Please don't shit on Tesla for being the first car company to actually fix bugs. I've worked in automotive infosec, and it SUUCKS. Before Tesla, security issues were dealt with by layers threatening to sue the shit out of anyone who publishes anything. What Tesla did moved the industry forward by decades. I never worked at Tesla, but were I was at, we were all super grateful that they finally set the precedent to take security seriously.

Instead of relying on a company to properly secure their ridiculously over-electronic, over-networked, software-based vehicles, I'd rather just keep driving an older vehicle which just doesn't have any of that in the first place. I have no need for any of that, it doesn't add any value for me.

I honestly don't know what I'm going to do in the future, there's no chance I'm ever going to buy a modern "car", it's going to get tougher and tougher to keep a real vehicle running after enough decades have passed. Of course a non-modern car is infinitely easier for the average individual person to maintain and keep running so I'll be able to keep going for a long time.

Or, maybe, keep your paranoia in check?

How is this paranoia? The ratcheting up of software sophistication does not necessarily add value to the average buyer. What it does do is add cost to repairs for both complex systems/parts and labor. This added complexity and cost make it prohibitive for the average owner to fix or even diagnose problems as the auto industry evolves. This isn't about being paranoid its about being economically conscious of the cost imposed by sophistication.

Well, that and going into the dealer for a simple software recall is really bad for the consumer. I've had it happen with other cars and its just not a good experience. Add that the dealer always has an upsell ready and its even worse.

Exactly this. If they would mail me a USB stick with the update so I could do it myself I'd happily do that, but driving 20-30 minutes to the dealer, waiting for the update, and then driving back home is an enormous waste of time.

Dodge/Chrysler/Ram did that a few years ago when some researchers showed how they could take over a Jeep Grand Cherokee via the 4G connection in the entertainment center, and apply brakes and gas. I got a USB stick in the mail, with instructions on how to use it.

Though how sure were you that it was Chrysler that sent you that USB stick? Not that I don’t think it was legit but is that really more secure than an encrypted OTA update?

> Though how sure were you that it was Chrysler that sent you that USB stick?

For the same reason you never get malware USB sticks in the mail to stick into your computer. It costs money.

How much of this is due to the nature of software being changed so often? We do this very thing with hardware recalls on our vehicles, but my hunch is we tolerate it because it happens so rarely and people more easily and intuitively understand how hardware can cause a bad day.

I'd be curious on the HN perspective. Are we less willing to accept this from software because it's taken as a given that when "it's just software" changes are easy? Does it imply that the software process (particularly requirements and testing) are not as robust as with hardware processes, leading to more frequent updates? Does it imply we are overly reliant on software to mitigate hardware issues because "it's easier"? (I'm thinking, in part, of the 737-Max issue for the last one).

I expect them to make the case to the relevant people instead that it's a bad idea, and resist, so when the lawsuits get filed they can pat themselves on the back that they aren't part of it, because their cars weren't updateable over the air and thus aren't part of it.

Unfortunately, "the lawsuits get filed" is comfortably beyond the planning horizon of any entity out there right now, even though we're talking about lawsuits with the reasonable chance of driving the affected companies right out of business.