A mistakenly published password exposed Mercedes-Benz source code

I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.

But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.

Maybe it should be like Copyright or patents, you can keep things private for a while for an advantage, but then you would need to release all code as open source / public domain or similar? It should also be available before that to be reviewed by professionals following a formal process of some sort.

I think if you release code related to important everyday things like cars, everyone who is able will want to take a look. And you never know who will think outside the box and stumble across something they can then escalate and investigate with other people who are more capable. It happens in open source all the time.

Please remember that "open source" means access to the source code, plus the right to modify it, plus the right to redistribute it without requiring additional permissions from the copyright holders, plus no restrictions on who may use the software (other than those required by law).

You can have close source with access to the source (often called 'source available'), and even with the right to modify and use those modifications.

A license which is "for noncommercial use only" or "not for use by the military" is not open source, even if the source can otherwise be freely used, modified, and redistributed.

That said, having the source code in any form does not mean things are no longer 'inherently "unsafe"'.

Device drivers are notoriously finicky and depend, for example, on the precise timing of hardware vs. software. Reading the source, even with comments, may not be enough to assume modifications are safe, perhaps because it's obvious to an expert (which you are not) or because the original authors were not aware of the issue.

Nor does open source guarantee you can reproduce the build. The auto manufacturer may use a compiler with different behavior than your compilers. But hoseja called for open source, not reproducible builds of the open source software, so inherently accepts there will be some risks.

Certainly there's less risk with reproducible builds of the open source software, but as I said, these changes are best done in steps. There's no need for the huge step you want in your perfect world. Instead, mandate open source, get experience, and use that experience to guide future changes to public policy. That's how laws generally work.

Thanksfully the clown garage shop doesn't. But CAN access SW is available for most models

The main difference is that it's tracked. Licensed, too, but huge part of that licensing is about maintaining the history of the parts and plane, and that mechanics know given plane.

But the only reason you're going to know that a change happened was because the people have been trained to log it down - but there's no physical/computer lockout preventing them.

[...]

> There are places for safe experimentation like tracks, so I don’t see why this fear isn’t irrational or a ploy for control.

I don't think many people track modded minivans. "No the Subaru WRX is my DD, my main track car is a Honda Odyssey"

People won't intentionally make their vehicles dangerous, but it's easier to make bad software than to completely bodge a physical repair using manufactured parts.

I don't know how vehicle software works, but hopefully they don't crash like consumer software. Someone here knows the answer -- is there like a supervisory manager/kernel that keeps all the subsystems running? And modular separation so that bad changes to the fuel injection system won't take out the fly-by-wire brakes?