[HN Gopher] Automakers try to scuttle Massachusetts 'right to re...
___________________________________________________________________
Automakers try to scuttle Massachusetts 'right to repair' law
Author : rntn
Score : 190 points
Date : 2023-07-27 12:36 UTC (10 hours ago)
(HTM) web link (www.techdirt.com)
(TXT) w3m dump (www.techdirt.com)
| forgetfreeman wrote:
| Here's a hot take: legislate an airgap between operation control
| and infotainment/convenience horseshit.
| aoweijrti wrote:
| Nice in theory but almost impossible in practice, unless you
| start installing two copies of many things, one for safety-
| critical purposes and one for infotainment purposes.
| JohnFen wrote:
| What's wrong with doing that?
| forgetfreeman wrote:
| I fail to see the problem. Ditch the bullshit or at least
| corral it into a corner where it can't fuck with anything
| vital to vehicle operation and safety. ABS systems (for
| example) worked swimmingly decades before the first net-
| connected infotainment system was theorized.
| groos wrote:
| Tesla already does this. You can reboot the user screen while
| driving the car. Everything works but the only negative thing
| I've noticed is that you get no indication of turn signals
| working (they're flashing).
| Loughla wrote:
| Exactly. The infotainment bullshit should be in zero way
| connected to the actual operation of the vehicle. There is zero
| reason why the laggy, nonsensical software that controls my
| radio should control my engine. Someone correct me if I am
| wrong, please.
| AnimalMuppet wrote:
| No, your radio _has_ to be able to talk to the engine
| controller. How else can you get the engine to backfire in
| time with the beat?
| PeterisP wrote:
| It's not as simple. For example, look at the distance sensors
| used for parking and the data coming from them over the CAN
| bus.
|
| That bus needs to be able to (at least indirectly) reach the
| brakes so that automatic emergency braking can take their
| measurements as inputs. And that bus needs to be able to
| reach the audio system to provide audible feedback to the
| driver when parking, and also mute the radio. Ergo, you have
| a bus that reaches both brakes and radio. Now, you might want
| to prevent the radio firmware from sending data to the brakes
| over that bus, but physically you have to have a connection
| between them, as we don't really want to make many separate
| buses for reasons of complexity, cost and maintenance; moving
| from a separate end-to-end wire for each specific purpose
| towards a shared bus was a great improvement.
| forgetfreeman wrote:
| Parking assist is the very definition of bullshit
| convenience. In this case apparently it's dangerous as
| well?
| 542354234235 wrote:
| >According to the National Highway Traffic Safety
| Administration (NHTSA), _approximately 188,000 passenger
| vehicles were backing in crashes_ reported to the police
| in the United States during 2015...The combination of
| Rear Vision Camera and Rear Parking Assist reduced
| backing crash involvement rates by 42%. When Rear
| Automatic Braking was added to the Rear Vision Camera and
| Rear Parking Assist, vehicles with all three systems had
| backing crash involvement rates that were _78% lower_
| than vehicles with none of the systems.[1]
|
| The data would seem to contradict that statement.
|
| [1] https://www.sciencedirect.com/science/article/abs/pii
| /S00224...
| RoseRose wrote:
| I think "Rear Parking Assist" would be better phrased as
| "Rear Proximity Sensors", as the "Automatic Parking
| Assist" (which is what I thought we were discussing) only
| brings a (likely statistically insignificant) marginal
| risk reduction of 2% and seems to fall under the
| "bullshit convenience" category. I do agree that the
| proximity sensors are themselves huge wins but (if I'm
| understanding correctly) this could be fairly trivially
| conveyed on the dashboard instead of the infotainment
| system.
|
| As I see it, the issue here is that it's in automakers
| interest to tie together the safety improvements (which
| are great and benefit people) with the cost-reduction
| mechanisms consolidating controls and monitors into a
| single screen which seem to conflate operation with
| infotainment and, I would argue, reduce peoples' safety.
|
| This is only tangentially related but different to the
| repair question, so I modified what I said a bit to
| reflect I was going off topic.
| forgetfreeman wrote:
| You misunderstood my intent, I'm saying that introducing
| these systems apparently produces a infosec threat
| significant enough to warrant federal legislation. In
| response to your post however I think we can dispense
| with the notion that folks backing into parked cars,
| light posts, etc, represents anything more than a
| nuisance to whoever owned the property that got backed
| into. Yeah it says "crash" in the writeup but we're not
| talking Michael Bay style 8 lanes of exploding cars here.
| chollida1 wrote:
| We know someone who backed over their child and the child
| died.
