I've personally sworn off any more responsible disclosures to companies not paying at least $1,000/hr(USD) in rewards or without clearly good intentions. I am not bending and very backwards to find it either. Any shenanigans is instant disclosure and shenanigans exposure.

I'm about to be homeless and know of exploits currently working at 20billion dollar companies. They can't even bother responding to emails...

There's a point where one has to focus on needs. Morality I want, food I need.

Yes, but jail food isn't all that it's cracked up to be and if you are able to get that kind of work done then your choice isn't $1000/hour for undisclosed vulnerabilities or starving, the viable alternative is just to get a job.

With those skills you are 10x as employable as most people that are currently jobless. At least.

I should mention that I don't intend to release or sell anything harmful. I just recently experienced this issue and I came out on the right side(?). I can see someone coming out the other side too, too easily. My intent rather is to stop working for free. I will notice it, note it, eliminate my personal exposure, and ignore it. I would say that puts me somewhere between white and black.

It's not easy (for me) to find employment. My last company was in automotive advertising(bankrupt) and I am aware of quite a few more problems than what you see in this disclosure. Though the listed brands are outside of my knowledge.

https://news.ycombinator.com/newsguidelines.html

The automotive industry has simply been slow to adapt. Manufacturers were almost universally founded in an era when mechanical systems dominated and that's how they want to treat everything. There's been a painful and ongoing learning process for them to realize that software and computerized systems are fundamentally different from the mechanical systems they understand well.

On the inside, doing things securely takes a lot of deliberate and careful work. COTS stuff is rarely designed for high security systems. I've sat in more than one pen test where we found a wireless interface unintentionally added by some dev board that was selected for a completely different purpose. I've also seen cases where the security team/software teams were hired/onboarded after the vehicle design was essentially finalized with little consideration for their requirements.

And so have the legislators and regulators who should have been preventing the automotive industry from selling products where it increasingly seems plausible or even likely that a vulnerability will be found and exploited at scale by someone really trying to do harm and the consequences will be catastrophic.

The danger has been obvious to many who work in tech for a long time and has been publicly demonstrated often enough against enough different types of vehicles that the threat should be like a giant billboard that is repeated every 100m along every road in the world by now. Someone in power needs to realise that even the kind of intense scrutiny and safety culture that we see in for example aviation or some medical fields or nuclear power stations doesn't scratch the surface of what we need for an industry that sells around 100,000,000 new vehicles every year.

The auto industry is infamous for treating the human cost of its failures as a mere financial cost of doing business and operating accordingly. It simply can't be trusted to "adapt". It must be forced through unprecedented levels of oversight, regulation and sanctions for businesses, executives and investors who don't act responsibly.

That is a huge understatement, as they mostly (majorly?) employ electrical/mechanical engineers who end up writing code for the ECU's. Cloud services are mostly an afterthought in design. In my experience, regulation isn't the main problem.

I imagine my odds of being an accident in which 25 years of crash safety advancements help are higher than being hacked.

(and for the inevitable flood of "But the A pillars are bigger" comments, if you're safety conscious you can still get cars with reasonably sized A pillars. A few years ago Honda specifically called out smaller, further recessed, A pillars for visibility in the Accord redesign)

The best way to avoid crashes is to drive less, which is what I'm also doing and why I expect this car to last the rest of my life (and probably well beyond, the way I'm maintaining it). It's my daily driver because that's what I would be driving if I were to drive on any given day but I'm actually quite surprised to find out that I spent more last year on insurance than on fuel.

Automatic emergency braking is probably great if all you do is highway traffic and stop-and-go but it really sucks that you can't disable it and that it isn't able to distinguish between safe and unsafe to a degree that it will turn a safe situation into an unsafe one all by itself. At that point in time a safety feature becomes a risk in itself. Possibly the statistics are still in favor of the solution but I'd rather take my chances.

It's just pretty well established that in the last 25 years we've made huge strides is vehicle safety.

People routinely walk away from accidents where they would die in a 25 year old car because of those advancements.

The difference in survivability is not small: https://crashstats.nhtsa.dot.gov/Api/Public/ViewPublication/...

