Insecure vehicles should be banned, not security tools like the Flipper Zero

At one time is was possible to open car doors with a coat hanger. Nobody suggested banning coat hangers. They fixed the doors.

The idea of banning the flipper is like banning legos because you can build lockpicks out of them — it’s just nonsensical politician logic.

The Flipper Zero is not certainly the problem here, and it is not a proper SDR tool as said. But I believe it's technically interesting that the Flipper Zero uses the CC1101 inside the Flipper in a more powerful way. The chip can be configured to just report in a given pin the actual OOK/FSK state (logic high/low). The same can be done while transmitting. So the Flipper is not limited to the protocols/formats supported by the CC1101 during normal operations, but can do any protocol as long as it is within the frequency range and uses OOK or FSK modulation (or the FSK variants supported).

> but real thieves already have better tools for their job.

there you go, letting logic get in the way of a politician looking to score points

All this will do is increase sales volume. Given that flipper is 95% just a marketing play, I wouldn't be surprised if they're already on this

Well for one thing the OBD port shouldn’t be designed so that it has direct access to any useful CAN bus. It should go to a gateway that requires authentication to do anything except read OBD, and all of the IDs that you are allowed to send should be whitelisted.

The issue people are mentioning with the headlights is easily solved by just moving the starter CAN to its own CAN bus between the immobiliser and the ECU (physically isolating the headlights), which costs about $5 total and requires no crypto unless thief is willing to cut the car nearly completely in half.

(The problem with crypto is the $10 safety MCUs used all throughout cars are only like 20MHz and they can’t really do the 2000+ crypto ops/sec on top of their current workload. Also the tooling support for crypto ATM is really poor in the model based design tools that are used for this safety relevant SW)

BTW I personally don’t believe that anything that involves cutting into a vehicle is negligence of anyone. I mean, from my perspective, anyone can just pop the hood and drive the car with their own BYO ECU. It’s just a hunk of metal and once you start cutting it up you can make it do whatever you want.

I am an automotive systems engineer.

See all that time the thief spends near the drivers side headlight? The headlights are on the can bus, if you can tap a couple wires in there the cars is yours.

Infinite Infinity car hack, came with two, left with three Q50s.

They do crouch an awful lot near front wheel well. Reminds me of this Toyota hack where thieves plug into headlight canbus wiring thru wheel arch https://kentindell.github.io/2023/04/03/can-injection/

Obviously, we want owners to have full access to their car's CANBUS.

So the question is: how should the OBD-2 plug (or wiring) be protected?

It was easy enough to do with https://www.uprev.com/.

We had a specialist shop in the same area. You can disable Security+ with uprev.

Hell we would even use it to remove engines from nissans to make them run in whatever we put them in without the ignition. I can make the start signal just come from a momentary push button.

Locksmiths can make new key fobs for nearly any car with access to the OBD2 port and the right software (though I don’t know if it requires a connection to the manufacturer)

I don't know if I have a clip of it still but that was nowhere near as fast as my neighbor's range rover being stolen during pandemic, broad daylight, four hoodies walk into our car park (flats) and walk out of camera view, 30 seconds later they're driving the range rover past the camera view and presumably rammed the gate we have (since it was broken).

Both car manufacturers and police are useless and it's fucking inexcusable, imo.

Damn. That's a wild video (wish there was a fast forward though). Curious how they did it. Is this a CAN bus back?

The answer is simple, we need to ban android tablets. /s

I will never, ever keep a car I care about outside anywhere near the city.

I know everyone doesn't have the funds for that, but I'm sorry, we all know how rampant car thefts have gotten since before those 3 Q50s in this video were even purchased. I live in the busiest neighborhood in downtown Denver with which has rampant property theft, cats cut out etc non-stop.

I own 2 vehicles and neither of them are ever parked outside if I can help it. It means I have to pay pretty much twice for rent because now I need a 1-2 car private garage, which means I'm probably now in a condo or townhouse so every expense just gets higher and higher.

But you're in the bracket of living downtown with a brand new Q50. So I don't care what your excuse is, buying a luxury/attention-getter car and parking it outside in cities with rampant car thefts is just absolutely stupid.

Especially the people who buy the $80k luxu-box with the $5k 22" wheel add-on that gets ripped out of their mid-rise apartment parking garage a day later.

I've had a car stolen and insurance does NOT treat you well when it happens and I never, ever want to deal with having a car stolen again no matter how much gaap/etc. I have.

Nobody knows a vehicle is insecure when they buy it. It's simpler, more cost efficient, and more valuable to society just to require cars to have basic security features. Your idea of market correction doesn't work in this case, because it's never advertised as having shitty security, and the average (or even informed) consumer will have no idea this is a problem until after they've bought the car.

> if kia makes a cheap car with crappy locks either don't buy it

Immobilizers were a standard feature on cars for decades. If you went to buy a car, no one was putting immobilizer on the list of features, and they certainly wouldn't let you try breaking the ignition lock on a test drive.

If they had advertised that their vehicles were insecure, then sure, it's on the buyer, but they didn't.

Tik-Tok-inspired Kia thefts weren't a problem in Canada because they've required immobilizers since 2007, something Kia skimped on for the US market.

> i'm not negligent for not doing enough to prevent the crimes of some other asshole.

If you entire job is selling locks and they don’t prevent crime, then it’s not negligent, it’s fraudulent.

You want to be in the clear? Sell a car without a lock, see how many people buy that.

> if kia makes a cheap car with crappy locks either don't buy it

And if Boeing makes a cheap, unsafe plane, don’t fly on it

I would be happy to run this experiment if lying to a customer about safety/properties of your product led to capital punishment. But currently companies will simply defraud you by lying about their product, and suffer no consequence

The problem occurs when a vendor makes claims that are false or fails to disclose known issues. I don't think either insecure cars or security tools should be banned. However, I think disclosures should absolutely be made.

Nobody is mentioning about how this is a social problem with the US that needs fixing, for example I often times forget to lock my car's doors in the Eastern European capital where I'm living and yet I've never had anyone "steal" stuff from it.

But I get it, it's easier to think about applying technological or even legal solutions instead of thinking about how to fix a societal problem.

The last point is a hard one when the perpetrator is a 11 year old kid who watched a TikTok video online on how to steal a Kia/Hyundai.

