3 ms·

It doesn't matter. If a customer buys faulty hardware, it's the seller's responsibility to replace it with working hardware. If the breaks had a manufacturing d

by mirzap 1y ago

It doesn't matter. If a customer buys faulty hardware, it's the seller's responsibility to replace it with working hardware. If the breaks had a manufacturing defect, you wouldn't expect the customer to pay for the replacement.

quantumcotton 1y ago
What if, the software is significantly more robust than Dodge Chevy Honda or Kia. But! Check this out what if you were offered an additional layer of security? You can choose it or not. It's an option. I didn't see these being easier to steal than a car using a canbus.... If it is. Sure free upgrade. But if this is improving a system that is already less vulnerable than 50% of vehicles. I can see why they'd charge.
throwaway290 1y ago
I bet the stock car is 100% secure in Korea. Maybe you live in a country where car thieves hack into cars left and right. Maybe you live in a country where thieves just tow your car in the middle of the day and don't care about your locks at all. Do you expect car maker to ship you free fixes against every scenario? Security is a spectrum. Make your police better if you don't like it. /controversial opinion
- bobthepanda 1y ago
  South Korea has a fairly active neighbor in the cybercrime scene.
  - throwaway290 1y ago
    North Koreans don't walk around Seoul streets stealing cars!
ponector 1y ago
There is nothing faulty in the hardware, why they should replace it? Following the same logic: old phones, even iphones can be hacked. Should manufacturers replace the hardware?
- mirzap 1y ago
  Yes. If you remember, the exploding Samsung Galaxy Note was recalled globally.
- reactordev 1y ago
  In my opinion, yes, yes they should. If you can’t guarantee security of your device, and you don’t want to update the software, then you’ll need to upgrade the hardware. I think it’s perfectly reasonable to have that under a warranty.
  - TheDong 1y ago
    > I think it’s perfectly reasonable to have that under a warranty. The warranty is not that long, and I think the parent comment is talking about 6+ year old iphones that are definitely out of warranty. If those should get replaced, surely that means each person buys one iPhone in their life, and then just gets free replacements forever, leading to the initial cost of the phone having to go up a lot to account for that.
    - reactordev 1y ago
      Incorrect. Forced obsolescence lets manufacturers decide where that cut off is. 6+ year iPhone, nope, not going to touch it. Sorry. However, if it’s still serviceable and by some rule less than X years old, that just had a security issue or something publicly disclosed, should do their best effort to repair their customer relationships by making it right.
- discordance 1y ago
  The line between software and hardware is hard to distinguish when we talk about ASICs and FPGAs, but they still should be responsible for core functionality (i.e. locks) as they shipped insecure software.
  - ponector 1y ago
    But why? Locks are working. They perfectly fulfill requirements for the lock. Open/close with a key, stay closed if tried to be opened without a key. There is no such thing as secure lock. Any lock could be open without original key. The difference is in the amount of effort. Still baffles me that KIA sold cars which can be driven away using screwdriver and USB cable.
TheDong 1y ago
I've been holding my breath ever since spectre/meltdown for a free cpu upgrade to make up for the slower performance that the mitigations cause. It's intel's bug, they promised a certain processor speed, shouldn't it be their responsibility to replace it since their own security oversight resulted in the hardware not working as advertised? Did you expect the same from intel/amd when those bugs came out? Is it different from this situation?
- mirzap 1y ago
  They patched the issue, didn't they? Here we are talking about hardware issue that can cause physical harm to people, companies must eat that cost. Same way Samsung did by recalling exploding Galaxy Note a few years ago
- aembleton 1y ago
  > they promised a certain processor speed How have they advertised that? Was it clock frequency? Their mitigations mean it still runs at that clock frequency.
  - tlb 1y ago
    The last desktop processor that actually promised a certain speed was probably the 68020. Everything since then has had inscrutable performance characteristics.
  - TheDong 1y ago
    They promised the performance of their processor more than Hyundai promised that the Ioniq 5 was "carjacking-proof, even if the attackers have specialized tools", and this thread is about hyundai replacing parts of cars for free because attackers can hack into cars. With specialized tools. Which of course they can.
- bjackman 1y ago
  We don't actually know how to build the CPU that would replace your vulnerable one. New CPUs are largely immune to the specific attacks that were published before they were designed. But we aren't gonna get a fast CPU without sidechannels and IMO it's not possible in theory to build a branch predictor that never makes potentially exploitable mispredictions. In a sense this doesn't change your point but I wanted to take the opportunity to point this out. "This CPU is vulnerable to attack X" just means researchers have found an exploit in practice, which we already knew in theory was there. This wasn't the expectation before Spectre/Meltdown but now we live in a world where you need to assume a degradation in your CPU's effective performance as we learn about its vulnerabilities and need to apply software workarounds. I am building "one mitigation to rule them all" called Address Space Isolation but this doesn't fundamentally remove that fact, it just means that when we learn about a CPU's vulns we don't have to build a new mitigation we just have to change the settings on the existing one (and it should be more efficient than the bespoke one would be).

