4 ms·

I'm sure there are strict security measures and a rigorous testing regime in place, but still the idea of some anonymous engineer being able to push an over-the

I'm sure there are strict security measures and a rigorous testing regime in place, but still the idea of some anonymous engineer being able to push an over-the-air update to my fast moving, two-ton lump of metal makes me a little nervous. (Tin foil hat mode) Imagine the implications of some malicious third party gaining access to that process.

bo1024 13y ago
Agreed, what are the chances that there is no vulnerability (say buffer overflow attack) that allows a black hat to get into the system?
- mason55 13y ago
  Or even an "oops, I pushed that update to production instead of test"
  - norova 13y ago
    Given the extremely dangerous potentials of such a mix-up, I would very much doubt an "Oops" moment would occur. Quite honestly, the way they run the company, I wouldn't be surprised if the process of pushing an OTA update to the automobiles is akin to launching a nuclear missile.
    - jzwinck 13y ago
      Fifteen years ago, NASA lost a Mars orbiter because one of their contractors used Imperial measurements when NASA used metric. Swissair 111 crashed because the operator installed a new entertainment system which overheated. A lot of serious systems made by serious people still end up with stupid problems.
      - jann 13y ago
        While that is true, it also means that the 'serious firmware' developed for the car probably has stupid problems. And it might be safer and cheaper to have the option of fixing problems when you find them, because if you don't have that option, you're forced to weigh the costs of a recall against the risks of the issue for every little thing.
ghshephard 13y ago
I've worked in industrial process systems where firmware is pushed out to millions of devices. The process is pretty rigorous - first the engineering team develops a candidate build, they run it through full regression and acceptance. Once it passes all the various code quality tests (coverage, static analysis, etc...), it's signed. Only code which is signed can be run on the production bootloader. The process required to sign a firmware image requires M of N people to come together with their credentials (hardware keys) to have the HSM (Hardware Security Module), sign the firmware. The actual roll out of the firmware is of course staged - in Tesla's case, they likely roll it out to all of their employees teslas for a period of time, and then to a candidate group, and eventually everyone. The team that actually pushes the firmware, is completely separate from the team that builds, and signs - they have a fairly detailed set of procedures that ensures a quality push, which is their entire focus. The likely difference, is that the process I described, usually took 4-6 months after the code was completed, whereas Elon Musk/Tesla can probably spin it around in 4-6 weeks.
- drpancake 13y ago
  I could get behind that process, and I don't doubt that theirs is similarly rigorous. I guess the issue is that, in the long-term, how do we know that it's still being applied consistently and that there are no security holes. This is a much wider and rather tricky issue (how do I know that my Bitcoin exchange is performing cold storage correctly and consistently?) You could answer: more regulations and oversight. Doesn't solve the issue.
- lnanek2 13y ago
  I've done the same at smartphone OEMs, and I can tell you, even after all the precautions and testing similar to what you said, there's always a few units that get stuck in a bootloop or fail to update out of millions. That a happening for a car instead of a phone is much more dangerous.
  - thenewbtg 13y ago
    How is it bad for the car? Are Tesla's accepting OTA updates while driving, and updating firmware while the vehicle is moving? If so then you're right, they've made a terribly unsafe decision. But if you have to stop the vehicle, put it in park or off, before it actually updates the software, then a bricked car isn't exactly dangerous, just a massive inconvenience and a source of incredible frustration.
johnward 13y ago
The counter point to you argument is the number of people who are driving right beside you at highway speeds who have been completely ignoring the TSB recalls or even general vehicle maintenance. Allowing a direct update to something computer related doesn't let these people continue to drive unsafe vehicles. All you have to do is browse http://www.reddit.com/r/justrolledintotheshop http://www.reddit.com/r/justrolledintotheshop and you'll see so many people are not capable of having general maintenance done. Like this: http://imgur.com/a/VEeR9 http://imgur.com/a/VEeR9 the guy wanted to only have the flat tire repaired even though a strut went through his hood! Or this that is supposed to be a brake rotor : http://i.imgur.com/xhz90Bq.jpg http://i.imgur.com/xhz90Bq.jpg
tlb 13y ago
The updates aren't installed while the car's moving. You see a dialog box asking if it's OK to install at 3am (or you can change the time, or wait til later.)

