4 ms·

How about: you get to say whether you want to update and when and manufacturers are required to very explicitly list all of the changes in an update? That would

How about: you get to say whether you want to update and when and manufacturers are required to very explicitly list all of the changes in an update? That would seem to be an acceptable minimum.

pavel_lishin 1y ago
I don't think that Jeep would have sent out a message saying that one of the changes would brick your machine. It seems that the ability to trivially roll back any update would be a better choice, at least for this. (But I'm sure there are downstream effects I haven't thought about if that were implemented.)
- conductr 1y ago
  How do you roll back a fatal car accident caused by the faulty update? Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens. Allowing them time, gives them and Jeep the ability to slow roll the update so they can halt it if initial feedback is negative. I say this as a Mac user who does not allow auto updates for MacOS. I wait a week or so until the chatter validates it as non-breaking. They pushed an OS update several years ago that broke a few things I rely on. So I don’t trust them now, but these things just happen on OS’s with third party software. I expect it. But, I also don’t want to be forced to deal with the headaches immediately. I’d rather let the third parties run updates and advise how to deal, before I have to dive into fixing things. With car firmware, there’s really no excuse for this except poor engineering / processes.
  - tremon 1y ago
    Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens FTFA: > The buggy update doesn't appear to brick the car immediately. Instead, the failure appears to occur while driving — a far more serious problem And from the GP upthread: > There is no way to tell if you received the bad update. > There is no way to tell if you received the 'fix' either.
    - conductr 1y ago
      Good points, I did miss those. However, if I had this vehicle and I was reading this article today - and had the ability I'm asking for - I would just keep my current version running until they figure this mess out. It's the advantage of letting other people run the updates first, you get to hear about issues before you experience them.
  - deepsun 1y ago
    > user who does not allow auto updates for MacOS. Many security compliances require auto-updates to be on. It's thought of to be a lesser evil, because many (most) users never update their OS/browsers, which is worse.
    - conductr 1y ago
      The point is it’s up to the device owner to make their own risk calculation instead of the benevolent manufacturer
      - rk06 1y ago
        the point was that manufacture is forced to have auto update enabled in name of security compliance. so, this issue needs to be solved by compliance first
        conductr 1y ago
        This is a hypothetical in this situation, car manufacturers are under no such obligation. Also, rules like this tend to get reversed once the true risk is realized- people dying that is. We do all kinds of things for very marginal improvements to security these days
        deepsun 1y ago
        Well, my comment was from owner's side. An end-user corporation is the owner of a corporate device like car, so it can decide whether turning it on or off. I just commented that for any serious corporation auto-updates will be turned on, per compliance requirements applied to the corporation.
    - NoPicklez 1y ago
      Well it could be solved on two fronts, you could issue the update and let users know that the update needs to be installed and will be automatically installed if not done by a specific timeframe. If there are security related updates where the risk is severe then they may auto update.
  - throwway120385 1y ago
    > Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens. Allowing them time, gives them and Jeep the ability to slow roll the update so they can halt it if initial feedback is negative. This does not fix any QA process that is broken. And frankly you should not need to update any control unit firmware after it is sold. The fact that they're even doing this is broken. Unless your Mac is somehow attached to 5000 pounds of metal going 65 on the highway, the same standards should probably not apply.
    - cozzyd 1y ago
      > going 65 on the highway Oh you sweet summer child
    - WalterBright 1y ago
      > The fact that they're even doing this is broken. The NASA space probes are constantly uploaded with new software that has greatly increased the scope of their mission.
      - vips7L 1y ago
        The NASA space probes can’t plow into a minivan with a mom and her 2 kids inside. There’s an entire different risk level here.
        WalterBright 1y ago
        What if the update is to address a safety issue?
        hulitu 1y ago
        > What if the update is to address a safety issue? If they didn't make "safety" right from the first time, why do you think they will do it better the second time, when the fixes are more expensive and the time pressure is enormous ?
  - mrheosuper 1y ago
    on the other hand, if you know your old software is buggy and could cause fatal accident, you release a software update, but for some unknown reasons, the user keeps denying updating software, what would you do ?
    - worewood 1y ago
      In that case you issue a recall, which is the correct way of dealing with potentially fatal manufacturing defects.
      - mrheosuper 1y ago
