Also every technological advancement we are reducing fatality. We are not bringing it to complete zero but we are definitely reducing it.
Some mitigating factors:
- they can do slow releases. So if a serious anomaly does occur it is unlikely to be with your car.
- the conditons of space make errors much more catosptrophic. Although I can imagine similarly catosptrophic scenarios with a car, there are also more opportunities to safely rectify the situation (like the car pulling over and refusing to drive if things are not ok). In space, the satellite cannot just stop and wait for a tow truck to arrive.
- there is only one satellite to test the update on. If they screw it up, it's gone. With cars, there are many to test on, so errors will turn up and be fixed faster.
But back to the issue of risk:
Just like with drunk driving, you are at risk of somebody else's car going haywire as well, so it's a risk regardless of whether you yourself updated or not. At that point, the difference between your existing risk and the risk you take on from the update is probably not that great, so might as well just do the update.
I think it's a tradeoff. If self-driving cars can save tens of thousands of lives in the US every year, how many should we be willing to risk to enable this?
Eventually your insurance company may force this on you due to higher premiums, or government may make injuring someone in a manual car accident a crime like assault.
Tesla is the only offender I know about when it comes to real cars that actually exist and have obnoxious over-the-air update systems, because normal car companies are constrained by their contracts with dealer networks, so any software updates they might want to push on us would have to be done through the normal vehicle service program. This can easily be avoided by choosing a different mechanic. One can't very well choose a different mechanic if you are stuck a Tesla-like system that pushes diffs at you via radio, and that's what concerns me.
Thanks, here's $5k for your hard work as part of our bounty program."
I'm not in a position to discuss bug bounty ethics or judge what the right thing to do is given the market circumstances, I'm only in a position to make an opportune joke.
But you gotta admit...it is amusing seeing very critical vulnerabilities like ubiquitous user login being reported by researchers whom get 5k or 10k for doing the right thing. These holes could instantly cripple the trust of a company's userbase and yet the people reporting them get pennies.
What other option do these researchers have? Try to sell the vuln on the black market (illegal) or to a state actor (unethical and likely illegal)? Keep quiet about what they found and not get any money/recognition?
Companies are under no obligation to pay and researchers are under no obligation (except ethics, I guess) to turn over their findings. By having some non-trivial payment the companies are encouraging people to provide cheap sec audits for them.
That's probably what GP is alluding to. They do have this option and I can imagine they could get much more money this way, with little or no way to trace the source of a 0day back to them.
> Companies are under no obligation to pay and researchers are under no obligation (except ethics, I guess) to turn over their findings. By having some non-trivial payment the companies are encouraging people to provide cheap sec audits for them.
Well, of course. The question is, whether the amount companies chose to pay is enough to get most people to report vulnerabilities instead of selling them elsewhere, or if those companies are just putting a lot of trust in the strong morals of security researchers?
Well, after talking to their CISO, it sounds like no such thing will happen. Her reason was, "It's not actually a 'bug', so it's not going to be included in a bug bounty program". So there goes that idea.
I really don't get it. I could have just as easily sold everything in there for big monies, or could have personally done havoc of my own. There's a certain point where "thanks" just doesn't feel enough, especially after the bug bounty comment.
But being able to say "$GOODTHING happened because of me" felt so much better. It just means in the end that 50% of my meals are lentil based :P.
What makes you think I'm actually messing with big corps? I'm not. I disclosed the issue properly and safely. I have a good lawyer who would step in to help if something bad happened. But hell, if something bad did happen, where I can't get out of a sentence like that, then fine. It is what it is.
But letting that fear of 30 years of prison prevent me from disclosing something that could have long term effects for millions? Fuck. That.
I wasn't even doing any of this for money. I found it, I wanted to correct it. That's it. But for their CISO to drop a giant deuce on me like that without as much as a "Thank you" from her? Heh. It's a little annoying.
I'd rather not fall into this trap: https://theintercept.com/2016/04/28/new-study-shows-mass-sur...
I really think this part:
> > I really don't get it. I could have just as easily sold everything in there for big monies, or could have personally done havoc of my own.
would have earned you a prison sentence (if caught). The most obvious ways to 'profit' from security bugs for corps with no bug bounties are illegal.
> High energy particles may have disrupted the onboard electronics.
If this is a problem Humanity has a bigger problem.
Humor aside I agree defects in devices that can rapidly become two ton death machines must be taken seriously. There must be safe guards at every level.