3 ms·

>That's ends-justifies the means. I don't like it either, but it's a common philosophy that we experience in our daily lives, whether we want it to be that way

>That's ends-justifies the means. I don't like it either, but it's a common philosophy that we experience in our daily lives, whether we want it to be that way or not. >Instead they did it in about the most dangerous way possible: live on uncontrolled roads with other traffic. There are a number of ways they could have made it worse. >The 'researchers'/hackers. They directly put people's lives at risk to have a stunt to prove their point. We tolerate the same kinds of risks daily by allowing police to conduct traffic stops on busy roadways. We do so ostensibly because safety, but the reality is that it is mostly for some pretty dubious financial reasons. That's ends justify the means, and in this case ends are traffic fines collected, and the means are lives of police officers and motorists and man-decades of time lost in traffic every day. >FCA screwed up big, and deserve some sort of penalty from the government. But not jail, like for the evil hackers-not-researchers? >This shouldn't have been possible in the first place. Another uncomfortable reality for you. Software verification is a huge challenge which nobody has gotten right yet. There will be more of these vulnerabilities. We have to get this disclosure/update process right. The best thing that automakers can do to prevent disclosure stunts like this is to fix vulnerabilities ASAP when they're discovered. >But they didn't modify a running vehicle at 70mph surrounded by unsuspecting motorists. What they did/do (months worth of nothing) is far worse, and endangers far more lives. Imagine if someone/somegroup/somegov't had managed to bundle this vuln with a popular cell-phone app, or mobile website, and decided to activate it one day at rush hour. >If the hackers had done this reasonably safely, I'd have no issue at all. But they don't deserve the title 'researcher' after behaving like that. That's just petty, and nobody really cares what you call them. It does nothing to move the discussion in a fruitful direction; but it does make you appear a bit shallow in your reasoning.

MBCook 11y ago
> We tolerate the same kinds of risks daily by allowing police to conduct traffic stops on busy roadways. We've chosen to accept that risk, and have control over it though government. People could choose to make it illegal. Also note that when the police do it they take precautions such as having bright multi-colored lights on the car to draw attention. It also bothers me that the Wired guy didn't know what was going to happen, so he couldn't prepare as well. Even that would have helped (though I still think the stunt was dangerous enough for someone to go to jail). > But not jail, like for the evil hackers-not-researchers? We can't put a company in jail and we don't usually do it with the CEO for much bigger crimes. I doubt the CEO had any idea this could happen. I imagine this is one of those things where dozens of people in different departments (and even companies due to auto parts suppliers) all made small but not terrible bad decisions that added up to a huge problem. I doubt there is a smoking gun email someone where a manager says 'I know someone could disable the car on the freeway but it will save us millions!' And while this is happening to FCA there are other cars with cell connected systems (VW, BMW, Audi, others). I imagine if we had enoug time we'd find at least 2 or 3 other companies with vulnerable systems in other car brands's 2015 models. I just don't see how we could jail anyone in FCA. That's why I didn't call for it. On the other hand the hackers seems like a pretty cut and try case. > That's just petty, and nobody really cares what you call them. The words you use to describe something matter. Having taken such a stupid risk I don't see why they should ask to be acknowledged on the same level as security professionals who don't put people in danger for headlines. Frankly the number of people in these threads defending the overly dangerous demo scares me, as does the number of people who seem to tacitly encourage such behavior.
- fnordfnordfnord 11y ago
  >We've chosen to accept that risk, and have control over it though government. People could choose to make it illegal. I'll expect to see you down at the legislature lobbying for reform and threatening jail for the opposition. >Also note that when the police do it they take precautions such as having bright multi-colored lights on the car to draw attention. It's hard not to notice something so distracting! That's another argument against the practice, isn't it? >We can't put a company in jail and we don't usually do it with the CEO for much bigger crimes. I doubt the CEO had any idea this could happen. It's a funny thing. We can never seem to find anyone in a company who knows anything or has any responsibility. We just have to satisfy ourselves that if popular opinion moves against a company strongly enough, or the gov't gets shamed into prosecuting them, that maybe then they might address some problem, usually after it actually kills people, so long as nobody has to admit fault. It's almost like a huge stunt is needed to get peoples' attention sometimes! >I imagine this is one of those things where dozens of people in different departments... Yeah, we all know about how corporate structures insulate decision-makers from the consequences of their decisions. >cut and try "Cut and dry" So, because it's easy to prosecute these two, and hard to prosecute the others, justice should take the easy route, even though one may have endangered tens of people on one occasion, and the other endangers tens of thousands of people for months? I see a different value proposition here than you. >Frankly the number of people in these threads defending the overly dangerous demo scares me I guess it would surprise you to learn that I feel the same way about you after this conversation?
- c22 11y ago
  I'm gonna take this argument in a slightly different direction. While I agree with you that the way this experiment was conducted was needlessly unsafe and irresponsible, I don't believe these researchers deserve jail time given that only positive outcomes resulted from this event. Pragmatically, society has nothing to gain from punishing these individuals and in the best case scenario doing so costs us money and pointlessly devestates likely several lives. For that matter, I am also against sending people to jail even when their actions have negative effects if it is not clear that isolating them from the public will reduce future harm.
  - 11y ago