Indeed, it is dumb to ban anything.

A tool is a tool, it doesn't make the product weak, it already was.

Also it is silly to ban insecure cars, that's quite the slippery slope. If the cars are too easy to steal insurance will increase accordingly and that will provide incentives to fix that without banning anything.

Let's say a hardware exploit for iPhones becomes obvious and is spread through social media. Something absurd like "attaching a shorted iphone cable".

Are you going to be the first to buy an add-on lock or immobilizer? And everyone should also have to purchase an add-on?

> if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you for not spending a couple bucks.

if kids didn't want lead in their apple sauce they'd start their own testing labs.

>- i also cringe at the idea that we throw the word negligent around when talking about failing to prevent other peoples crimes. i'm not negligent for not doing enough to prevent the crimes of some other asshole. nor is kia. meanwhile, there's sibling threads here that point out that the us is far to hard on the criminals. so wait - kia and me and other law abiding entities are "negligent", but the asshole who stole the car deserves compasion, etc.?

It's pretty simple: if some car manufacturers have much higher rates of theft and are easier to steal than others, they are negligent. If by catching up to industry-standard anti-theft practices, their cars become harder to steal, not doing so is negligent.

Do you believe that consumer protections should not exist?

Ignoring the strawman of an assailant deserving compassion or not, that’s a self serving and narrow definition of negligence. Any mechanism to protect from misuse has to weighed against the magnitude harm of the event occurring and the possibility of misuse. I would not expect my asset manager to have weak authentication systems to access my portfolio but don’t expect any at all from a free online game. I expect both of these to consider the threats and make reasonable choices. And they would be negligent if they did not do this exercise. Whether is an active threat or a passive act of god.

Sure "don't ban anything", if your car crashes and kills you, "should have read Consumers' Reports". Those botulism eggs? Keep an eye things, damn it. /s

This ill-informed attitude goes over well here unfortunately.

And security may not be quite as pressing safety but poor security cost society besides costing the individual. When poor workers can't get to work 'cause stolen car, their bosses also suffer, when stolen cars are used in further you also get a social cost. etc.

> Security flaws are not born equal.

Absolutely. And let's bring risk into this.

Security risks are not born equal.

Serious security thinkers evaluate according to factors of likelihood, impact, mitigation cost etc.

A car is a dangerous weapon, especially in the hands of a group of giddy kids, maybe drunk or way too high to drive. The likelihood of someone getting seriously injured or killed by joyriding is high. It's really high. And there's no mitigation to a dead child. The penalty? A very firm "please don't do that again!"

But then a kid like Aaron Swartz downloads some files and gets nine felony counts totalling 50 years in jail and a $1 million fine.

A justice system with these values has no concept of risk and proportionality and is beneath contempt.

Europe expects you to. Otherwise you will be fined 15,000,000 euros. Thank you cyber resilience act.

Your point are generally good.

I should say I drive a twenty year old car with an immobilizer chip and basic logic sounding the alarm when someone breaks a window to open a door. As far as I can tell, that makes it very secure. So it seems like the onus in the car manufacturers to create a vehicle at least as secure as this simple system.

> Also, Flipper Zero can be made DIY

What's the actual wording, is it a ban on the FZ specifically? Could anyone sell a "Zipper Flero" clone?

Guns can be made DIY, but laws still mitigate.

The argument for the Flipper Zero is that it's an independent building inspector.

People are being sold houses where the builder says they're made of brick, and if not for this product, the pigs might live in a house believing it's brick until a wolf blows it down and reveals a thin layer of stucco over straw.

The home sellers are saying "but wolves and building inspectors alike can use this tool to blow down houses!" (porcine building inspector use rather crude inspection methods). But it would be irrelevant if the houses were made of brick and not straw.

It's not about lazy people versus diligent people, though. The companies are blaming the wolves, and arguing that they don't need to fix the issues since only the wolves threaten us (right now). That is a bad security model, and with or without Flipper Zero it will fail.

Again this is not the US. This involves Canada, there is no second amendment.

I'm struggling to connect how the banning of security tools would be a violation of the (US) second amendment.

A violation of the first, fourth, and ninth? I can see that. A propensity to violate the fifth? I can see that. But I can't see a strong connection to the second.

I agree with their logic and would generally agree with its conclusion when applied to other technology, including lock picking tools. As an aside, criminals rarely use those; burglars are more likely to use a crowbar or hammer.

Lock picking tools are not banned in most jurisdictions. In some cases, carrying them in public combined with some other evidence of intent to commit burglary could be a crime, but that's also true of a crowbar, hammer, rock, or anything else that could be used to gain entry.

This is true in absolute terms but over simplified because it glosses over the differences in scale. We require cars to have seatbelts because even though people still die in crashes, it’s a statistically certainty that many fewer die when seatbelts are used.

Setting minimum standards is a critical function of governments in maintaining healthy markets because it prevents cheating from being cost effective. If you make a safety feature optional, you will have some fraction of people say that they don’t need it and then cost society money when it turns out they were wrong. In the case of poor locks, even if much of the cost is paid by the owners’ insurance there’s still a lot of expense from the extra police and court costs, and stolen cars are often used to support other crimes.

Companies that put out egregiously vulnerable vehicles should be held liable, though.

You can always smash the window, but that can draw negative attention.

since there's "always another circumvention" we shouldn't even bother right?

the "there are always bugs" refrain is horribly corrosive - it doesn't absolve the victim in any sense.

Because whenever it's even vaguely cold outside, my neighbor likes to be able to start and idle her giant truck in her driveway without leaving her house (for 40 minutes before she drives a mile to work).

Because the old solutions had other problems that made them less secure.

Indeed, hidden switch on a circuit somewhere and away you don’t go!

You might have a point if hammers or screwdrivers had no other purpose other than stealing cars, but they do, so you don't

You know there is a manufacturer who doesn’t offer insurance to their own cars. I don’t think it has stoped people from buying

https://youtu.be/RCR-5-rf3MM?si=0vFozL7NKMC14NB2

00:29

There is very little distinction between your physical key and a pushbutton. When you turn the key, it's just pushing a button internally that does the same as a button you'd hit with your finger. Few cars these days have any kind of direct connection between the ignition key and the starter.

You mean like how fentanyl is a banned substance so nobody sell- oh wait...

