[moooo99]

It is amazing how Volkswagen keeps messing up. I am currently in the market for a new car, an EV specifically. Volkswagen brands were at the top of my list for many reasons, among them the excellent driving assist implementation.

I got an offer from a dealer three weeks ago and was going to order the car, then the API for the community integration got turned off. I decided to hold back and see what comes from it. Now this, which ultimately - since I am a GrapheneOS user - makes me completely cancel my plans.

I really do not understand VWs thinking here. It would cost them little to nothing to continue not blocking the the inofficial API and not block GrapheneOS (or other non Play Protect androids) users. It would have no adverse effects on the average Joe, but it would gain a lot of support and enthusiasm from heavy users, differentiating from other brands. Not to mention the fact that it is the USERS data in the first place

[this_user]

German companies, especially old school industrial ones like VW, have a very hard time understanding open platforms. The view everything through the lense of liability and compliance first. Their thinking is that if someone runs their app on a custom ROM and uses that to manipulate the app in any way, and that causes some extremely hypothetical damage, that they might be held liable for not having prevented this situation.

Obviously, the chances of that are virtually zero. But they'd rather make their product worse than assume with any kind of risk, even if it is virtually zero. That is simply the way in which German enterprises operate.

[leonidasrup]

It looks like the software development at Volkswagen is done by mixed bag of different deparments with different quality.

On one hand you have: Linux at Volkswagen

"Software development without Linux is no longer possible within automotive environment. Therefore Volkswagen Group IT created and maintains a Linux distribution for our developers. This short talk will highlight our starting goal to integrate into the existing environment, highlight our integration problems and solutions with contributing to upstream. Furthermore we will show where Linux desktop need to improve in future iteration to be a good fitting replacement for other systems."

https://media.ccc.de/v/4486-linux-at-volkswagen

On the other hand you have insecure implementation of telemetry: Wir wissen wo dein Auto steht

"Bewegungsdaten von 800.000 E-Autos sowie Kontaktinformationen zu den Besitzern standen ungeschützt im Netz. Sichtbar war, wer wann zu Hause parkt, beim BND oder vor dem Bordell.

Welche Folgen hat es, wenn VW massenhaft Fahrzeug-, Bewegungs- und Diagnosedaten sammelt und den Schlüssel unter die Fußmatte legt?"

https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...

[podnami]

I’ve spent time doing software at VW and a few of its subsidiaries, and this matches my experience.

Compliance is everything, and SAFe (Scaled Agile) is deployed as a blunt instrument.

Management treats software exactly like hardware production lines—everything is just an "engineering process" that can be optimized on a spreadsheet.

The underlying assumption is that individual engineering talent is just an interchangeable commodity. Once you view developers as replaceable cogs, outsourcing the entire infrastructure to the lowest bidder in India becomes the logical conclusion.

It’s a textbook case of process-over-people driving institutional tech debt.

[rickdeckard]

> Management treats software exactly like hardware production lines

That's exactly my observation as well. Classic hardware-producing companies have an immense respect on the step of entering mass-production, as whatever issue that slipped through will be multiplied and physically spread across the world.

So they come from the mindset that the dominant mindset is to minimize the SURFACE-area of potential risk. This makes it really hard for them to compete in software-space, because in software the dominant mindset is to just estimate risk.

Neither is wrong, but applied vice-versa is.

- If you treat software like hardware, you end up cutting out everything that could make your product fit more than your decided main use-case.

- If you treat hardware like software, you're placing a bet on behalf of your customer that the product "will be fine", and a (very expensive) bet that this product won't create an aftermath which may destroy your entire company.

Companies which can't manage the distinction here end up putting hardware in the hands of customers they should have built differently and then spend all their resources on software updates just to somehow keep the core function working.

[MichaelZuo]

Why shouldn’t software be treated with the same rigor at Volkswagen scale?

Pretty much all software products typically talked about on HN are laughable at that scale, they have crashes or weird bugs way more often than the six sigma norm of 99.9999% reliability.

For example, I don’t think it’s even possible nowadays to buy a new iPad and use it with default apps and settings for any significant duration continuously. It’s well under 1 million minutes of uptime before failure and a hard restart is needed.

So anything more complex than the simplest possible use case of an iPad is even more of a joke under hardware norms.

[rickdeckard]

> Why shouldn’t software be treated with the same rigor at Volkswagen scale?

No one said that it shouldn't.

What I wrote is, that the approach of minimizing any SURFACE of risk in software creates the (subjectively good and solid) software of previous car-generations (in Volkswagen terms: MIB2 ~ a bit downhill already in MIB3): A solid, predictable and closed product fulfilling its core use-case.

But it DOESN'T create a user experience with those "fun" niche features, competitive remote-access Smartphone features, exposed API's, sudden new features during lifecycle, funny "ludicrous modes" etc.

And today's customers are demanding those features, it's now a hygiene factor for a premium experience on Smartphones as well as on cars.

A Tesla is not considered a "Premium" car because of its premium hardware or manufacturing quality. They disrupted the car-industry by being the first to apply a software-dev mindset to it, and the consumer perceives this as premium.

