Car dealerships revert to pens and paper after cyberattacks on software provider | Hacker News Reader

Car dealerships revert to pens and paper after cyberattacks on software provider

apnews.com

221 pointsachristmascarl344 comments

This is what happens when a single player (CDK Global) has massive market share (90% when measured by number of vehicles sold [0] --- EDIT: this is actually the combined market share of CDK + Reynolds, who have a non-compete agreement ---). The entire industry becomes fragile to product issues and/or malicious attacks. Anti-trust is important.

[0] https://casetext.com/case/loop-llc-v-cdk-global-llc-in-re-de...

Also, the vendor becomes insulated from customer demands.

Why patch things or work your ass off, when none of your customers have an alternative? (especially if PE buys the business or CEOs get a stock price focus and gut engineering to keep-the-lights-on levels)

There's a quiet irony in car dealership networks being fucked like this. They spend so much money ensuring their government-mandated monopoly, only to fall victim to a different kind of monopoly.

> government-mandated monopoly

Could you expand on this, aren't U.S. car dealerships private businesses competing in a (mostly) unregulated market?

> direct manufacturer auto sales are prohibited in many states by franchise laws requiring that new cars be sold only by independent dealers.

https://en.wikipedia.org/wiki/Tesla_US_dealership_disputes

not a monopoly per se, but "forced demand"

Doesn't just about everyone hate dealing with a dealership? Shouldn't it be very easy to vote to fix that in a democracy?

Not when dealers pay politicians to keep it that way.

Even if you ran a petition and forced a state ballot measure, dealers would run a propaganda campaign to make it sound like a pro-Tesla measure.

"they're giving YOUR RIGHTS away to BIG CORPORATIONS. Vote NO on Bill 9928"

when, of course, that very line was funded by large corporations. such is life in Modern America

See “Public Choice Theory”: https://en.m.wikipedia.org/wiki/Public_choice

Or watch the BBC comedy “Yes, Minister” and “Yes, Prime Minister” to grasp how government (as well as most large companies) actually works.

Yep. Basically, in no election we can practically foresee, is this going to be a politically salient issue. The voters aren't motivated enough about it, and the interest groups involved are mostly aligned on keeping the status quo. Elections put people and parties into power, not individual ideas.

Direct democracy (https://klissarov.eu/en/books/platform-of-the-pp-direct-demo...) can change the status quo - if enough people get up from the couch and do vote for it. It just needs to reach a critical mass - but at the moment people are too lazy and wait for someone else to do the job.

It depends. Most jurisdictions allow for a ballot referendum to put measures to a popular vote. This has gotten more difficult with signatory requirements that have gotten larger in most states, mostly orchestrated to keep the dominant parties in power and limit grass roots efforts in general.

Going through existing congressional process means getting at least a champion on board and overcoming dis/misinformation from many insider corporations, often large local donors.

edit: From my understanding,successful campaigns via referendum tend to cost anywhere from $2-20 million usd. Often involving paid signature gathering and local advertising.

The "problem" with referenda is they often forcibly enact policies that the elected politicians, judges, bureaucrats, and other organized political actors don't want. Since these people decide what the government actually does, they often find ways to ignore, work around, or in some cases outright overturn, "settled" referendum results. Making it more difficult to get questions on the ballot outside of the ordinary political process is just streamlining things from their perspective.

Too bad it's a Republic.

“Republic” (any system in which top-level government offices aren't personal property of the officeholder) and “Democracy” (any system in which government serves and is accountable to the general population—usually through voting on candidates and/or specific policies—rather than vice versa) are not mutually exclusive.

It’s pretty common for modern Western governments to be both of (Democratic, often also Federal) Republic and (Representative, sometimes with minor areas of Direct) Democracy.

To put a finer point on it: actual experts in the study of government routinely refer to the US as a democracy. It’s absolutely not a sign of better familiarity with the topic to “correct” that usage—it’s a sign of low side of middling familiarity, specifically.

Debate whatever you want, we do not have a direct democracy, which is what most people hear when they hear "Democracy". It's Representative Democracy. Supposedly.

That isn’t what most people think of when they hear “democracy” in the context of describing countries like the US as a democracy. Lay-usage and expert usage are in accord here. It means more-or-less liberal and with voting that significantly affects how the state runs and/or who runs it. That’s all, and that usage doesn’t confuse anyone. If we didn’t use “democracy” for that we’d just have to come up with something else, because it’s a very useful term to have. But everyone just uses “democracy” and that works great.

It's what a nonzero number of Americans hear.

You're talking to one, who knows others.

Democracy as defined is a goal we have. Not something all (maybe most!) Americans would claim to enjoy.

You mean you thought tejohnso believes the US is a direct democracy, because of that post?

They, like many others, probably have a somewhat fuzzy grasp on what the meaning of word democracy is, due to the way it's used.

Honestly, I can't even think of an alternate(, but still charitable,) interpretation of:

"Shouldn't it be very easy to vote to fix that in a democracy?"

Suggest one, if you can?

Goalposts shift from

> most people

> a nonzero number of Americans

Holy motte and bailey, Batman.

Why don't you keep this thread on-topic, and reply to:

> "Shouldn't it be very easy to vote to fix that in a democracy?"

> we do not have a direct democracy, which is what most people hear when they hear "Democracy".

That hasn't been the dominant use of the term for centuries, but, sure, you keep pretending.

No, you're right, we're bringing (federated republics with some vestige elements of) democracy ALL OVER THE WORLD!

It's a federated representative democracy with some issues, some of the components of which have some level of direct democracy.

It is also a republic. It could be a republic even if it was a pure direct democracy somehow without "issues" - in fact I struggle to see how a direct democracy without issues could be something other than a republic.

> some of the components of which have some level of direct democracy.

What, HOAs?

State level initiative and referenda processes.

I think that's true for tech savvy nerds, but my mom loves her dealership. Part of it might be the experience of leasing vs owning, where the dealership often does maintenance for free during the lease.

where the dealership often does maintenance for "free" during the lease

FTFY. She's still paying for it!

The percentage of people who want a law to pass is negatively correlated with the chance of it passing.

If voting could change anything it’d be illegal.

To be specific, the objective of state statutes is to block direct manufacturer auto sales. The objective is achieved in a roundabout way: the statutes written prevent the establishment of physical dealership locations owned by the manufacturers. They are not broad enough to restrict direct sales. This means that some creative sales techniques can be used, if you:

(a) don't need to have cars in a lot,

(b) can sell online,

Then, you can (in many states), sell cars directly.

Tesla does all 3 as they usually don't have (a) inventory and in some cases, the law doesnt prohibit showrooms (b) seem perfectly comfortable selling you the car online (and critically, customers are ok with this too) and (c) have money to fight for settlement of the issues.

Theres even more creative sales now - tesla is actively setting up sales ops in Indian reservations - which have their own sets of the laws outside of specific states.

Edit: added (c) which is certainly an important factor in many states

Kinda like auditing.

That's the opposite of a monopoly. It's intentionally breaking up vertical integration.

No, they only exist because state laws prevented manufacturers from selling directly to customers.

They'd originally existed because manufacturers didn't have enough resources to sell directly to customers, and they'd probably still exist (in a smaller capacity) today even if manufacturers could sell direct. Because there still are some manufacturers that sell low enough volumes in the US that it would probably still financially make sense for them to lean on a dealer network.

But for sure, Ford, GM, Toyota, Stellantis, etc would probably love to sell direct.

So you're saying dealerships are more of a monopoly than manufacturers selling directly to customers?

Car dealerships exist in what is probably the most favorable regulatory environment of any business. It's a side effect of owners of car dealerships often being the wealthiest people in a locale, and being politically active. If you look up donations to your local and state politicians, you'll probably find several of the largest donors have last names that happen to match that of the local Ford or Chevy dealership network.

They have rules that protect them from competition from manufactures, rules that protect them from them from competition from other dealerships (i.e., Ford can't allow a dealership to open across the street from one they don't like), in many states, there are special rules for inheriting a dealership.

> their government-mandated monopoly

Anyone can open a dealership, except manufacturers, and it looks to be a reasonable and non discriminatory process. Critically, the government does not mandate the minimum or maximum number of dealerships in an area, so competition is not harmed in any way. This really does not seem like a monopoly issue.

Good luck trying. Dealerships hold municipal governments by the balls.

Well.. where I live.. most municipal governments tax car dealerships to the point where they all exist mostly in one county that doesn't tax them as much. In the county that does, they have every incentive to open more, and dealerships have healthy competition and turnover.

It doesn't seem like there are any 800lb gorillas in the market where I live.

Unpopular opinion: Manufacturers like this model, in the sense that artists "like" ticketmaster.

Dealerships take a lot of inventory and capital risk away from manufactures. Most (unlike Tesla) do not what to deal with retail customers directly.

People will hate on car dealerships until the automakers remind everyone (again) why dealership protection laws were passed in nearly every state in the first place.

You basically see this with Tesla: refusal to comply with local lemon laws, the CEO personally banning customers from buying his cars, repairs that take months, service centers hundreds or thousands of miles away.

I encourage a complaint to be filed.

https://www.justice.gov/atr/complaint-center

https://www.ftc.gov/advice-guidance/competition-guidance/ant...

> CDK Global has massive market share 90% when measured by number of vehicles sold

I suspect we're missing some nuance in that 90%. US dealerships are dominated by UCS(Reynolds&Reynolds) and CDK. ADP and DealerTrack have a fair amount. I used to provide support for three of those.

ADP is CDK as of a few years ago. I've seen a fair number of Auto/Mate stores in addition to DealerTrack, but not as many as CDK and R&R.

That 90% is for both of the two biggest DMSes, CDK and Reynolds & Reynolds. Both DMSes have been around since the '70s or so, so they're probably considered a safe option by a lot of dealers.

Ah, you're correct. However, the linked litigation doc argues that the two have an agreement not to compete with each other. It also explains that it's very disruptive for a dealership business to transition to a new data management system.

I believe the litigation was about data integration, due to the mentions of Authenticom. Authenticom was a vendor my company used until we needed to start getting data directly from R&R. (IIRC we were a third party on a lawsuit related to that.)

Switching DMSes is likely disruptive, but is still pretty common. We've had dealerships do it every now and then.

