[pavel_lishin]

I don't think that Jeep would have sent out a message saying that one of the changes would brick your machine.

It seems that the ability to trivially roll back any update would be a better choice, at least for this. (But I'm sure there are downstream effects I haven't thought about if that were implemented.)

[conductr]

How do you roll back a fatal car accident caused by the faulty update?

Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens. Allowing them time, gives them and Jeep the ability to slow roll the update so they can halt it if initial feedback is negative.

I say this as a Mac user who does not allow auto updates for MacOS. I wait a week or so until the chatter validates it as non-breaking. They pushed an OS update several years ago that broke a few things I rely on. So I don’t trust them now, but these things just happen on OS’s with third party software. I expect it. But, I also don’t want to be forced to deal with the headaches immediately. I’d rather let the third parties run updates and advise how to deal, before I have to dive into fixing things. With car firmware, there’s really no excuse for this except poor engineering / processes.

[tremon]

Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens

FTFA:

> The buggy update doesn't appear to brick the car immediately. Instead, the failure appears to occur while driving — a far more serious problem

And from the GP upthread:

> There is no way to tell if you received the bad update.

> There is no way to tell if you received the 'fix' either.

[conductr]

Good points, I did miss those. However, if I had this vehicle and I was reading this article today - and had the ability I'm asking for - I would just keep my current version running until they figure this mess out. It's the advantage of letting other people run the updates first, you get to hear about issues before you experience them.

[deepsun]

> user who does not allow auto updates for MacOS.

Many security compliances require auto-updates to be on. It's thought of to be a lesser evil, because many (most) users never update their OS/browsers, which is worse.

[NoPicklez]

Well it could be solved on two fronts, you could issue the update and let users know that the update needs to be installed and will be automatically installed if not done by a specific timeframe.

If there are security related updates where the risk is severe then they may auto update.

[conductr]

The point is it’s up to the device owner to make their own risk calculation instead of the benevolent manufacturer

[rk06]

the point was that manufacture is forced to have auto update enabled in name of security compliance. so, this issue needs to be solved by compliance first

[deepsun]

Well, my comment was from owner's side. An end-user corporation is the owner of a corporate device like car, so it can decide whether turning it on or off. I just commented that for any serious corporation auto-updates will be turned on, per compliance requirements applied to the corporation.

[conductr]

This is a hypothetical in this situation, car manufacturers are under no such obligation. Also, rules like this tend to get reversed once the true risk is realized- people dying that is. We do all kinds of things for very marginal improvements to security these days

[throwway120385]

> Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens. Allowing them time, gives them and Jeep the ability to slow roll the update so they can halt it if initial feedback is negative.

This does not fix any QA process that is broken. And frankly you should not need to update any control unit firmware after it is sold. The fact that they're even doing this is broken.

Unless your Mac is somehow attached to 5000 pounds of metal going 65 on the highway, the same standards should probably not apply.

[cozzyd]

> going 65 on the highway

Oh you sweet summer child

[WalterBright]

> The fact that they're even doing this is broken.

The NASA space probes are constantly uploaded with new software that has greatly increased the scope of their mission.

[vips7L]

The NASA space probes can’t plow into a minivan with a mom and her 2 kids inside. There’s an entire different risk level here.

[WalterBright]

What if the update is to address a safety issue?

[throwway120385]

The manufacturer needs to issue a recall in that case. They can't have their cake and then eat it too. Either the update is not critical and should not be generally available or it is critical and they should inform their users with the proper framing.

[hulitu]

> What if the update is to address a safety issue?

If they didn't make "safety" right from the first time, why do you think they will do it better the second time, when the fixes are more expensive and the time pressure is enormous ?

[mrheosuper]

on the other hand, if you know your old software is buggy and could cause fatal accident, you release a software update, but for some unknown reasons, the user keeps denying updating software, what would you do ?

[worewood]

In that case you issue a recall, which is the correct way of dealing with potentially fatal manufacturing defects.

[mrheosuper]

Which will be costly. Also, it does not guarantee the user will return your car, right?

[conductr]

It should be costly. You want to encourage companies to make better/safer products that have been well tested. The whole “Move quick and break things” is from the perspective of a completely nonessential social media service. They have no consequences when they break things, although even that has changed as every minute of downtime is lost revenue. Self inflicted financial pain is completely acceptable, if they choose to take that path. Car companies should not.

[spaqin]

Yeah, but the user will be liable for not returning the vehicle under a recall.

As for cost, surely you can ask Ford's lawyers who worked there in the 70s to give you a good calculation on life vs recall costs.

[mrheosuper]

Just issuing a recall is not enough. There are countless reasons why someone does not return the product: They maybe simple not know, and there is no way to reach them.

That is why Samsung push update to disable note 7 even after recalling them.

[hulitu]

> on the other hand, if you know your old software is buggy and could cause fatal accident, you release a software update

No. You test it. And release it if and when it is fully tested. (you know, V-cycle). But we are Agile now and testing is expensive.

[mrheosuper]

You can apply every fancy safety model (V cycle, iso262626, ASIL, MIRSA) and nothing can guarantee you write one-shot bug free software when your software is slightly more complex than just controlling some lights, sensors or actuators.

[conductr]

But you’d catch cases like this where the hardware is immediately bricked during driving. If you didn’t, your tests aren’t up to snuff.

Let’s not let perfection obstruct progress.

[mrheosuper]

>your tests aren’t up to snuff

Yup, my test is not perfect, but "Let’s not let perfection obstruct progress".

[jacquesm]

This is not a case of 'absolutely bug free', more a case of 'not obviously and stupidly broken'.

[rurp]

It's not perfect but seems reasonably easy to implement and would certainly help. If the user needs to approve each update and can see what the changes are most updates will either be skipped or delayed long enough that catastrophic bugs will only hit the small subset of cars that update immediately.

I would bet most updates, especially from a company this bumbling, will be more along the lines of increasing telemetry or pointless UI changes than releasing actually useful features and bug fixes.

[danielheath]

You might not accept an update with a bunch of changes that didn’t sound relevant to you.

I certainly wouldn’t accept one while I was still driving the car!

[skywhopper]

The update didn’t happen while people were driving. Rather, the bug took time to occur, well after the update had been applied.