5 ms·

I strongly disagree with the eff. Safety trumps all and there simply isn't a compelling need (that I can think of) that requires the need to tinker with the aut

by larrys 12y ago

I strongly disagree with the eff. Safety trumps all and there simply isn't a compelling need (that I can think of) that requires the need to tinker with the auto software. All of the "arguably restricts vehicle inspection, repair, and modification" is just a red herring. "The reach of copyright law has expanded so far that it now threatens people's ability to repair their own cars and protect them against malware. Yesterday, EFF launched a legal campaign to fend off that threat." Can't even think that I have read any stories (so far) about malware having an impact on auto operation. Hard to believe that opening up the software won't result in something bad happening either.

nickysielicki 12y ago
Safety doesn't trump all. But that logic still doesn't hold up. If you care about safety you should want as many eyes on your cars code as possible. See the following computer bugs that caused safety problems: * http://www.bloomberg.com/news/articles/2014-07-10/honda-recalls-175-000-fit-vezel-hybrids-for-control-flaw http://www.bloomberg.com/news/articles/2014-07-10/honda-reca... * http://abcnews.go.com/Blotter/toyota-pay-12b-hiding-deadly-unintended-acceleration/story?id=22972214 http://abcnews.go.com/Blotter/toyota-pay-12b-hiding-deadly-u... there are dozens of other stories. If safety trumps all, we might as well ban people from changing their tires. If you don't use a torque wrench, you might find your wheel coming off on the freeway.
thinkling 12y ago
I think the key issue is whether tinkering with the software is materially different from tinkering with physical parts of the car like (say) installing new brake pads yourself.
skj 12y ago
My manufacturer wants to charge me $400/year to keep the built-in map system updated. It was a $3500 add-on when we bought the car originally. It sure would be nice if I could go in and put Google maps in there.
Zikes 12y ago
In the short term, they could easily use this to lock people out of being able to perform certain routine maintenance operations on their vehicles, forcing them to go to authorized dealers and paying exorbitant markups. In the long term, tires, filters, and brake pads could become proprietary in the same way as Keurig's K-Cups are now, though I imagine with more complex DRM.
- deleted 12y ago
  [deleted]
- crististm 12y ago
  This already happens with other machines (washing ones). Only the dealers get access to a proprietary DRM software that updates a 4KB firmware. I bet that not for too long. http://www.scc-service.com http://www.scc-service.com
crististm 12y ago
First of all safety does not exist in a vacuum. And second, software is just a technology. If you have the tools you will be able to hack the device. What will happen instead is, the car's software will be signed and even if you somehow get the sources, you won't be able to run a different version. Just like in tivo. Getting back to technology, 20 years ago you were able to hack the car with a wrench. Now it's just plain impossible to know what's going on. Hopefully not for too long.
ploxiln 12y ago
"Safety trumps all" - I really do kinda hate you people. Anyway, you can already mess with modern cars tire pressure sensors, when driving near them. http://www.winlab.rutgers.edu/~gruteser/papers/xu_tpms10.pdf http://www.winlab.rutgers.edu/~gruteser/papers/xu_tpms10.pdf Closed source and un-modifiable car firmware is like closed-source crypto and other systems - it's not the best. Because it doesn't really have to be better, so why bother. Open source / custom can be as bad or worse, or it can be much better. I prefer a world where we have the freedom to have good stuff.
- larrys 12y ago
  " I really do kinda hate you people." Seems you have broken this rule: http://blog.ycombinator.com/new-hacker-news-guideline http://blog.ycombinator.com/new-hacker-news-guideline
jasonlotito 12y ago
> Can't even think that I have read any stories (so far) about malware having an impact on auto operation. http://www.nytimes.com/2010/05/14/science/14hack.html?_r=1 http://www.nytimes.com/2010/05/14/science/14hack.html?_r=1 The study referenced [PDF] http://www.autosec.org/pubs/cars-oakland2010.pdf http://www.autosec.org/pubs/cars-oakland2010.pdf This was a simple search: "malware car software." Pretty sure disabling the brakes or selectively braking individual wheels on demand could have a deadly impact on auto operation.
genericuser 12y ago
Personally I bought an OBDII cable and disabled my passenger seat belt chime. I got so sick of putting heavy objects in the passenger seat where they would be convenient to grab when I got out of the car, and having to strap them in to stop that horrible chime.
- gambiting 12y ago