|
| I assure you, that was not a nuisance.
| alistairSH wrote:
| Some portion of those incidents were backing over
| pedestrians and children, not just backing into
| stationary objects.
| 542354234235 wrote:
| I don't think it needs to be some Michael Bay crash to be
| significant. Let's say that _all_ these crashes are
| minor, as you state. If repairs ranged from $500 to
| $1,500 evenly, that is about $188 million in property
| damage a year. That's not nothing. I agree that systems
| need to be better designed with infosec in mind.
| forgetfreeman wrote:
| It's not nothing, it's the consequences of people's
| general disinterest in operating a motor vehicle
| effectively. I think it -should- be expensive to be a bad
| driver. Good decision making is learned through poor
| decision making.
| forgetfreeman wrote:
| Removing incentives to actually pay attention to where
| your two ton death machine is in space isn't how one
| introduces safety. What you're proposing is a crutch that
| rewards inattentive behavior. There's no moral to it.
| 542354234235 wrote:
| > I think it -should- be expensive to be a bad driver.
| Good decision making is learned through poor decision
| making.
|
| You want less safety in order to teach some sort of moral
| lesson to people? Thank god we don't design planes that
| way, I guess.
| snarfy wrote:
| > And that bus needs to be able to reach the audio system
| to provide audible feedback to the driver when parking, and
| also mute the radio. Ergo, you have a bus that reaches both
| brakes and radio
|
| A $2 speaker would work just fine. You would still hear it
| over the radio. If your radio is so loud you couldn't hear
| it while parking you have bigger problems. A shared bus
| might be more efficient, but it is not more redundant. I
| would rather spend $2 on redundancy here.
| RealityVoid wrote:
| Current cars usually have gateways that route messages
| around different busses. This would protect you from having
| unwanted messages arriving on secured buses, but pass
| through the wanted messages.
| 83 wrote:
| Seems like that would be trivially managed with a firewall
| (canbus security gateway). Is it purely cost that they
| don't lock down or segment off the canbus? Being able to
| steal a car by talking to the immobilizer through the
| headlights comes to mind.
| JohnFen wrote:
| > Ergo, you have a bus that reaches both brakes and radio.
|
| But do you? Why not have a plain old audio connection that
| goes to the audio system? It doesn't have to be on the CAN.
| sonic45132 wrote:
| Without all that being connected how else would they use the
| built-in lte to send back all of the data about you from the
| car? Car companies cant be missing out on selling customer
| data too.
| sidewndr46 wrote:
| The reason is optimizing for lower cost.
| VectorLock wrote:
| Because people want things like remote start, remote climate
| control, etc. that they can control from phone apps.
| JohnFen wrote:
| I can't be the only one who actively doesn't want any of
| that. Surely there's a market for those who just want a
| car, not a smartphone on wheels.
| forgetfreeman wrote:
| Do they though? I mean if it's there sure people will mess
| with it but I don't recall any public outcry for either
| center dash ADHD factories or keyless anything.
| dsr_ wrote:
| In my experience, people like the following remote
| features:
|
| * Where's my car? Press the button, get a honk.
|
| * Lock the doors. If they're powered, close themi first.
|
| * Unlock the doors. If they're powered, open them
| afterward.
|
| * Warm up the car, it's cold outside.
|
| * Cool down the car, it's hot outside.
|
| So that's five buttons on a remote, maximum. None of them
| require connection to infotainment systems.
| dsr_ wrote:
| If I didn't care about discoverability, I could
| reasonably reduce that to:
|
| * Lock button. Hold it down to get a honk.
|
| * Unlock button. Hold it to get the car started; if the
| interior temperature of the cabin is outside a set range,
| warm or cool it appropriately.
|
| Make one button big and round and smooth and bright, and
| the other one big and square and textured and dark.
| fragmede wrote:
| That's easy enough for the salesman to tell the customer
| when they're looking at the car. Still need a button to
| open the trunk tho.
| axus wrote:
| The car keys should probably contain the master private key , and
| the mechanic could use that to authorize third-party components
| and modifications to the car.
| josephcsible wrote:
| What would people do when they lose their keys? Isn't that a
| common thing?
| VectorLock wrote:
| There is no simple and secure technical reason car makers can't
| do this, they just want to fight it because they make tons of
| money off making fragile cars, charging exorbitant fees at
| their dealers service department and for parts, and they see
| MA's Right to Repair bill as a threat to their revenue stream
| and how much they can extract from customers while providing no
| value back to them.