Is R&R still that large? A few NADAs ago I approached them to see about getting a direct integration. Only one of my customers was R&R at that time. ReyRey acted very elitist and told me that they had no interest. Fast forward to this last NADA where I approached ReyRey again with only three customers. I asked them if we could integrated with three and they stated that they would even do a single customer. Quite the change of tune. I asked ballpark what it would be and they said "low 5 digits". Not even CDK is that expensive with their certification process.

This will also be interesting to see how it affects their their long in-development and repeatedly stalled Fortellis product. They are attempting to release it as a DMS agnostic solution which I did not think that other DMSes will gravitate to just because it comes out of CDK. This attack is just another reason for a competitor DMS to not use it.

R&R is still one of the largest. The elitism was definitely something I saw when I wrote the RCI integration at Dealer Wizard around 2014. I've heard they've been trying to change the culture internally. I'm not sure how that's going, but it'd certainly be welcome.

Does Fortellis even accept other DMSes? I've dealt with it a bit to integrate with eLeads (now CDK CRM), but there didn't seem to be much on there apart from CDK's APIs.

From a hiring standpoint, the culture at R&R is “beyond absurd” / “jumped the shark”. They utilize an IQ test which has many extremely “cultural” questions — quite a few questions have nothing to do with IQ, just trivia you’d only know if you’re from a very specific background (white, old). Things along the lines of “What celebrity died in 1997 in a car crash involving paparazzi?” (Princess Diana) … “what sport did Jack Nicklaus play?”. I fit the profile they are looking for, and knew all the answers to these questions, but I still felt they were "beyond the pale".

This is for software programming. Their salary ranges are also unbelievably low and they avoid interviewing anyone with even moderately strong qualifications (which would be considered "mediocre" qualifications in any tech hub).

why didn't Silicon Valley try to disrupt this market?

Seems to me like now is a good time to raise some money around this particular issue.

they did - see Tesla

How much of a disruption was that? Teslas still can't be sold everywhere (such as anywhere in Michigan)...

I personally can't immediately envision what the disruption would look like. Do you have any notions? Tekion is one of the newer DMSes to be built with modern architecture and be cloud-native versus the retrofit of all the other DMSes (which were retrofits of other types of solutions before they were automotive). I would love to see something be the Uber or Airbnb for Deal Management.

What would the value add or differentiator be? If you try to go with cheaper, the incumbents will take note and adjust their prices accordingly (it's software, prices are much more flexible than physical stuff).

Close to this market - ShopMonkey is doing it for general garage work, and we, GlobalWorkshop, are doing it for high end/custom vehicles (restoration/restomods/small motorsport teams).

I'm pretty sure one of our recent trialling companies have been using CDK and desperate to get away from it for their restoration work.

"It hasn't been updated in years" was the quote last week..

It's complicated. The amount of industry knowledge needed is huge - not something someone with good software expertise can just leave on the fly.

It's also been, traditionally, a crazy business with dozens and dozens of vendors that a dealership can choose from. CDK and Reynolds might have pretty big market share, but a lot of that is because they integrate with zillions of tiny vendors.

Lastly, I just don't think there's been enough money in it to try. The industry as a whole is lucrative but you're not gonna get rich trying to dominate a single aspect of it. COVID represented a permanent shift in how software was viewed in the industry. Dealerships have to spend more on higher quality software, because they simply can't afford to stay in business without it.

The closest company I can think of that's trying to disrupt this is Tekion.

My entrepreneurial mind immediately thinks: Let's create a better solution to revolutionize this industry and make the old, expensive incumbents obsolete. We can drive to the affected car dealers and migrate them one by one.

Of course, I'm not going to do it and it's probably extremely hard :)

I'd rather we remove laws that ban direct sales.

https://www.justice.gov/atr/economic-effects-state-bans-dire...

Enterprise vendors have gotten better at locking in customers on multi-year contracts which takes away some of the biggest upside to chipping away at the market. Often a challenger will come in and snag a few smaller deals but the Monopoly has a plethora of options to swat it away - rev up their larger more experienced product team to compete, lobby for regulation, poach from the challenger, acquire the challenger, tank prices in the one area the challenger has traction, and much more.

I read a particularly disgusting book called "Competitive Strategy" by Michael E. Porter, that plainly explains how and when to carry out each of the monopoly-preserving actions you have listed

From what (little) I know, Porter's generally considered to be the expert on Strategy. What did you find disgusting about the book?

I guess we are coming from different worldviews. These were IIRC collectively referred to as "retaliation" by the incumbent firm and none of them sat very well with me as conducive to innovation.

- lobby for regulation

- poach from the challenger

- tank prices in the one area the challenger has traction

I believe Porter also mentioned trying to secure vendor lock-in.

Not familiar with Porter, but being an expert doesn't necessarily make you ethically untouchable. Warren Buffett for example is well known for investing in companies with aggressively anti-competitive behaviours.

wait.. why is "rev up their larger more experienced product team to compete" bad?

It's not "bad" it's just a factor to consider when planning market entry, like a start-up trying to get these dealers on their platform.

At least it's not the healthcare industry...

It is extremely hard!

Dealerships don't make most of their money (or any money, really) selling cars. They make their money from service, and selling info to 3rd parties (ever notice when you buy a new car, you will receive mail from SirusXM for a year after). In order for this to work, their systems are all tightly integrated. When you buy a new car, the dealer will know when you're due for service. When you have your current car serviced more than a certain amount, the dealer will know you're in the market for a new car.

So, it's not possible to swap out only the service management piece of CDK or only the sales piece, or only the CRM piece. They all have to work together. The reason I know is I happened to contract with the IT department of a very large dealer network at the time they were undergoing a migration from Reynolds to CDK. A year into the migration process...they pulled the plug. Moving even from one large incumbent to another was too much work.

Good luck breaking in on that as a brand new baby startup! I think you'd probably have better luck completely disrupting the car sales process from the ground up.

CDK didn't just run the DMS. They operated the physical networks at the dealerships, managed the the PCs, the phone system, even leased the dealers their printers. CDK was DEEPLY integrated into the dealerships.

People try all the time. The usual problems are 1) CDK doesn't just do the DMS, they have a whole bunch of connected software that interoperates with it, and so you can't just spin up a DMS to compete. And 2) A bunch of the value CDK brings to the table is supporting the business with things like compliance (laws relating to car dealers change constantly, there are teams at CDK which keep up with all of this regulatory stuff as their full time job).

That's my perspective, as someone who has worked at CDK.

If you want something corroborating that, go look at r/serviceadvisors and see why people say they can't switch to anyone from CDK. The tiny dealers are the best candidates for moving, everyone that's reasonably big has too many needs the other DMS providers do not address (yet).

Maybe part of the problem is the reliance on the cloud. Will the pendulum ever swing back to on prem?

Workloads are starting to converge back to on-prem and there hasn't been so much pressure on only cloud. Hybrid approaches seem to be prevailing (for much larger co's)

Specifically, 83% of enterprise CIOs plan to repatriate at least some workloads back to private cloud/on-prem according to a Barclays CIO Survey program

On-prem is less likely to get patched and it's somewhat more work for the criminals to breach each installation individually but overall it's probably less secure.

Well it's single point of failure vs distributed resiliency.

You could hack your local dealership but if they can't sell, the customers just go to the dealership down the street, which serves as a very high incentive to get your systems back up and running.

>EDIT: this is actually the combined market share of CDK + Reynolds, who have a non-compete agreement

I would bet money they have non-competes and no-hire agreements with more companies than that - the entire industry is full of it

IIRC our market share is closer to 70%. It also includes businesses that people don't usually think of but are broadly similar to car dealerships in business model and therefore can be served with nearly identical software. Heavy equipment, etc.

R&R doesn't have as wide a product offering as we do, and the upstart DMS providers trying to disrupt the market are even narrower than that. For all its problems, CDK is dominant for good reason.

Wow so you work at CDK. I wouldn't wish the sh-t storm you guys must be going through on our worst enemy.

I was talking with one of your clients today (we're not competitors) and you just don't realise how far screwed some of these companies are right now.

It actually made an instant upsell today of 'here's our additional cloud sync' feature. No questions, no umming and ahhing, it's just 'yep done, add it, turn it on'. Heck we probably undersold it by 10x.

I hope you guys start getting some sense of normality soon and get systems back online.

I can't argue against market dominance purely based on product. However it looks to me like the dominance is exacerbated by a raft of anti-competitive practises such as colluding with other big players and placing artificial restrictions on dealer and third-party data.

The AP article is terrible. It's basically CDK's press release.

There's more useful stuff on Reddit.[1][2][3]

- Some dealerships can still sell cars. Some can't.

- Parts and service are in worse shape than new vehicle sales because their inventory info is in the CDK system.

- The process by which new cars and parts are ordered and delivered to dealers is down.

- Many dealerships can sell what's on the lot and do repairs with parts in inventory, but the supply chain has stopped.

[1] https://www.reddit.com/r/partscounter/comments/1dmbmy7/the_c...

[2] https://www.reddit.com/r/serviceadvisors/comments/1djisf5/cd...

[3] https://www.reddit.com/r/askcarsales/comments/1dkf0xv/how_pr...

I'm reminded of the opening line of the second Mistborn novel:

> I write these words in steel, for anything not set in metal cannot be trusted.

The digital world feels increasingly dangerous and ephemeral. If I have something written with ink on paper I have certain guarantees:

I know that it's accessible even if the power is completely out. I know that it won't randomly get deleted if my hard drive suddenly dies. I know that the only way someone can read its contents are if they get physical access to that piece of paper. I know that it's not being automatically scanned by a platform provider to comply with government surveillance laws. I know that any alteration to the document would require physical access to it and would most likely leave a visible trace.

There are technologies that if applied would provide some or most of these guarantees and even provide increased safety, but I don't trust any existing SaaS providers to give me any of them out of the box, and the average person doesn't have the skill to string tools together to get them.

And so here we are: in 2024, anything not printed on paper still cannot be fully trusted.

I was recently looking at a 15 year old manual for an appliance. It had a sales recepit attached. Despite being put inside some papers, in a plastic case and then in a binder (kept in the closet)... the recepit just evaporated. The print is nearly invisible.

Is that done on purpose?

It's thermal printing, they heat the paper to turn it black, but if you store it somewhere warm the chemical reaction can reverse.

