Agreed.

The predictable retort that there is no need for a public review of source code, "because indecipherable/underhanded code can still be written" is nonsense. If the code is so poorly written and tested that it is possible to be underhanded without the risk of anyone noticing, that code should not be on the road!

We wouldn't be happy if the cars wiring and hydraulic systems were a fragile spaghetti mess that was impossible to inspect, why should we allow it for embedded software?

The submissions to the underhanded C contest don't look very poorly written to me.

> Code that runs a car is the opposite: it is worthless by itself

What about for self-driving/automation features? There is a strong argument that such code especially should be available for scrutiny, but it is far from worthless as a standalone.

Not to mention that as far as the physical portion of the car is concerned, competing manufacturers can simply buy the car and tear it apart.

That said, there's probably a strong argument for protecting the source behind things like integrated entertainment/navigation systems, provided they're sufficiently decoupled from the car's critical systems. A really slick UI is a competitive advantage.

Yeah, but what are you going to gain from looking at the source when you can see the screens and output directly? Is there really that much innovation in entertainment systems that can't be discerned from the UX itself, and which requires deep analysis of the code? The only way that makes sense is if the code itself gets cloned, but that's a minimal development-time savings in an otherwise huge release of software + the car itself.

DMCA in these cases seems to be a protection against third-party aftermarket for upgrades, and protection against remote hacking rather than protection of IP for competitive purposes.

Admittedly you're right; there's little to gain competitively from source access there. However, it wouldn't stop car companies from screaming bloody murder if they were required to disclose the source for those components—let alone the rest of the vehicle.

I imagine it would also create a licensing nightmare since navigation and entertainment components often utilize licensed, closed source, third party software. Much more so than the core functions of a vehicle (e.g. engine, steering, braking).

If anything, affording manufacturers the right to keep non-critical vehicle systems closed source would further the goal of opening up the critical portions.

Also, DMCA as a means of protection against remote hacking is tantamount to security through obscurity—but worse. While public source code access isn't some magic solution to security, it seems likely that it would vastly improve automotive security via allowing security researchers to do their far job more efficiently.

Good point on DMCA as not effective as a form of security through obscurity--the horse is already out of the barn before the DMCA would ever kick in.

The problem with making it public is it would start this process of regulation. Then it gives way for these regulations to be used in such a way that would greatly restrict software creativity and growth.

This is too vague to judge.

Does the AI code in self driving car apply? Or the control software in a drone?

And in the future, ECU may not be a standalone device any more.

Yes. Any code which has a safety responsibility should have it's code publicly available.

You could divide the cars systems up into safety critical and non-safety critical components, like there is no reason why the software running the car's media center needs to publicly available, but there should be a well defined interface between the media center and safety critical code (or no interface at all)

So you want software regulations on how code ought to be done? Forcing the separation of components based on safety... what even warrants a component to fall under these regulations. Such a dangerous slope. Just think of a time when regulation is at its peak and people want to innovate but can't due to law restrictions / regulations. Being trapped by standards that are produced by people who know nothing about software.

Yes but it gives it to competitors as well, which is a problem.

But your competitors can't really steal it, because they are subject to the same rules and have to make their code available too. So any theft of code will be apparent.

Manufactures will probably check each others code to make sure none of their own code has been stolen and file lawsuits if it has.

There's still China you know. They don't play by the rules and copy everything relentlessly.

Why? Competitors are the best placed entities, in terms of both resources and motivation, to perform a review.

Also, do you want officials to have to review and test one hundred different implementations of a safety critical piece of code, or would you prefer an evolution to a single standard shared code base, shared between manufacturers, for which all testing efforts are directed at new patches?

Before cars had software in them, competitors could learn everything by just buying a car, taking it apart, and measuring all the pieces. Yet that was the golden age of the auto industry, with no lack of competition and market growth. So I think it's not a problem for competitors to gain access.