Hacker News Reader

Comment by ohstopitu | Hacker News Reader

have you thought the consequences of that?

No I'm very serious: we are unable to protect smart TVs. Networked smart cars (because let's be real - Google and co. would want to monetize this with Uber-like services, Ads in cars etc.) are a magnitude more likely to be hacked by both the state actors and rogue individuals (altho I don't see why we make this distinction...both are criminal acts).

The worst that can happen if your smart tv is hacked, is that they can listen and maybe watch you in your living room. If your car is hacked, they can probably kill you and hurt others while they are at it. If this happens on a large scale, it's extremely dangerous.

So while I have no problems with self driving in itself (or with Google for that matter of fact), I have a problem with banning human driving cars on the road without a viable (non-intrusive) alternative.

View on HN

We are not "unable" to protect smart TVs. If anyone gave a shit those things would be locked down tighter than a bank vault, but we don't, so they aren't.

But, as evidenced by terrorism paranoia, people do care about their personal safety--perhaps excessively and irrationally so. Security in a networked self-driving car won't be treated as an afterthought, if nothing else because of the massive legal liability.

I seriously doubt this. People do care if their car gets stolen. Unfortunately most (if not all) built-in electronic systems for protecting modern cars from being stolen are crap and thieves somehow get around them. Many of these systems (e.g. Keeloq) used "roll your own" insecure cryptography based on security by obscurity, despite availability of much stronger algorithms at that time.

> We are not "unable" to protect smart TVs. If anyone gave a shit those things would be locked down tighter than a bank vault, but we don't, so they aren't.

Every year, every major browser and major OS gets cracked in Pwn2Own. The cost of these zero-days is going up thanks to good security practices like sandboxing in Chrome et al., but they still happen. Every. Single. Year. Think about that for a second.

The fact is, we can't write secure software, especially secure networked software. I can't imagine writing secure software for cars using current best practices---let alone imagine car manufacturers doing that. To solve this, we'll need (in addition to everything we're doing now) something along the lines of Rust to prevent these sorts of bugs. And even then, it's likely that the net effect will be similar to sandboxing: the cost of an attack will go up, but not enough to prevent random individuals (let alone larger organizations) from finding zero-day security vulnerabilities on a regular basis.

It's extremely important not to be cavalier about this security risk. The combination of zero-days and self-driving cars is a scary one.

It sounds like a nightmare to me. God forbid I live in a state that won't allow me the enjoyment of safely operating a vehicle. Maybe they can choose what I'm allowed to eat as well. Please relieve me of all this self-reliance big brother...

Nobody will prevent you from the enjoyment of driving, but just as it is now, you will probably be required to insure yourself against the externalized risk associated with operating your vehicle, and that risk will be measured relative to your other transportation options.

It's the same reason that you pay relatively high car insurance premiums when you are in your teens and twenties.

We'll manage. Already a lot of critical technology (electric grids, military weapons) is connected to the internet. Civilization hasn't collapsed in spite of that.

Well, nowadays someone can easily hijack a truck and drive it in a crowd of people. And maybe self-driving cars don't need to be connected to the internet?

Reply on news.ycombinator.com