Why link to some dude's twitter, I WONDER, when he links the [actual paper](https://keenlab.tencent.com/en/whitepapers/Experimental_Secu...).
There's even a better summary of the entire research in this Twitter thread: https://twitter.com/campuscodi/status/1112064046369591296
Research is pretty smart, but highly impractical for real world attacks.
It's also been patched since 2017, with additional patches in 2018. So, it's also impractical because it doesn't work anymore.
So maybe the lane marking thing is still unfixed?
I'm also a bit amused by the suggestion that we should feel even safer because it was fixed twice! :)
On the ”we should be worried” end of the scale, we have
”we fixed a bug but didn’t add a test, then accidentally reverted the bug fix, had to fix it again, and still didn’t improve our process to prevent this from happening again”
In the exaggerated version, they don’t use source control, so they had to figure out how to fix the bug twice, and they don’t even did a test, but, in both cases, only believed they fixed it.
Going back to your example, it depends on how they detected that they missed cases, and on how sure they are they know them all now. If (100% hypothetically) they only detected it after ten people died, denied existence of the problem, and were sued in court, we should be worried.
In the real world, just like all other companies working on autonomous driving, I think they will never be able to say they truly fixed the problem. The problem is, and always will be, underspecified, and even if we knew the problem well, we don’t really know for what kinds of problems the software we use to do this is a reliable solution.
I would be a bit more worried about Tesla than, say, about German car manufacturers because Tesla has shown to be willing to sail close to cliffs. Worried enough to be really worried? No.
It's entirely logical.
Zero patches, one, two, or more. That there are patches merely tells you that they tried to respond to an identified threat. It doesn’t tell you the threat was properly mitigated in any case.
I think we can say it is strictly better to have more than zero patches in the case where a vulnerability is public. Exactly one patch to me doesn’t guarantee anything about the quality. Multiple patches at least implies persistent effort and dedication to securing the fix. Maybe at some point the number of patches implies incompetence but I’m not sure I’d draw that line at “2”?
Now, in the case of an undisclosed voluntarily, waiting may be preferred as a path is going to get people to look on that direction. However, with public disclosure the clock is ticking.
Hypothetically, it could be a very targeted attack if the attacker drives in front of the target to put the paint on the road, and then a car behind the target covers it up. If the cover-up looks just like normal road (no idea how easy that is to achieve), and if nobody is looking for it because it's not a common thing to do, it might never be found. There are probably much better attacks that one could come up with if one gives it more than two minutes' thought, but it seems realistic enough to me to be interesting. Or if not a targeted attack, it can be very disruptive once there is some adoption.
Then again, people could already be disruptive and leave stuff on the road or rails, and experience tells us it's very rare (per driven person-kilometer at least). Something about tricking the computer seems more likely to happen than putting physical objects to harm others directly, but that's probably just between my ears.
Powdered chalk would probably make that trivial. https://cdn-tp3.mozu.com/24645-37138/cms/37138/files/30c19d5...
Or did you mean that there is not a specific page in the pdf which gives an overview?
- Linking to a specific page might not work for many setups such as those who use an external program to open the pdf
- The tweet is a lot easier for many people to digest who may otherwise pass on reading (even a section of) a 40 page pdf
- The full original source (which often I would prefer to link) was easily available in the tweet, so it wouldn't be hard to find for anyone who wanted it
- Coming up with a suitable submission title (80 characters or less) for the PDF was difficult as I wanted it to include information about more than one of the sections (such as both remote control + lane changing)