        Which will be costly. Also, it does not guarantee the user will return your car, right?
        spaqin 1y ago
        Yeah, but the user will be liable for not returning the vehicle under a recall. As for cost, surely you can ask Ford's lawyers who worked there in the 70s to give you a good calculation on life vs recall costs.
        mrheosuper 1y ago
        Just issuing a recall is not enough. There are countless reasons why someone does not return the product: They maybe simple not know, and there is no way to reach them. That is why Samsung push update to disable note 7 even after recalling them.
        mschuster91 1y ago
        > There are countless reasons why someone does not return the product: They maybe simple not know, and there is no way to reach them. In Germany we let the Kraftfahrtbundesamt handle this. You are required by law to keep your address updated with the authorities, and all vehicles have to be registered to get a license plate. When a recall for safety reasons happens, the Kraftfahrtbundesamt writes a notification letter, and if you do not respond in time with evidence of having the recall issue remediated by a qualified shop (or doing it yourself and getting a sign-off from a licensed inspector), eventually they write to your local DMV office that can ban your vehicle from the roads, and if you miss that the police shows up at your home and physically removes the license sticker from the table. And heaven forbid you get actually caught driving the car after having gotten the notification letter from your local DMV. That's automatically felony territory. Our authorities really, really do not mess around. [1] https://www.kba.de/DE/Themen/Marktueberwachung/Rueckrufe/rueckrufe_node.html https://www.kba.de/DE/Themen/Marktueberwachung/Rueckrufe/rue...
- rurp 1y ago
  It's not perfect but seems reasonably easy to implement and would certainly help. If the user needs to approve each update and can see what the changes are most updates will either be skipped or delayed long enough that catastrophic bugs will only hit the small subset of cars that update immediately. I would bet most updates, especially from a company this bumbling, will be more along the lines of increasing telemetry or pointless UI changes than releasing actually useful features and bug fixes.
- danielheath 1y ago
  You might not accept an update with a bunch of changes that didn’t sound relevant to you. I certainly wouldn’t accept one while I was still driving the car!
  - skywhopper 1y ago
    The update didn’t happen while people were driving. Rather, the bug took time to occur, well after the update had been applied.
ashanoko 1y ago
[dead]
kube-system 1y ago
Release notes won't help a user figure out whether the update is going to brick their car the day after they install the update. The solution here is that the manufacturer needs to test their damn update before any of their customers get them.
hulitu 1y ago
> How about: you get to say whether you want to update and when and manufacturers are required to very explicitly list all of the changes in an update? Huh ? What a stoopid idea. Who would protect your security ? Who will protect the children ? /s
jwr 1y ago
It has become convenient for manufacturers to treat software/firmware differently from hardware, and we should fight that. If you buy a car, phone, or a TV, you buy an appliance, not "hardware stored at your place with software/firmware controlled by us". OTA software updates should be a convenience, not a requirement, never be automatic, and be otherwise treated just like a visit to a car repair shop. Similarly, no manufacturer should be able to tell you "oh, but it's a software problem" if your thing doesn't work as expected (I had Apple tell me this, for example).
- jcgrillo 1y ago
  Exactly. It has become accepted that manufacturers can sell us complicated systems before they're "done" and software is the excuse. It should not be acceptable, and if done well we could see incentives against this behavior causing manufacturers to sell radically simpler, safer, and more maintainable systems. In this case, it appears somehow that an infotainment system update impacted the drivetrain. In my fully "fly by wire" computerized vehicle from 1999 (M-B E300), even if it somehow could receive OTA updates, these systems are physically separate. The ABS system is a different module from the transmission controller, which is different from the engine controller. They all communicate over CAN, but the only way one could crash another is if somehow it responds poorly to incorrect CAN messages.. And even if these computers crash the mechanical components they control will probably keep working more or less.. What has happened in the intervening quarter century that made it possible for this failure to happen?
- AnthonyMouse 1y ago
  > Similarly, no manufacturer should be able to tell you "oh, but it's a software problem" if your thing doesn't work as expected Well, they should if they provided you with the hardware and you got the software from someone else. But that's the other problem: They prevent you from doing that, and then if their software is crap or they decide to turn off the servers, what do you do? Watch for some carmaker to try to say that the car only had a 10 year warranty and then brick them by turning off some servers after they're over 10 years old, or just go out of business with the same result. It's a travesty that people even put up with that for electronics.