  Just a word on safety - if you hit something, that heavy object in your passenger seat might actually kill you flying unrestricted around the cabin. All items in the car should be positioned in such a way that they don't turn into flying bricks upon collision.
  - genericuser 12y ago
    Its usually a large duffel which sits on the seat jammed between the seat back and the glove box, but point taken.
joshstrange 12y ago
> Can't even think that I have read any stories (so far) about malware having an impact on auto operation. Hard to believe that opening up the software won't result in something bad happening either. First of all it would be EXTREMELY hard to nail down a car crash to malware currently because we have no tools/insight to do so. For all we know (put's on tinfoil hat) car hacking has been employed multiple times by state actors to kill off people who they disagree with. It's way too easy to write it off a the driver made a mistake and never have an investigation into the root cause. However we HAVE seen that it's possible to hack into a car, there are multiple news articles showing people taking over control of cars remotely and killing the breaks, shutting off the engine, pushing down the accelerator, etc. Also I don't buy the "Safety" argument it's way to easy to scream "Think of the children" to kill off an argument. Hobbyist hackers who want to hack their own cars have to still abide by the laws set out by the government just like a mechanic can't put a car on the road without breaks. I don't see the difference, yes maybe it will make it easier for bad hackers to disable your breaks but they could just cut the break line which would probably be easier (or should be if the automakers take security seriously at all which I would bet they don't).
- ams6110 12y ago
  Key safety systems have passive modes that work regardless of the software. Steering and brakes are among these. You might lose the power assist, but you can still steer and stop. Killing the brakes on a car would require mechanical interference/sabotage, not just software hacking.
  - snuxoll 12y ago
    This all depends on the vehicle. For example, Toyota's Hybrid Synergy Drive (formerly Toyota Hybrid System) in their hybrids is entirely drive-by-wire, meaning there is no direct attachment between the steering column and pedals and the mechanics they control. I see no reason why the ability to brake in my Prius couldn't be disabled by sabotaging the ECU, same with steering and acceleration. There's not a traditional transmission either, so I can't just force it into neutral and roll up a hill to stop. There's technically a mechanical linkage in the break pedal to the disc brakes should the ECU fail, but ECU failure and ECU tampering are two separate concerns. With that said, I'm not overly concerned about electronic attacks on my vehicle at the moment, someone would still need to forcibly enter the cabin, connect to the OBDII port and make modifications to the ECU firmware, not something some jerk could do while we are going down the freeway. I would certainly feel a lot safer if the code running on the ECU was available for the community at large to dissect and inspect, though.
cmdrfred 12y ago
In response I simply defer to Ben Franklin: "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
mikeash 12y ago
How is repair and modification a red herring? It's commonplace to repair or augment vehicles with third-party aftermarket parts. Do you think we should live in a world where you must buy spare parts from the original manufacturer? Because that's where this ends up if they get to exercise this level of control.
amorphid 12y ago
Having recently worked on a proprietary enterprise software app, I have no confidence that you should assume the software in your car is safe. What's unsafe is hiding essentially software in a black box without the ability to review the code.
bougiefever 12y ago
You must be a PR person for the auto makers. I personally want to know when my driving information is being sent to a third party and be able to modify this behavior so I can control how my information is shared.
_cipher_ 12y ago
> Safety trumps all and there simply isn't a compelling need (that I can think of) that requires the need to tinker with the auto software. So you won't have any problem in <x> years if all PCs are coming with default configuration 'cause "safety trumps all' and "you don't need to tinker with the auto software". You don't need to change your shell. You don't even _need_ a shell anymore. The _company_ will provide you with everything you need. And of course, no choice for what OS you're going to install. I imagine an answer would be "but my PC isn't going to run over a child". No, but an insecure OS can cause you to lose all your credit balance and many more (which I imagine you can guess being an hn member). All that just because "you don't need to tinker with the auto software". I'm sorry, but people with views like yours keep the world behind.