bo1024 13y ago

Agreed, what are the chances that there is no vulnerability (say buffer overflow attack) that allows a black hat to get into the system?

mason55 13y ago
Or even an "oops, I pushed that update to production instead of test"
- norova 13y ago
  Given the extremely dangerous potentials of such a mix-up, I would very much doubt an "Oops" moment would occur. Quite honestly, the way they run the company, I wouldn't be surprised if the process of pushing an OTA update to the automobiles is akin to launching a nuclear missile.
  - jzwinck 13y ago
    Fifteen years ago, NASA lost a Mars orbiter because one of their contractors used Imperial measurements when NASA used metric. Swissair 111 crashed because the operator installed a new entertainment system which overheated. A lot of serious systems made by serious people still end up with stupid problems.
    - jann 13y ago
      While that is true, it also means that the 'serious firmware' developed for the car probably has stupid problems. And it might be safer and cheaper to have the option of fixing problems when you find them, because if you don't have that option, you're forced to weigh the costs of a recall against the risks of the issue for every little thing.

ghshephard 13y ago

I've worked in industrial process systems where firmware is pushed out to millions of devices. The process is pretty rigorous - first the engineering team develops a candidate build, they run it through full regression and acceptance. Once it passes all the various code quality tests (coverage, static analysis, etc...), it's signed. Only code which is signed can be run on the production bootloader. The process required to sign a firmware image requires M of N people to come together with their credentials (hardware keys) to have the HSM (Hardware Security Module), sign the firmware. The actual roll out of the firmware is of course staged - in Tesla's case, they likely roll it out to all of their employees teslas for a period of time, and then to a candidate group, and eventually everyone. The team that actually pushes the firmware, is completely separate from the team that builds, and signs - they have a fairly detailed set of procedures that ensures a quality push, which is their entire focus. The likely difference, is that the process I described, usually took 4-6 months after the code was completed, whereas Elon Musk/Tesla can probably spin it around in 4-6 weeks.

drpancake 13y ago
I could get behind that process, and I don't doubt that theirs is similarly rigorous. I guess the issue is that, in the long-term, how do we know that it's still being applied consistently and that there are no security holes. This is a much wider and rather tricky issue (how do I know that my Bitcoin exchange is performing cold storage correctly and consistently?) You could answer: more regulations and oversight. Doesn't solve the issue.
lnanek2 13y ago
I've done the same at smartphone OEMs, and I can tell you, even after all the precautions and testing similar to what you said, there's always a few units that get stuck in a bootloop or fail to update out of millions. That a happening for a car instead of a phone is much more dangerous.
- thenewbtg 13y ago
  How is it bad for the car? Are Tesla's accepting OTA updates while driving, and updating firmware while the vehicle is moving? If so then you're right, they've made a terribly unsafe decision. But if you have to stop the vehicle, put it in park or off, before it actually updates the software, then a bricked car isn't exactly dangerous, just a massive inconvenience and a source of incredible frustration.

johnward 13y ago

The counter point to you argument is the number of people who are driving right beside you at highway speeds who have been completely ignoring the TSB recalls or even general vehicle maintenance. Allowing a direct update to something computer related doesn't let these people continue to drive unsafe vehicles. All you have to do is browse http://www.reddit.com/r/justrolledintotheshop http://www.reddit.com/r/justrolledintotheshop and you'll see so many people are not capable of having general maintenance done. Like this: http://imgur.com/a/VEeR9 http://imgur.com/a/VEeR9 the guy wanted to only have the flat tire repaired even though a strut went through his hood! Or this that is supposed to be a brake rotor : http://i.imgur.com/xhz90Bq.jpg http://i.imgur.com/xhz90Bq.jpg

tlb 13y ago

The updates aren't installed while the car's moving. You see a dialog box asking if it's OK to install at 3am (or you can change the time, or wait til later.)