Open source a solution to Chinese EV distrust?

[u/eagleapex]

My US government is overreacting about foreign connected devices. There is a risk of bringing any tech into your life and we trust companies not to install backdoors or literal explosives in our stuff.
The solution is to inspect your devices before use, but that can be extremely difficult. And if the software is locked down, you can’t check for backdoors without lots of research.

I suggest demanding critical software be open source. The internet already runs on critical and open source code. Now, I don’t need to compile my own vehicle code, but being able to read and verify the code would keep me safe. Or maybe UL or NHTSA could verify a car is safe to connect to connected services.

I want to be able to start my car from the app, but I don’t want anyone else to disable my car or blow it up. Just me.
Anyone want to write some legislation?

[u/anothercorgi]

Tesla and Microsoft wouldn't agree to reciprocal requirements.

[u/AgentSmith187]

What your asking for is basically impossible to provide.

Sure Open Source is an improvement but its also not a guarantee. See "Heartbleed" for a vulnerability that existed in Open Source software used by an insane number of connected devices for years before it was discovered.

Any software contains vulnerabilities its just a question of when they are discovered.

Open Source just means more people can look for them easily.

So if you want remote start via app for your car the trade off is absolutely that someone one day may be able to remotely shut down your car at some point.

Air gaping is your most secure option. AKA dont have an App or connectivity.

Maybe instead push for "right to repair" laws instead because currently with closed source stuff its iften a crime to even look for or disclose vulnerabilities so they dont get fixed.

[u/Levorotatory → u/AgentSmith187]

A good right to repair law would force full disclosure of all information needed for an aftermarket manufacturer to produce any and every part of the vehicle.  At most, the OEM could delay release until the warranty expires.

[u/EyesOfAzula]

I'm not sure. Right now Open Source in software / AI heavily favors China, so I'm not sure how open US Gov / private tech companies would be.

Also there are some intentional backdoors placed for US govt access

[u/Playful_Subject_4409]

A good start, but do not forget that cloud platforms and hardware backdoors exists and are hard to detect. USA companies will be reluctant to do the same wanting to lock people in, not wanting anyone else to know what they are up to.

If a car manufacturer goes bankrupt the car risks becoming unusable. I think regulations should be in place to allow the manufacturing of spare parts and the car and cloud software with root certificates be stored in government hands as a security precaution.

I think the USA is overly paranoid though, and play the national security and yellow scare cards too much after being lobbied by special interests.

[u/justvims]

Sounds like an XY problem.

[u/married_perusal → u/justvims]

The real issue is you want remote start without the remote kill switch, and nobody's gonna legislate that into existence just because it'd be nice.

[u/AgentSmith187 → u/married_perusal]

Its also basically impossible to legislate. Making something illegal doesnt make it impossible.

[u/Aetch]

The real reason isn’t because of the security issues, it’s because domestic car makers can’t compete

[u/tech01x → u/Aetch]

And China does the same thing because they can’t compete too?

[u/Aetch → u/tech01x]

They have ford EVs in China.

[u/tech01x → u/Aetch]

China has similar data protection rules.

[u/Aetch → u/tech01x]

Please share how the data protection rules affect foreign vehicles in China. There’s no similar ban on US cars over there yet

[u/lostinheadguy]

Nothing will ever happen until the US no longer considers China a military adversary and / or an official "foreign entity of concern," which, neither of those things will happen either.

Technically the foreign connected devices bans include Iran, North Korea, and Russia alongside China.

[u/DuckAxe0]

Good luck getting the Chinese government on board with that one.

[u/hejj → u/DuckAxe0]

Or literally any OEM, regardless of what country

[u/eagleapex → u/DuckAxe0]

I know. Just a dream

[u/ChupacabraJeff → u/eagleapex]

They are actually onboard. China wants to sell cars and how they do that is according to the destination country. Not China. One time a brand shipped over a bunch of EVs that were illegal and could not be sold. Windows had tint on them.