If you extend the time range to 25 years I might agree, but let's say we start at year 2000. I fail to see those "huge strides in vehicle safety". Perhaps what you mean is that certain "upper tier" features made their way into basic equipment. That no doubt has positive impact on an average driver.

However, at least for me, any time I bought/rented an old car it was always a top spec version, so as mentioned. I don't see those huge strides.

Back to the topic at hand, are you claiming that all of the safety improvements added to the cars over the past 20 years didn't make a massive positive impact on passenger safety during collisions? Arent't there agencies worldwide that issue safety ratings after performing variety of tests and studies (that are way more rigorous and quantitative than a one-off anecdote), and they show massive safety improvements over time for all cars in general? Or are you trying to claim that those agencies can't be trusted, and that their tests are not valid?

I am not trying to be combative about it. I am just genuinely trying to figure out what point you were trying to make with this anecdote, but all I have right now is pure guesses.

A good 10-20 year old car may have as good crash rating as many modern cars. top or average modern cars may be better than top or average 10 year old cars. Stats are interesting thing. But then there's the average driver assistance vs average UI vs average visibility vs average handling of these cars.

Bottom line, I don't feel less safe but I do feel differently safe, in my old Subaru and new Honda.

What percentage of crashes can be attributed to that? Let's make it simpler, how many crashes per year as a raw number happen due to those reasons you listed?

Because out of all things I would be worried about when it comes to car safety, this is the one that is least concerning to me. Especially since for most modern cars that have such a thing as "software updates" in the first place, they have the driving subsystem and infotainment subsystem entirely detached (yes, even on Teslas). Very easy to confirm yourself by force rebooting the infotainment center and seeing that the car still drives just fine.

In summary, the infotainment system and the drivetrain definitely speak to each other and unless a secure architecture comes along, I would not discount the possibility of unintended interactions due to bugs. In fact, most famous car hacks start from the infotainment system and make their way into the drivetrain.

2. I don't have those numbers, in fact point of my post I'd that I don't know how we get those numbers. When I'm a passenger I'm terrified how distracted people can be by poor UI. I wish we had more hard data. Some studies are slowly emerging.

Why do I compare an old "upper class car" with a modern "lowest tier"? Isn't this unfair? No, because that is usually the choice people have. If they can afford just the cheapest of new cars, there is likely a much better one that is not new available for the same price or a lot cheaper.

Case in point: I've restored a Daihatsu Trevis, a small Japanese budget car, and after working on it and bringing it back up to the standard required to pass a salvage title inspection (which is a higher standard than the original one where I live, you have to book an inspection for the vehicle that takes several hours and that will have cross frame measurements and all kinds of assessments to make sure that the vehicle is safe) I decided that this is not a car that is suitable for many kilometers of highway driving. A crash in that car that would be survivable in even the cheapest Golf or Skoda would be lethal in that little car. So I ended up passing it on to people that only drive in the city and got an elderly Golf instead.

And a Golf was definitely not the high end of safety at that time, but it was tons better than the much more modern Trevis.

That car was often a butt of many jokes as people thought its chassis was made off "recycled paper" (in fact it was one of the first composite chassis cars). It was called a plastic-soap-box, but it was so simple to repair one needed a push bike set of tools to fix anything (until once a suspension strut in a rear wheel failed). Then all it took to be able to get back home slowly was to wrap it with some steel wire... Fun little car. Unfortunately it was scrapped against my will when I was abroad (my parents weren't happy I drove it). Today many people consider it a classic and it has quite a following.

We are monsters.

https://www.epa.gov/clean-air-act-overview/benefits-and-cost...

Like it or not, old cars spew highly toxic crap out their exhaust.

I've gritted my teeth every time somebody on HN has referred to their computer as their "daily driver", but I will remain silent no more: You, sir, are the daily driver of your automobile, and NOT vice versa.

However, I'll allow that to connect any new auto you purchase to your computer, you might need to download new drivers.

I'd drive either of them to any spot in the world. I'd carry tools and spares, but I'd still drive them there.