Hacker News Reader

Comment by yk | Hacker News Reader

That's pretty much the same mistake as in VW recent "We know where you parked" hack. [0] So while I don't really want to say anything nice about VW, the mistake is no something that only happens to side projects.

[0] https://www.spiegel.de/international/business/we-know-where-...

View on HN

This is also something that keeps affecting "smart" software engineers with projects, that don't realise they've got misconfigured S3 buckets, or have Firebase or Mongodb etc. wide open to the world. We've seen so many companies that absolutely should know better be in this area.

The reality is that cloud providers make it easy to deploy infrastructure without much thought. You need skilled domain specific IT Architects working together to ensure that an organization's cloud presence is efficient and secure. That discipline and rigor is often dismissed or underappreciated because it forces you to slow down and decreases agility.

Some organizations have some form of Enterprise Architecture group that governs technology and ensures that there is discipline though the maturity and scope varies. I would say most organizations are completely devoid of that type of supervision and oversight.

> I would say most organizations are completely devoid of that type of supervision and oversight.

It's unfortunately far too counter to "move fast and break stuff" that startup space tends to be enamored of, because they tend to want you to do things safely and try to avoid a "Front page of the New York Times" type of security event.

Has being on the front page of the NYT for a software bug or leak killed any companies?

I think they correctly believe security failures are at most a short term PR problem as far as the market is concerned.

Sure wish it meant more than it does. Sorry that "Front page of the NYT" phrase is one I've been using since back when everyone would have expected it to be the death of a company!

Software is unfortunately a side-project for most auto makers :)

With the amount of complexity found in modern car's pre-packaged software I'd not be so sure.

No he is right, hardware manufacturers treat software as a line item and just part of the BOM. Typically just contracted out (although some are trying to change that) Thats why its typically mediocre from companies outside of SV.

You need a software first agile mentality from the leadership of the company on downwards and these legacy companies just dont have it.

Agile workflow for making cars? No.

Agile workflow for frequently updating non-critical software in devices that happen to be cars? Sure.

> software first agile mentality

I can release a website with a list of known bugs. Do any govt allow release of cars with known bugs?

There's a wide spectrum of possible bugs. I would hazard that every car ever sold was sold with known bugs.

As long as you're reasonably confident that the bugs don't pose a safety issue I don't see the problem.

VW realized that software was important years ago and founded a dedicated software-only company called Cariad to specialize in it. They went ham recruiting traditional software folks for high salaries (in European terms). I know a few people who moved Bay area -> Europe to work for them and they have a couple west coast offices where you'd expect for the people who don't want to move.

It's been an absolute disaster, with billions of dollars spent to produce delayed, buggy software.

Damn that last sentence was a heck of a plot twist.

As someone who worked in a software startup founded by a hardware company, it was very predictable.

Oh no they did write that one piece of software, which was successful until it wasn't.

https://venturebeat.com/offbeat/how-volkswagen-used-software...

The problem with hardware companies is they’re bad at software because the disciplines are so different that what works for one doesn’t work for the other.

The problem with software companies is they’re bad at hardware for the same reason.

User experience companies can be good at both. Maybe not as good at hardware as a hardware company, maybe not as good at software as software companies.

Apple’s the obvious example, but Google, Garmin, heck even Starbucks are also good examples. Start with the user experience, build hardware of software or whatever else is needed. Specializing in a tool has value, but limits you to that tool.

OK, I'll bite. How is selling shitty coffee in large quantities a good example of either software or hardware excellence?

It’s neither. But they’re successful because of the user experience — consistency, the preloaded cards, the mobile ordering with notifications when your order is ready.

They build whatever hardware (in store) or software (mobile / back end) is necessary to give the user experience they want.

But you’re absolutely right — we can lump their mediocre coffee into hardware, or call it “goods” as a third category that you also don’t have to be the best at if you’re a UX company.

Having been in automotive software development and testing for over a decade now, I assure you, it's so very much worse than even that.

The complexity is a symptom of it being a side-project, not evidence that it isn't. As a reminder, today's cars are still vulnerable to remote takeover via malformed songs on the radio because of shitty can-bus practices combined with buffer overflows in those side projects.

Safety-critical firmware is scrutinized fairly well (not because it's not a side project, but because of regulatory constraints combined with the small scope allowing the car manufacturers to treat it as a fungible good), but other software is not, even broken feedback loops interacting with that firmware.

Automotive software is worse than you can possibly imagine. It is literally some of the most broken code I have seen in my entire career and that is the industry norm. Shockingly poor. In fairness, the constraints placed on automotive software production ensure this outcome. There is no room for good practice.

If I could walk everywhere the rest of my life, I would.

Reply on news.ycombinator.com