7 ms·

The core automaker message I got out of this is: Automakers want to lock out consumers and unapproved mechanics from tinkering with vehicle software on the gro

by kileywm 12y ago

The core automaker message I got out of this is: Automakers want to lock out consumers and unapproved mechanics from tinkering with vehicle software on the grounds that (1) they could purposefully or accidentally make the vehicle non-compliant with safety/emission standards, and (2) they could use the vehicle's computers to infringe copyright (presumably ripping streaming audio?), and (3) closed source = more difficult for malicious hacking of vehicles. There are already laws in place to deter all of the outcomes of these actions. To deter the action that might lead to unlawful action... sigh.

larrys 12y ago
"There are already laws in place to deter all of the outcomes of these actions." When have laws ever stopped bad actors? There are laws against breaking and entering, burglary and so on. Does that mean you don't lock your house or install an alarm system?
- ploxiln 12y ago
  It does mean you don't use technical or legal measures to prevent people from having locksmiths fix or replace their door locks. You also don't outlaw locksmith tools, hammers and saws etc. (DMCA)
  - larrys 12y ago
    "to prevent people from having locksmiths fix or replace their door locks" In some places (quick check here, California as one example) locksmiths are required to be licensed: http://www.bsis.ca.gov/forms_pubs/locksmith_fact.shtml http://www.bsis.ca.gov/forms_pubs/locksmith_fact.shtml Also noting that there is a physical limitation to the harm that can be done if locksmith tools are sold. Both geographic and how the tool (which in not digital and has friction in distribution) is able to spread. Someone using locksmith tools will most certainly operate in one area. They can't work from the comfort of their bedroom and in most cases can't cover their tracks as easily as digital crime can be covered (and done from anywhere in the world).
    - ploxiln 12y ago
      I guess we're just lucky that anyone who can get licensed (mechanics are also licensed, though not criminal-background-checked I guess) can work on any lock in the regulatory region, because door locks don't have sophisticated software yet.
      - monknomo 12y ago
        "Sorry, that's a Yale and I only have my Schlage tools with me"
        Intermernet 12y ago
        That actually sounds like something an accomplished lock picker would say!
- skj 12y ago
  Laws stop bad actors all the time. Certainly not all burglaries are stopped, but I imagine there would be more of them if there were no consequences. We should punish the actual bad behavior, not things that enable bad behavior. Otherwise, we'd outlaw kitchen knives and driving cars because, hey, you never know what someone could use them for.
- CamperBob2 12y ago
  I lock my house. I don't lock yours.
- vacri 12y ago
  When have laws ever stopped bad actors? In San Francisco I saw someone start to cross an empty street at an intersection, who then saw a police car cross the street two blocks away. The pedestrian stepped back onto the pavement and waited for the lights to change. This was one of the most trivial crimes possible - jaywalking on an empty street - and it was stopped by a law.
rpedroso 12y ago
This line really struck me: "They say you shouldn’t be allowed to modify the code in your car because you might defraud a used car purchaser by changing the mileage." All you would need to do is checksum to know if the consumer had manipulated the code. Let car owners see the code running on their cars but void liability if the software has been altered.
- joezydeco 12y ago
  Odometer mileage is data, not code. If I can fake in a new mileage reading and correctly spoof the checksum (without triggering any anti-tamper safeguards), I've committed fraud with no way to trace it back to me.
  - cmdrfred 12y ago
    Most of the cars I see anymore have some sort of web connectivity, what if you just send a packet every time you start it? If the mileage suddenly goes from 9000 to 3000 you know you have a problem.
    - joezydeco 12y ago
      There are countless ways you could bypass that and now we're talking about a type of DRM...and DRMs never work. Plus, the idea of a car needing a net connection to operate is a non-starter (excuse the pun).
      - cmdrfred 12y ago
        Not to operate (I'd never purpose such a travesty) but it could work sort of like carfax. Go to buy a used car, Oh it's never been synced with the cloud in its 3 years of existence? I find that rather suspect. Knock off a couple grand.
        joezydeco 12y ago
        If you pay me $50/year I'll have my server spoof the packet report from your car to the manufacturer's server. It will transmit twice a day at 8:45am and 5:15pm to show the car being driven 5 miles to work and back. Hell, I'll even throw in a lunch outside the office once in a while. Your turn.
chiph 12y ago
I bet it's primarily the fear of being sued. If your cousin's friend changes the code for the ABS to "work better on gravel roads" and then you wreck, who's going to get sued? Not your cousin's friend - he's living in a van down by the river. The automaker is, because they're the ones with the money.
- w4 12y ago
  This was my immediate reaction as well. I'm quite sure that their primary motivation (service fees aside) is avoiding the litigation minefield created by permitting people to hack their cars and potentially make them unsafe.
  - aluhut 12y ago
    Which you can do already without electronics. The whole justice system is broken if we have to take the stupidity of ridiculous cases in account to tame down technological progress.
    - pyre 12y ago
      > Which you can do already without electronics. As is stated elsewhere, it's easier to determine that a physical part failed, and that it was not automaker-issued than to do the same with (e.g.) modified firmware. It's not like people are above attempting to hide the fact that they modified the firmware in order to win a lawsuit.
      - aluhut 12y ago
        But aren't they innocent until proven otherwise?
        alricb 12y ago
        Not in civil trials, no. Well, they aren't "innocent", they are either liable or not, depending on the preponderance of evidence.
nadams 12y ago
> they could purposefully or accidentally make the vehicle non-compliant with safety/emission standards, As much as I wanted to know about the mysterious "software upgrade" that the dealer claimed was available for my car (that was covered under warranty) - I understand why they keep consumers in the dark. Do you really want some random guy messing with the base code of his car and accidentally get into a deadlock situation causing the brakes to not engage? Or for the vehicle's accelerator to keep increasing without being pressed? Something else to keep in mind - people already have figured out how to remotely control a vehicle using bluetooth. [1] I couldn't tell you what the solution is - whether it be build-your-own-car or forcing auto makers to release their source code - each will still have problems. [1] - http://arstechnica.com/security/2015/02/senator-car-hacks-that-control-steering-or-steal-driver-data-way-too-easy/ http://arstechnica.com/security/2015/02/senator-car-hacks-th...