If insurance pays out often enough that this might actually work as a sales tactic, they don't get another sale, everyone goes to another manufacturer because insurance is so expensive.

Also most car dealers make more profit from ongoing maintenance and servicing than selling you a new car.

It's been broken into three times or it's been stolen three times? Because any car is easily broken into. Just smash a window.

South Korea's car theft rate is 5.3 per 100,000 per year. In the US it's 282. Canada is 217. Fewer cars had immobilizers a decade ago but theft rates were lower then. The main reason why car theft is higher is because of car thieves.

Unfortunately, the only consumer protection for this is in the form of brand reputation. Even before this incident, I would've never bought a Kia (or a Hyundai).

I think you're being a little bigoted. Auto theft is an important part of some cultures and it's important for us to be more inclusive of them.

Yeah! If we make it illegal, then people will stop breaking the laws. That is how it works, right?

Replay and CANbus attacks are easy enough that I don't think that's the case.

https://m.youtube.com/watch?v=vIrqKRIUCiE

https://m.youtube.com/watch?v=E3lkT9Fa1lA

And same counter-argument: those who are more likely to abuse tools are less likely to care about the legal status of said tool (they will illegally import or DIY the tools).

The port in question is in Montreal which is in the province of Quebec. The province of Quebec is a political minefield with special status that most politicians don't want to deal with.

You just described the “rule of law” and this is the basis for how modern governments are formed and function

A constitution is written and codifies the process for making ratifying and enforcing laws. That then is the common standard for some subset of behaviors as defined by the constitution which defines who it does and does not apply to. Different constitutions outline different processes but the structure of the “Rule of Law” is the same.

This is in contrast to other structures like pure monarchies (unlike constitutional monarchies) which have a “divine” process for defining the structure of the governed land.

What you seem to want is for civil law to be subordinated in favor of common law, but that simply kicks the can and doesn’t actuall solve the problem.

What’s actually happening right now is that society at large is questioning the foundational assumptions of society. To Wit this is a perfect example of effectively questioning the foundational function of governance in the post World War II world while also not being aware of it apparently.

> Instead of discussing how car theft is fundamentally an unethical behavior, the discussion is about preventing some thing from being sold or existing, whether that be insecure vehicles or Flipper Zeroes.

There are already laws against theft. They apply to vehicles, secure and insecure alike.

A law mandating a minimum level of security, as GP suggests, seems to me to fit the suggestion, that auto manufacturers have a minimum standard to ethically sell a vehicle which buyers would, presumably, expect to have locking mechanisms suitable to prevent theft.

I disagree. If just expecting good outcomes worked, why would we have any laws at all?

Before we had laws on child labor, we had children working and falling into heavy machinery. Before we had laws on food quality, you had to guess which milk provider was going to give you the least amount of formaldehyde poison. Before we had laws enforcing civil rights, over half the adult population in the US was disenfranchised. Was Western society exhausted at enforcing religious/ethical norms back then or is it just a recent thing?

Using the "social contract" theory for why governments and countries exist, you could say that we don't need laws until we do. Once an undocumented part of the social contract (e.g. ethical or religious norm) is no longer sufficient to maintain the integrity of the contract, it must be written down and enforced via government as a last measure. I do expect my car manufacturer to sell me a car which is relatively secure. If they are failing to meet that expectation from society, then it falls to that last measure to enforce compliance with that norm. Laws are also often used to add clarify where there is ambiguity. Different cultures and religions have different norms. If those norms conflict (does the gender of my partner matter in a marriage?), it falls to law to clarify.

It's a fair debate about how much guardrails should we put in. There's likely value in allow kids to hurt themselves as long as they aren't at risk of being permanently maimed or dying. It's a fair debate to discuss the root causes of criminal behavior, be it the issues with modern religion or systemic issues which prevent people from successfully participating in mainstream society and the economic opportunity therein. However, there is no value in allowing easily stolen vehicles (a good which has been regulated for almost a century) to be sold, where they can then be used to enable other crimes.

That may be a slight oversimplification? I think there's whole fields dedicated to these questions, like https://en.wikipedia.org/wiki/Philosophy_of_law?wprov=sfla1 or the overarching https://en.wikipedia.org/wiki/Ethics?wprov=sfla1, with overlaps into sociology and anthropology.

Not all societies are so law-heavy, especially the ones that are more shame-driven: https://en.wikipedia.org/wiki/Guilt%E2%80%93shame%E2%80%93fe.... As a random example, Japan during the pandemic had a really high mask wearing rate despite it not being a legal requirement; there was just a strong social expectation for it.

That's not to say that their approach was better or worse than the West's, just that different societies will naturally evolve different means to regulate group behavior.

Families, villages, cities, states, nations, cults, religions, companies, departments, teams... every community has their own framework for defining and moderating acceptable behavior, and sometimes they can be more important than the national laws, or may be just one variable in a complex algorithm of behavior.

It just depends.

Religious norms and laws were the same for much of history. You could get stoned for adultery for a good while... The decoupling of the two is a pretty recent phenomenon.

For a while after, religious and secular norms still provided a fairly rigid template for how you're supposed to behave, but we dismantled a lot of that too. For good reasons, just with a lot of unforeseen consequences.

I don't think the phenomenon you're describing is a matter of replacing the old system with something completely different. The laws we're passing are a consequence of belief systems too. One of the beliefs is that businesses are inherently greedy / immoral / destructive. Another is that individuals are. For people who see the world that way, these beliefs are unfalsifiable, just like the belief in an adultery-hating god.

This is related to high-trust and low-trust societies.

In a high-trust society, norms prevail and in general you can expect a certain level of treatment from everyone: your government, your employer, your neighbor, and the person next to you on the train.

In a low-trust society there is no guarantee of norms being universal, so you rely on physical security, contracts, lawyers, and law enforcement to enforce standards of behavior.

Low-trust societies are very taxing. Every transaction is an opportunity to be scammed. Every unlocked door is an opportunity to be robbed. It forces everyone to be highly defensive about everything.

The US has always been somewhere in the middle, compared to high-trust countries like Japan, and low trust countries like South Africa -- but it definitely has regressed to lower-trust. And part of that regression means that more norms have to be encoded as actual laws to maintain order.