| COGlory wrote:
| Right to repair os starting to reach a boil. The car companies
| have lost. The combat has changed and they're well on their back
| foot. The sooner they realize this, the less painful it will be
| for them. Legal loopholes and dirty tactics will only get them so
| far now.
| markdeloura wrote:
| Insurance companies should get behind Right to Repair. We've so
| far waited three months and have an $11,0000 price tag to the
| insurance company on a minor collision that bent our car's front
| fascia and broke a sensor -- no frame or metal damage. I would
| have happily repaired on my own if possible just to avoid being
| without the car for so long. If only I could get those parts and
| have a decent service manual.
| ineedtosleep wrote:
| I guess it depends on the state. A friend recently was hit and
| had their car only slightly damaged. They went to insurance car
| shops that insurance recommended, but they all declined to fix
| the car. They ended up getting paid out and fixed it themselves
| since they're already skilled with maintaining vehicles, and
| they pocketed the rest.
| _puk wrote:
| Does this not affect insurance?
|
| We have categories of write off, so if insurance has paid out
| it affects the future value of the car.
|
| This would be a category D [0], which makes a big difference
| on resell.
|
| 0: https://www.rac.co.uk/drive/advice/know-how/what-is-a-
| catego...
| bityard wrote:
| In the US, firstly it is considered unfashionable by many
| to buy a used car altogether ("you're just buying someone
| else's problems!") and secondly, the only thing that can
| reliably affect resale value is if it condemned with a
| "salvage title." Which can mean a few things but usually
| means the car suffered more damage than it is economical to
| fix. But just the fact that a car was in a collision or had
| a claim against it does not automatically affect the car's
| future insurance rates or resale value.
|
| We have a company called CarFax that produces vehicle
| history reports for used cars, but there are many problems
| with it. Starting with the fact that all reports are
| voluntary. I have looked at cars that were clearly in
| floods when you know what to look for and yet the CarFax
| was squeaky clean.
| sokoloff wrote:
| > But just the fact that a car was in a collision or had
| a claim against it does not automatically affect the
| car's ... resale value.
|
| What? Accidents, even after repair, decrease the resale
| value of a car, significantly in the case of a young or
| exotic car, less so for an older, more pedestrian car.
|
| Having been in an accident removes some possible buyers
| from the pool. (Some buyers will not knowingly buy a car
| with damage history.) That necessarily changes the
| balance of supply and demand for that car.
|
| If you had a choice between buying a car that was in a
| crash and repaired versus the otherwise identically
| equipped car that had never been crashed, which would you
| choose? Lots of buyers prefer the latter option, which is
| why they're worth more than the former option.
| bluGill wrote:
| The majority of cars sold are used cars. Yes there are
| some who won't consider a used car, but they are a
| minority (a large minority, but still a minority). The
| average car last 12 years, the typical new car is
| replaced every 3 years with a newer one.
|
| A salvage title is only used when someone intends to
| restore the car, and then it goes back to a normal title
| once restored (or at least that is how my state did it 15
| years ago - each state is different). You get the salvage
| title only to justify paying taxes on the actual value of
| the car (sales tax on a car is for actual value not the
| price you paid, so a salvage title is useful to prove it
| isn't worth what the book says) It will show up on CarFax
| as restored then. (though as you note most such issues
| never get a salvage title as they are not sold)
| compiler-guy wrote:
| Don't know what state or country you are in, but that
| isn't the way a salvage title works in any US state that
| I am aware of.
|
| A car with a salvage title stays branded with "rebuilt"
| or "restored" in all common scenarios. There are ways to
| wash them to unbranded, but most are unethical and
| involve retitling in different states and such, rather
| than simply restoring the car.
|
| Regardless, unless dealing directly with the DMV, most
| people call a branded title a salvage title, or at least
| say something like, "the title isn't clean".
|
| https://en.m.wikipedia.org/wiki/Salvage_title
| Spooky23 wrote:
| Salvage titles are restored wrecks. Back in the day when
| it was easy to get clean titles, people would steal cars
| and "restore" wrecks... or move parts from wrecks into
| stolen cars to launder them.
| vlovich123 wrote:
| Insurance companies (of any kind) are not incentivized to find
| the cheapest service. Anything they pay out is passed on via
| premiums. Indeed, the more expensive service is better because
| a 2% profit on $1000 makes them 10x more profit than 2% profit
| on $100.
|
| There's some competition here in that a marketplace of
| insurance companies can compete on the premiums so there can be
| downward pressure, sometimes. But for things that impact all
| insurance companies like this equally, then insurance companies
| would also be opposed because more expensive repairs = more
| money in their pocket.
|
| That's why you see things like medical insurance not being
| aligned with lowering medical costs.