by larrys 12y ago

nickysielicki 12y ago

Safety doesn't trump all. But that logic still doesn't hold up. If you care about safety you should want as many eyes on your cars code as possible. See the following computer bugs that caused safety problems: * http://www.bloomberg.com/news/articles/2014-07-10/honda-recalls-175-000-fit-vezel-hybrids-for-control-flaw http://www.bloomberg.com/news/articles/2014-07-10/honda-reca... * http://abcnews.go.com/Blotter/toyota-pay-12b-hiding-deadly-unintended-acceleration/story?id=22972214 http://abcnews.go.com/Blotter/toyota-pay-12b-hiding-deadly-u... there are dozens of other stories. If safety trumps all, we might as well ban people from changing their tires. If you don't use a torque wrench, you might find your wheel coming off on the freeway.

thinkling 12y ago

I think the key issue is whether tinkering with the software is materially different from tinkering with physical parts of the car like (say) installing new brake pads yourself.

skj 12y ago

My manufacturer wants to charge me $400/year to keep the built-in map system updated. It was a $3500 add-on when we bought the car originally. It sure would be nice if I could go in and put Google maps in there.

Zikes 12y ago

In the short term, they could easily use this to lock people out of being able to perform certain routine maintenance operations on their vehicles, forcing them to go to authorized dealers and paying exorbitant markups. In the long term, tires, filters, and brake pads could become proprietary in the same way as Keurig's K-Cups are now, though I imagine with more complex DRM.

deleted 12y ago
[deleted]
crististm 12y ago
This already happens with other machines (washing ones). Only the dealers get access to a proprietary DRM software that updates a 4KB firmware. I bet that not for too long. http://www.scc-service.com http://www.scc-service.com

crististm 12y ago

First of all safety does not exist in a vacuum. And second, software is just a technology. If you have the tools you will be able to hack the device. What will happen instead is, the car's software will be signed and even if you somehow get the sources, you won't be able to run a different version. Just like in tivo. Getting back to technology, 20 years ago you were able to hack the car with a wrench. Now it's just plain impossible to know what's going on. Hopefully not for too long.

ploxiln 12y ago

"Safety trumps all" - I really do kinda hate you people. Anyway, you can already mess with modern cars tire pressure sensors, when driving near them. http://www.winlab.rutgers.edu/~gruteser/papers/xu_tpms10.pdf http://www.winlab.rutgers.edu/~gruteser/papers/xu_tpms10.pdf Closed source and un-modifiable car firmware is like closed-source crypto and other systems - it's not the best. Because it doesn't really have to be better, so why bother. Open source / custom can be as bad or worse, or it can be much better. I prefer a world where we have the freedom to have good stuff.

larrys 12y ago
" I really do kinda hate you people." Seems you have broken this rule: http://blog.ycombinator.com/new-hacker-news-guideline http://blog.ycombinator.com/new-hacker-news-guideline

jasonlotito 12y ago

> Can't even think that I have read any stories (so far) about malware having an impact on auto operation. http://www.nytimes.com/2010/05/14/science/14hack.html?_r=1 http://www.nytimes.com/2010/05/14/science/14hack.html?_r=1 The study referenced [PDF] http://www.autosec.org/pubs/cars-oakland2010.pdf http://www.autosec.org/pubs/cars-oakland2010.pdf This was a simple search: "malware car software." Pretty sure disabling the brakes or selectively braking individual wheels on demand could have a deadly impact on auto operation.

genericuser 12y ago

Personally I bought an OBDII cable and disabled my passenger seat belt chime. I got so sick of putting heavy objects in the passenger seat where they would be convenient to grab when I got out of the car, and having to strap them in to stop that horrible chime.

