6 ms·
List of Open Source Licences in Mercedes Cars [pdf]
- patrickg 13y agoMeta-question: what does [scribd] mean in the title?
- homeomorphic 13y agoIt's a link to a scribd version of the PDF. Try clicking.
- patrickg 13y agoDuh! Thanks.
- Xylakant 13y agoIt's auto-added for pdfs by HN and links to the scribd mirror of the same document.
- apostlion 13y agoJust to clarify – there are 108 distinct licenses used. So apart from Apache, BSD, GPL v2, GPL v3, LGPL, there are 103 _different_ license terms used. IP law, as currently used, is something really overcomplicated.
- Xylakant 13y agoThe other interesting takeaway is that obviously open source is widely used in embedded systems such as cars. 108 distinct licenses means that they're using at least as many libraries/projects, likely many many more that fall under the big ones.
- teh 13y agoI would be interested to see how many contracts and licences they have for their other technology. OS Software licences are just particularly visible.
- the_mitsuhiko 13y ago> GPL v3 There is no [AL]?GPLv3 in those cars, it would be impossible to comply with the license terms.
- leoedin 13y agoSurely the device could contain GPLv3 software which isn't statically linked, or which is simply running on the computer. A lot of these devices use Linux, and may include GPLv3 utilities.
- bri3d 13y agoGPLv3 contains the "Anti-TiVo" clause which requires that GPLv3 software be able to be swapped out with its equivalent from-source build by the end-user. Most car manufacturers are very hesitant to give users access to swap out their car's software, often for warranty and safety reasons.
- belorn 13y agoI can take a car to a repair shop of my choice, and replace the breaks. This is not illegal, nor does it invalidate some kind of "warranty". If the break is found to cause safety risk, it is not the car manufacturer that is going to get into trouble. Why would there be a special warranty or safety concern replacing the software that control the break, but no warranty or safety concern replacing the physical breaks with custom ones?
- bri3d 13y agoI agree that there should be nothing illegal about modifying software, and that modifying software can't (or at least shouldn't) blanket-void a warranty. My point was that since the burden is on the manufacturer to prove that they're denying a warranty claim due to a user's negligence or damage, manufacturers hate users modifying control software. It's a lot easier to make a software change, damage a car, and reverse the change than it is to make a physical change, damage the car, and swap the part back before taking the part back to the dealer. Plus, errors in software are much harder to spot. If I get a brake caliper bracket with a giant crack in it, I see the issue while I'm installing it and can send it back. If I download BillyJoe's Flash V1.65, I have to go to a lot more work to figure out if it's going to hurt me.
- davidw 13y agoThere are really only a few broad categories of OS licenses, so in this case it's the fault of the programmers for the proliferation of licenses.
- stickydink 13y agoHas anyone driven an S-Class? It has almost every one on that list. What's it got in there that the others don't?
- Xylakant 13y agoMost interesting: Why libpcap, strace and netcat? Also: gcc in a car?
- dagw 13y agolibpcap can sniff Bluetooth and the S-class has Bluetooth? Otherwise I'm guessing it's probably all just part of their standard tool chain and someone said "give me a list of all open source software you used while developing the software for the S-class".
- dominicgs 13y agoBluetooth is certainly one possibility, although libpcap can be used for a broad range of protocols, including USB and CAN, which are other candidates in a system like this. Everything in this header that starts with DLT_ is a supported data link type: https://github.com/mcr/libpcap/blob/master/pcap/bpf.h https://github.com/mcr/libpcap/blob/master/pcap/bpf.h
- homeomorphic 13y agoSomeone else suggested that they're probably used by diagnostic tools.
- train_robber 13y agoAll that would be used for on-board diagnostics for the different electronic control units.
- czr80 13y agoThe S-class is famously the test bed for new technologies - they start at the high end and then slowly migrate downrange.
- pyalot2 13y agoWeirdly this is simultaneously pretty cool (yay, open source makes an impact, take that Ballmer) and quite horrible (license jungle anyone?).
- sjwright 13y agoThis shouldn't come as a surprise to anyone, and probably not worthy of promotion on Hacker News. Consider the counterfactual: if Merc hadn't used these open source libraries, they would have had to roll their own implementations of PNG, ZIP, an XML parser... now that would be a story! Similar hilariously long lists can be found on many web-connected devices, from BMWs to iPhones. (Pages 3 to 6 are the interesting ones though -- it shows that a majority of these libraries/codebases apply to the brand new S-Class. And the most noteworthy inclusion is AOSP, i.e. Android.)
- Xylakant 13y agoI'm not surprised they use OS. Some of the libraries come as a surprise to me: * gcc * libpcap * strace * netcat I also found it slightly amusing that liboil is used in a car (and is completely unrelated to "oil")
- sjwright 13y agoMy guess is it's a lot easier to add a bunch of licenses into the documentation than it is to exclude diagnostic tools from production builds.
- tobithiel 13y agoThese are mostly used for diagnosing/debugging the newer head units. They rely on BT and standard networking. GCC is pretty standard for any embedded device, I would say.
- adrianb 13y agoEntertainment and navigation systems in cars use Android lately. They normally use the base operating system and APIs while the UI is always heavily customized, so you might not recognize it, but it's of course very convenient instead of developing a full OS for your cars.
- __alexs 13y agoAre drivers of the S-Class bound by the terms of the JSON license and so better be careful not to do anything Evil lest they anger Crockford?
