<story><title>BMW are complying with the GPL</title><url>https://shkspr.mobi/blog/2016/03/bmw-are-complying-with-the-gpl/</url></story><parent_chain><item><author>suzeanne</author><text>Well, the first time a hacker vehicle exploit results in one or more deaths of the driver and&amp;#x2F;or passengers of one of these Internet-connected vehicles, it&amp;#x27;s going to be all over the news. Right around then... and when the lawsuits hit, some execs&amp;#x2F;directors are going to realize that such effort is far less costly than the PR disasters that can unfold when corners are cut.&lt;p&gt;I mean, obviously some people at Volvo thought that actual emissions compliance was far too costly to bother with --and that didn&amp;#x27;t even result in a vehicle accident or personal injury. Certainly their bottom line has had a major impact as a result. The potential for PR disaster with Internet-connected vehicles is certainly much more concerning.&lt;p&gt;The inevitability of some such future tragedy and resulting media-fueled PR disaster for one or more vehicle manufactures is a certainty. It&amp;#x27;s only a matter of when and which vehicle manufacturer(s) will be liable. When that happens, I’m certain that such sizable companies can figure out how to streamline the approval process with whatever regulatory bodies might be involved, or they’ll just learn to live with the pain… for being for less than the much greater pain of a PR disaster.</text></item><item><author>a3n</author><text>Total guess: as a regulated company, they may have to get approval for their code, which would include validated versions of 3rd party code. If they have to go through that with any new version of 3rd party code, they may not want to make that effort.</text></item><item><author>suzeanne</author><text>Interesting: BMW did share the OSS they used, and in the process they also revealed lots of outdated packages in use. This of course leads me to wonder: Vulnerabilities?&lt;p&gt;It is after all an Internet-connected vehicle.&lt;p&gt;Despite the article author&amp;#x27;s recognition given for BMW&amp;#x27;s OSS compliance, I am dismayed to see yet another example of likely inconsideration given toward implementation of security in the engineering of an Internet-connected vehicle.&lt;p&gt;This sort of negligence is eventually going to result in some rather ugly outcome.</text></item></parent_chain><comment><author>slgeorge</author><text>&amp;gt; Well, the first time a hacker vehicle exploit results in one or more deaths of the driver and&amp;#x2F;or passengers of one of these Internet-connected vehicles&lt;p&gt;It&amp;#x27;s the infotainment system according to one of the original blog posts. And in fairness the previous post was all about the updates they were providing - albeit unencrypted.</text></comment>
<story><title>BMW are complying with the GPL</title><url>https://shkspr.mobi/blog/2016/03/bmw-are-complying-with-the-gpl/</url></story><parent_chain><item><author>suzeanne</author><text>Well, the first time a hacker vehicle exploit results in one or more deaths of the driver and&amp;#x2F;or passengers of one of these Internet-connected vehicles, it&amp;#x27;s going to be all over the news. Right around then... and when the lawsuits hit, some execs&amp;#x2F;directors are going to realize that such effort is far less costly than the PR disasters that can unfold when corners are cut.&lt;p&gt;I mean, obviously some people at Volvo thought that actual emissions compliance was far too costly to bother with --and that didn&amp;#x27;t even result in a vehicle accident or personal injury. Certainly their bottom line has had a major impact as a result. The potential for PR disaster with Internet-connected vehicles is certainly much more concerning.&lt;p&gt;The inevitability of some such future tragedy and resulting media-fueled PR disaster for one or more vehicle manufactures is a certainty. It&amp;#x27;s only a matter of when and which vehicle manufacturer(s) will be liable. When that happens, I’m certain that such sizable companies can figure out how to streamline the approval process with whatever regulatory bodies might be involved, or they’ll just learn to live with the pain… for being for less than the much greater pain of a PR disaster.</text></item><item><author>a3n</author><text>Total guess: as a regulated company, they may have to get approval for their code, which would include validated versions of 3rd party code. If they have to go through that with any new version of 3rd party code, they may not want to make that effort.</text></item><item><author>suzeanne</author><text>Interesting: BMW did share the OSS they used, and in the process they also revealed lots of outdated packages in use. This of course leads me to wonder: Vulnerabilities?&lt;p&gt;It is after all an Internet-connected vehicle.&lt;p&gt;Despite the article author&amp;#x27;s recognition given for BMW&amp;#x27;s OSS compliance, I am dismayed to see yet another example of likely inconsideration given toward implementation of security in the engineering of an Internet-connected vehicle.&lt;p&gt;This sort of negligence is eventually going to result in some rather ugly outcome.</text></item></parent_chain><comment><author>catnaroek</author><text>You&amp;#x27;re confusing Volvo with Volkswagen.</text></comment>