How about: you get to say whether you want to update and when and manufacturers are required to very explicitly list all of the changes in an update? That would seem to be an acceptable minimum.

pavel_lishin 1y ago

I don't think that Jeep would have sent out a message saying that one of the changes would brick your machine. It seems that the ability to trivially roll back any update would be a better choice, at least for this. (But I'm sure there are downstream effects I haven't thought about if that were implemented.)

conductr 1y ago
How do you roll back a fatal car accident caused by the faulty update? Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens. Allowing them time, gives them and Jeep the ability to slow roll the update so they can halt it if initial feedback is negative. I say this as a Mac user who does not allow auto updates for MacOS. I wait a week or so until the chatter validates it as non-breaking. They pushed an OS update several years ago that broke a few things I rely on. So I don’t trust them now, but these things just happen on OS’s with third party software. I expect it. But, I also don’t want to be forced to deal with the headaches immediately. I’d rather let the third parties run updates and advise how to deal, before I have to dive into fixing things. With car firmware, there’s really no excuse for this except poor engineering / processes.
- tremon 1y ago
  Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens FTFA: > The buggy update doesn't appear to brick the car immediately. Instead, the failure appears to occur while driving — a far more serious problem And from the GP upthread: > There is no way to tell if you received the bad update. > There is no way to tell if you received the 'fix' either.
  - conductr 1y ago
    Good points, I did miss those. However, if I had this vehicle and I was reading this article today - and had the ability I'm asking for - I would just keep my current version running until they figure this mess out. It's the advantage of letting other people run the updates first, you get to hear about issues before you experience them.
- deepsun 1y ago
  > user who does not allow auto updates for MacOS. Many security compliances require auto-updates to be on. It's thought of to be a lesser evil, because many (most) users never update their OS/browsers, which is worse.
  - conductr 1y ago
    The point is it’s up to the device owner to make their own risk calculation instead of the benevolent manufacturer
    - rk06 1y ago
      the point was that manufacture is forced to have auto update enabled in name of security compliance. so, this issue needs to be solved by compliance first
      - conductr 1y ago
        This is a hypothetical in this situation, car manufacturers are under no such obligation. Also, rules like this tend to get reversed once the true risk is realized- people dying that is. We do all kinds of things for very marginal improvements to security these days
      - deepsun 1y ago
        Well, my comment was from owner's side. An end-user corporation is the owner of a corporate device like car, so it can decide whether turning it on or off. I just commented that for any serious corporation auto-updates will be turned on, per compliance requirements applied to the corporation.
  - NoPicklez 1y ago
    Well it could be solved on two fronts, you could issue the update and let users know that the update needs to be installed and will be automatically installed if not done by a specific timeframe. If there are security related updates where the risk is severe then they may auto update.
- throwway120385 1y ago
  > Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens. Allowing them time, gives them and Jeep the ability to slow roll the update so they can halt it if initial feedback is negative. This does not fix any QA process that is broken. And frankly you should not need to update any control unit firmware after it is sold. The fact that they're even doing this is broken. Unless your Mac is somehow attached to 5000 pounds of metal going 65 on the highway, the same standards should probably not apply.
  - cozzyd 1y ago
    > going 65 on the highway Oh you sweet summer child
  - WalterBright 1y ago
    > The fact that they're even doing this is broken. The NASA space probes are constantly uploaded with new software that has greatly increased the scope of their mission.
    - vips7L 1y ago
      The NASA space probes can’t plow into a minivan with a mom and her 2 kids inside. There’s an entire different risk level here.
      - WalterBright 1y ago
        What if the update is to address a safety issue?
        hulitu 1y ago
        > What if the update is to address a safety issue? If they didn't make "safety" right from the first time, why do you think they will do it better the second time, when the fixes are more expensive and the time pressure is enormous ?
- mrheosuper 1y ago
  on the other hand, if you know your old software is buggy and could cause fatal accident, you release a software update, but for some unknown reasons, the user keeps denying updating software, what would you do ?
  - worewood 1y ago
    In that case you issue a recall, which is the correct way of dealing with potentially fatal manufacturing defects.
    - mrheosuper 1y ago
      Which will be costly. Also, it does not guarantee the user will return your car, right?
      - spaqin 1y ago
        Yeah, but the user will be liable for not returning the vehicle under a recall. As for cost, surely you can ask Ford's lawyers who worked there in the 70s to give you a good calculation on life vs recall costs.
        mrheosuper 1y ago
        Just issuing a recall is not enough. There are countless reasons why someone does not return the product: They maybe simple not know, and there is no way to reach them. That is why Samsung push update to disable note 7 even after recalling them.
        mschuster91 1y ago
        > There are countless reasons why someone does not return the product: They maybe simple not know, and there is no way to reach them. In Germany we let the Kraftfahrtbundesamt handle this. You are required by law to keep your address updated with the authorities, and all vehicles have to be registered to get a license plate. When a recall for safety reasons happens, the Kraftfahrtbundesamt writes a notification letter, and if you do not respond in time with evidence of having the recall issue remediated by a qualified shop (or doing it yourself and getting a sign-off from a licensed inspector), eventually they write to your local DMV office that can ban your vehicle from the roads, and if you miss that the police shows up at your home and physically removes the license sticker from the table. And heaven forbid you get actually caught driving the car after having gotten the notification letter from your local DMV. That's automatically felony territory. Our authorities really, really do not mess around. [1] https://www.kba.de/DE/Themen/Marktueberwachung/Rueckrufe/rueckrufe_node.html https://www.kba.de/DE/Themen/Marktueberwachung/Rueckrufe/rue...
rurp 1y ago
It's not perfect but seems reasonably easy to implement and would certainly help. If the user needs to approve each update and can see what the changes are most updates will either be skipped or delayed long enough that catastrophic bugs will only hit the small subset of cars that update immediately. I would bet most updates, especially from a company this bumbling, will be more along the lines of increasing telemetry or pointless UI changes than releasing actually useful features and bug fixes.
danielheath 1y ago
You might not accept an update with a bunch of changes that didn’t sound relevant to you. I certainly wouldn’t accept one while I was still driving the car!
- skywhopper 1y ago
  The update didn’t happen while people were driving. Rather, the bug took time to occur, well after the update had been applied.