| unyttigfjelltol wrote:
| The facts in your post are wrong. Insurance companies
| establish rigorous processes to steer repairs to the low cost
| provider and push that provider to make only necessary
| repairs. Policy holders might go along with it and might not,
| same as other insurance scenarios.
| lotsofpulp wrote:
| > That's why you see things like medical insurance not being
| aligned with lowering medical costs
|
| Health insurance companies are lambasted all the time for
| denying coverage for certain procedures or medicines or
| requiring prior authorizations to prove it is medically
| necessary or evidence based treatment.
| monocasa wrote:
| They do both to carefully approach the 20% overhead allowed
| by the ACA. Denying claims wholesale, and allowing the
| claims they do approve to increase in cost year over year
| greater than inflation so that they can make the total pie
| that they take 20% of greater each year.
| lotsofpulp wrote:
| Then why do some of them exceed the minimum medical loss
| ratio by quite a bit? Why did Elevance simply not deny
| more claims so it could get closer to 80% rather than 90%
| and book more net income?
|
| https://www.oliverwyman.com/our-
| expertise/insights/2023/mar/...
|
| > MEDICAL LOSS RATIO TRENDS
|
| >Reported loss ratios are 89.4% for Elevance (fka
| Anthem), 86.0% for CVS Health (Aetna), 83.8% for Cigna,
| and 82.8% for UnitedHealthcare. Loss ratios have been
| impacted by seasonal patterns and the return to more
| stable utilization than seen in 2020.
|
| Seems like an unsubstantiated conspiracy theory.
| cityofdelusion wrote:
| I'm curious as to what make/model is damaged -- I self-repair
| all my cars and have no issues with access to parts and service
| manuals. Ebay is full of suppliers and mechanics operating a
| black market on these things.
| speed_spread wrote:
| Insurance companies will just follow the money like they do in
| (USA) healthcare. Expensive repairs create a world where there
| are two kind of people, those who are insured, and those who
| aren't. A high cost of repair guarantees you _really_ don't
| want to be in the latter group, so you'll pay whatever is asked
| to be in the first part. On their end, the insurance companies
| will use their weight to negotiate much lower prices on parts
| and service, increasing their margins.
| legutierr wrote:
| I'm not sure how this logic applies when having insurance is
| mandatory. If you don't have insurance, you're not driving
| legally.
|
| Are there really people out there who wouldn't otherwise buy
| insurance, but they choose to do so only because the cost of
| repairs is too high?
| sokoloff wrote:
| Having _liability_ insurance is mandatory. Having
| _collision_ insurance is optional (unless your car is
| financed, in which case it is likely required by the terms
| of your financing, but not by law).
|
| I don't carry collision insurance on my daily drivers (the
| newest of which is 9 years old), because it's too expensive
| for the coverage offered.
| AlexandrB wrote:
| I think insurance companies are also salivating at having
| access to detailed driving data so they have more reasons to
| deny claims and raise rates. I'm not sure they want to
| jeopardize that by getting on automakers' bad side.
| sokoloff wrote:
| How will right to repair speed up your particular repair,
| though? If a part is back-ordered, it's still going to be back-
| ordered even with right to repair.
|
| Said differently, what is blocking you from doing the repair
| today? Is it just that the sensor needs coding to the car or
| calibration?
| alistairSH wrote:
| This.
|
| Back in 2013/2014, my Jeep was rear-ended. Some of the body
| panels were back-ordered, so the repair took 2 months longer
| than expected. Even if I was could have done the body repair,
| I couldn't have purchased the parts.
|
| Likewise, a co-worker had his airbags stolen last year and it
| was many months until Acura had replacements available.
| klyrs wrote:
| > Likewise, a co-worker had his airbags stolen last year
| and it was many months until Acura had replacements
| available.
|
| A mystery that resolves itself by the end of the sentence:
| who the hell would steal _airbags_? Clearly, there 's
| demand from people who don't want to wait months for a
| replacement... talk about making a market.
| sokoloff wrote:
| > who the hell would steal airbags?
|
| Someone who didn't want to pay $400-800 per bag to get
| their banged up car back on the road.
|
| Who the hell buys used tires? Who buys used catalytic
| converters? Who puts mismatched fenders on their car?
|
| People who need a car to get to work and don't have a lot
| of money and, in the case of bags and fenders, may
| (wisely) not have collision coverage...
| gottorf wrote:
| I would have assumed that someone who would go out of
| their way to steal somebody else's airbags would also not
| bother with safety inspections or whatever that might
| have kept their broken car from being on the road.