Many of these thermal and carbon transfer receipt printers have poor ink/print life. I doubt it was done on purpose as most of these systems are sold by 3rd parties to retailers. I'm sure the issue has been raised but then they willing thought to themselves, yeah actually this benefits us, let's just "pretend to ignore" the issue.

More modern retailers are offering receipt-email options which is the option I choose if available, that way I have a "permanent" record of the transaction. I recently did some old taxes from 7 years ago and this feature was invaluable as most online portals no longer offered the records.

Not likely. It's just a technical limitation of thermal paper. That's the trade-off for cheap, tiny form factor, fast, and low maintenance printing.

Receipts are commonly printed on thermal transfer spools to avoid the maintenance needed for printing with ink but this process is not as durable as using ink. Decide for yourself if this decision is made due to cost or a conspiracy.

The other answers mentioned _what_ happened. In terms of next steps:

(1) Generally, receipts should be scanned (and perhaps re-printed, depending on your needs) for any sort of conservation effort. The heat from scanning (not in any modern tech, just as an FYI so you can decide for yourself) can cause the same degredation. It doesn't necessarily take a long time either. If you ever order a pizza where the driver tucked the receipt in the box you'll also notice that chunk of the receipt is illegible.

(2) If it's partially visible in its current state, you can probably get away with increasing the contrast and applying a decent OCR to the result. You'll get some hallucinations, but if you fill in the most likely characters conforming to the grammar of a typical receipt you're likely to be in the right ballpark (if you need a particular warranty code or something you might have to manually try a few options for particularlly blurry letters). Pair that with a photo of the receipt in its current state for any distrusting shopkeeps.

The fading of receipt is a common issue with thermal paper and I do not believe that it is done on purpose

It usually disappears way faster than that, often ater a year or two. Could be useful to photocopy. However most of warranties those days are not really longer than this ¯\_(ツ)_/¯

Flood and fire are only getting more and more common.

Yeah, but the prevention measures for loss due to those are well understood by every adult and easy to take into your own hands as either a business or a regular person.

The prevention measures for digital catastrophes are not widely understood by those outside the industry and most people would have to outsource them to someone else without any way of knowing for sure that what they have set up will actually work if push comes to shove.

Arguably, the prevention measures for digital catastrophes are not widely understood by those INside the industry.

Cuneiform as a Service

GIVEN a customer is filing a complaint against a copper merchant THEN the text of the complaint is written to media with a read guarantee for minimum 4000 years

Those two phenomenon are quite incompatible.

Sure, but at least then your options are limited to existence or destruction, and you still have to have physical proximity to experience either. Digital represents a third form-factor, "malformed", and physical proximity is no longer needed either to corrupt data, destroy it, or steal it (two of these three not necessarily being obvious to the owner).

As stated before, convenience is a tradeoff with security.

verbal is less secure than digital, which is less secure than paper, which is less secure than clay, etc.

IMO Every important document must be first written and then scanned (or digitized) That includes medical records, sales receipts.

But I still thing balance is important. Balancing the use of digital and physical documents can leverage the strengths of both

thats why i always print my airlines tickets instead of trusting eTickets on my phone

Me too. Paper-printed tickets have an amazingly long battery life.

Find me a printer that’s more reliable than a phone.

https://www.theverge.com/23642073/best-printer-2023-brother-...

The reliability of the printer versus the phone is not at discussion. The reason to go with paper tickets is that they have significantly better availability and partition tolerance than phone based tickets. Using a paper ticket requires that the ticket be available at an exact future moment in time (when you board). The hassle of potentially using multiple unreliable printers ahead of time to prepare the paper ticket is an engineering trade off in providing a system with excellent time of use properties.

In the event that your personal printer is not functioning, the airport has many publicly accessible printers for your ticket printing convenience.

Still use the same Brother laser AIO purchased in 2007, a printer in 2006 and a Canon around the same time. They all work perfectly, only the rubber rollers on the double sided ADF had to be replaced.

I don’t have any phones still working of that vintage.

Not a perfect comparison but the argument is dumb because the item at issue is the printed product not the printer.

If a printer is broken, you find that out much earlier, with time to address the fault before it becomes a crisis.

If someone is carrying their printer with them on their entire trip in order to print their boarding passes at the last possible second at the gate, that's... A different kind of problem.

I never trust e-tickets either but I save mine as photos. Quick and easy to access. Photo gallery works without an internet connection. Plus photos are synced to the cloud so this way if I have a phone emergency I would also be able access the ticket from my laptop.

Have yet to try to hand the gate agent my laptop screen to scan. Will try!

that doesn't help my main worry of the battery dying.

nightmare scenario: your flight is delayed on the runway, so you end up watching a bunch of videos and draining the device battery. once you land, you sprint to catch your connecting flight following the delay. but just as you get to the gate to board, your phone dies and you can't prove you have a ticket before they close the door.

Sorry, I know I'm being that guy, but if making my tight flight connection depends on saving my phone battery, I just wouldn't watch a bunch of videos and would instead turn it off until my flight lands?

What happens if your phone dies? Now you have to go to a counter to get help. That won’t happen with printed tickets.

> I write these words in steel, for anything not set in metal cannot be trusted.

IT needs more logging to write-once media. That's mandated for many financial businesses, but it's not widely seen elsewhere. With unchangeable logs, and the ability to re-establish databases from logs, there's a path to recovery.

And no, that does not mean emulating WORM devices on erasable hard drives.

I think some of it's a matter of workflow design, rather than any particular technology. In particular, synchronous systems which can't work unless every part is ready to operate, versus asynchronous ones where delays are part of the design and the goal is eventual rather than immediate consistency.

The former are far more vulnerable to outages and interruptions.

>The digital world feels increasingly dangerous and ephemeral. If I have something written with ink on paper I have certain guarantees:

Fair but paper comes with a significant drawback of poor discoverability. I've had to dig through old aerial survey photographs taken before digital photography, and combing through the indexes to find what I looking for was an adventure unto itself. Never would've been able to do it without help from the librarians, and there's only one archive where that information is stored.

And digital format can be more readily altered, but it can also be more easily backed up or have redundancies. There's ways of managing digital's drawbacks, and ultimately I think we're probably better off having digital formats then just reverting to alternatives for the most part.

Just want to say I read the Mistborn series recently and it was excellent :)

I bought a new car this weekend and some of the symptoms of this were:

* dealer didn't have a good handle on what was available in stock on the lot * anything related to a title for a tradein was massively hampered. * appears USAA's auto insurance online add/replace vehicle on your policy is broken * everything was literally hand written, down to the sales contract

I would imagine the impact of this is in the tens of millions of dollars

That has always been my experience at car dealerships regardless of the status of their computer system.

> appears USAA's auto insurance online add/replace vehicle on your policy is broken

FWIW, USAA did some kind of upgrade recently and there have been several functions that broke utterly. They had a message for a while apologizing for it. Not sure if it's fixed now, it could be that which you are experiencing and not related to CDK. Or you may be right.

Oh boy, has this made issues and opportunities for my automotive B2B SaaS. My product's customer are car dealerships and most of my customers are on CDK. This is definitely creating a void of data for them though fortunately my product won't fail without the expected DMS data. In terms of opportunity, dealers had paperwork that would be generated for the F/I department from CDK which I was able to port into my SaaS and prefill with data we can capture at the time of sale. All the praise is due for FOSS like `pdf-lib` that I was able to incorporate in a matter of a few hours. All the disdain for Adobe Acrobat Pro which fought me tooth and nail when converting their paperwork to fillable PDF forms ( - if you're the Product Manager on that then please get a UX audit of it!) Currently, we are supporting our CDK dealers in this critical time by getting them paperwork filled and printed to keep the car buying experience going.

Also, we're hiring! I could use another solid dev and a solid designer that wants to create a delightful experience out of an awkward wait time in dealership. Challenges abound but persistence prevails. Primary stack includes React, Remix, Xstate, Remotion, Framer motion, Python, Django, Graphql. Contact devs@zipdeal.com if interested and we can go from there.

What are cdk and dms in this context? I'm only familiar with them on AWS

Car Deployment Kit (I jest, I have no idea)

CDK is the company that got cyberattacked; DMS = dealer management system.

CDK is the company name. Stands for Cobalt (marketing firm that got bought and has since been spun off), Dealer Services (CDK used to be a subsidiary of ADP called ADP Dealer Services), and K (Kerrigan, the international arm of the business, it was spun off).

Should just rename it back to Dealer Services at this point.

DMS, as someone already mentioned, stands for Dealer Management System.

For those looking for close coverage of this issue, "GuyDealership" is a good source.

https://x.com/GuyDealership https://www.dealershipguy.com

*not affiliated

Wow these are great, thank you!

He's def a good source, but, he said that "cybersecurity" is the new buzzword of the year, replacing "AI" and "Digital Retailing"[0].

When you talk security to most dealerships, it's about protecting the assets that are on their floor plan -- the vehicles -- not necessarily anything else. Most places have tried to take steps that prevent their sales folks from walking out with their customer book, but, that's the extent of most of their information security needs.

0: https://x.com/GuyDealership/status/1803421101713715290

I feel like GuyDealership is running about 4-5 years ahead of most dealerships. His guests, often successful dealership owners and related service providers are all pushing cutting-edge tools but yet the majority of the industry is creaking along using tactics that are at best decades old.

All that being said, I will call him out on Twitter for some of the things he says that are quite ridiculous. He's a sales guy after all.

He was actually the first place I heard about this.

Crazy how we are talking about this like a weather event, like it's just an unfortunate outage. Cyberattacked by whom? How? What vulnerabilities allowed the intrusion and what organizational processes created those vulnerabilities?

Naturally the people who know these answers are very busy today but hopefully we will hear more soon.

> Cyberattacked by whom?

Whoever is politically convenient

> How?

Probably social engineering but possibly poor security practices

> What vulnerabilities allowed the intrusion

Probably poor security training on employees and poor safeguards, but possibly also poor security practices in software engineering

> what organizational processes created those vulnerabilities?

Leadership with poor priorities and shortsightedness for the sake of short-term profit

That probably is the better way to see it at this point. There's already enough bad actors out there that it's not really worth keeping track.

I'd be willing to bet that they have comprehensively sloppy and terrible infosec practices and that we'll never hear any details about it - most of their customers wouldn't understand, and it would only expose how bad they are at all of this if they did.

