Hacker News Reader

Comment by 77pt77 | Hacker News Reader

> I'm guessing, of the car makers out there, Tesla and Rivan are near the top since they are new and have people with security experience?

From what little has been leaked, I really doubt Tesla should be enar the top.

View on HN

Which car makers offer prizes at pwn2own?

Have _anyone_ seen a Prius crash and reboot while driving? There are plenty viral videos for Tesla.

The entertainment system of the tesla can reboot while driving, but that's different to a) being hacked or b) the control system

Yeah, but if something's so glitchy that people had seen speedometer go blank on camera, just how's it supposed to translate to code quality or software security?

Tesla is amazingly good at software development practices. It’s the new Fords that are bricking themselves via updates, not Teslas.

That's not the impression I've gotten from Tesla's software. From the flash wear issue to the numerous vehicle opening issues, to the entire mess of their UDS implementation, there's quite a lot to complain about compared to a hypothetical "best practices" manufacturer, as opposed to the dumpster fire software of other OEMs.

Was it Chris Lattner or Francois Chollet that joined Tesla, set up their CI pipeline, and politely left?

I don't know anything about their practices, but once bumped into this Reddit post by someone claiming to be ex-Tesla and describing exceptionally bad practices. There's no way to verify the claims, they could as well be total misinformation. But I found the link to that Reddit post:

https://old.reddit.com/r/EnoughMuskSpam/comments/99sbwa/form...

It's easy to complain since they're the only manufacturer who opens up your car as an API

None of the issues I mentioned where discovered via API. The flash wear issue was discovered by bricked cars. Security researchers are pretty good at publishing about remote unlock mechanisms for all manufacturers, though Tesla's bounty program has helped. The UDS implementation issues are non user facing and were discovered by reverse engineering. Ford, as an interesting point of comparison, published a competent (if incomplete) open source UDS server.

I wanted to say thank you, searching for that phrase[1] produced a ton of fascinating reading, including https://mpese.com/publication/uds_fuzzing/SAE_UDS_Paper.pdf "Comparing Open-Source UDS Implementations Through Fuzz Testing" from Apr 2024 which itself linked to a lot of GH repos of the tools they used

I didn't find the Ford one specifically, but I also didn't go surfing through the many pages of results

1: https://duckduckgo.com/?q=open+source+UDS+server&ia=web

Reply on news.ycombinator.com