[anonymousiam]

If they have concerns about the security of their app on some platform, they have the choice to either put "security" into the app, or to trust the platform vendor to provide the security. The correct solution is the first way. Deferring trust to the platform provider is the lazy way.

If their APIs are done correctly, they shouldn't be afraid to expose them.

[okanat]

You're proving the previous commenter's point. VW doesn't want liability. They do not care about "security" just liability.

When they leave the "security" to the platform they can blame them in a lawsuit.

[anonymousiam]

Google has a pretty good legal team. Their developer ToS that absolves them of any sort of liability for anything. So this means VW is just being lazy and not seeking legal protection.

https://play.google/developer-distribution-agreement.html

[klausa]

>Their developer ToS that absolves them of any sort of liability for anything.

This is... obviously not true?

If you could (somehow) meaningfully damage a car via the app, do you think VW wouldn't be liable because of the Google Play developer ToS?

[anonymousiam]

My point was that Google would not be liable. VW cannot evade liability from app misbehavior by using Google Play Protect, so why do they do it?

[noisy_boy]

> VW is just being lazy

Maybe they rather be lazy and be able to shift blame, even without much legal recourse.

[rurban]

They don't care about legal recourse. If there's something wrong, they'll just change the laws. That's why they don't care about GrapheneOS users, or any EU regulation which could harm them.

[nightpool]

How else would you build "security" into the app (in the sense of not allowing third-party modifications of it that would open them up to liability), except relying on hardware attestation that the app has not been modified? That attestation necessarily requires the platform provider to be involved.

[plaguuuuuu]

You don't, the app runs on a user-supplied device. They should secure the part that runs on the car and consider the interface between the app and the api to be a user interface.

[nightpool]

I don't disagree with this, but you're completely contradicting the user I'm replying to. I'm pointing out that the user who says "you should put security into the app" is completely misguided or at the very least perfectly explaining why VW is doing this.

[steelframe]

Volkswagon has no jurisdiction over how I manage my fob, which is the client for the vehicle's unlock and start API. Once you hand a bearer token to me that governs full access to the vehicle, including the accelerator and steering wheel, it's not your job to babysit whether I chose to use it while drunk or hand it over to someone else.

[tuhriel]

So you don't have a VW employee coming by your house in the evening to check if the key fob is still in you possession? Sometimes he even does a testdrive to make sure it still works with the car.

Maybe I have to ask that guy some questions....

[nightpool]

Okay, but how does that square with the person I'm replying to's claim that VW should "put security into the app"? You missed the point of my reply.

[Hnedelin]

Except it is their job, that is why certain signals on the car are protected from manipulation. Any attempt to circumvent this and succeeding would require direct action from VW. If they cannot prove that they did everything possible to prevent that, then they are legally liable to the authorities.

Same way that banking apps don’t care if you could screw up your account anyway, they will ban rooted phones just to avoid the risk. Because when something happens, what do you think is more likely? That the customer accepts full responsibility for using a rooted device and says that’s on me? Or that they blame the bank for losing all their savings?

[AnthonyMouse]

> If they cannot prove that they did everything possible to prevent that, then they are legally liable to the authorities.

Laws mostly don't work like that. The seller of gasoline doesn't have to prove they did everything possible to design the product to prevent anyone from using it for arson, nor should they because that's preposterous.

> Because when something happens, what do you think is more likely? That the customer accepts full responsibility for using a rooted device and says that’s on me? Or that they blame the bank for losing all their savings?

You're making the assumption that rooted phones are more likely to be compromised, but it's entirely the opposite. The stock software on phones regularly goes out of support and has known unpatched vulnerabilities (but will still pass Play Protect) and the only way to get a patched system on that device is to install a newer third party ROM. On top of that, GrapheneOS has better security than stock Android even for the same version.

Moreover, that has nothing to do with liability. When the user with the vendor-supplied firmware still gets pwned and has their account drained, they're still going to go to the bank looking to get their money back. All the bank does by going out of their way to block third party firmware is to make that marginally more likely.

[crote]

Easy: separate the systems into the safety-critical ones required for driving, and the nice-to-have ones used for things like entertainment. You can now give the car's owner full access to the latter via all sorts of weird 3rd-party apps, as there's no way for that access to cause serious issues.

They should be doing this anyways, or else you end up with your Jeep being crashed via wifi [0], and having the blast radius of a corrupt album image [1] restricted to infotainment is probably a really good idea too.

[0]: https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-e...

[1]: https://www.theregister.com/software/2022/02/10/radio-statio...

[user3939382]

VW didn’t seem too concerned with compliance when they were rigging their pollution tests.

[xenocratus]

They'd have you know they actually cared a bit too much about said compliance itself.

[CuriouslyC]

*appearance of compliance

[Obscurity4340]

The Lady doth comply too much!

[joe_mamba]

Them cheating the tests WAS them ensuring THAT compliance.

In fact, that's how a lot of compliance works in industries where there's little little enforcement and relies a lot on self regulation.

[zie]

That was just engineers engineering their way into creating Electrify America :)

[zelphirkalt]

I am pretty sure that was not the engineers, but someone higher up the food chain ordering people to do that. I might be wrong, but maybe I missed the obvious "/s" or "/i" here.