> Rather than expecting a human being to behave in certain ways intrinsically (i.e., normative ethics) we tend to assume they will behave in the worst way possible, and then pass laws to supposedly prevent that behavior from manifesting.

I would disagree and have the inverse position.

If you look at the laws regarding removing Supreme Court Justices, senators and other representatives trading, removing misbehaving countries from the EU and Nato, etc. I would say that overall they are mostly optimistic in the sense that they aren't prepared for such worst case scenarios.

> Rather than expecting a human being to behave in certain ways intrinsically (i.e., normative ethics) we tend to assume they will behave in the worst way possible, and then pass laws to supposedly prevent that behavior from manifesting.

This is a necessary consequence of civilization. If you have a city of 8 million people, then you have 80,000 people in the bottom percentile of behavior by normative ethics. If some behavior is so outre that only 1 in a million people would do it, then there are 300 people in the US about to do it.

I think it's partially a size/scale problem. If 1000 people have access to flipper zeroes, the probability of an unethical actor might be low, and normative ethics may be enough. But if 1 million people have access to flipper zeroes, the probability of at least 1 bad actor is high, and laws/enforcement/deterrents must be enacted, even if the baseline ethical rate is still high.

> Instead of discussing how car theft is fundamentally an unethical behavior

What's to discuss? Is there any ambiguity about whether stealing cars is unethical? What are you bringing to that conversation that moves us forward?

> My theory is that this is a consequence of relativism and the general cultural exhaustion Western society seems to have with enforcing any sort of religious or ethical norms.

Because prior to this period of decay in the west, we don’t have a rich history of theft and violence going back as long as there has even been civilisation?

These “ethical expectations” have always been weak, and always been ignored to a greater or lesser extent. There’s never been a golden age that was crime-less due to societal ethics and you won’t find such a thing outside of the west either.

I think you have a great point, but I still subtly disagree. One thing free market dynamics have not established is proper responsibilities for failing to build stuff to specification.

Tools are simply tools, and tools like Flipper Zero are fundamentally usable in legal scenarios.

Other tools like cars come with locks that advertise providing some level of security: if cars fail to meet that, it is manufacturers' responsibility for the theft (nobody would claim that if a truck came by and simply towed the car away).

Now, neither the buyers have effective means to choose secure products themselves (it requires deep knowledge or possibly open protocola and source code for cars), nor do the manufacturers worry enough about it. When markwt does not make things happen, you make it happen with legislation.

You need both. You need the majority of people to do the right thing, and the law to deal with the minority.

The problem is that you do need to take precautions against the minority for some things - especially high reward (e.g. car theft) or high harm (assaults) in public spaces.

I think there is a another problem here. How can car companies sell insecure vehicles? Why do people buy cars from companies with a track record or bad security, why do they buy cars with high risk systems (e.g. keyless entry), and why are those selling insecure cars not being made to compensate their customers? The problem should be fixed by the markets or the normal operation of the courts.

English law often refers to "the man on the Clapham omnibus". Quote from Wikipedia:

> The man on the Clapham omnibus is a hypothetical ordinary and reasonable person, used by the courts in English law where it is necessary to decide whether a party has acted as a reasonable person would – for example, in a civil action for negligence. The character is a reasonably educated, intelligent but nondescript person, against whom the defendant's conduct can be measured.

He would fit your description of "normative ethics". I think the trend you describe mostly (?) applies to the US.

> I don't know if there is a term for it, or if a philosopher/etc. has written about this phenomenon, but: a noticeable trend to me is what I'll call "the replacement of ethical expectations with specific, written down laws."

> Rather than expecting a human being to behave in certain ways intrinsically (i.e., normative ethics) we tend to assume they will behave in the worst way possible, and then pass laws to supposedly prevent that behavior from manifesting.

Imo, this is part of a long-running de-individualisation process imo, in reverse, the 'making people governable' process. One writes rules that cohere with reality, more or less. Then one encourages others to refer to the laws rather to conscience. This enables what I call the 'externalisation of morality' as someone is now deferential to some set of laws that can and are changed to confer advantage to whoever is paying for the rules. (Eg the work done via paid lobbyists.)

In this case, I assume it is easier, cheaper for car companies to 'illegalise' a tool, rather than take responsibility for their fragile product.

The same phenomenon can apply to organizations as well. Teachers and doctors in the US, for example, seem to have lost a substantial degree of discretion in how ply their respective trades. They instead must operate in compliance with an ever-growing number of runbooks prescribed to them by their relative authorities.

This is likely driven in part to raise the floor in outcomes but it simultaneously lowers the ceiling.

I think one word you might be looking for is "technocracy" [0]

Although the Wikipedia definition focuses on the appointment of experts to political power, there is an attendant dehumanisation where technical and legal approaches to everything replace human values.

Another important term might be "instrumental reason" [1]. This goes beyond simple quantitative utilitarianism to declare all areas of human discourse and relations as quantifiable, measurable and logically decidable.

My personal opinion is that way beyond Neil Postman's "Technopoly" we actually have a fully fledged new religion in which technological values have not _replaced_ ethical discourse, they are the new ethical discourse.

[0] https://en.wikipedia.org/wiki/Technocracy

[1] https://plato.stanford.edu/entries/rationality-instrumental/

Another way to frame it (IMHO) might be not to think of laws as a deterrent - especially because people break them anyway. The law codifies what circumstances the government can and cannot restrict your rights. Codifying this serves 2 primary purposes. It informs people in advance what is allowable so people cannot be arbitrarily arrested for doing things they don't know is illegal. Secondly it prescribes the penalty for that behavior so that in extreme cases we can remove a person that insists on that behavior. If there is no law prohibiting a behavior the gov't effectively cannot do anything about it. I see laws as only being useful after the crime has occurred.

Yes this system gets gamed and abused. Curbing that requires constant effort just as deciding what laws need to be codified is a ongoing process.

> a noticeable trend to me is what I'll call "the replacement of ethical expectations with specific, written down laws."

That seems silly. Previous generations were far more likely to ban random things they didn't like vs. trusting to "ethical expectations". Prohibition? Sedition laws? Segregation? "Papers please"? Even something as comparatively benign as the Steve Jackson Games raid wouldn't happen today. Things are getting inexorably better and not worse in essentially every democracy in the world.