gambiting 12y ago
Just a word on safety - if you hit something, that heavy object in your passenger seat might actually kill you flying unrestricted around the cabin. All items in the car should be positioned in such a way that they don't turn into flying bricks upon collision.
- genericuser 12y ago
  Its usually a large duffel which sits on the seat jammed between the seat back and the glove box, but point taken.

joshstrange 12y ago

> Can't even think that I have read any stories (so far) about malware having an impact on auto operation. Hard to believe that opening up the software won't result in something bad happening either. First of all it would be EXTREMELY hard to nail down a car crash to malware currently because we have no tools/insight to do so. For all we know (put's on tinfoil hat) car hacking has been employed multiple times by state actors to kill off people who they disagree with. It's way too easy to write it off a the driver made a mistake and never have an investigation into the root cause. However we HAVE seen that it's possible to hack into a car, there are multiple news articles showing people taking over control of cars remotely and killing the breaks, shutting off the engine, pushing down the accelerator, etc. Also I don't buy the "Safety" argument it's way to easy to scream "Think of the children" to kill off an argument. Hobbyist hackers who want to hack their own cars have to still abide by the laws set out by the government just like a mechanic can't put a car on the road without breaks. I don't see the difference, yes maybe it will make it easier for bad hackers to disable your breaks but they could just cut the break line which would probably be easier (or should be if the automakers take security seriously at all which I would bet they don't).

ams6110 12y ago
Key safety systems have passive modes that work regardless of the software. Steering and brakes are among these. You might lose the power assist, but you can still steer and stop. Killing the brakes on a car would require mechanical interference/sabotage, not just software hacking.
- snuxoll 12y ago
  This all depends on the vehicle. For example, Toyota's Hybrid Synergy Drive (formerly Toyota Hybrid System) in their hybrids is entirely drive-by-wire, meaning there is no direct attachment between the steering column and pedals and the mechanics they control. I see no reason why the ability to brake in my Prius couldn't be disabled by sabotaging the ECU, same with steering and acceleration. There's not a traditional transmission either, so I can't just force it into neutral and roll up a hill to stop. There's technically a mechanical linkage in the break pedal to the disc brakes should the ECU fail, but ECU failure and ECU tampering are two separate concerns. With that said, I'm not overly concerned about electronic attacks on my vehicle at the moment, someone would still need to forcibly enter the cabin, connect to the OBDII port and make modifications to the ECU firmware, not something some jerk could do while we are going down the freeway. I would certainly feel a lot safer if the code running on the ECU was available for the community at large to dissect and inspect, though.

cmdrfred 12y ago

In response I simply defer to Ben Franklin: "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."

mikeash 12y ago

How is repair and modification a red herring? It's commonplace to repair or augment vehicles with third-party aftermarket parts. Do you think we should live in a world where you must buy spare parts from the original manufacturer? Because that's where this ends up if they get to exercise this level of control.

amorphid 12y ago

Having recently worked on a proprietary enterprise software app, I have no confidence that you should assume the software in your car is safe. What's unsafe is hiding essentially software in a black box without the ability to review the code.

bougiefever 12y ago

You must be a PR person for the auto makers. I personally want to know when my driving information is being sent to a third party and be able to modify this behavior so I can control how my information is shared.

_cipher_ 12y ago

> Safety trumps all and there simply isn't a compelling need (that I can think of) that requires the need to tinker with the auto software. So you won't have any problem in <x> years if all PCs are coming with default configuration 'cause "safety trumps all' and "you don't need to tinker with the auto software". You don't need to change your shell. You don't even _need_ a shell anymore. The _company_ will provide you with everything you need. And of course, no choice for what OS you're going to install. I imagine an answer would be "but my PC isn't going to run over a child". No, but an insecure OS can cause you to lose all your credit balance and many more (which I imagine you can guess being an hn member). All that just because "you don't need to tinker with the auto software". I'm sorry, but people with views like yours keep the world behind.