a smartphone to it or if you have an optional data network. Just like with our smartphones, there's nothing stopping a car company from pushing system-damaging updates when they want to steer us toward buying a new vehicle since that one is too outdated/no longer supported. What you say can be true about a static isolated system, though. My employer has a Windows XP computer still running a machine in our factory. The PC was built built in 2006, connected to the Internet once upon deployment then disconnected thereafter. It has been running the software and machine more or less untouched since, receiving zero updates, performing it's duty as it was built to.
- M95D 1y ago
  I'm not opposed to a player connected to a phone or other network, but that player doesn't need to be on the CAN bus, or any other car bus. Car speed for volume control, steering wheel buttons, lights, etc. can be communicated from the car to the player via dedicated wires (on/off, pwm, voltage ladder, etc.) like they did it in the early 2000s.
kube-system 1y ago
That is, if it wasn't already broken. Part of the rationale for updates is to fix problems that shipped with the vehicle.

general1726 1y ago

You can just not connect to the internet and then it does not matter if software in your car is 1 month or 20 years old.

netsharc 1y ago
"Cannot communicate with battery, TLS certificate expired". I think something like this happens to Macbooks if you set the date too far into the future: https://discussions.apple.com/thread/251100942?sortBy=rank https://discussions.apple.com/thread/251100942?sortBy=rank I suppose then you can change the date on the car's computer so it's still 2014 or something, at least the car would remain a non-fascist place with Obama still president...