One of the biggest concerns is when you start trying to see secure APIs and such, you quickly realize that what you did 5 years ago isn’t nearly good enough today.
And most cars stay on the road for 14-some years.
I bet I could straight brute force any consumer grade security measure from like 2009 with the phone I’m typing on right now.
How can we expect auto manufacturers to secure their systems for 15 years?
While over-the-air updates are becoming a thing, it’s not going to be financially attractive for auto makers to continue providing security updates for 15 year old cars.
I don’t know what the solution it, but it’s going to be challenging.
I mean, based on the requirements, we’re going to end up with essentially little embedded servers in all ours cars, running some sort of tweaked version of Linux with “drivers” for various parts of the car’s systems. Probably tapping into the same things that the OBD port uses.
Hopefully, it’ll be something like a Raspberry Pi that can be both easily upgraded and hopefully replaced during warranty service when the inevitable vulnerabilities are discovered.
Part of the solution may be the GSA, Government Services Administration. When I was still working in tech, we had to guarantee 5 years of spare parts or replacements for all government contracts. GSA could start requiring software updates for up to 15 years. This would then become the norm and trickle out to consumers.
Sounds good in theory. But the switchover to electric is almost certainly going to have casualties. Not every company will survive, which means a lot of cars will have no support structure.
Maybe have car companies put the source code in escrow and have it released to public domain if the company goes belly up?
Having the software in my car maintained as OS isn’t a great feeling. But it beats not having it maintained at all.
This is especially true as the break even point concerning EV vs ICE carbon footprints is at 89,000 miles. Many of us consider EVs for the environmental impact, so when you add into the lifetime of the product, the need for upgrades to keep them secure, it becomes a serious issue.
Looking at your link, the 89,000 number comes from assuming that you fuel your EV using 100% coal-fired generation. Who does that?
Using the “U.S. average energy mix,” the number is 14,800 miles. Or at least it was back in 2021 when this article was written. Given that the grid keeps getting cleaner every year, I assume that number has continued to improve.
And of course, that’s just the average. There does seem to be some correlation between states that generate clean energy, and states that have lots of EVs.
One of the biggest concerns is when you start trying to see secure APIs and such, you quickly realize that what you did 5 years ago isn’t nearly good enough today.
And most cars stay on the road for 14-some years.
I bet I could straight brute force any consumer grade security measure from like 2009 with the phone I’m typing on right now.
How can we expect auto manufacturers to secure their systems for 15 years?
While over-the-air updates are becoming a thing, it’s not going to be financially attractive for auto makers to continue providing security updates for 15 year old cars.
I don’t know what the solution it, but it’s going to be challenging.
I mean, based on the requirements, we’re going to end up with essentially little embedded servers in all ours cars, running some sort of tweaked version of Linux with “drivers” for various parts of the car’s systems. Probably tapping into the same things that the OBD port uses.
Hopefully, it’ll be something like a Raspberry Pi that can be both easily upgraded and hopefully replaced during warranty service when the inevitable vulnerabilities are discovered.
Part of the solution may be the GSA, Government Services Administration. When I was still working in tech, we had to guarantee 5 years of spare parts or replacements for all government contracts. GSA could start requiring software updates for up to 15 years. This would then become the norm and trickle out to consumers.
Sounds good in theory. But the switchover to electric is almost certainly going to have casualties. Not every company will survive, which means a lot of cars will have no support structure.
Maybe have car companies put the source code in escrow and have it released to public domain if the company goes belly up?
Having the software in my car maintained as OS isn’t a great feeling. But it beats not having it maintained at all.
This is especially true as the break even point concerning EV vs ICE carbon footprints is at 89,000 miles. Many of us consider EVs for the environmental impact, so when you add into the lifetime of the product, the need for upgrades to keep them secure, it becomes a serious issue.
https://www.reuters.com/business/autos-transportation/lifetime-carbon-emissions-electric-vehicles-vs-gasoline-cars-2021-06-29/
Looking at your link, the 89,000 number comes from assuming that you fuel your EV using 100% coal-fired generation. Who does that?
Using the “U.S. average energy mix,” the number is 14,800 miles. Or at least it was back in 2021 when this article was written. Given that the grid keeps getting cleaner every year, I assume that number has continued to improve.
And of course, that’s just the average. There does seem to be some correlation between states that generate clean energy, and states that have lots of EVs.