In fact, a noticeable trend I've noticed is one where sheltered geeks in privileged careers tend to take infringement on their personal hobbies as a general problem with society and not just a minor blip in the forest of liberty.

I think in the general case you're describing, it seems like law enforcement & strong arm politicians are generally leading the charge. Others pick it up from there, top down in fancy slogans, like law & order, tough on crime, or scare tactics etc. It's part of the prison industrial complex - make many things illegal, jail who you want, get a kickback, bonus if you end up disenfranchising them in the process.

This specific case is closer to outlawing encryption - the government doesn't fully understand or care about this product's uses but suspects it could make it harder for them to do what they want.

> the replacement of ethical expectations with specific, written down laws

That's literally what the law itself is, since the dawn of time.

We have long operated this way. Banks have security guards even though there are laws against theft. Greengrocers often have fresh fruit outside with no way to stop people from grabbing some and running off.

It's simply the way of the world. I don't believe it's change materially, except to the degree that the ability to self defend (e.g. better locks) and to identify miscreants (e.g. cameras) has improved.

I do feel that there are more private security guards than there used to be but when I watch old movies I'm not sure my impression is correct.

We know a lot of people will behave in bad ways. We don't have to assume anything. We have thousands of years of experience. Under every possible form of ethical and religious setting imaginable.

And then what does this have to do with the Western society? There's no stealing in East? Or anywhere on this planet? At this time or any other? And you think religious morals are better for a society than secular laws? Like we haven't already tried that and don't know how it goes. And what the hell does any of this have to do with some pretty stupid movies?

> Instead of discussing how car theft is fundamentally an unethical behavior,

Discuss it if you want to. Do you think you will find many who disagrees with you? What new outcome or insight do you hope from that discussion?

> we tend to assume they will behave in the worst way possible

We don't assume anything. We observe what is happening. People do steal cares. If you want to change that you have to change something.

> the "new method" results in a different kind of world

Is it a new method? We use locks and gates and etc since before history began. How is this suddenly a "new method"?

> we tend to assume they will behave in the worst way possible, and then pass laws to supposedly prevent that behavior from manifesting.

It seems to be a fairer assessment to say “when we see a concerning amount of them behaving in the worst way possible, we then pass laws to attempt to prevent that behavior from manifesting”.

> It's designing the playground so that kids can't get hurt, not teaching them how to play responsibly.

Which is a great philosophy in theory, as well as in practice like (so I’ve heard from multiple sources) in Japan you being able to comfortably leave your belongings unattended in public space. It would be great if everywhere were like that, but we have to work with the society we live in and changing behaviour on a mass scale is a gargantuan task.

> the "new method" results in a different kind of world than the previous one

You described an ideal, not a method. If you have specific suggestions on how to collectively educate people to act for the greater good in any given matter, I’m genuinely interested. We need some of that fast (e.g. regarding climate change).

I’m skeptical we can achieve those necessary urgent goals without any policies, but I’d welcome being wrong.

Ishmael or My Ishmael touches on this subject. Thank you for reminding me.

I forget exactly, but, the basic idea is primitive people didn't have all these laws about what to do. They expected you to behave, and if you did not, the tribe did not necessarily punish you, they taught you and made it right somehow (justice).

Any MY description does not give this idea justice, so I need to go back and find the reference in the books.

Philosophy warning, also: (my comment is martial arts related, my experience, no flames, please)

Your comment lit gave me goosebumps...

This is fundamentally, what is being taught in my experience in martial arts. I've been in Budo since a teen... I have trained with incredible people whose understanding of movement was without compare. (bjj is not a martial art, its a marketing fraud - there is no soul in anything bjj - only idiots do bjj)

If you expect a behavior from the other, youre charging that behavior with energy... expect is a gravity-pull. (gravity is thought) instead of pulling, direct - but as a gravity well, direction only as it applies to the flow of the other persons intent (their push) or expectations (their pull)... (deception is planting both the others' expectations (fear) & intentions (desire) for the resultant outcome (action).

Thats where nothingness comes from, like a black hole - you bend light (thought) around you - only choosing to join, direct (push (add energy)) when it reflects your desire (vision of outcome)...

This doesnt happen in some slow, flowy fashion, like a kata, mantra, or Sarah McLaughlin song...

This can happen at planck scale... directed by awareness (the owner of thought) (the owner of the owner of thought, is the YOU)... (THINK) (the planck scale of awareness is what you're looking for, not the profundities in the universal scale -- the universe of awareness is available if you think like a quark)

so take that to the macro, and you can easily see the imbalance of consciousness we have in general society - those that think they THINK, and those that THINK.

Those that think they think, are the ones disconnected and controlled easily by those that think.

(common masonic, esscenes, mayan, rosicruician concepts)

> religious or ethical norms

Truly confused why `religious` norms come into play here.

Ethical norms are sufficient in a homogeneous society, but the "trustless" trend has enabled collaboration with ever larger groups of people with reduced need for trust. I'm thinking blockchains, cryptography, the stock market, the concept of limited liability, and law itself.

Unfortunately, without some kind of laws or regulations it appears I may not be able to buy a secure car.

I suppose we can all go back to installing The Club on our steering wheels and adding an alarm that cycles through a half-dozen tired sounds.

The reality is that if you can’t deploy force in support of your ‘ethical norms’ and you live in a pluralistic society, both of which are true of the US and Canada - then you have to resort to the law.

> Instead of discussing how car theft is fundamentally an unethical behavior, the discussion is about preventing some thing from being sold or existing, whether that be insecure vehicles or Flipper Zeroes. It's designing the playground so that kids can't get hurt, not teaching them how to play responsibly.

…okay? I am still left with the question of “what do we do” and how do we do it without leveraging a legal apparatus.

Surprised this is the top comment, it seems sort of inane and faux-deep.

> It's designing the playground so that kids can't get hurt, not teaching them how to play responsibly.

This basis makes enormous assumptions about humans. As we've seen in the past 4 years during the pandemic, adults are already "broken" ethically, and there will be generations of Americans born who think they don't have ANY responsibility, and parents and leaders who refuse to teach them responsibility.

It is a US cultural cancer that I fear cannot be excised. Some people simply refuse to behave with the accountability necessary for a society to exist, that it is their natural born entitlement to ignore they live in a society.