MBCook 11y ago

> We tolerate the same kinds of risks daily by allowing police to conduct traffic stops on busy roadways. We've chosen to accept that risk, and have control over it though government. People could choose to make it illegal. Also note that when the police do it they take precautions such as having bright multi-colored lights on the car to draw attention. It also bothers me that the Wired guy didn't know what was going to happen, so he couldn't prepare as well. Even that would have helped (though I still think the stunt was dangerous enough for someone to go to jail). > But not jail, like for the evil hackers-not-researchers? We can't put a company in jail and we don't usually do it with the CEO for much bigger crimes. I doubt the CEO had any idea this could happen. I imagine this is one of those things where dozens of people in different departments (and even companies due to auto parts suppliers) all made small but not terrible bad decisions that added up to a huge problem. I doubt there is a smoking gun email someone where a manager says 'I know someone could disable the car on the freeway but it will save us millions!' And while this is happening to FCA there are other cars with cell connected systems (VW, BMW, Audi, others). I imagine if we had enoug time we'd find at least 2 or 3 other companies with vulnerable systems in other car brands's 2015 models. I just don't see how we could jail anyone in FCA. That's why I didn't call for it. On the other hand the hackers seems like a pretty cut and try case. > That's just petty, and nobody really cares what you call them. The words you use to describe something matter. Having taken such a stupid risk I don't see why they should ask to be acknowledged on the same level as security professionals who don't put people in danger for headlines. Frankly the number of people in these threads defending the overly dangerous demo scares me, as does the number of people who seem to tacitly encourage such behavior.

fnordfnordfnord 11y ago
>We've chosen to accept that risk, and have control over it though government. People could choose to make it illegal. I'll expect to see you down at the legislature lobbying for reform and threatening jail for the opposition. >Also note that when the police do it they take precautions such as having bright multi-colored lights on the car to draw attention. It's hard not to notice something so distracting! That's another argument against the practice, isn't it? >We can't put a company in jail and we don't usually do it with the CEO for much bigger crimes. I doubt the CEO had any idea this could happen. It's a funny thing. We can never seem to find anyone in a company who knows anything or has any responsibility. We just have to satisfy ourselves that if popular opinion moves against a company strongly enough, or the gov't gets shamed into prosecuting them, that maybe then they might address some problem, usually after it actually kills people, so long as nobody has to admit fault. It's almost like a huge stunt is needed to get peoples' attention sometimes! >I imagine this is one of those things where dozens of people in different departments... Yeah, we all know about how corporate structures insulate decision-makers from the consequences of their decisions. >cut and try "Cut and dry" So, because it's easy to prosecute these two, and hard to prosecute the others, justice should take the easy route, even though one may have endangered tens of people on one occasion, and the other endangers tens of thousands of people for months? I see a different value proposition here than you. >Frankly the number of people in these threads defending the overly dangerous demo scares me I guess it would surprise you to learn that I feel the same way about you after this conversation?
c22 11y ago
I'm gonna take this argument in a slightly different direction. While I agree with you that the way this experiment was conducted was needlessly unsafe and irresponsible, I don't believe these researchers deserve jail time given that only positive outcomes resulted from this event. Pragmatically, society has nothing to gain from punishing these individuals and in the best case scenario doing so costs us money and pointlessly devestates likely several lives. For that matter, I am also against sending people to jail even when their actions have negative effects if it is not clear that isolating them from the public will reduce future harm.
- 11y ago