by mirzap 1y ago

quantumcotton 1y ago

What if, the software is significantly more robust than Dodge Chevy Honda or Kia. But! Check this out what if you were offered an additional layer of security? You can choose it or not. It's an option. I didn't see these being easier to steal than a car using a canbus.... If it is. Sure free upgrade. But if this is improving a system that is already less vulnerable than 50% of vehicles. I can see why they'd charge.

throwaway290 1y ago

I bet the stock car is 100% secure in Korea. Maybe you live in a country where car thieves hack into cars left and right. Maybe you live in a country where thieves just tow your car in the middle of the day and don't care about your locks at all. Do you expect car maker to ship you free fixes against every scenario? Security is a spectrum. Make your police better if you don't like it. /controversial opinion

bobthepanda 1y ago
South Korea has a fairly active neighbor in the cybercrime scene.
- throwaway290 1y ago
  North Koreans don't walk around Seoul streets stealing cars!

ponector 1y ago

There is nothing faulty in the hardware, why they should replace it? Following the same logic: old phones, even iphones can be hacked. Should manufacturers replace the hardware?

mirzap 1y ago
Yes. If you remember, the exploding Samsung Galaxy Note was recalled globally.
reactordev 1y ago
In my opinion, yes, yes they should. If you can’t guarantee security of your device, and you don’t want to update the software, then you’ll need to upgrade the hardware. I think it’s perfectly reasonable to have that under a warranty.
- TheDong 1y ago
  > I think it’s perfectly reasonable to have that under a warranty. The warranty is not that long, and I think the parent comment is talking about 6+ year old iphones that are definitely out of warranty. If those should get replaced, surely that means each person buys one iPhone in their life, and then just gets free replacements forever, leading to the initial cost of the phone having to go up a lot to account for that.
  - reactordev 1y ago
    Incorrect. Forced obsolescence lets manufacturers decide where that cut off is. 6+ year iPhone, nope, not going to touch it. Sorry. However, if it’s still serviceable and by some rule less than X years old, that just had a security issue or something publicly disclosed, should do their best effort to repair their customer relationships by making it right.
discordance 1y ago
The line between software and hardware is hard to distinguish when we talk about ASICs and FPGAs, but they still should be responsible for core functionality (i.e. locks) as they shipped insecure software.
- ponector 1y ago
  But why? Locks are working. They perfectly fulfill requirements for the lock. Open/close with a key, stay closed if tried to be opened without a key. There is no such thing as secure lock. Any lock could be open without original key. The difference is in the amount of effort. Still baffles me that KIA sold cars which can be driven away using screwdriver and USB cable.

TheDong 1y ago

I've been holding my breath ever since spectre/meltdown for a free cpu upgrade to make up for the slower performance that the mitigations cause. It's intel's bug, they promised a certain processor speed, shouldn't it be their responsibility to replace it since their own security oversight resulted in the hardware not working as advertised? Did you expect the same from intel/amd when those bugs came out? Is it different from this situation?

mirzap 1y ago
They patched the issue, didn't they? Here we are talking about hardware issue that can cause physical harm to people, companies must eat that cost. Same way Samsung did by recalling exploding Galaxy Note a few years ago
aembleton 1y ago
> they promised a certain processor speed How have they advertised that? Was it clock frequency? Their mitigations mean it still runs at that clock frequency.
- tlb 1y ago
  The last desktop processor that actually promised a certain speed was probably the 68020. Everything since then has had inscrutable performance characteristics.
- TheDong 1y ago
  They promised the performance of their processor more than Hyundai promised that the Ioniq 5 was "carjacking-proof, even if the attackers have specialized tools", and this thread is about hyundai replacing parts of cars for free because attackers can hack into cars. With specialized tools. Which of course they can.
bjackman 1y ago
We don't actually know how to build the CPU that would replace your vulnerable one. New CPUs are largely immune to the specific attacks that were published before they were designed. But we aren't gonna get a fast CPU without sidechannels and IMO it's not possible in theory to build a branch predictor that never makes potentially exploitable mispredictions. In a sense this doesn't change your point but I wanted to take the opportunity to point this out. "This CPU is vulnerable to attack X" just means researchers have found an exploit in practice, which we already knew in theory was there. This wasn't the expectation before Spectre/Meltdown but now we live in a world where you need to assume a degradation in your CPU's effective performance as we learn about its vulnerabilities and need to apply software workarounds. I am building "one mitigation to rule them all" called Address Space Isolation but this doesn't fundamentally remove that fact, it just means that when we learn about a CPU's vulns we don't have to build a new mitigation we just have to change the settings on the existing one (and it should be more efficient than the bespoke one would be).