by kileywm 12y ago

larrys 12y ago

"There are already laws in place to deter all of the outcomes of these actions." When have laws ever stopped bad actors? There are laws against breaking and entering, burglary and so on. Does that mean you don't lock your house or install an alarm system?

ploxiln 12y ago
It does mean you don't use technical or legal measures to prevent people from having locksmiths fix or replace their door locks. You also don't outlaw locksmith tools, hammers and saws etc. (DMCA)
- larrys 12y ago
  "to prevent people from having locksmiths fix or replace their door locks" In some places (quick check here, California as one example) locksmiths are required to be licensed: http://www.bsis.ca.gov/forms_pubs/locksmith_fact.shtml http://www.bsis.ca.gov/forms_pubs/locksmith_fact.shtml Also noting that there is a physical limitation to the harm that can be done if locksmith tools are sold. Both geographic and how the tool (which in not digital and has friction in distribution) is able to spread. Someone using locksmith tools will most certainly operate in one area. They can't work from the comfort of their bedroom and in most cases can't cover their tracks as easily as digital crime can be covered (and done from anywhere in the world).
  - ploxiln 12y ago
    I guess we're just lucky that anyone who can get licensed (mechanics are also licensed, though not criminal-background-checked I guess) can work on any lock in the regulatory region, because door locks don't have sophisticated software yet.
    - monknomo 12y ago
      "Sorry, that's a Yale and I only have my Schlage tools with me"
      - Intermernet 12y ago
        That actually sounds like something an accomplished lock picker would say!
skj 12y ago
Laws stop bad actors all the time. Certainly not all burglaries are stopped, but I imagine there would be more of them if there were no consequences. We should punish the actual bad behavior, not things that enable bad behavior. Otherwise, we'd outlaw kitchen knives and driving cars because, hey, you never know what someone could use them for.
CamperBob2 12y ago
I lock my house. I don't lock yours.
vacri 12y ago
When have laws ever stopped bad actors? In San Francisco I saw someone start to cross an empty street at an intersection, who then saw a police car cross the street two blocks away. The pedestrian stepped back onto the pavement and waited for the lights to change. This was one of the most trivial crimes possible - jaywalking on an empty street - and it was stopped by a law.