> Naturally the people who know these answers are very busy today but hopefully we will hear more soon.

Most of us don't actually know the answer, to be honest. They're not telling 6500 employees what really happened. I know more than you, but not that much more, and I'm definitely not saying anything about it.

I'm trying to buy two cars right now, and this has put a big wrench in the process. The dealership can't tell me what's on their lot compared to what's on their Website, except by going out and searching.

Maybe offer to bring them more pens and paper so they can send someone out to make a list of what's on their lot.

This is mostly a site for programmers. I can’t imagine working in computers and not believing at least that the intent is to make people’s lives more convenient and make work efficient.

If the dealers have the capacity to go around and run everything by pencil and paper, it seems like either the are really poorly run for the average case where the computers work and make life easier, or the programmers have done a really poor writing useful programs.

Let's assume you're only selling what's on the lot, and you're not running some complex network operation where you care about other dealerships' stock.

Googling tells me the average car salesman sells 8-10 cars per month. Maybe more for a 'high volume' dealership but certainly less than 1 car per day.

I would think the paperwork to sell a single car would take substantially less than 8 hours for an experienced worker to complete.

The paperwork to do one transaction might not be too bad, but keeping all the inventory on pencil and paper seems like a pain.

It'd be a pain at the multi-dealership-network level, sure.

But an individual dealership has what, 50 cars in stock? That seems easily manageable to me. I'm old enough that I've seen far larger operations running on paper.

Of course, the days of paper-based paperwork did require businesses to employ diligent and numerate clerks, and to have filing cabinets, manual calculators, photocopiers, whiteout, and suchlike. I suppose they could have run into some challenges around that sort of thing.

Yeah, I assume they had an assortment of clerks who’d be hard to replace right this moment, especially given that the duration of their employment would be like, what, a week or two? However long it’ll take to get this attack taken care of.

> 50 cars in stock?

That would be a very small dealership around here, even in the suburbs. 50 cars on the lot was the amount I was seeing during the height of the pandemic supply chain problems and I was amazed at how empty the lots looked.

My last car purchase took 14 hours total. 2 separate days, was buying new, no trade-in. I tracked my time because it was a work week! Despite telling them after the first day to "have everything ready" for my second visit, I still spent the majority of the day inside the dealership, twiddling my thumbs.

It's a major tactic of car salesmen to delay the selling process repeatedly; it physically and mentally wears down the customer and they are more likely to accept aspects of a deal they don't like, to get it over with and completed.

It seems a lot of the process is slowed by "someone has to run to the registry" type stuff which has to be done in a specific order and during "normal" business hours. Typically the sales guy is eager to finish (just wants to sell his next car) but the paperwork is where things get really slow.

The entire time I was thinking how much of a "waste of time" this all was for the sales guy. He really didn't do much after the initial 2 hours of sales time, just "held our hands" while the paperwork was processed.

Wow sounds awful for them. They might have to get up from their desks.

They might have hundreds of cars and not every feature is immediately visible.

Say it takes 5 minutes to manually enumerate all the features of a car. This seems more than generous. An intern can go through 12 cars per hour at this rate. This is a major inconvenience, but it doesn't sound like a thing that would completely disrupt business.

A smart intern would take photos of the window stickers, OCR them, put them in a Google drive folder, and salespeople could then search them. Could be done as fast as walking from car to car.

It started last Wednesday, and the estimate for the fix is “several days” according to the AP. I think it will be difficult even to get somebody hired in time.

The paid internship... The true unicorn...

For a STEM student, in the US? I’ve never heard of an unpaid internship, sounds like a scam.

Dang it's a shame there's no list of features easily found on the windows or something.

All those dealerships really should have checked on HackerNews before investing in all these pointless computers I guess.

Or maybe they should manually see what they have in inventory. Why is that such a difficult thing to do? The alternative is that they can sit around with their thumbs up their asses and not sell any cars "because the puter is down."

Even when the system is working they have to go search the lot, because half the cars listed in the system are phantoms.

> half the cars listed in the system are phantoms

How? Like, they order a certain number of cars from the dealership--do they just trickle in randomly? Do they forget to log sales? I get misplacing where the car is, but whether it is?

Granted, I have friends who work at rental-car companies, and the level of shitshow they aspire to is truly inspiring.

Was going to say, ghost-car sounds familiar at rental places.

I can verify that this happened to me last year. The dealer could not positively affirm that they did or did not have a particular model in their inventory, so the salesman and I wandered around the lot for ten minutes before deciding they did not.

I told him, "okay, well if you do get any in, call me up so I can come over and buy one." Easiest sale ever. Well, that didn't happen, and my assumption is that they just don't know what they have from day to day.

As in, the car listed on the web site does not exist.

It's merely a gimmick to get you in the door and convince you to buy something else. (And probably illegal, too.)

Happened to me the first time I went to buy a car. I just walked out and went to a different dealer.

> the car listed on the web site does not exist

Sure. And I get that some of the walking around is probably a ruse. But we're talking about their internal records.

>And I get that some of the walking around is probably a ruse

I don't doubt that on a slow day a salesperson and the entire process will be slowed down... nothing like tapping into the sunk cost fallacy (as a buyer I spent 3 hours here today, I'm not walking out now and doing THIS again)!

The thing is the car does probably exist somewhere - but it may be in their system, but allocated to someone (on paper only, because if they allocate it in the system it disappears from the website, but they want you to come in), or in transit (they appear on the website the moment the factory assigns a VIN build to the dealer, etc.

And sometimes I swear it's just a glitch and they don't really care.

In my case it wasn't that: The dealer straight up imagined a sale they wanted to have, and were quite rude to me.

Me: "I want to buy one of the cars you advertised in the newspaper." (It was 2003)

Them: "We don't have those cars."

Me: "But you're advertising this sale."

Them: Poker face.

It wasn't like they said, "Oh, yeah, that was a popular sale and they sold out." It was very clear they advertised cars they didn't have so they could divert me to a more expensive model, and it wasn't like they offered to call another dealer to ask if they still had inventory.

Yeah 2003 they were getting away with that - now they have to list the VIN and "only one available" and similar wording.

Sounds like the average dealership experience.

It does. My last car buying purchase (2023) involved Internet research and then on multiple occasions on the call to the dealership I heard: "Oh we don't have THAT specific model on the lot but we have something similar".

Even in person, the people in the office would look at inventory on the computer but then have to send someone physically out into the lot to verify they did in fact have what "the system" said they have.

but but we have to make sure manufacturer direct sales are banned, because they don't know how to sell cars

With all the intelligence built in to current cars, the salesman should be able to send a group text to the cars on the lot asking whether any of them has all or most of the desired features. And if so, what are its GPS coordinates. Or turn on it's emergency flashers and sound horn in five minutes.

I think every process needs a paper backup. There’s just no telling when something will be down.

If you run a SAAS you could offer this as a feature. Even hire data entry people to input transactions later if needed.

Is there anything relevant to recovery / graceful functional degradation in SoC2?

If not, this feels like an obvious match there.

E.g. "Company has a defined and demonstrated process by which they can (a) offer degraded but limited functionality in the event of full system outage & (b) accept data updates via a backup method, until system restoration."

Sure would have helped with Change Healthcare...

I think you have to have a tabletop exercise once a year. So all good, right?

I mean, better than not. Everytime I see something basic in a standard, it makes me realize there were businesses out there who weren't doing anything of the sort.

You can price this relatively quickly, and see that it's probably not worth it.

~1 week outage once every ~5 years, let's say you lose 100% of revenue that week, that's 0.38% of revenue. Now most likely they're not losing 100% of revenue, demand for cars is not very elastic... it starts to get pointless all around.

Which is frustrating for consumers, but the profit for perfection isn't usually there.

I think you'd have to compare that .38% of revenue to the cost of developing the paper process, as well comparing what revenue you'd lose with the paper process anyway. It doesn't seem crazy to me, unless your paper process is hard to develop.

There's also an argument that developing a backup process is a great exercise to help people understand all the parts of your system and how they interact, as a first step to making them more efficient/redundant/secure/delightful.

I know some (former) CDK alumni and I'm not surprised. Notorious for paying below market in engineering and IT. A place to cut your teeth but not to stay.

Why don't they have any competition?

My hot take is auto dealers are a notoriously painful enterprise sales cycle due to network effects aka "good 'ol boys" club (anecdotally from folks in tech who have to deal in this industry).

can confirm. also the high cost entailed to retrain folks from one system to a newer one.

Many are also not tech-savvy. Many dealerships are inherited within a family that has owned them since the 1950s if not longer. They are cash cows for the owners and there's little motivation to try new things. When they are forced to, like when internet sales and marketing became a thing they had to deal with, they just go with the same system that all their fellow dealers are using.

There also isn't space to grow. It's not like running a dealership with hyper efficiency is going to lead to being able to open another dealership. The market is largely saturated and in the rare event that an existing dealership comes for sale, you'll be competing with massive PE-backed conglomerates that can pay nonsense prices for them.

Maybe 30 years ago. That's not the case with big dealer groups or young small independents.

Japanese-origin management for US Nissan dealers?

It's still very much a dinosaur industry. I suspect the names (i.e. Tony Jone's Toyota) in dealerships and dealership gorups are typically 70+ years or older by now. Children might be taking over and running things now but dad is still likely "chairman of the board" and makes final expense decisions.

they do. there are a couple of large competitors and several small ones. the reason there are not more boils down to: a high barrier to entry, since software suites (not individual products) are often needed, and the high cost of retraining folks using older systems in order to use your new, better product.

Another way of looking at it is CDK's main product is an ERP tailored to the automotive industry. These aren't systems with short setup times and there is major risk to trying to replatform you're accounting system. How do you pull of an ERP migration while you're existing one is down? Further, almost everything the dealer does from inventory management to service is integrated to this system of record either directly or via data integrations.

Some of the smaller mom-and-pop stores just use small business accounting systems like quickbooks but those get pretty tedious to maintain with any sizable number of sales or employees per month.

Who would invest in building a company to compete in this market? It's limited in size, has deeply entrenched competition, and technological progress hasn't unlocked an obvious improvement or efficiency that can be capitalized on.

Best case, this startup gets bought out by a larger competitor. Worst case, they get crushed by it.

Oligopolies going to oligopoly.