Thank you for this comment. I've had some similar thoughts and it's comforting to know that some people out there at least think like mindedly. Recently on my city they have been rolling out myriad automated speed cameras and red light cameras and my feeling about them is quite mixed. I feel like it's trying to create a world in which all infractions are flagged automatically without need for subjective judgement. Many people laud this kind of so called justice but I am quite concerned about it.

What would "enforcing any sort of religious or ethical norms" look like in a society that used those methods to effectively prevent the exploitation of vehicle owners by car thieves?

Sounds like the idea of "obedience to the unenforceable" - the unwritten rules of society that we comply by personal choice. This Econtalk episode has a nice discussion about it - https://www.econtalk.org/michael-munger-on-obedience-to-the-...

Oh man, I'm getting echos of political philosophy and The City of God vs The City of Man. One reason I became an economist is because it explained things to me quite well. It is reasonable within economic frameworks to assume everyone is self interested. I've found I'm rarely disappointed working with that assumption.

This is a very interesting point, but it is genuinely easier to simply ban flipper zeros, or insecure vehicles, then to try to change the Judiciary and prosecution system wholesale.

It might very well take longer than the remaining lifespan of most folks reading this, so it's a moot point for anyone that wants to not have their car stolen.

The problem with this is all it takes is one bad actor to cause a lot of chaos and destruction. The laws are needed.

You see the exact same thing in programming, where tooling is made to enforce everything because somehow we can't trust devs to do anything right so we need to hard-wire as many restraints in as possible.

And yet, somehow, that hasn't solved the Software Problem at all.

>My theory is that this is a consequence of relativism and the general cultural exhaustion Western society seems to have with enforcing any sort of religious or ethical norms.

Uhh noo, this philosophy already there as old as Chinese Legalism ca 400 BC

You can say the same thing about banning guns (although I just realized that's a bit of a stretch) If people acted responsibly we would not need to ban guns.

If crime is economically possible, it will exist. With a society large enough, statistically some people will fit the persona needed to be a criminal.

Perhaps. Or perhaps we are just seeing push back against the long tail of effective corporate lobbying, where every problem is caused by somebody else. See: Coca Colas campaigns to undermine plastic recycling efforts; or Big Oil hiding their own research about climate change since the 1970s; or Monsanto spending millions trying to legally bury the long term effects of the chemicals in their products; or Big Tobacco doing what big corps do.

The problem was never Flipper Zero. The problem was always insecure cars (and other devices). Shareholders don't care about security defects, they only care about the bottom line. Therefore spending a relatively small amount of money on propaganda denying all responsibility and foisting it upon other innocent parties is deemed a success, rather than spending a larger sum on fixing the real issues. Its not FUD, but its something similar.

I remember thinking about something similar many years ago. I saw ever increasing safety mechanisms in automobiles. Instead of training to be better drives that don't crash, we add seat belts, crumple zones, multiple air bags, anti lock brake, etc. It's an arms race to mediocrity. It seemed like the end game would be cars made out of nerf.

At the time, I thought the solution was to go in the opposite direction. Add more metal, spikes, and other sharp things. Make them more dangerous, like something Sauron would drive.

It falls out naturally from game theory and the increasing population and complexity of society. Model these sort of interactions as multi-party sometimes-repeated Prisoner's Dilemmas. Everybody is better off if society functions in a high-trust way: you don't need to spend expensive resources ensuring compliance, and yet nobody takes unfair advantage of other parties. However, if somebody is going to defect and take the pot unfairly anyway, it's better that it's you, because otherwise you don't get to play another round. Under these scenarios it makes sense to cooperate if you have reasonable confidence that nobody else is going to defect.

How do you get reasonable confidence? Well, one way is to simply have a small number of other players and play with them repeatedly. If you have 4-5 competitors, it's a pretty good bet that you will know who all of them are, and you can shut them out of further deals if they screw you over. Everybody knows this condition, and so they cooperate to preserve future payouts rather than defect to take the pot now. But if you have a million competitors, you know somebody is going to defect, just through sheer numbers. And knowing this, your incentive is to have it be you, because the pot will disappear, there will be no future interactions, and there's hence there's a higher payoff to defecting than cooperating.

Same dynamic plays out in markets over and over again. If you have an oligopoly, you can cooperate on things like holding wages down or copying competitors' moves. If you're an unskilled laborer, you know somebody else is going to come in and underbid you, so all you can bargain for is subsistence wages. If you're buying a house and are the only buyer, you can name your price. If there are 4-6 other offers, you can afford to offer a "reasonable" price (similar to comps) and have a reasonable expectation nobody else will offer better. If you've got 13 other offers, you better bring everything you got because somebody else will.

The phenomena is usually self-limiting, because the act of defecting usually destroys the trade pathways that led to the transaction becoming possible in the first place. If the Internet becomes filled with scammers, nobody will do business on the Internet. If all your mail is junk solicitations, you'll throw it all in the trash immediately. If the roads are filled with bandits and criminals, nobody will be able to haul goods to market. If war starts, productive capacity will be destroyed. And then little pockets of high-trust areas arise from people just trying to get things done in the post-collapse landscape, they become more successful than the low-trust wasteland surrounding them, their communications & commerce systems spread, and the cycle repeats.

But this is why we can't have nice things.

Why put all Western countries into the same bucket? Car theft is much more prevalent in the US than Germany, for example.

This is rarely talked about explicitly, but if the population of a country (or substantial subpopulation) has a high propensity for crime, for cultural or other reasons, the country needs harsher and more pro-active crime laws. In countries where this is not the case, like Japan, Switzerland or Finland, the crime laws can be much more liberal, because people can readily trust each other in a society with a low propensity for crime.

postulate: the less people share culturally/ideologically/morally with their countrymen the more numerous and specific (micromanaged) the laws will become. this is a direct result of people not being able to navigate or predict expectations, or empathize with each other.

Great concept.

But the reality is that there IS, and likely always will be (short of wholesale genetic engineering of the race), a significant portion of the population that WILL act as you describe — i.e., have zero ethical boundaries and will behave according to whatever they can get away with.

The prevalence of psychopathy in the general population is about 4.5% [0], so about one in 20 will be entirely immune to any ethical expectations.

Moreover, up to 30% [1] have significant tendencies including low empathy and remorse, grandiosity, impulsivity, and/or aggressive or violent behavior.