| sokoloff wrote:
| ALPRs with a live querying capability to the registry of
| motor vehicles will now flag cars with expired safety
| inspections around here. It's an easy ticket for the
| police to grab their town some cash and several local
| towns are fairly aggressive about ticketing for expired
| inspections.
|
| I suspect that most people who need airbags are still
| buying them; they're just buying them at the end of a
| chain of fencing stolen bags.
| chongli wrote:
| Wouldn't an insurance company naturally want to avoid the
| additional liability of personal, unlicensed repairs? What if
| someone improperly repairs the brakes on their own car and they
| fail on the road, causing a collision?
| lokar wrote:
| All repairs are unlicensed.
| MichaelZuo wrote:
| The parent was using the term in the context of insurance
| companies or manufacturers authorizing the repair. Not that
| of a legal licensing system.
| chongli wrote:
| Maybe the US is different then, because here in Canada auto
| mechanics are licensed after a ~4 year registered
| apprenticeship.
| NikolaNovak wrote:
| I just learned that recently - I was at a quick oil
| change place and asked them to quickly look at my brakes
| while down there. After some commotion their manager came
| over and explained (In a friendly fashion) they are
| technically a "lube shop" with "lube technicians" and not
| licensed mechanics and cannot do or say anything but
| change my oil and maybe fill up the fluids / change
| wipers. Interesting!
| mwint wrote:
| Likely this has more to do with their professional
| liability insurance than any government regulation,
| directly.
| somerandomqaguy wrote:
| Kinda?
|
| > Trade certification for automotive service technicians
| is compulsory in Nova Scotia, Prince Edward Island, New
| Brunswick, Ontario and Alberta and available, but
| voluntary, in Newfoundland and Labrador, Quebec,
| Manitoba, Saskatchewan, British Columbia, the Yukon, the
| Northwest Territories and Nunavut.
|
| > Automotive service technician (transmission) trade
| certification is compulsory in Ontario.
|
| > Automotive service technician (steering, suspension and
| brakes) trade certification is compulsory in New
| Brunswick and Ontario.
|
| https://www.jobbank.gc.ca/marketreport/requirements/14799
| /ca
| not2b wrote:
| People work on their own cars and have done so for at least a
| hundred years. Using technical means to prevent people from
| doing their own repairs, or from hiring someone of their
| choice to do the repair, is a relatively new thing.
| adrianmonk wrote:
| > _would have happily repaired on my own if possible_
|
| I actually did that once. The claims adjuster was pretty
| surprised at the request, and she confirmed multiple times that
| I really wanted them to pay out _less_ money (parts but no
| labor). Then she was like, "Well, I don't know why you'd want
| to, but it's your decision, so OK."
|
| The reason: someone stole my stereo and, in the process, they
| destroyed several pieces of the dashboard. The insurance didn't
| cover my (aftermarket) stereo, just the dashboard.
|
| I was going to install a replacement stereo myself. I had
| installed the other one (that was stolen), so I already knew
| how to do it, and I knew that stereo installation requires
| removing the same dashboard parts. If I'd let insurance pay a
| shop to do it, I would have needed to have them install the
| parts, then take it home and remove the same parts, install the
| stereo, and then put them back. Buying parts at the dealer is
| less work and takes less time.
| MikeKusold wrote:
| They were probably surprised because the insurance company
| would have paid the fair market rate for the replacement
| (parts & labor based on various quotes), regardless of if a
| professional did the work, if you DIYed it, or even if you
| never decided to repair it.
|
| You likely talked yourself out of additional money.
| jkingsman wrote:
| Yeah this process caught me off guard during a recent
| repair. In my mind, the model was "Insurance company will
| pay what the repairs cost." How it actually works is
| "Insurance company will give you the cash to cover what
| they believe the repairs cost. If it costs more, they'll
| cover the difference. You are free to do anything you want
| with the money."
|
| Walking away with leftover cash in your pocket is a normal
| and above-board part of the process if you can do the
| repair more cheaply/by yourself/don't get it fixed; it's
| not fraud.
| function_seven wrote:
| > _Walking away with leftover cash in your pocket is a
| normal and above-board part of the process if you can do
| the repair more cheaply /by yourself/don't get it fixed;
| it's not fraud. _
|
| A friend had paint damage to his truck caused by a canopy
| (a large EZ-UP) being blown into it repeatedly during a
| storm. He filed a claim and the adjuster determined it
| would be something like $5,000 for a proper repaint.
|
| He asked another friend of ours-who worked in insurance--
| if it was okay to just keep the money and ignore the
| paint damage: "Yeah, you suffered a loss, you were
| compensated for that loss, that's all there is to it.