rpedroso 12y ago

This line really struck me: "They say you shouldn’t be allowed to modify the code in your car because you might defraud a used car purchaser by changing the mileage." All you would need to do is checksum to know if the consumer had manipulated the code. Let car owners see the code running on their cars but void liability if the software has been altered.

joezydeco 12y ago
Odometer mileage is data, not code. If I can fake in a new mileage reading and correctly spoof the checksum (without triggering any anti-tamper safeguards), I've committed fraud with no way to trace it back to me.
- cmdrfred 12y ago
  Most of the cars I see anymore have some sort of web connectivity, what if you just send a packet every time you start it? If the mileage suddenly goes from 9000 to 3000 you know you have a problem.
  - joezydeco 12y ago
    There are countless ways you could bypass that and now we're talking about a type of DRM...and DRMs never work. Plus, the idea of a car needing a net connection to operate is a non-starter (excuse the pun).
    - cmdrfred 12y ago
      Not to operate (I'd never purpose such a travesty) but it could work sort of like carfax. Go to buy a used car, Oh it's never been synced with the cloud in its 3 years of existence? I find that rather suspect. Knock off a couple grand.
      - joezydeco 12y ago
        If you pay me $50/year I'll have my server spoof the packet report from your car to the manufacturer's server. It will transmit twice a day at 8:45am and 5:15pm to show the car being driven 5 miles to work and back. Hell, I'll even throw in a lunch outside the office once in a while. Your turn.

chiph 12y ago

I bet it's primarily the fear of being sued. If your cousin's friend changes the code for the ABS to "work better on gravel roads" and then you wreck, who's going to get sued? Not your cousin's friend - he's living in a van down by the river. The automaker is, because they're the ones with the money.

w4 12y ago
This was my immediate reaction as well. I'm quite sure that their primary motivation (service fees aside) is avoiding the litigation minefield created by permitting people to hack their cars and potentially make them unsafe.
- aluhut 12y ago
  Which you can do already without electronics. The whole justice system is broken if we have to take the stupidity of ridiculous cases in account to tame down technological progress.
  - pyre 12y ago
    > Which you can do already without electronics. As is stated elsewhere, it's easier to determine that a physical part failed, and that it was not automaker-issued than to do the same with (e.g.) modified firmware. It's not like people are above attempting to hide the fact that they modified the firmware in order to win a lawsuit.
    - aluhut 12y ago
      But aren't they innocent until proven otherwise?
      - alricb 12y ago
        Not in civil trials, no. Well, they aren't "innocent", they are either liable or not, depending on the preponderance of evidence.

nadams 12y ago

> they could purposefully or accidentally make the vehicle non-compliant with safety/emission standards, As much as I wanted to know about the mysterious "software upgrade" that the dealer claimed was available for my car (that was covered under warranty) - I understand why they keep consumers in the dark. Do you really want some random guy messing with the base code of his car and accidentally get into a deadlock situation causing the brakes to not engage? Or for the vehicle's accelerator to keep increasing without being pressed? Something else to keep in mind - people already have figured out how to remotely control a vehicle using bluetooth. [1] I couldn't tell you what the solution is - whether it be build-your-own-car or forcing auto makers to release their source code - each will still have problems. [1] - http://arstechnica.com/security/2015/02/senator-car-hacks-that-control-steering-or-steal-driver-data-way-too-easy/ http://arstechnica.com/security/2015/02/senator-car-hacks-th...