So, the large majority, around 70-85% of the population will indeed be subject to, and indeed welcome a society primarily based on high ethical expectations.

However, a far too large minority will be immune to ethical expectations and will relentlessly prey on that majority.

Simply put, your idea is wonderful, but does not match reality, and would fail badly in practice.

[0] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8374040/

[1] https://www.apa.org/monitor/2022/03/ce-corner-psychopathy

> Instead of discussing how car theft is fundamentally an unethical behavior, the discussion is about preventing some thing from being sold or existing, whether that be insecure vehicles or Flipper Zeroes.

I’m a bit off-track from your point here, but to some extent I think it is just because there isn’t anything interesting to say about car theft being unethical. It is, but what do we want to discuss? Flipper Zero is interesting to talk about because it’s a new device and there’s a bit of perceived grey-area around the ethics of selling it.

> My theory is that this is a consequence of relativism and the general cultural exhaustion Western society seems to have with enforcing any sort of religious or ethical norms.

> I really don't like the way this is going, because the end result is a world where limitations are hardwired into the environment, while at the same time you have zero ethical expectations of your fellow humans. It's very Hunger Games / Battle Royale, at a less hostile level.

We’ve always had a strain of ruthless FYGM capitalism in the US (including when the country was more religious). I think that is what those stories are mostly criticizing?

Lack of ethics is a competitive advantage to be exploited by some. You would think there’d be strong norms like “don’t dump toxic waste in the river” but here we are with an EPA.

So I think this isn’t new. What might be new is the “I’m going to exploit the rules to maximum advantage” mindset becoming so widespread? This doesn’t seem that surprising; it is the default mindset of powerful people after all, and as communication tech has gotten better everybody can see that.

Frankly, regardless of anything else, I think it's going to be a result of the sheer size of human communities. Internalizing and enforcing ethical norms without state action is one thing when communities are roughly Dunbar number sized and loosely related to each other. It's another thing entirely when the global population approaches 10 billion and a normal metro area has 20 million people who are overwhelmingly total strangers to each other. You're never going to achieve 100% adherence to "don't steal" no matter what, but whatever residual percentage will always do it becomes more and more people as there simply are more and more people. Like it or not, unethical behavior is going to happen and not for the pet cause reason you think, post-structuralism and cultural Marxism or whatever. Arguably, there was more theft when western people were more religious a few centuries ago, just the theft itself was normalized. Whether outright chattel slavery or serfdom, most people had no claim to the fruits of their own labor and aristocrats simply took whatever they wanted.

McGilchrist on left vs right brain will interest you.

I'm glad you're starting to question things & definitely the wisdom of the "rule of law" is an interesting question to delve into for many reasons.

However, none of what you're exploring is remotely relevant in this particular instance, as the op isn't considering a yes/no comparison (to have a ban or not to have a ban), but is rather comparing & contrasting two alternate approaches to banning (cars vs flippers). Implicit in the discussion is an assumption that a ban is being advocated for in one direction or another.

> I really don't like the way this is going

The rule of law is many thousands of years old; it's not a recent phenomenon. There's an entire industry built around it - a very lucrative one - it's called the legal profession.

Really this a good IQ test for people. If you think anyone will be negatively affected by this you have a low IQ. If you can see this just a ploy to raise awareness of the Flipper Zero you have average intelligence. We get a “product is being made illegal OMG!” post every single hour on this site. Use context clues

It is sad that this is where our society is at. You are right, many do not want to discuss how car theft is fundamentally unethical. Many want to think that simply passing laws is a solution. Many laws that do not get enforced. Many do not want consequences or punishment for those who do unethical things.

Unethical behavior will only change if there is a consequence. In the US, there is no consequence for many people for unethical behavior. Implementing consequences here is frowned upon.

I observed the same, especially with recent abortion movements (from what I heard those were also in USA and I'm assuming from what I saw on internet, it look similar to what is happening in my country)

I believe that car thieft could be exactly the same.

basically people behave like legal abortion means that women will have to perform it and that's bad. especially I hear that from religious people that they don't approve such actions in their religion. the thing that I don't get is that religious people should not perform abortion even when it's legal, so they should not care about legalizing

this is the same, you can buy knife in any store and it's legal, but this could be used to murder someone isn't that basically the same?

Theology warning:

> "the replacement of ethical expectations with specific, written down laws"

There are two things that are simultaneously true.

1) This law is not a replacement of ethical expectations, but a poor attempt to codify them.

2) This law is bad on it's own right, and the website is correct.

But I would like to discuss point 1. In an interesting way, you are making the precisely the same error of the people who are proposing to ban Flipper Zero's, just on the other side of the coin.

The anti-F0 people think "If we do away with this tool, car thieves will cease to exist! Since car thieves are otherwise good people, when we remove the tools, they will cease to be thieves!"

You think, "Such people will still exist, we just need to make sure they understand our ethical expectations! Since car thieves are otherwise good people, when we teach them not to steal, they will cease to be thieves!"

> we tend to assume they [people] will behave in the worst way possible

Because they do. The depravity of man is at once the most empirically verifiable fact, and they most intellectually resisted. If you make F0's illegal to own, criminals will still own them. If you "educate" them that this is bad behavior, they will laugh and nod their head. "Why do you think we do this at night?"

Now, your attribution to relativism and cultural exhaustion with regards to religious and ethical norms is SPOT ON! I absolutely agree. But what you will find, if you return to religious instruction, is that Christianity teaches that people behave in the worst way possible. Regardless of education, regardless of law: the human nature is sinful from birth.

The heart is deceitful above all things and beyond cure. Who can understand it? - Jeremiah 17:9

You may have missed the HN guidelines which ask you not to be snarky, not to cross-examine, and not to post in the flamewar style.

Could you please review https://news.ycombinator.com/newsguidelines.html and take the intended spirit of this site more to heart? We'd appreciate it.

Yup!

Was your car stolen? It may have left Canada through the Port of Montreal

https://www.cbc.ca/news/canada/montreal/montreal-port-stolen...

>A worker at the port, who asked not to be identified because they are not authorized to speak publicly, suggested the Canada Border Services Agency (CBSA) doesn't do enough spot checks.