| It's up to you if you want to repaint, or if you consider
| it diminished value compensation, or whatever. It's your
| money free-and-clear."
|
| It feels wrong somehow, but it really isn't. Just don't
| try to claim the same damage again in the future.
| Spooky23 wrote:
| Yup. I know a body guy, and always get quotes from an
| expensive shop, then he does it for less.
|
| I hit a deer a few years ago and made $5000.
| mwint wrote:
| Did you suffer any increase in premiums? I've never been
| involved in any sort of accident (other than being a
| passenger), so what happens after an accident re.
| premiums, etc. is a Scary Thing that I'd love to
| demystify for myself before I learn by experience.
| teeray wrote:
| > For now, Massachusetts' law is tied up by lobbying and legal
| fisticuffs.
|
| It's depressing that the will of the people that passed this
| ballot measure can get pre-empted like this. Before it passes?
| Sure. But afterward you're just disenfranchising the voters.
| mrguyorama wrote:
| State governments pretty regularly ignore citizen initiatives
| if they don't like it. Our state voted to decriminalize weed
| and our republican governor filibustered it for the remaining 4
| years he was in office and even the democrat governor who
| replaced him took her sweet time.
|
| Right now if you look it up, GOP state governments are working
| hard to kill the ability for citizens to enact initiatives that
| could allow them to implement things they want that the state
| representatives do not want.
| brnaftr361 wrote:
| Direct democracy is a threat to order, the unwashed masses know
| nothing, they're _protecting_ us.
|
| I think the saddest part is there probably isn't an auto
| manufacturer that isn't a participant in the lobbying campaign
| against bills like this. I can't even vote with my wallet in
| this situation.
|
| At this point I'm hoping I'll be able to buy an electric kit
| car that can satisfy my minimal needs in the near future so I
| don't have to deal with modern vehicles and their shithead
| manufacturers.
| burkaman wrote:
| You can vote with your wallet by either not buying a car or
| only buying used cars.
| sidewndr46 wrote:
| BS? I thought at least one Federal agency suggested that
| compliance is in fact a Federal crime.
| 1MachineElf wrote:
| If only it were that simple...
|
| The federal agency is NHTSA. The lawyer there who signed the
| letter about it being a federal crime is Kerry E. Kolodziej.
|
| Kolodziej also works at Mayer Brown, the same law firm that
| fought in court against the Massachusetts law on behalf of
| Alliance for Automotive Innovation.
|
| It is believed the NHTSA letter to automakers was a veiled
| attempt to circumvent the court battle. It fits squarely into
| the _BS_ category, subcategory _Monumental_. Tagged with
| _Regulatory Capture_.
| tetrep wrote:
| Here's a source to support some of the above the above claims
| (including a link to PDF of NHTSA letter):
| https://www.techspot.com/news/99079-biden-administration-
| car...
|
| There's some interesting context missing from the explanation
| too, which is that apparently the feds were consulted years
| ago and they said "it's fine."
|
| The Massachusetts Right to Repair Coalition's response to the
| NHTSA letter:
|
| On behalf of two million voters and thousands of independent
| auto repair shops across Massachusetts, we are outraged by
| the unsolicited, unwarranted, and counterproductive letter
| from NHTSA that conflicts with the Department of Justice's
| statement submitted two years ago in federal court stating
| that there was no federal preemption. NHTSA's letter is
| irresponsible, having been transmitted without any new
| evidence and after the conclusion of the federal trial,
| despite having been asked by the judge to participate in the
| court proceeding and declining. NHTSA's letter fails to
| acknowledge the evidence and testimony presented at the trial
| that demonstrated the viability and security of an open
| access platform. This is yet another delay tactic the
| manufacturers are using to thwart the will of their
| customers, Massachusetts voters who voted 75-25 in favor of
| their right to get their car repaired where they choose. The
| FTC, the Biden Administration, and many members of Congress
| have all come out in support of Right To Repair.
| ceejayoz wrote:
| I was not aware of this. Citation:
| https://www.thedrive.com/news/feds-tell-automakers-to-ignore...
| RealityVoid wrote:
| Current cybersecurity standards enforced in the automotive
| industry will probably completely kill the possibility of after-
| market car parts and the usage of used parts in cars.
|
| I say this as someone working in this field that has asked a
| couple of people doing work in this exact direction. I point
| blank asked them if this will happen, and they just shrugged
| their shoulders and said... yeah, kinda'.
| technofiend wrote:
| From the article: "federal regulators claim that malevolent
| third parties could "utilize such open access to remotely
| command vehicles to operate dangerously, including attacking
| multiple vehicles concurrently."
