Hacker News Reader

Comment by drpancake | Hacker News Reader

I'm sure there are strict security measures and a rigorous testing regime in place, but still the idea of some anonymous engineer being able to push an over-the-air update to my fast moving, two-ton lump of metal makes me a little nervous.

(Tin foil hat mode) Imagine the implications of some malicious third party gaining access to that process.

View on HN

I've worked in industrial process systems where firmware is pushed out to millions of devices. The process is pretty rigorous - first the engineering team develops a candidate build, they run it through full regression and acceptance. Once it passes all the various code quality tests (coverage, static analysis, etc...), it's signed. Only code which is signed can be run on the production bootloader. The process required to sign a firmware image requires M of N people to come together with their credentials (hardware keys) to have the HSM (Hardware Security Module), sign the firmware.

The actual roll out of the firmware is of course staged - in Tesla's case, they likely roll it out to all of their employees teslas for a period of time, and then to a candidate group, and eventually everyone.

The team that actually pushes the firmware, is completely separate from the team that builds, and signs - they have a fairly detailed set of procedures that ensures a quality push, which is their entire focus.

The likely difference, is that the process I described, usually took 4-6 months after the code was completed, whereas Elon Musk/Tesla can probably spin it around in 4-6 weeks.

I've done the same at smartphone OEMs, and I can tell you, even after all the precautions and testing similar to what you said, there's always a few units that get stuck in a bootloop or fail to update out of millions. That a happening for a car instead of a phone is much more dangerous.

How is it bad for the car? Are Tesla's accepting OTA updates while driving, and updating firmware while the vehicle is moving?

If so then you're right, they've made a terribly unsafe decision.

But if you have to stop the vehicle, put it in park or off, before it actually updates the software, then a bricked car isn't exactly dangerous, just a massive inconvenience and a source of incredible frustration.

I believe they update when the car is parked at home.

Yea, I would be pretty livid if one morning my car is just dead for no good reason.

You might object that a dead battery can cause that. But I take constant preventative measures, can tell when a battery is starting to go, and I can fix a dead battery.

And in 2030 we'll look back and think, yeah, OTA updates are how cars became a subscription service.

Or, god forbid, an advertisement delivery platform.

(Yeah, radios deliver ads, but I don't have to listen to the radio. Can you imagine if your car ran banner ads around the spedometer?)

It would be driving us so we won't be looking at the speedo. Because of the new "free rides while you listen to our adverts" deal. Big red button for "just buy the goddamned product and leave me in peace".

> Big red button for "just buy the goddamned product and leave me in peace".

Finally a business plan where modern advertising makes any sense: Torture based freeware. "Send us money and we'll stop. Here are the products you'll hate today..."

They could even remove products from their list after payment from manufacturers.

I could get behind that process, and I don't doubt that theirs is similarly rigorous. I guess the issue is that, in the long-term, how do we know that it's still being applied consistently and that there are no security holes.

This is a much wider and rather tricky issue (how do I know that my Bitcoin exchange is performing cold storage correctly and consistently?)

You could answer: more regulations and oversight. Doesn't solve the issue.

The counter point to you argument is the number of people who are driving right beside you at highway speeds who have been completely ignoring the TSB recalls or even general vehicle maintenance. Allowing a direct update to something computer related doesn't let these people continue to drive unsafe vehicles.

All you have to do is browse http://www.reddit.com/r/justrolledintotheshop and you'll see so many people are not capable of having general maintenance done. Like this: http://imgur.com/a/VEeR9 the guy wanted to only have the flat tire repaired even though a strut went through his hood! Or this that is supposed to be a brake rotor : http://i.imgur.com/xhz90Bq.jpg

The updates aren't installed while the car's moving. You see a dialog box asking if it's OK to install at 3am (or you can change the time, or wait til later.)

Agreed, what are the chances that there is no vulnerability (say buffer overflow attack) that allows a black hat to get into the system?

Or even an "oops, I pushed that update to production instead of test"

Given the extremely dangerous potentials of such a mix-up, I would very much doubt an "Oops" moment would occur. Quite honestly, the way they run the company, I wouldn't be surprised if the process of pushing an OTA update to the automobiles is akin to launching a nuclear missile.

Fifteen years ago, NASA lost a Mars orbiter because one of their contractors used Imperial measurements when NASA used metric.

Swissair 111 crashed because the operator installed a new entertainment system which overheated.

A lot of serious systems made by serious people still end up with stupid problems.

While that is true, it also means that the 'serious firmware' developed for the car probably has stupid problems.

And it might be safer and cheaper to have the option of fixing problems when you find them, because if you don't have that option, you're forced to weigh the costs of a recall against the risks of the issue for every little thing.

Reply on news.ycombinator.com