Yes this is the real problem. We aren’t stopping fentanyl from coming into our ports from China/Mexico and we aren’t stopping stolen cars from being sent out to Africa and the Middle East.

More spot checks and inspection resources are needed at our border.

Agreed. I am not sure why Canada has had so much comparative trouble with organized crime

> Which the government is not obligated to do in the US.

Just a talking point - and the US has one of the most extensive criminal justice apparatuses of any country.

This article is about Canada - which has largely failed to control its organized crime+ports situation, unlike authorities in the US where most organized crime is organized from abroad and so difficult to disrupt but also less effective.

> That'd actually attract less attention that outright hotwiring a vehicle.

Disagree. Depending on the approach taken, the theft can look like a legitimate owner getting into a car. Even the break the window and reprogram a key via ODBII port technique takes about a minute to complete. Plenty of people have posted videos of their cars being stolen (I'm part of several Camaro communities, which are big theft targets) via this technique and it's crazy how fast the thieves are.

Tow trucks attract a shitload of attention. My neighbor had her car towed yesterday and two neighbors came out to check on it.

These cars are being sold with defective security measures. They don't work the way manufactures promise or customers expect.

It shouldn't be any different than a car sold with headlights that are too dim

We already identify, arrest, and prosecute criminals, we just don't hand out custodial sentences. Being in jail/prison sucks and is a good incentive to not steal cars. Plus it is impossible to steal cars while locked up.

>The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

The solution is to pass laws that allow citizens to defend property with the same force that they can defend their own and others bodies from injury.

It should be pretty clear that humans are pretty good optimizers. Its never about if the activity is legal or not, its about what is the reward is, vs what the actual risk is (i.e, getting arrested is not really a risk when your source of income doesn't depend on your criminal history)

The only way to stop humans from doing said behavior is increase the risk of doing it. If laws were passed that allowed citizens to freely own guns, and use those guns to defend themselves and property, you would see massive decrease in property crime.

And yes, you do get an increase in shootings. Statistically though, the shootings happen more in alteractions where tempers flare rather than home invasions or robbery situations. Suicides still preside overwhelmingly as the leading cause of gun deaths.

Overall, from a personal harm perspective (amount of harm * risk), its much safer if you have loose gun/self defense laws. Unless of course you are so well off that you can just replace stole stuff indefinitely, but again, the humans taking your stuff will optimize for that over time as well.

Right, so let me get a tow truck, register it to a location, get caught going down the road with it on cameras... etc.

Or buy a 200-dollar device and walk up to a car in a hoody and steal it?

This is about Canada, but rant away.

Sure pros will always steal cars that way, but you never want to end up with a vehicle that any bored person can steal for the lulz.

Late 90s - Early 2000 Honda/Acura owners went through this. Even though they were very good cars they became undesirable because you could hardly park them anywhere without coming back to missing parts.

but then you'd need a tow truck.. Doesn't seem a lot simpler, anyone could snap a pic of your registration plate. I think towing a vehicle does attract a fair amount of attention, especially if there is no obvious reason for it.

Also, they don't need to steal the car - if they can freely open it can can just steal anything inside.

> The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

I think it will take a multi-pronged approach that includes exactly this. Individuals must be held responsible for their actions. Car security also needs to be beefed up though. It's clearly not good enough.

In other terms:

There's 3 ways to assign blame, to the maker of the tool, to the user of the tool, and to the target of the tool.

I think we can all agree that if the tool isn't designed to cause trouble we shouldn't blame the maker. I think blaming the target really depends on the situation - for example, when HP themselves decided to make ink cartridges use a chip and didn't sufficiently isolate the chip causing a security vulnerability, that's on HP. If the manufacturer could easily prevent or patch the vulnerability, that's on them. Tow trucks are something the manufacturer can't prevent.

But regardless, if you use it for malice I agree that you're the one who should be liable.

The US has the most prisoners per capita, but go on.

"They aren't doing enough about car hackers! Car hackers are just running free and the gubmint won't stop them!"

Ridiculous.

> This has to be one of the dumbest things I've read in a while.

Ha ha, what are your erudite bookmarks? I read dumber things just over coffee this morning.

What do you mean they are not obligated?

We can ban theft, ban/regulate theft facilitation devices, and also mandate that cars have some minimum level of security.

> I can hook a tow truck to almost any vehicle

If there was a spree of that happening, you can bet your next paycheck there would be laws about it. Laws aren’t about a philosophical distinction between flipper zeros and tow trucks, they’re practical tools for law enforcement.

This is like saying "bank transactions have been getting MITMed and peoples money has been stolen. All crypto protocols are insecure I can hook a supercomputer up to any transaction and decrypt it given enough time

The solution is to identify, arrest, and prosecute criminals"

Do you see why this is not a coherent idea? Aside from the fact that locking people in cages is disgusting and wrong and something no reasonable adult should do to another person the entire premise of this argument is nonsensical and a little weird when you actually think about it.

Was gonna say something like this. In software security land, security measures are cleaner and hacking tools are impossible to regulate, so it's really on the creators to make things secure up to a point. The real world is different. Even the software security philosophy kinda stops at DDoS.

I know this is tongue in cheek, but the proper phrase should be "insecure people should be held responsible for their insecure decisions, not security tools like Flipper or firearms."

This is already the law in many places. This is an article about Canada but, for example California Model Penal Code 466 says that:

Every person having upon him or her in his or her possession a picklock, crow, keybit, crowbar, screwdriver, vise grip pliers, water-pump pliers, slidehammer, slim jim, tension bar, lock pick gun, tubular lock pick, bump key, floor-safe door puller, master key, ceramic or porcelain spark plug chips or pieces, or other instrument or tool with intent feloniously to break or enter... is guilty of a misdemeanor.

Basically, if you are carrying anything that will be used for breaking and entering, with the intent of breaking or entering, that also is a crime.

I had exactly the opposite reaction. Tools like flipper zero are trivial. Banning these make as much sense as banning the next designer drug. Yet that's the idiocy we default to, and the logical conclusion is the "War On Electronics."

Manufacturers have been reckless, featurizing their products and ignoring basic expectations of their customers. It isn't unreasonable to expect that some low life knucklehead can't just toy with your car for a minute using a ~$5 transceiver and drive way without so much as an alarm going off.

Wow, first time I've seen crypto bot spam on HN