ashanoko 1y ago

[dead]

kube-system 1y ago

Release notes won't help a user figure out whether the update is going to brick their car the day after they install the update. The solution here is that the manufacturer needs to test their damn update before any of their customers get them.

hulitu 1y ago

> How about: you get to say whether you want to update and when and manufacturers are required to very explicitly list all of the changes in an update? Huh ? What a stoopid idea. Who would protect your security ? Who will protect the children ? /s

jwr 1y ago

It has become convenient for manufacturers to treat software/firmware differently from hardware, and we should fight that. If you buy a car, phone, or a TV, you buy an appliance, not "hardware stored at your place with software/firmware controlled by us". OTA software updates should be a convenience, not a requirement, never be automatic, and be otherwise treated just like a visit to a car repair shop. Similarly, no manufacturer should be able to tell you "oh, but it's a software problem" if your thing doesn't work as expected (I had Apple tell me this, for example).

jcgrillo 1y ago
Exactly. It has become accepted that manufacturers can sell us complicated systems before they're "done" and software is the excuse. It should not be acceptable, and if done well we could see incentives against this behavior causing manufacturers to sell radically simpler, safer, and more maintainable systems. In this case, it appears somehow that an infotainment system update impacted the drivetrain. In my fully "fly by wire" computerized vehicle from 1999 (M-B E300), even if it somehow could receive OTA updates, these systems are physically separate. The ABS system is a different module from the transmission controller, which is different from the engine controller. They all communicate over CAN, but the only way one could crash another is if somehow it responds poorly to incorrect CAN messages.. And even if these computers crash the mechanical components they control will probably keep working more or less.. What has happened in the intervening quarter century that made it possible for this failure to happen?
AnthonyMouse 1y ago
> Similarly, no manufacturer should be able to tell you "oh, but it's a software problem" if your thing doesn't work as expected Well, they should if they provided you with the hardware and you got the software from someone else. But that's the other problem: They prevent you from doing that, and then if their software is crap or they decide to turn off the servers, what do you do? Watch for some carmaker to try to say that the car only had a 10 year warranty and then brick them by turning off some servers after they're over 10 years old, or just go out of business with the same result. It's a travesty that people even put up with that for electronics.