Didn't they also outsource a large part to an India-focused outsourcer as well?

A lot of the operational stuff, especially the folks already in India, were outsourced to Genpact. The people went too. Not as many in the US, but a few.

> Notorious for paying below market in engineering and IT

Why assume that good people are only driven by money and pay? Further that good people know all the opportunities and can get a job paying better? Also there is no evidence that I have seen that the places that pay better don't suffer from cyber attacks or ransomware.

A bigger part of the problem (maybe) is the fact that there is a vast amount of info published which helps people improve their hacking skills and make more attacks possible than would be the case if that info was not as easily available. (Note I did not say anything that indicates it wouldn't still be possible or happen but that it wouldn't be as easy to do).

> Why assume that good people are only driven by money and pay?

Ah that's easy: Because CDK Global does not utilize the kinds of technologies or operate in a market where it would attract engineers who'd take the job out of passion or curiosity. It's a dime-a-dozen Enterprise Java shop that sells software to car dealerships. It is also not a startup that offers you equity upside.

If you want a job where you get to write Spring Boot Java that gets deployed to AWS for a "mature" employer you're spoiled for choice; and orgs with the same tech stack will pay 30+% more.

That's highly variable. In my area of the company the pay is very competitive (and I don't have to worry about any Enterprise Java, as per another comment of yours ;-)). But I don't work anywhere near IT, nor on the DMS.

The real problem IMO is that Brian MacDonald is focused (again, this is his second shot) at squeezing the company for every penny so he can make a buck turning it public again. I hate to see all the work people are doing 24/7, but a little part of me is giddy with the thought that BM is getting bent over hard by this. Couldn't happen to a nicer guy.

This illustrates the difference between a Business Continuity Plan and Disaster Recovery.

I don’t know anything about operations management, securitization, etc. What’s the difference between these two? Also, I work for a very large HW company, and we’re locked down. From my point-of-view “operations” just works. What does this look like for a small not-in-computers company? Like, how could the Seattle Public Library have secured itself from ransomware with a turnkey, reasonably priced solution?

At a high level, disaster recovery can often be "how do we get back to the way we were doing business?" A BCP is "what do we do if the way we did business before is not an option?"

So in this case, a DR plan might be "how do we restore our CDK data if something important gets deleted?" A BCP might be "what do we do if CDK no longer exists?"

DR: bring IT services back online.

BCP: keep the business running, possibly without using IT.

The BCP is what you execute while the DRP is in process.

If you have a BCP with no DRP you're probably going to survive, painfully.

If you have a DRP and no BCP the company may be dead before the disaster is recovered.

One of the reports of this I heard was on Marketplace the other day... and the part that made me chuckle was on cursive.

Pen and paper, but please no cursive: Widespread cyberattack sends car dealers back to 20th century - https://www.marketplace.org/2024/06/21/cdk-global-hack-softw...

> Car dealers are a pretty big part of this economy, doing some $1.2 trillion in sales last year, according to the National Automobile Dealers Association. In the wake of the CDK hack, there’s a new policy among the salespeople and mechanics at the Willis Automotive dealership in Des Moines, Iowa: no cursive.

> “We have a lot of staff members that are younger than 30 that I’m not sure have seen cursive in their life. So we try not to go the cursive route just to make sure everybody understands what’s going on,” said Jason Willis, CEO of the dealership.

I like how they blame "young people" for not being able read cursive instead of their own terrible hand writing.

"Young people" are not being taught cursive in school. Schools are not teaching cursive to students any longer since 2010 if they're following the Common Core curriculum. https://en.wikipedia.org/wiki/Cursive_handwriting_instructio....

You can learn to read cursive in a few hours. It's not like they are writing in Mandarin, most of the letters are identical. Complaining about it is culture war virtue signaling.

Additionally, kids do still learn cursive. It's just not mandatory curriculum. My nephew is was learning it just before school ended this year.

Don't get my Boomer mother started on this topic. Apparently, "the country is going to shit" because cursive isn't being taught in schools anymore. LOL

Sorta-related: manual-transmission cars. About a year ago, my girlfriend found a VW Jetta that she liked on the BMW lot with a manual-transmission. She offered the dealership about 60% of what they were asking. The dealer strongly rejected the offer, even laughed at it. My GF and I walked away. The dealer called back a few days and accepted her original offer. They were never gonna sell that car with the manual-transmission and they knew it. The only downside is that she's never gonna be able to re-sell the car, either.

More likely they just had the car overpriced like what dealerships have been doing since the pandemic.

I was involved in the building of the 911 system for my country. When doing that, we had to design it with this in mind.

If the system ever fell down, the operators had standard templated papers they would fill, and once the system would be back up they would add the case data back in.

Thank you for investing in that it will definitely pay off.

In many parts of the US, there are still red "call boxes" in working order and maintained as a backup to the 911 system, and was actually used when Massachusetts' 911 system went down last week:

“The current 911 system is down statewide, if you have an emergency and need assistance pull your nearest Fire Box, or call the Boston Fire Department at 617-343-2880. You can also get assistance by going to your nearest Firehouse,” the post read.

Police Commissioner and Boston Police Chief Michael Cox said earlier Tuesday that residents looking to contact officials while the 911 system was down could call local police departments for assistance, and pull the local red call box on streets and corners to alert fire/EMS.

https://www.kake.com/story/50917965/statewide-911-system-out...

The technology, patented by Gamewell in the 1880s, is based on telegraph technology from the mid 1800s - you pull the handle, it releases a notched disc which starts spinning and transmitting a number to the central fire command. The number corresponds to a street address and emergency services will be alerted.

Old call box still in working order: https://www.instagram.com/reel/C5bwxFoJc56/

Why say "my country"? There are less than 300 countries world wide, people should know all of them.

Probably because they don't want to say what country they are in, for privacy.

For about ten years, I've theorized that we will see the rise of 'boutique' doctor, dentist, and law offices that keep only paper records for the sake of the privacy of their clients.

There are a bunch of problems that connection and automation bring with them, the rise of digital monocultures seems to be one of them.

I rented from a small landlord office, they were using Windows XP long after dropped support and got infected with ransomware.

Interested in hearing more. I've heard the same sentiment from not just old (~30 yr old) practices but just-starting ones.

Like any non-technical market, they just bought what was pitched, and there's often more gripes than complains.

One example:

When a patient transfers to another dental office, their records need to follow. Before you "had to" fax or snail-mail them. The software/cloud solutions promised streamlined, painless transfers, but those benefits never really materialized due to the amount of HIPA-compliancy issues (the details around this pain point are fuzzy).

The office-manager explaining all of this was (half-jokingly) fantasizing about going back to snail mail.

I work in infrastructure for an EHR provider, so interoperability isn't really my area, but I do work with devs who must do this.

I'd say the problem is approximately zero to do with HIPAA; we almost never even talk about it in my experience. It's just a lack of standards, and poor implementations of what standards do exist - every once in awhile something will crash because of a weird escape character or something in an HL7 message (though that could be on us no doubt).

I believe last year was the first time that there was a mandated standard to export EHR data and one of the devs was complaining that it didn't even say if units should be imperial or metric.

I'm told the labs are a complete mess and have no federally mandated standards; I know they've written code because doctor X wants to use lab Y. Obviously the big national labs win because you only have to write code for them once and all customers can use them.

It's just another aspect of a broken American healthcare "system" - there's no incentive for anyone to interoperate in the best case, and in the worst case it allows you to create lock-in for your product.

This works until it really doesn't - for example, you are visiting your family 3 hours away from home, slip and fall, go the ER, and die because you are allergic to some random drug but that was only noted in your paper documents. This is a contrived example and allergies to medicine are typically checked on the fly - The point is, you will be at a disadvantage any time your records need to be ported somewhere new.

I don't believe they will go back to paper records.

However, I could see certain professions operating with simplified "air gapped" systems.

Not connected to the Internet at all. It would take some disciplined processes but it would be possible. Updates could be done by qualified tech's to maintain the air gap when updating with a "sneakernet".

> For about ten years, I've theorized that we will see the rise of 'boutique' doctor, dentist, and law offices that keep only paper records for the sake of the privacy of their clients.

"Privacy" until a disgruntled staffer copies or takes a picture or just takes the pieces of paper and publishes them.

With digital systems, this can be mitigated (rate limiting, encryption and least privilege information sharing, audit logs etc.) to an extent. With paper, you're screwed.

I still remember a few years ago walking on a street in a city in Easter Europe, behind a bank office for a bank which no longer exists. There were dumpsters nearby that were overflowing with garbage, and the wind was carrying some of it around, like sheets of paper with bank loan applications, ID card scans, etc etc etc.

Paper is not easier to secure than digital systems if the people supposed to secure it don't care.

> With digital systems, this can be mitigated (rate limiting, encryption and least privilege information sharing, audit logs etc.) to an extent.

None of those measures do anything to prevent someone from taking a picture of the screen, which is the same sinking boat you describe.

I think you are insightful in identifying care as the key principle. My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components.

> None of those measures do anything to prevent someone from taking a picture of the screen, which is the same sinking boat you describe.

But it's relatively easy to only have the people that need specific information to have it. Receptionist only has your names and contact information; doctor only has your relevant medical information; etc etc.

With paper, either everything will be together in a big file, or it would be very impractical to manage.

> My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components.

Potentially. Or they'll improvise because they're a small operation and there's trust. Many a small company has been caught with terrible physical or digital security, because nobody cares and at their scale dedicated people to care don't make sense.

> But it's relatively easy to only have the people that need specific information to have it.

Which brings us back to...

> "Privacy" until a disgruntled staffer copies or takes a picture or just takes the pieces of paper and publishes them.

With paper, it's primarily about the trust you place in people.

With digital it is not only the trust you place in people, you add the trust required for the systems you use; not only the ones you select, but the ones they depend on.

Across a range of systems, we are seeing that we haven't yet mastered complexity.

> Many a small company has been caught with terrible physical or digital security, because nobody cares and at their scale dedicated people to care don't make sense.

Which brings me back to those boutique firms... with paper-only you reduce the problems to one that have been well-understood for hundreds of years. Air-gapped systems seem like an attractive option, but even then, you're depending on both the trust you place in the hardware, OS, and package vendors and in the practice of the new field of digital hygiene by the staff. My prediction is that some clientele somewhere - actors, politicians, billionaires - will decide that their private data should be as private as they can possibly make it, and that it will be the old-fashioned way.