|
| Which really means auto makers built a terribly insecure system
| and hope to hide the fact behind security as obscurity? If so,
| that's the real problem. The vulnerabilities described should
| not be there in the first place.
| genter wrote:
| > Which really means auto makers built a terribly insecure
| system and hope to hide the fact behind security as
| obscurity?
|
| Yes
|
| (I've reverse engineered the security system on an ABS
| controller for the top selling vehicle of a major auto
| manufacturer. It is atrocious. I'm pretty confident the whole
| reason it exists is so that they can claim they have one to
| use the DMCA to stop third party tools from interacting with
| it.)
| RealityVoid wrote:
| It's an open secret in the industry that the CAN bus is not
| authenticated. If you connect, you can read the data on the
| bus and inject the data on bus.
|
| But, that does require physical access to the car and hooking
| to the wires. Nobody complains that if you hook to the buses
| on a PC you can own it.
|
| Now they have this security concept where every ECU on the
| car will have their own private key in their own secure
| enclave. You need that key to put authenticated data on bus
| and it can only be updated by the OEM's.
|
| The authenticated bus infra will probably not protect against
| remote attacks ( since if you own the ECU SW you have the
| cert and you will still be able to publish signed messages)
| but will kill ability to change HW.
|
| I really would not like to kill our ability to fix our
| vehicles but I feel this is the thing that is going to
| happen.
| hooverd wrote:
| I hate computers. Seems like lately they're only used to
| make our lives worse.
| gottorf wrote:
| Since the Industrial Revolution, and only made worse with
| the Information Revolution, technology has advanced much
| quicker than the ability for laws and customs to adapt.
| bluGill wrote:
| It sometimes seems that way, but when you look at how
| people lived without computers things were worse. Cars in
| the 1930s were not fuel efficient, polluted a lot, and
| you have to do things like file the points every couple
| months. I remember when you called buildings not people -
| the phone was attached to the wall, and what just a voice
| device, it didn't hold Wikipedia or current maps to
| everywhere. However we forget how bad the past really
| want.
| JohnFen wrote:
| > when you look at how people lived without computers
| things were worse
|
| In some ways. In other ways, things are worse now.
| harambae wrote:
| > Now they have this security concept where every ECU on
| the car will have their own private key
|
| Not just a concept, on vehicles you buy today (from, for
| example, Ford and VW)
|
| https://cdn.vector.com/cms/content/products/VectorCAST/Even
| t...
| mycall wrote:
| The devices on CAN bus can use embedded certificates to
| securely communicate with each other. Basically VPN over
| CAN.
| tkfu wrote:
| It's not about security by obscurity. A better analogy would
| be the fight over "tivoization". In safety-critical and
| highly-regulated systems like automotive and health care,
| there's a meaningful regulatory interest in ensuring that the
| devices as sold and authorized to be on the road (or in
| patients' hospital rooms) don't get modified in dangerous
| ways. That means that the software and firmware running on
| each of the dozens of ECUs in a vehicle is part of the
| (regulated) functional safety spec of the system. There are
| real, meaningful technical challenges to overcome if you want
| to meet both the goal of ensuring that dangerous and
| malicious software can't run in safety-critical domains, and
| the goal of allowing users to modify their vehicles as they
| see fit.
|
| I'm speaking as one of the authors of the Uptane standard for
| secure software updates in vehicles, and as a life-long
| proponent of user freedom and open access to the computers we
| buy. There are possible solutions here, but they are not
| easy.
| rolph wrote:
| dont include dangerous features that have nothing to do
| with the function of the vehicle. telemetrics, and remote
| manipulation of software during drive time are not required
| for safe operation.
| the_lego wrote:
| > In safety-critical and highly-regulated systems like
| automotive and health care, there's a meaningful regulatory
| interest in ensuring that the devices as sold and
| authorized to be on the road (or in patients' hospital
| rooms) don't get modified in dangerous ways.
|
| On the other hand, a Minority Report future where "your"
| car answers to a different master, or you don't have the
| right or ability to control your own medical implants and
| prosthetics, is terrifying. Given that we've lived for
| almost a century in a world where cars can be modified in
| unlicensed ways, I'll go with the devil we know.
| lifeisstillgood wrote:
| Could you expand, or point to a good primer on the issues?