- snippyhollow 13y agoOnly if the car was built after august of this year (page 5). We'll see a lot of good being done soon! ;-)
- yitchelle 13y agoA snippet from the SQLite license...I wonder how the driver will comply to this one.... May you do good and not evil. May you find forgiveness for yourself and forgive others. May you share freely, never taking more than you give
- lucian1900 13y agoSQLite is public domain, that snippet is just a README.
- Xylakant 13y agoFor a work to be in placed in public domain, the author(s) must waive all rights to the work. So the "license" part of the readme is actually "The author disclaims copyright to this source code." You can actually obtain a "real" license for sqlite since some jurisdictions do not recognize public domain at all.
- informatimago 13y agoPlus, the author should be dead in France for 70 years. "L'article L. 123-1 du Code de la propriété intellectuelle précise : « L'auteur jouit, sa vie durant, du droit exclusif d'exploiter son œuvre sous quelque forme que ce soit et d'en tirer un profit pécuniaire. Au décès de l'auteur, ce droit persiste au bénéfice de ses ayants droit pendant l'année civile en cours et les soixante-dix années qui suivent. »" Notably, the authors are prevented to waive all rights to the work, because this obliterate the rights of his heirs, present and future.
- rajeemcariazo 13y agoThis line has caught my attention "If you are affiliated in any way with Microsoft Network, get a life" under Netcat License
- plaes 13y agoSo, do they also provide downloads of source code and the modifications?
- merijnv 13y agoI don't think they provide downloads, but the document includes an offer to obtain the source: Components of the software used in the vehicle may be free and open source software licensed under the terms of license of the GNU General Public License, Version 2 (GPLv2), GNU Lesser General Public License, Version 2.1 (LGPLv2.1) or GNU Library General Public License, Version 2 (LGPLv2). Upon request, we will supply the source code of the components licensed under the GPLv2, LGPL v2.1 and LGPLv2 on a data-medium (please specify the designation of your vehicle). Please direct your request to the following address within three years after vehicle delivery: Daimler AG, HPC: CAC, Customer Service, D-70546 Stuttgart The copyright holders usually do not provide any warranty and assume no liability whatsoever for the free and open source software components. Note that any modificati- on to the vehicle of any kind can void any warranty claim.
- blumentopf 13y agoFurther ways to contact the Customer Assistance Center (not in the PDF): phone: 00800 1 777 7777 e-mail: cs.deutschland@cac.mercedes-benz.com
- femto 13y agoA cursory search of the net returns the license pdf, but no source code, list of source code used or offer of source. Is this the sort of thing that comes with the actual car? Edit: My bad. The offer is in the pdf. Anyone actually looked at the provided disk? What's on it?
- robmcm 13y agoInteresting to see GTween in there, HTML animation lib simular to the AS3 API used in the S-Class. So I guess the dash must have some browser in it. Seems inefficient for something I imagine has a finite scope, such as open a car door animation, or tween the temperate bar etc.
- olalonde 13y ago> NetFront (not China) > NF Browser (only China) Anyone has a clue what is the difference between those and what it has to do with China? The license terms are exactly the same except for the name of the software. Also, NF Browser redirects to NetFront on Wikipedia (https://en.wikipedia.org/w/index.php?title=NF_Browser&redirect=no https://en.wikipedia.org/w/index.php?title=NF_Browser&redire...).
- binarymax 13y agoHow long before cars are zero-day susceptible to remote wireless hacks that can endanger lives of the passengers? I have seen conspiracy theories about acceleration and brakes being tampered with, but those allude to the tampering while the car was stationary. When a vehicle has so much code in it, control systems are fly-by-wire, and there is bluetooth and wifi access, it is not a stretch to imagine a malicious entity driving on the highway and taking over nearby vehicles.
- adisbladis 13y agoI would guess the control systems and entertainment/navigation systems are separated for that very reason.
- dominicgs 13y agoThey probably are completely separate, but the use of wireless protocols is not necessarily confined to the entertainment system. For example, wireless tyre pressure/temperature sensors are installed in many cars and can be read with SDR hardware[1]. It's not too much of a leap to assume that false readings could be injected. [1] http://sandiego.toorcon.net/2013/10/07/dude-wheres-my-car-reversing-tire-pressure-monitors-with-an-sdr/ http://sandiego.toorcon.net/2013/10/07/dude-wheres-my-car-re...
- mcculley 13y agoThey are not that separated. Some modern cars have the entertainment system take note of the speed of the engine and adjust the volume accordingly. Some flip the infotainment display to a backup camera when the transmission is indicated to be in reverse. This is in addition to some cars adjusting the side mirrors when in reverse. I remember reading of an exploit that took advantage of the fact that the security system was on the same network in a particular car and thieves were able to crack off a side mirror and inject an "unlock" command. Does anybody have a reference for that?
- spatulon 13y agoThey are typically connected, but (kind of) sandboxed. A small ECU acts as a bridge between the infotainment system and the CAN bus.
- meshko 13y agoI got a little worried when I saw msdos_fsck in the list but then I remembered that I don't own a Mercedes and calmed down.
- microcolonel 13y agoThat's for FAT filesystems... i.e. SD cards and the like.
- powertower 13y agoThe crypto stuff is handled by these guys - http://www.bouncycastle.org/ http://www.bouncycastle.org/ I was originally looking at their library to help me programmatically generate self-signed certificates via C# (that are Apache / openssl / mod_ssl compatible), but ended up trying to use some native interop code and Windows crypto-api, and could only get it 80% of the way, so I gave up and moved on.