I worked at one of these companies catering to a large network of dealerships. Quit after 1 month. The one company I worked at was outsourcing all or most of the development work with an onshore mostly as management and a couple of devs in the US.

It was a massive shit show.

- Tests? Useless and garbage. Only used to pump their code coverage reports to show to management

- Design? Non existent and a hacked together code base across a half dozen low bid contractors, probably junior engineers at best

- CI? Dedicated test environments? Nah, costs too much money. Just “use docker to test on local and deploy directly to prod”

- Documentation? Besides very basic instructions on how to deploy locally … good luck

- backup and recovery? Nah who has time for that. Just work on the features that {big client} wants

- code quality? I wish there was a “god” class, but in this code base they managed to create a universal class or “macro service”

Management was a mess. Just a mouthpiece for sales or executives. No backbone. No vision. Just “alright we just need to get through the quarter” mentality.

I've worked in many different companies (healthcare, real estate, investment research, payroll, semi-conductor, streaming media, and more). I am currently in FAANG. All of your points pretty much apply across the board. Especially the one about tests, that is nearly universal. Outsourcing is a recipe for amplifying all of those negatives though and always has been. It won't be long before they start bringing those jobs back here again for that reason. Happens every time.

"macro service" hilarious, will most certainly use this in some future conversation at work, thanks.

Some more updates from bleeping computer last week: https://news.ycombinator.com/item?id=40751754

This explains so much.

I am in the market for a new vehicle and did multiple test drives this weekend. One salesperson casually mentioned "our software is down and things are a little crazy". But other than a lot of waiting, things proceeded as I expected.

I figured that by 1000 this (Monday) morning I'd be fending off follow up texts and calls. Yet its now 1430 and not one outreach has appeared on my phone. This is not a complaint but it is a surprise compared with past buying experiences.

I don't want to come off a loving Tesla too much, they're not perfect, but this is another big area where they are transforming the status quo. So much of the FUD being thrown at them is by this lobby, they still can't sell cars direct to consumer in Texas! Car dealers, especially used cars, in the US are one of the most hated consumer experiences. Pricing is unclear, consumers are talked into buying things they don't want or need, to the point that most women I know won't buy a car without a man joining them. Additionally, they're resistant to EVs because it is eating into their service margin. I saw a brand new Porsche dealer going up recently with only two Level 2 charges. Probably a 10M project, and they have only a token level of concern for planning for future infrastructure. They're out of touch, short sighted, businesses with little alignment to the corporate manufacturing brand.

Getting repair parts can be impossible though, because they’d rather put the limited number of parts they have into new cars. I’ve had friends with broken windows and seats that took more than a year to fix. A whole year with a trash bag taped over the window in a luxury-priced car!

Is that still an issue? I know it happened in the past, but I don't believe it's the case anymore. The flip side is a dealer might have better parts availability, but often at a 2-3x mark up. I think it's a growing pain for Tesla than a profit strategy for dealers.

I haven't bought a new car in 8 years. Do they still do that thing with the pen and paper where they write down a bunch of numbers while crossing other numbers out randomly for like 10 minutes?

The four square sheet? Yes they still do it because it's how they manipulate buyers. It's not random, it's very intentional.

Yes, all sorts of nonsense like that still happens.

Yes, but only if you foolishly walk in to the dealer cold without having already arranged some plan. Also, not all dealers. Just stand up and walk out as soon as they make the crossed lines. Those dealers aren't worth it at all, and there are actually some dealers that don't suck nearly that bad, believe it or not.

I still choose to just do it all by email anyway and then show up only to grab the keys. Works fine. Next time I'm going to go a step further and have them bring the car out to my driveway. They absolutely will, even if it just means having a salesman drive it out.

In an age where digital transformation is the backbone of business operations, a cyberattack can bring entire industries to a standstill. And it's a little bit frightening

They upgraded to the Centurion package: https://youtu.be/gbyXfLSqveM

Seems weird that to me that it make a front page on HN (from an European pov ; it's quite common)

It's a fairly large cyberattack, so it's halfway interesting to HN readers.

Scary. I made a short story based on a massive AI attack that takes this up a notch: https://www.tiktok.com/@likearollingbot/video/73841103452012...

What is the reality something like this could happen to all google accounts, apple accounts, etc?

Someone needs to get fired over this. Probably an incompetent, non technical Product VP

I have several ideas in mind, but honestly I'd just go for the CEO and be done with it.

I like old doctors who still use pen and paper for medical history. I don't like the idea of my medical records being stored online. Unfortunately this is the exception and not the rule nowadays. The same goes for imagery, X-Rays aside I don't remember any exam that didn't go straight into an online system.

Neither of these are feasible:

1. There are legal incentives (in the US at least) for doctors to use electronic health records, EHR. Providers that don't use EHR are penalized for it when it comes to Medicare/Medicaid.

2. Imaging PACS (Picture Archiving and Communication Systems) allow radiologists to read images from multiple different facilities from one location, including smaller/rural hospitals, and at all times. The alternative is to require physical staffing by radiologists at every single location, which is obviously much less efficient.

I agree there are tons of issues with the quality of cybersecurity, especially in the health system, but saying "I just want it all on paper" is throwing out the baby with the bathwater, not to mention basically impossible at this point.

I would bet that a developer knew of the security issues, but was vetoed by Product.

The usual case for software development the last decade is developers who don't fully understand what they're doing, and are mostly focused on resume-driven-development (RDD) and looking good in Agile sprint standups.

Noteworthy exceptions: FAANG promotion bid orientation, and VC growth startup alignment towards shipping something to look like growth towards exit.

In a small minority of cases, you have developers who know what they are doing, and are thinking rigorously.

The norm isn't big-meanie Product making (forthright, courageous, photogenic) developers ship negligent security vulnerabilities, against developers' protests. Developers are at least as much responsible as Product.

Not getting time to do security because we need to ship v1 is a decision called by Product

If you know of a developer who would've done responsible security, but was pushed to ship instead, against their protest, I'd be happy to hear that.

In my experience, Product is always the first one to suggest cutting corners.

Part of the job of Product is triage on all sorts of things.

But I don't think there's hardly any developers who would've done something securely but didn't because Product said no.

I know it's not directly related to this, but I remember one time I went to a dealership in my area that was apparently known for being particularly skeezy (unbeknownst to me before I went in). They got sued for some sort of fraud.

Anyways, I remember going in, and the guy pulling up a car in their system when the (too good to be true) car listed wasn't in stock.

He turned the computer screen around, and there was one of those (I think) fake "you have a virus" pop ups in the IE window. It was either that or a real alert. Either way - clearly incompetent with tech, and once I saw that I noped out of there fast.

Got took back to the stone ages

Another commercial for eliminating cash and moving to 100% digital currency!

>Another commercial for eliminating cash and moving to 100% digital currency!

Because then it would be impossible to do transactions on paper when the computer system goes down? That doesn't sound like an advantage.

In studying voting systems I’ve come to respect paper-based logs along the same quality parameters as databases. Resiliency, scalability, backup, readability, schema-flexibility , onboarding, power-efficiency are all very good with paper.

So many of us were quick to move paper-based systems (voting, orders, kiosks, parking meters, journals, requests, etc) over to computers – without accounting for the e2e cost and flakiness of the software-based system.

How does the backup aspect work for paper? Scanning?

Otherwise paper is quite fragile and susceptible to combustion.

What if voting was all done via paper and you could later view the scan of your ballot as it existed at the time of count? Unfortunately there could still be funny business on the backend.

I'm not a fan of being able to see the values of your ballot after it is cast. It greatly opens up the possibility of coercion or bribery. If I can show how I voted, it leaves it open for someone to demand/request I prove to them how I voted. And just seeing a picture of it tells you pretty much nothing about if the system actually counted it properly or not, you still need to trust the counting system at some level.

Lets say someone offers me $500 to vote for candidate X. I don't like X, but I do like money. I vote for Y, I tell them I voted for X, there is no proof either way, would they still want to give me that $500? Or if someone says, "vote for X or I'll break your legs", how would they know if I voted for X or not?

Agreed, you raise some really good points. Thanks!

xerox

fire protection is easier than data retention

no perfect solutions, only tradeoffs

The part I love about paper-bases voting is the ability for anyone to visit the polling station and understand from A to Z how it works and how security is graranteed.

If you have doubts about the system, you can just come and see.

indeed. paper-based systems are truly transparent in that you can walk through the entire operation shoulder-to-shoulder to perform the audit.

A software system, even when reading the code, is much more difficult to see the chain of custody and workflow

Related note: car stealerships are a relic of the past. There is no reason why a middleman should exist when buying a car. Consumers should have the option to purchase directly from the manufacturer.

I am personally not a fan of Tesla as a vehicle, but I admire the business model of buying directly from Tesla. Stealerships are a drain on the consumer. All that land they own can be used for productive economic activity or housing.

I agree they're useless middlemen but I don't believe for a second that the direct-to-manufacturer model wouldn't also be enshitified eventually too.

It's what we had before the laws prohibiting direct-to-consumer/manufacturer-owned dealerships. It's hard for me to find any reliable sources that explain why we got those laws though (was it because direct-to-consumer was bad?)

It seems like the EU has reined in the worst excesses of dealerships a lot, and allows direct-to-consumer. Maybe the US will follow suit in a few decades.

In the early days of the automobile, auto manufacturers didn't have the resources to have stores in every town in America. People couldn't just get a vehicle in Atlanta from Detroit if they didn't have a way to get there. Dealers both organically popped up, and some manufacturers actively engaged with local dealers to get their cars out to a broader audience (e.g. Ford with the Model T).

But as those manufacturers and dealers grew, they then had the resources to operate at broader geographies, and dealers lobbed for franchise laws to "protect local businesses", etc.

Dealerships came about because car manufacturers were demanding that all service go through their dealerships at crazy marked up prices. So dealerships started as way to "protect the consumer" but quickly because terrible places all on their own.

I think you go too far. I too have a deep dislike for dealerships, but they are not useless. Specifically, it's a place you can go to test drive cars and they have OEM-certified garages for warranty repairs. Can't test drive when you buy online.

