Removal of Mazda Connected Services integration
home-assistant.io
home-assistant.io
> MNAO analyzed some of the code and determined that the code provides functionality same as what is currently in Apple App Store and Google Play App Store.
Is this really legal? Because in my mind, providing the same functionality does not violate copyright, since the actual intellectual material is new. And I don't think Mazda has a patent on the ability to control your vehicle over an API.
https://www.theregister.com/2022/02/15/missouri_html_hacking...
Never know when they decide otherwise. "Hacking/cyber crime" is very wide and open term.
And how relatively easy lawfare can be brought against someone, especially if the person bringing it has infinite money and/or nothing to lose.
Do they? When it comes to reverse-engineering mobile app APIs, the usual strategy is to observe the network because it's so much easier than making sense of the disassembled binary.
Even if you can decompile, you'd generally use it as an aid to understand the network captures rather than using it as your primary source.
Additionally, MITM and trying things out on a toaster are one thing, doing the same on a 40k$ machine that can potentially make it impossible to do your commute is another.
This is IMO a prime example where the double team rev eng is key to success: one documents the API, the other uses it without having access to code (whiteroom)
> (A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.
https://www.law.cornell.edu/uscode/text/17/1201
As I understand it, car manufacturers prevent independent repair shops from lawfully obtaining some of the diagnostics information in the onboard computer by encrypting it with a key that sits on the very same drive. Said encryption is the "technological measure that effectively controls access" and using the key to decrypt it is "circumvention" -- naturally, of the "effective" access control.
(https://www.law.cornell.edu/definitions/uscode.php?def_id=17... to “circumvent a technological measure” means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner)
Mazda might be interpreting the SSL certificate as a similar measure and therefore use of the certificate to decrypt traffic as a similar violation.
[1] https://github.com/github/dmca/blob/master/2023/10/2023-10-1...
There's merits to this claim if you're indeed implementing some advanced, niche algorithm but it definitely wouldn't apply here as all he's doing is calling HTTP APIs, a very generic and common thing to do.
One person views the "contaminated" decompiled code and writes a specification. A separate person writes the code based solely on the specification. This is an accepted method of demonstrating that there is no infringement.
Just remember: they don't just want money. They want all the money.
A Home Assistant integration means people "engage" less with their app and thus whoever is working on it is at risk of irrelevance. Doesn't matter whether this actually translates to more business and money coming in at the top, PM wants their "engagement" and this is an easy way to trade long-term customer goodwill for it.
It's a wash.
For me it's sad how such an interesting engine had so many problems.
A new engine at the dealership price of $7K is still going to be cheaper than an equivalently sporty new car though!
Presumably neither their ios nor Android app used Python, so direct copyright infringement seems impossible.
It certainly seems likely that this DMCA notice was in bad faith.
At best you might get an amicus brief if there's a lawsuit and the lawsuit is high-profile enough for them to be interested.
Note that the complaint appears to have been filed on behalf of Mazda North American Operations.
I think that's actually not something that would be wise to hook up to an automation platform. A car running in the garage can kill, and 'a human chose to press this button' is an important interlock. After all, you have to swipe your way in to the official app, and to use a key fob you need to hold the button for several seconds.
'How dare Mazda permit this' is a real lawsuit that will happen. Automakers also got sued because pushbutton start is confusing and people would leave the car running after use. There is an active lawsuit right now about push-button gear selectors making it too hard to put the vehicle in park, allowing unexpected rollaways.
> I have somehow automated some lights to come on too early in the morning but the specific task/automation I set to do this is nowhere to be found.. I can create and remove new tasks but I'm being haunted by this old task.
Do you have an attached garage? How about if it gets turned on with the door closed at 4am after a daylight savings changeover gone horribly wrong. I enjoy my home assistant but I wouldn't let it control something that can gas me. I've seen way too much weird shit in my iot network to ever trust it with that.
Old cars gassed people with carbon monoxide. Odorless and deadly.
Modern cars make basically none of that. Instead, you'll die of too much CO2.
Luckily, humans are pretty good at detecting gradually increasing levels of CO2 - it's what happens when 5 people are in a car together and someone says "it's getting stuffy in here, turn the vent on!".
Sudden CO2 increases can still kill. But gradual ones like a car gradually producing more and more CO2 likely wouldn't. Even in your sleep, you will wake up and find the air stuffy (it can happen when lots of cave people are all sleeping in a badly ventilated cave, so we evolved to handle it).
However, you shouldn't rely on the above for the safety of people - all it takes is someone to be drunk or taking sleeping pills, and they might not be able to act on their senses... Also, cars where the emissions system has been tampered with or faulty can still produce a lot of deadly carbon monoxide.
The last go-around about the keyless ignitions was kicked off by a 2017 toyota. The story was from 2019
https://www.nytimes.com/2019/06/28/business/keyless-carbon-m...
I guess I’ll just reverse engineer it myself. Good to know it is possible since I can replace the app.
Code not being hosted on Github != it being unavailable
These fools really don't like someone building a better mousetrap, particularly when they see it as an exploit of their systems to do so, as they can't track/monetize/charge, etc the usage without the app component. That's really what Mazda is angry about.
As a result of things like these, I'll end up keeping my old non-connected cars as long as possible, environment be damned.
The best reason to buy new is that your mission has changed and the available used vehicles don’t provide a cost effective resource.
https://www.tesla.com/developer-docs
https://electrek.co/2023/10/12/tesla-releases-official-api-d...
They firmly asked me not to do so and kindly asked me to stop using my plugin.
I complied with the first request. For the second, not so much.
Anyway, the moral of the story is that the DMCA was written to GitHub. Your own local clone is no one’s business.
I understand if we're talking zero days and you have reasonable faith the company will attempt to fix, but I presume here we're talking more accessible heating control?
E.g., could we create a FuckYouMazda corporation, whose sole purpose was to develop this software. And if Mazda successfully sued for copyright damages, the financial liability is limited to the corporation's assets?
Knowing, deliberate actions of criminality are sufficient to piece the corporate veil.
I.e., the alleged violations are civil rather than criminal, and a reasonable person might believe Mazda's DMCA claims are unjustifiable.
You could sincerely believe that murder was ok, but that's not going to change how the law would view you murdering someone.
The idea around "piercing the corporate veil" is that you can't just slap a company in front of your actions -- regardless of whether or not you believe your actions are justified or legal -- and avoid legal consequences.
However, a person is generally liable for his own torts regardless of corporation. The shareholders might not be liable vis-à-vis the corporation, but the actual programmers and managers doing the infringement could likely be sued individually the same as if they weren't working for a corporation.
Could that company join Y Combinator?
I do not care about donating to a legal defense fund. I do want to give to a legal OFFENSE fund.
Nukers need to go to loose everything and die broken and penniless.