Hacker News Reader

Comment by anonporridge | Hacker News Reader

One of the underrated benefits of having hoards of haters, is that they'll work feverishly to find and yell about any and all of your flaws and weakness, for free.

Those who don't have any haters have to pay for that valuable information, and still end up left wondering if the feedback is too soft.

View on HN

I don't know if "Lots of black hats loathe my vehicle's manufacturer and want to do it harm, and potentially by proxy me," is as beneficial as you're making it out to be.

> they'll work feverishly to find and yell about any and all of your flaws and weakness, for free.

This is a very questionable assumption. I don't see why a black hat who manages to pwn Tesla is going to then turn around and responsibly report the vuln they're using instead of doing maximum damage to the brand, potentially endangering lives of drivers, or selling their 0-day to some other malicious actor.

I’m definitely a Tesla fan.. considering a cyber truck but one concern I have which I think is similar to what your saying is I’m worried because it’s been demonstrated as bullet proof what if someone I drive by decides to test it out ?

The idea that the cyber truck is 'bylletproof' is laughable. 3mm of stainless sheet does not start defying physics when you sprinkle Tesla marketing on it. Low energy pistol rounds designed for minimal penetration might be stopped but I wouldn't bet your life on it

I have seen video of it. It's 'bulletproof' for what they shot at it, which includes handgun, shotgun, and a tommy gun.

I wouldn't rely on it as an armored vehicle. If I want extra protection, then I would spend money on uparmoring it.

Perhaps you shouldn’t put so much trust in marketing videos.

https://www.quora.com/How-thick-of-a-hardened-steel-plate-do...

Without tests with AR-15 it is simply half-true marketing. but Tesla is full of such statements, like full self driving or price including gas savings.

Toyota should do same marketing tricks with new Prius.

They shot the windows?

Depending on the ammunition type, those guns all stand out as having very low penetration.

Starting with the handgun, the two most popular calibers are 9 mm and .45, and if you shoot hollow point rounds, they can even be stopped by a few inches of drywall (hollow points are designed to expand on contact), and lead bullets may also be stopped by the truck if they are shot at an angle, but I wouldn't be sure about high-penetration rounds like full metal jacket. The Tommy gun is also handgun-caliber (assuming they shelled outout a small fortune to rent a real one, .45).

Shotguns have an even wider variety of available projectiles. A shotgun shooting buckshot has far lower kinetic energy behind each projectile than a handgun, and their velocity falls off very quickly with increased range. A slug (a solid chunk of metal) designed for armor penetration, on the other hand, will penetrate 3 mm of steel easily, with similar caveats about range.

Just replying to myself because I watched the video: the Tommy gun was loaded with hollow points, the pistol was a 9 mm Glock and shooting regular lead bullets and one of them penetrated, and the shotgun was 00 buckshot, and even the buckshot had a penetration. Their excuse for both penetrations was "two hit right in the same spot," but that is pretty doubtful. They also used a suppressed MP5 in the mix, which would have lower velocity (and thus less penetration) than the pistol, and shot the same ammunition as the pistol. All in all, a very unimpressive trial.

Suppressors don’t have a significant effect on muzzle velocity [0]. That said, in my experience, most people who shoot suppressed intentionally shoot subsonic rounds, since they are inherently quieter.

If anyone in Arizona gets a Cybertruck and is interested in more testing, I own a (legal) machine gun and I would be honored to test your vehicle’s bulletproofing. I’ll even supply the ammo.

[0] https://arxiv.org/pdf/1802.05748.pdf

> and a tommy gun

Al Capone hates this one weird trick.

Especially since those weirdly conceived 'bulletproof' windows went out the window and it's just normal glass so much of the vehicle profile is entirely susceptible to small arms fire.

Shhh they don’t have a marketing department, there is no marketing!!!! /s

> what if someone I drive by decides to test it out ?

Where do you live that you actually worry about someone shooting your vehicle while you're out driving?

Wherever it is, you need to leave if that is a valid concern.

Sounds like a random US city for me. Are you suggesting to move to Europe?

Tommy gun - nonproblemo

AK47 - accelerate

Indeed - a bit like how police riot shields seem to attract people to throw stones, I did wonder whether Elon's antics might encourage people to pelt any cybertruck they see with bricks, just to see.

Excellent points. And these hackable vehicles are powerful enough in the physical word to be "kinetic" weapons.

So we should expect the exploit market to include buyers for assassinations (of occupant or person on the street), extortion ("every hour that the Bitcoin aren't transferred, we will take over one of your customer's vehicles in an extremely tragic way, and later we will tell the news media that you declined to prevent it"), economic sabotage, market moving, terrorism, and warfare.

I wonder how bad this is compared to the competition. https://comma.ai allows you to add self-driving features to a large number of non-Tesla cars so, if we’re including physical firmware hacks as a threat vector, I’d bet tons of alternative cars (new enough Honda Odysseys, Toyota Siennas, etc: probably anything with adaptive cruise control and lane following) have the same sort of potential vulnerability.

Probably depends on how online the car is. The always-online, always able to receive manufacturer firmware updates aspect of Teslas is probably the most risky part. I don't worry about anyone hijacking my Civic remotely.

It might be risky in theory, but hasn’t firmware signing on Apple Devices and other such devices basically shown that we can do this safely?

It can be done safely, but if Tesla is compromised and their attackers gain access to their network and their signing keys, all bets are off.

I would bet that there are multiple unfriendly nation states who have intelligence groups persistently looking for ways to penetrate vital networks and secrets, like Tesla's, just to have the option of causing pandemonium if they wish to.

at some point the exploit does becomes known, but with the reporting (read: tracking) available on Teslas, I'd be surprised if an exploit being exploited isn't discovered sooner, rather than later. After reports of them being stolen get escalated by the police, how they're getting stolen or getting into unexplained accidents will be investigated. It's not like there's a keyhole to jam a screwdriver and an iphone cable in to steal the things.

and the ability for Tesla to update the firmware remotely means they don't have to do a recall in order to fix an issue.

Tesla has a decent bug bounty program - the haters get paid.

Source: I'm a paid hater. :)

What it the evidence that this is what happened here?

There's a certain sense of martyrdom around Tesla.

But I think that has nothing to do with this. Tesla has, for better or worse, one of the most "connected" vehicle systems. There are things I don't miss in my car, but I certainly like other things.

That just makes it a bigger target. Attack surface and all that, more opportunities.

It doesn't have to be about "the haters".

The downside is stronger, if your buisness modell depends on people not knowing your flaws. Like a promised full self driving, that cannot do full self driving, but rather has serious flaws, capable of killing people:

https://arstechnica.com/tech-policy/2023/11/elon-musk-and-te...

Yeah it’s free QA

Nah, they have a bug bounty program, people get paid for their bugs. Probably one of the better things Tesla do is their attitude towards bug hunters.

"hoard of haters"

If you're not repulsed by Musk, you haven't been paying attention. He is an abhorrent human being, antisemite, conspiracy theorist, anti-human rights, philandering, anti-free speech, billionaire troll. Every one of those claims has citations based in reality. Sorry to burst your bubble.

I had to read OP's comment again just to make sure I wasn't missing anything - what part of his comment made you go off like this? Burst his bubble? of what?

I think they read "hoard of haters" like "basket of deplorables"

Reply on news.ycombinator.com