I think the main problem with dealerships is the government granted monopoly. If a dealership is in a region, most states prevent any other dealership from setting up shop in that region. That's why so many of them are passed from father to son like a dynasty. No competition at all -- and they act like it.

Restore competition and the "stealership" aspect should go away.

To be fair, how many copies of one car do you need? Once you got 15 models on display you should be good to go for testing purposes. You don’t need a parking lot with a hundred cars.

Some people want to buy a car _today_. Lots of people want to buy a car this week. Fewer people have the patience and funds to pay and wait for car on order.

Sure, most people don't need to drive away same-day with a car, but some want to. That's the value of inventory.

>Specifically, it's a place you can go to test drive cars and they have OEM-certified garages for warranty repairs. Can't test drive when you buy online.

Tesla doesn't have independent dealerships and it's quite easy to test drive their cars before you buy.

It's also very, very difficult to get them repaired...

It's interesting, because in theory the requirement for independent dealerships could promote competition - they can compete to offer the lowest markup over MSRP, offer different addons, or offer better service. Just like going to a specialist shop for computer parts or audio gear or whatnot.

But instead we ended up with a system where car dealerships basically own local lawmakers and got laws passed that not only prevent the manufacturer from competing with them, but make it really hard for people to start new dealerships to compete with them. And the experience shopping for cars at a dealership is absolutely terrible, which shows you that they don't feel any pressure to compete.

It did work that way though. I've never payed MSRP on a brand new car. Good luck doing that if all you can do is order from the manufacturer's website.

Would iPhones be less expensive if you could only get them from local dealers and not Apple?

It depends upon if Apple tried to set price controls and how successful they were at pursuing businesses that violated them.

For example, Games Workshop doesn't like when 3rd party retailers charge less, but it's easy to find 3rd party retailers that charge less than Games Workshop on their website.

In response they've increasingly made certain models online only and its always at full markup.

>But instead we ended up with a system where car dealerships basically own local lawmakers and got laws passed that not only prevent the manufacturer from competing with them, but make it really hard for people to start new dealerships to compete with them.

There are practical reasons for this. People buy expensive items and expect to be able to get those items maintained and serviced. If the business was cutthroat, that could be more difficult. I don't want my dealer going bankrupt, frankly.

But the idea that dealerships aren't out there competing with each other is insane. Have you ever actually bought a new car?

>And the experience shopping for cars at a dealership is absolutely terrible, which shows you that they don't feel any pressure to compete.

Just the complete opposite experience I've had in my lifetime of buying new vehicles. And the idea that they don't compete is an outright fabrication. You have an incredible amount of leverage buying a car, and you can shop quotes around.

> you can shop quotes around

And use them openly against each other to get a better subsequent quote.

Exactly. And once they know you are interested, you have all the leverage, because there are so many great cars out there. You can negotiate ferociously.

I once had the salesman turn his terminal around and say to me, "Have a look. By the time we pay the guys to detail and prep the car, we will make $700 off this sale. I have no more room."

Which was a negotiation tactic and a lie, since dealers make a lot of their money from volume bonuses and not just the price difference of a car. "Invoice price" is also often not the actual price dealerships pay for a vehicle.

Yes, I've bought cars a couple times, and also had to trade-in cars. Every dealership experience I had was drawn-out misery where they tried to scam me. Maybe it depends on where you live?

Carmax was fairly OK in comparison to my experience with dealers but still took like 8 hours.

   And the idea that they don't compete is an outright fabrication.

Not when almost all the dealerships in given region are own by the same family. Here the same group own the Genesis, Infiniti, Kia, Hyundai, Mazda, Mercedes, Mitsubishi, Nissan and Volvo dealerships in a 100km radius.

If I want a Mazda I can get a quote from Joe Cardealar or I can drive 50km and get a quote from his brother Steve Cardealar.

> People buy expensive items and expect to be able to get those items maintained and serviced. If the business was cutthroat, that could be more difficult. I don't want my dealer going bankrupt, frankly.

So, more competition is bad for the consumer?

Why is this a related note? Is the regulatory framework around car retail a contributing factor to their vulnerability to ransomware?

This feels like a reflexive response to the mention of the word ‘car dealerships’, not something that will lead to a discussion of the substance of this article.

I suppose dealerships couldn't get hacked if they didn't exist.

The activity of dealing cars will still exist even if someone else (e.g. the manufacturer) is doing the dealing.

It is kind of a crazy model. You don't go to the Pepsi store for Pepsi and the Coke store for Coke. The exclusivity dealerships get enshrined in law is kinda nuts.

Still, I think there is something to be said for independent dealerships overall for service quality. Trying to get a Tesla serviced is still something of a nightmare. In comparison the service departments of dealerships have are much more robust.

I'm not sure that's a good comparison. There are several middlemen before you buy a Coke or Pepsi.

Usually, your soft drink is manufactured from the brand's syrup by a bottling partner, which is then distributed to a retailer, who you buy it from.

e.g: https://www.coca-colacompany.com/content/dam/company/us/en/a...

I used to work for Pepsi-Co so I am well aware of how their distribution works.

But in this case, at the point of retail it makes no difference. The store can sell as many different brands as they want. The problem is not the middlemen, it's the exclusivity arrangements that disincentivize brand competition.

Then you should be aware that Pepsi/Coke are notorious for their exclusivity agreements in some of their retail channels

e.g. I drank Coke products in my undergrad because of my school's exclusivity agreement.

Unfortunately the soda business isn't free of noxious exclusivity deals either. Restaurants almost never have both Coke and Pepsi products, it's either one or the other. As I understand it that's because restaurants get a lower price if they agree to exclusively offer one brand.

One of my dealers locally sells both Ford and Chevy. It's great for cross shopping. There can be exclusivity arrangements, sure, but it's not set in stone. And in any case Coke & Pepsi absolutely have the same sorts of arrangements with both retailers and restaurants.

And there's a HUGE ecosystem of repair, service and resale around traditional dealer networks. I'm pretty sure Tesla would say that for their model (that doesn't have this) this is a feature - from which they benefit immensely.

Everyone I know IRL never gets their car serviced at the actual dealership, always going to a third party repair shop.

Tesla has service issues, I'm not sure that they're related to their lack of dealerships though.

I go to the dealership. Half the time, the neighborhood guy sucks. I've almost never had luck with local guys.

Exactly. And you'll pay a premium, no doubt. But they have incentive to please you, as a current and future customer.

Yea, I was always a "never get your car serviced at the stealership" snob, until I moved homes. Now I'm in a different city and I haven't found a trustable mechanic yet, so for things I can't repair myself, I'm going to bring it to the dealership.

Yup, I had a guy over tighten a spark plug and totally ruin my engine. Had to have the master cylinder repair then it finally crapped out... just to save some dough.

Once your car is older/out of warranty, yes. New cars under warranty pretty much go to the dealer.

Dealers actually don't know much about their older cars. Try to bring for example a 1990's era (or really anything more than 10 years old or so) Mercedes to a dealer for service, none of their techs have any idea what it is, unless they happen to have an old guy.

Dealership shops are trained and reasonably competent working on newer stuff that's under warranty coverage. Older than that, you can often get better workmanship and cheaper prices with an independent.

I never go to the local guy. My dad did, but he loved old cars more than I do. And the one time I did go to his guy, I was astonished at how much he charged. Made the dealer seem downright competitive. And the dealer definitely has better access to parts and model-specific knowledge.

> The exclusivity dealerships get enshrined in law is kinda nuts.

It’s wired that the country of free market has all these protectionist laws that do not exist in many ex-soviet evonomies

> the country of free market

It's a common misconception, but the US actually has a mixed economy.

> Trying to get a Tesla serviced is still something of a nightmare

They literally come to my house and fix things, it's incredibly easy for me, but I have four service locations within 30 minutes drive, so may not be the common experience.

Most other modern dealerships do this as well, when applicable. My parents had the software in their Ford Maverick updated by a mobile service team.

>Consumers should have the option to purchase directly from the manufacturer.

They should have the option, sure.

But what difference do you think this makes in reality? The process ends up being the similar.

>but I admire the business model of buying directly from Tesla

A lot of people don't want to buy a $40,000+ item online. Tesla understands this, which is why they opened "showrooms" to have real people walk you through the process.

Oh, and let's not get started on surprise repair costs from Tesla, as if they are immune to that ridiculousness.

Saying "no stealerships" (so clever) doesn't change the fact that there's a manual process involved with buying a car.

> But what difference do you think this makes in reality? The process ends up being the similar.

The difference is the price listed is the price you pay. There's not an environment where the dealer is injecting whatever BS fee or piss poor financing they can to milk out every extra cent from the customer.

The manufacture is incentivized to sell these cars at the advertised price.

>The difference is the price listed is the price you pay. There's not an environment where the dealer is injecting whatever BS fee or piss poor financing they can to milk out every extra cent from the customer.

What does the "advertised price" mean, when companies like Tesla can, and do, change it on a whim? Is that really better?

No one is stopping you from walking into a dealership and paying sticker/MSRP.

What does Tesla do differently regarding changing product prices that they're worth calling out compared to other companies?

My personal experience is that they honoured my order and delivered a vehicle superior in every metric but "turning radius". (Which has a far higher price if ordered again on my delivery day)

Every company in every industry modifies products and pricing? See e.g. "shrinkflation"

> But what difference do you think this makes in reality? The process ends up being the similar.

But there isn't a middleman with big facilities and staff to feed, so the resulting product can be cheaper, with the process being streamlined because the middleman's job is to milk you for all they can, meanwhile the original vendor just wants to sell their product.

> All that land they own can be used for productive economic activity or housing.

No it can't. You still need places where cars can be repaired as well as storage for parts/cars inventory. The only way you reclaim some land is if service gets worse.

Edit: For example, Tesla sells direct to consumers but there's still a Tesla "showroom" in my town. In terms of footprint/appearance it's basically a dealership. So where are the land savings?

The Tesla showroom near me is much smaller than a dealership.

That said, still need somewhere to buy/sell used cars.

A repair shop doesn't need parking for 100 unsold cars, and it doesn't need to be in a high-traffic part of town.

Yeah, the footprint of my local mechanics are peanuts compared to the gigantic parking lots gobbled up by dealerships. Parts take space, but not 5 acres of space.

> No it can't. You still need places where cars can be repaired as well as storage for parts/cars inventory. The only way you reclaim some land is if service gets worse.

