4 ms·

The messenger reported the problem privately 9 months ago[0] and it was only fixed as they were preparing to go to the press. The day before the "stunt hacking"

• MBCook 11y ago
  FCA deserved the press, but demoing it on a public road (at high speed) was horrendously dangerous and irresponsible. They deserve to be charged/locked up for that portion of it.
  • fnordfnordfnord 11y ago
    >horrendously dangerous and irresponsible. Not something that I would do, at least not on that stretch of road. But, nobody was actually harmed, nor was anyone even inconvenienced beyond perhaps having to make a lane-change. It could have caused a pile-up accident, but to give some perspective, I commuted into Houston on that same day and counted half a dozen disabled vehicles on my route, and two police officers trying to catch speeders; both of which add at least the same magnitude of risk to other motorists. >They deserve to be charged/locked up for that portion of it. "They" the two that did the risky road demo, or "they" the ones who waited 9 months to mitigate the safety defect in thousands of cars? Locking one of those groups up makes us more safe, and the other less.
    • MBCook 11y ago
      > But, nobody was actually harmed That's ends-justifies the means. I'm not arguing someone was hurt, I'm arguing they put people in a situation with a higher than necessary risk. > I commuted into Houston on that same day and counted half a dozen disabled vehicles on my route, and two police officers trying to catch speeders; both of which add at least the same magnitude of risk to other motorists. You can't control what other drivers around you do to cause road hazards, but in this case that's exactly what the hackers did. By cutting the transmission they caused a possibly dangerous situation. They could have done this test safely in numbers ways. On a rig designed for testing horsepower, an abandoned parking lot, a private track, or asked some police to close a section of road. Instead they did it in about the most dangerous way possible: live on uncontrolled roads with other traffic. > "They" the two that did the risky road demo, or "they" the ones who waited 9 months to mitigate the safety defect in thousands of cars? The 'researchers'/hackers. They directly put people's lives at risk to have a stunt to prove their point. FCA screwed up big, and deserve some sort of penalty from the government. This shouldn't have been possible in the first place. But they didn't modify a running vehicle at 70mph surrounded by unsuspecting motorists. If the hackers had done this reasonably safely, I'd have no issue at all. But they don't deserve the title 'researcher' after behaving like that.
      • gtremper 11y ago
        The "ends justifying the means" is not a fallacy, unless you think Consequentialism is completely wrong[1]. In this case, it seems a lot of people do think the ends justify the means. In other words, the risk was morally justified given the results. [1] https://en.wikipedia.org/wiki/Consequentialism https://en.wikipedia.org/wiki/Consequentialism
        • MBCook 11y ago
          I don't think it its a good argument in this cases since they had much safer options.
      • fnordfnordfnord 11y ago
        >That's ends-justifies the means. I don't like it either, but it's a common philosophy that we experience in our daily lives, whether we want it to be that way or not. >Instead they did it in about the most dangerous way possible: live on uncontrolled roads with other traffic. There are a number of ways they could have made it worse. >The 'researchers'/hackers. They directly put people's lives at risk to have a stunt to prove their point. We tolerate the same kinds of risks daily by allowing police to conduct traffic stops on busy roadways. We do so ostensibly because safety, but the reality is that it is mostly for some pretty dubious financial reasons. That's ends justify the means, and in this case ends are traffic fines collected, and the means are lives of police officers and motorists and man-decades of time lost in traffic every day. >FCA screwed up big, and deserve some sort of penalty from the government. But not jail, like for the evil hackers-not-researchers? >This shouldn't have been possible in the first place. Another uncomfortable reality for you. Software verification is a huge challenge which nobody has gotten right yet. There will be more of these vulnerabilities. We have to get this disclosure/update process right. The best thing that automakers can do to prevent disclosure stunts like this is to fix vulnerabilities ASAP when they're discovered. >But they didn't modify a running vehicle at 70mph surrounded by unsuspecting motorists. What they did/do (months worth of nothing) is far worse, and endangers far more lives. Imagine if someone/somegroup/somegov't had managed to bundle this vuln with a popular cell-phone app, or mobile website, and decided to activate it one day at rush hour. >If the hackers had done this reasonably safely, I'd have no issue at all. But they don't deserve the title 'researcher' after behaving like that. That's just petty, and nobody really cares what you call them. It does nothing to move the discussion in a fruitful direction; but it does make you appear a bit shallow in your reasoning.
  • jessaustin 11y ago
    ...demoing it on a public road (at high speed)... The result of the hack was that the vehicle slowed down. That happens on public roads, that vehicles slow down. Have you ever driven a vehicle on public roads? Be sure and watch for vehicles slowing down! They deserve to be charged/locked up for that portion of it. What is wrong with you? Some hackers have made a great hack, and you want them hassled by the authorities? You're a bad person and you should feel bad.
    • MBCook 11y ago
      > What's wrong with you? [...] You're a bad person and you should feel bad. That's unnecessary (and I get the reference). I have no problem with them fining and disclosing this hole. I'm glad someone is proving that cars are woefully insecure. I have a problem with the unnecessarily dangerous way it was demoed. Why do I have to choose between 'white hat hackers saving the world' and 'evil computer terrorists'? Why are can't I judge one part of the story (the discovery) from another (the demo)?
      • jessaustin 11y ago
        In this case, your judgement is poor. St. Louis area prosecutors would like nothing better than a showy media trial of suburban white dudes to distract from the well-deserved asskicking they've gotten over the last year. Fiat-Chrysler would like nothing better than pictures of these guys in handcuffs to distract from their fuckup. Those of us who hack shouldn't be so quick to turn on our own, and those of us who have ever driven on a public road know that sometimes vehicles slow down. Driving is dangerous, and as a society we've accepted that, because trade-offs. If you don't make your kids wear crash helmets while riding the school bus, you have no business calling the fury of the state down on these guys.
        • tptacek 11y ago
          A lot of reasonable people would say that it is because driving is dangerous that we shouldn't be tolerant of people needlessly adding more danger to it.
    • 11y ago