|
| I love "it's a complicated trade off" - it's way more
| interesting than whatever slogans end up defining "sides"
| in a debate
| bluGill wrote:
| Whenever I dig into this I discover that what people
| complaining really want to do is modify their cars so it
| no longer meets emissions standards (you can get more
| power and/or better fuel mileage by doing this). Nobody
| is replacing ECUs with one of their own design that
| otherwise meets emissions. Sensors and parts are easy to
| replace (sometimes at high cost), and mostly radially
| available. The OEMs already tell mechanics what all the
| diagnostics codes mean.
|
| sure most of us reading this have the skills to write new
| code for their ECU, but realistically almost none of us
| would do that anyway unless we want to make a trade off
| that effects emissions.
| BenjiWiebe wrote:
| OEMs only tell _authorized_ mechanics what the codes
| mean. Most cars have the basic standardized OBD-II codes,
| and an additional much-more-useful set of codes
| /diagnostics that are proprietary.
| bluGill wrote:
| They tell the third party scan tool manufactures as well.
| (for a "reasonable" price - where reasonable can be 6
| figures) I used to work on those scan tools, and so I saw
| the data (I probably shouldn't talk about it - lets just
| say were reversed engineered their tools often).
|
| Many mechanics will read and tell you the codes for free.
| Auto part stores will as well.
| alistairSH wrote:
| It's not just that. For example, BMW has paired the main
| battery to the ECU in their cars for years. So a dead
| battery requires a trip to an authorized repair shop (or
| buying an OBD scan tool) to have a new battery operate
| correctly. This is relatively easy & safe ~4 bolt job (2
| tether the battery, then 1 for each terminal) in many
| other cars. Technically, it can be self-repaired, but
| it's extra steps and cost _because reasons._
| tpxl wrote:
| > the devices as sold and authorized to be on the road (or
| in patients' hospital rooms) don't get modified in
| dangerous ways
|
| What use is preventing dangerous modifications, when
| unmodified devices contain critical safety bugs, and will
| continue to contain them. The ongoing effort by automakers
| is increasing the amount of safety bugs by connecting
| everything to the internet without proper security
| practices.
|
| The only reason to require signed firmware/hardware as it
| stands is to decrease the repairability, harm the second
| hand market, and increase profits.
| MSFT_Edging wrote:
| There should really be some kind of airgap between internet
| connected entertainment systems and "mission-critical" aspects
| such as brake/drive by wire, steering input, etc.
|
| It seems incredibly short sighted to give your radio access to
| drive the car into a median.
| 1970-01-01 wrote:
| It's an ongoing battle. Giants such as the FTC are able and
| willing to fight these battles. Other large orgs such as SEMA
| are also pushing back, for both the right to repair and the
| right to modify. Additionally, OEMs don't want us to realize
| how they are putting themselves on top of a slippery slope. If
| we look at the NACS example, when one or two break away from a
| 'gentleman's alliance' it quickly creates a domino effect.
|
| https://www.ftc.gov/system/files/documents/reports/nixing-fi...
|
| https://www.sema.org/news-media/enews/2023/28/right-repair-a...
| josephcsible wrote:
| If I ever have to choose between security and freedom, I'd pick
| freedom all the way, every time. But usually this is a false
| dichotomy and you can in fact have both, despite claims to the
| contrary.
| harambae wrote:
| I also work in the industry and tend to agree. Right now if you
| get an official replacement ECU on a secured CAN network the
| device comes from the OEM already set up with the matching
| SecOC (AES-128) key that the OEM recorded in their backend
| database at time of manufacturing.
|
| But how would this work with a 3rd party ECU?
| rolph wrote:
| like this; an ECU is an ECU. match unit to make and model.
| gap the ECU from remote modifications. an ECU doesnt require
| keys, they are not part of the required properties of an ECU.
| RealityVoid wrote:
| I suspect that auto makers are fully aware of this and are
| salivating at the idea of extra income with upgrade and
| repair fees.
|
| So far this has eluded public consciousness, but I expect it
| will hit the users hard at some point in the near future.
| VectorLock wrote:
| "Authorized parts" and "Authorized repair centers only"
| would be allow them to extract massive profits while
| providing no consumer benefit. That then incentivizes them
| to create even more fragile, unreliable vehicles.
| bityard wrote:
| There are quite a few parts on modern cars already that you
| cannot just replace on your own car with either a new or used
| replacement because before they will work, they require a
| "relearning" procedure that only the dealership computers can
| initiate and those computers have to be online, connected to
| the automaker's mothership when they do it.
|
| So basically DRM on car repair/parts is already a thing.
| not2b wrote:
| We (in the US) need a national right to repair law. There are too
| many legal tactics companies can use to defeat state laws.
___________________________________________________________________
(page generated 2023-07-27 23:02 UTC)