You probably aren't going to have 10 Ford dealerships in town all selling the same models of cars. That's where the space savings comes in.

As for parts/service, that also gets more streamlined as you aren't likely to have the audi/ford/dodge dealerships and instead just the 1 ford manufacturer in town.

>You probably aren't going to have 10 Ford dealerships in town all selling the same models of cars. That's where the space savings comes in.

So do we want competition, or not?

What competition? We are talking about ford. It's not like these dealers are making ford vehicles or getting different prices from the manufacture.

The competition is that besides ford there's going to be a GM, stellates, and Audi lot (probably).

If we want more competition, we get it not by having dealers competing over who can screw you the most with the best hidden fee, we get it by adding more car manufacturers.

The difference is those places could be relocated to where all the other warehouses are, out in the boonies, rather in the city where we want housing and business. The only places that can't move are repair shops, which have a much smaller footprint than an entire dealership and are thus not a problem to keep around

The original purpose of dealerships was to isolate "vehicle manufacturer going bankrupt" from "organization you bought your car from going bankrupt" events.

The idea was "if you buy a VinFast" from vinfast and they exit the market, you're 100% hosed, but if you buy a VinFast from "Karl Marx VinFast and Fiskar Dealerships of North Idaho" you can go back and talk to KMoNI Inc about your new car.

The dealership model was established a very long time ago back in the cambrian explosion era of car manufacterers and people were buying cars from companies like Auburn, Cole, Crow, Davis, Dixie, Durant, Elcar, Grant, King, Kline, Lafayette, Kurtz, Marmon, Mercer, Overland, Peerless, Pilot, Roamer, Saxon, Stearns, Velie, Wescott and Winton [1] and then the company would vanish and there would be no support.

[1] https://www.supercars.net/blog/cars-of-the-1920s

Imagine if there were car retailers, though.

Towns don’t all need one Unilever store to sell your Ben&Jerry’s, your Dove body wash, and your Hellmans Mayo, then a separate Procter and Gamble store that sells Tide, Pampers and Bounty.

Why can’t you just get all the main car brands at Costco?

I'm not sure why you hate car dealerships so much, doesn't your opinion apply to any distributor between the manufacturer and the end consumer? This is a the same narrative that people said about bicycle retailers as well, but there are significant problems with the DTC model, notably service and support. And if you look where dealerships are located nobody wants to build housing in a big strip beside the freeway.

Dealerships are a special case. From Wikipedia: https://en.wikipedia.org/wiki/Car_dealership

> They have considerable political influence and have lobbied for regulations that guarantee their survival and profitability. By 2010, all US states had laws that prohibited manufacturers from side-stepping independent car dealerships and selling cars directly to consumers. By 2009, most states imposed restrictions on the creation of new dealerships to compete with incumbent dealerships.

Dealerships are more entrenched, but the economics aren't that different from big box stores selling white goods, bike shops selling bikes, etc. Retailing is hard, expensive, and idiosyncratic; providing adequate after sale service is worse. A manufacturer might reasonably prefer to make and market cars, while shuffling the inventory risk and retailing cost off to someone else.

That's a hell of a purchase to make effectively "sight unseen" without the ability to test drive the vehicle first which you would do at a dealership.

The last vehicle I purchased was certified preowned and I went through several models before landing on one - much of my decision was based on how the vehicle handled to me.

We buy so many things "sight unseen" because of the quality and reliability.

As an average car consumer, I have done many test drives and gotten nothing out of it except the car salesman looking like he did something.

I will buy a reliable car sight unseen like I bought my big screen t.v.

Yep, I've never gotten anything out of the test drive either - my mind was already made up based on price/features when I went to the dealership. I'm more-or-less just looking for something that gets me where I need to go safely, I don't care about "handling." My last car purchase (a Nissan Sentra) I didn't even bother with the test drive, I felt it would just be a waste of time.

The other thing is that some "car people" that I know will rent a car before purchasing it because the test drive is far too superficial for them.

>My last car purchase (a Nissan Sentra) I didn't even bother with the test drive, I felt it would just be a waste of time.

Something led you to buy a Sentra, though, a car that is middling in its class. Why?

I already answered in the comment you are replying to -

"my mind was already made up based on price/features"

and

"I'm more-or-less just looking for something that gets me where I need to go safely."

I know that "car guys" can't fathom this but I've driven a LOT of car models (as I've rented a LOT) and they are (mostly) the same to me; I consider cars almost a commodity. I wouldn't even know how to compare vehicle "handling."

You’ve driven a lot of car models yet you wouldn’t know how to compare handling?

That claim seems disingenuous, in order to serve up a point.

You most certainly would be able to differentiate and compare.

Your point wouldn’t stand though would it?

>You’ve driven a lot of car models yet you wouldn’t know how to compare handling?

Correct. I've also been driving for a quarter of a century.

>That claim seems disingenuous, in order to serve up a point.

>You most certainly would be able to differentiate and compare

No I wouldn't. I swear to you I'm not lying. A car is a car to me. There are different sizes and some are a bit more comfortable than others but they are mostly the same to me. I don't even know what "handling" even means, I've never had a car behave unexpectedly when turning the wheel.

In sure I would notice a difference if I was racing or something, but I'm not, I'm just going to the god damn grocery store.

>We buy so many things "sight unseen" because of the quality and reliability.

Name 1 or 2 other things you buy "sight unseen" that are remotely close to the cost of a new vehicle.

>I will buy a reliable car sight unseen like I bought my big screen t.v.

If you have zero preference for the multitude of ways even similar cars can vary, you aren't an average car buyer. Most people care about these things, be it sight lines, headroom, where the chargers are, driving dynamics...

>Name 1 or 2 other things you buy "sight unseen" that are remotely close to the cost of a new vehicle

That question cannot be answered, we all know that nothing is comparable to that price in an average household's shopping list.

But a few years ago a shoe purchase was in store only but a month ago I bought a new pair online. Because I knew that I could try it and return it easily.

Luckily, I didn't have to return.

I wish I could do the same with cars.

I've been in rental cars that I wouldn't buy based on driving them for 5 minutes. IMHO, a test drive is to confirm the car basically works. Some of the value is just from sitting in the car, but is there any thing terrible going on with steering, visibility, pedal feel, shifting, etc.

For my car shopping, I've usually been locked into a model before I visit the dealer/private party, but if I test drive a car and it drives like some of those rentals, I'd be back to looking at other things. I also just recently test drove a lower trim / different engine/transmission configuration vehicle than I wanted, because that configuration was available to test drive and the desired one wasn't... and I was pleasantly surprised by the drivability, so I broadened my search (helps that the configuration I wanted is more expensive and less produced; it's easier to compromise towards something that I might be able to buy for less)

> I will buy a reliable car sight unseen like I bought my big screen t.v.

A few years back I was convinced I wanted a certain model Hyundai (Elantra), researched the hell out of it, figured I didn't even need to test drive as I had owned the previous model. Got to the dealership, sat in the drivers seat and found there was no headroom. I'm not that tall, but the new model was so "aerodynamic" (swept back windshield) that it felt claustrophobic. I bought another model (Sonata).

There are Tesla showrooms where you can do test drives.

The key difference that the place is owned by the car company instead of rich middlemen that engage in regulatory capture, add markups that don't go the manufacturer and degrade the experience.

Manufacturers want to offload the customer service as it's extremely expensive as well as limit liability. That's why dealers exist and will continue to exist.

Does anyone know exactly how we got to this situation (required car dealerships)?

National Auto Dealers Association (NADA). Once there was a large number of these independent dealers, they had the political sway to get it made into law.

https://caredge.com/guides/how-did-car-dealerships-become-so...

I'm not defending the dealership model but when you use the term "stealership" in any way other than making fun of people who say it unironically, you come off as the same kind of person who says "M$" when referring to Microsoft. Out of touch and impossible to reason with.

I'm not in love with dealerships, but one thing that a dealership does is provide final QA on inbound cars. They don't catch everything, but they do catch some of the things that slipped through QA at time of manufacture.

It's somewhat telling that Tesla has a bad reputation for delivered quality, and they don't have a dealership network that does final QA.

Of course, dealerships also like to install unnecessary options while they're doing the other parts of dealer prep, so it's a mixed bag.

> final QA on inbound cars

Indeed, a good dealer will spend several hours checking out the new arrivals and then detailing them to remove the transport dirt. AFAICT Tesla doesn't do this as well themselves, both my Model 3s had some fairly obvious defects that took me under a minute to spot.

> car stealerships are a relic of the past. There is no reason why a middleman should exist when buying a car. Consumers should have the option to purchase directly from the manufacturer.

This is really such a classic clueless HN comment from someone who both doesn't understand business and hasn't taken the time to understand why things are done the way that they are. (My comment doesn't mean in any way that things can't and shouldn't change and/or can't be improved. But seriously calling them in part 'stealerships'. And 'there is no reason'. Thanks for having it all figured out.

...okay, and what understanding of the business and the way things are done are you bringing to bear here? I as well don't like OPs rhetoric but if you don't have a counter why...counter?

> There is no reason why a middleman should exist when buying a car.

There are for the politicians who benefit from the lobbying the dealerships do!

I agree with you though, I just don't love the entire model of dealerships being that some local person just wants to run their own business and this is the easiest. So little brand or experience consistency across dealerships and so much perception that the person benefiting most from your transaction is the dealership itself. I have zero interest in putting any money in some locals pocket for a car transaction, I'd really rather it all just go directly to Toyota and have Toyota keep a more consistent experience across the country.

> car stealerships are a relic of the past

Hard disagree. Shitty car dealers should be a relic of the past, sure, but the business model is sound. It's basically like every other product you buy. How often are you buying from the manufacturer? Almost everything you buy from a store. That's what a dealership is.

Inventory is nice to have for all the same reasons you are happy the home store has inventory. And a built-in service department with a good parts and knowledge source is pretty important for a big expensive device which requires maintenance and that you're going to keep long enough for it to break a couple times.

The laws protecting them, I do think should be repealed. But I don't see the business model going anywhere. And I am on my second Tesla, so I see the alternative. The buying experience is easier, sure, but otherwise it's all the same shit under a different name. And some dealers can provide the same experience, frankly. In the future all of them will, or they will go out of business.

Chinese retaliation for EV tariffs?

Reply on news.ycombinator.com