Comment by cmurf | Hacker News Reader

Comment by cmurf | Hacker News Reader

I wonder if the primary control code should be open source. That's without respect to right to modify or reuse the code, just whether it should be mandatory that it be published. And it'd exclude things like user space apps and UI/UX stuff. But any of the code that controls or affects steering, acceleration, ignition, braking, and lighting, really seems like it's not OK to just consider it a black box, subject to DMCA, copyright, and trade secrets laws and thus risky (or flat out illegal) to reverse engineer and understand how it works. And right now a significant part of an automobile is a black box, and you do not fully own it.

It was supposed to be that patenting required you to fully disclose all the details of an invention. The idea was to not only make clear what you had a monopoly for, but so that others could learn from your invention and make something different that was better.

If it's just published you can't be sure it's the same code that runs in the car. You should be able to compile the code and inject your locally compiled firmware to the ECU if you want to verify that the car engine is doing what it's supposed to be doing.

If you can do it, chances are an attacker can, too. I prefer hardware that won't load unsigned software in such places.

Then use reproducible builds. You inspect the source code, and if it does what it's supposed to, compile it reproducibly, and compare the binary with the official one which has a signature. If they match, then everything is kosher.

Difficult unless the compile tools are free and open source, and the manufacturer documents the exact version of what compiler they're using, and what feature flags are enabled, etc. Otherwise the exact same source code can produce many different binaries, each of which hash differently.

I don't know the solution, but the black box approach we have right now I do not like. As a pilot this is a bit weird for me to say because those systems are also completely proprietary as well, full on black box - and not the d/v recording type. And I'm even wondering if that's overdue for a change as well.

Perhaps we need an approach whereby abuse of patented or otherwise protected technology should be punished in part by termination of the monopoly protection, and its immediate free availability to competitors. I imagine it would create some serious economic hurt for VW if these allegations are proven to be true and their ECS were made public domain - far more than a fine, or at least any fine that's likely to be politically acceptable.

Reply on news.ycombinator.com