[zie]

LOL exactly, It was not meant in seriousness :)

Clearly the engineering team didn't know ahead of time that Electrify America would be the end result of dieselgate. Had they known, perhaps they would have been more eager to do the engineering work though! haha

It was just a fun inside joke, since nobody could have assumed the fines would create Electrify America. Personally I'm glad Electrify America exists, though the way it happened was probably not the best path to get here.

EA even has successfully moved on from just being an org forced into existence and are actively trying to take care of customers and produce a good product now that they have some competition.

[SecretDreams]

I think the latter on this one.

[jimmydddd]

Yes, but Hans, that one rogue guy in engineering, did get assigned 100% of the blame from the PR dept.

[this_user]

I mean, the only reason they did it was to be able to comply with the requirements of the test.

But the reality is that every once in a while you have a scandal like this or something like Wirecard, and it happens, because the culture is such that absolutely nobody thinks it possible. That includes officials and regulators whose first instinct will often be to come after the people trying to expose the scandal, as has happened in the case of Wirecard.

[joe_mamba]

>because the culture is such that absolutely nobody thinks it possible

Only naive laymen or newcomers to Germany think it's not possible. German business leaders, lawyers and politicians know exactly how much corruption and scamming is going on in the business sector, and it's not a little.

>first instinct will often be to come after the people trying to expose the scandal, as has happened in the case of Wirecard.

That was purely malicious to try to protect Wirecard, not because the regulators couldn't possibly imagine corruption and law breaking exists, that was the story they used as cover for their corruption.

Like you're a regulator and instead of doing the thing you were hired for and look at the evidence The Economist showed you, you instead "use your instincts" to decide not to do your job and not look into Wirecard because you can't imagine something bad can ever happen? Come on! All those regulators should have been fired and tried for corruption and/or accessory to crime.

[LtWorf]

I think germans are fine with corruption as long as delude themselves greece has more.

[joe_mamba]

Germans have a superiority complex over lesser developed countries like Eastern Europe that they use to justify how their corruption is acceptable, and how having much slower and much more expensive internet than developing countries is also acceptable. They're victims of their own arrogance and lack of self criticism.

[Hnedelin]

And since they saw what it cost them, they are now VERY concerned with compliance.

[linzhangrun]

“Compliance” only matters when their own interests aren’t involved

[raxxorraxor]

They have a hard time to understand software in general, software developers have a very low standing in German engineering and engineering culture has long been replaced by finance people.

And I don't think the liability is the primary problem, they have a problem with freedom and fear that they lose some mechanism for monetisation. This is why you get subscriptions for heating your arse.

[formerly_proven]

If I had to guess it’s liability concerns around the app-based remote unlock and parking + R155 and CRA. A lot of european companies have moved to require attestation in their apps, likely spurred on by the CRA.

[Perseids]

But why? I'd understand (though not approve) them tightening down everything about the car firmware to the max. They are responsible for the app, sure (it's a "digital element"), but they aren't responsible for the OS the app runs on. The CRA should not be used as an excuse to enact stupid restrictions.

[tadfisher]

Unfortunately, due to the nature of these things, you cannot verify an app is unmodified without also verifying the OS running it is also unmodified. So if VW decides that only their unmodified app may access APIs, then they kind of are stuck verifying the OS.

They can, given basic competence in SW engineering, also verify against GrapheneOS' published release keys. The reason they don't is the same reason Google closed my ticket asking them to include Graphene keys in Play Integrity checks: they don't care.

[microtonal]

The reason they don't is the same reason Google closed my ticket asking them to include Graphene keys in Play Integrity checks: they don't care.

I think the reasons are very different. VW maybe doesn't care. Google does it because it would undermine their stronghold over the platform. If they would allow GrapheneOS, what would block Samsung or another OEM from also sandboxing Play Services and not preinstalling a bunch of Google apps and requesting the same?

This shows why attestation is in the wrong hands. Whether a particular device is attested should be purely based on the security of the device (which would also exclude a bunch of certified devices that Google will happily attest now), not on maintaining a smartphone duopoly.

[crote]

Alternatively: don't add inherently-unsafe functionality which requires attestation in order to have a veneer of "safety".

As media piracy and game cheating has shown: no matter how hard you try, there will always be ways around it. You should assume that 3rd-party device you have zero control over is already compromised, so why not use the API as the boundary layer, stop pretending you can secure the app, and open it up to 3rd-party access like it already is in practice?

[vitorbaptistaa]

The same company that supposedly views everything through the lens of liability and compliance does this:

> When the cars were operating under controlled laboratory conditions - which typically involve putting them on a stationary test rig - the device appears to have put the vehicle into a sort of safety mode in which the engine ran below normal power and performance. Once on the road, the engines switched out of this test mode.

>

> The result? The engines emitted nitrogen oxide pollutants up to 40 times above what is allowed in the US.

https://www.bbc.com/news/business-34324772

[4thguy]

The first thing I did when I read the parent comment was to double-check if I mixed-up my German companies.

There's only one reason why they're doing this: it benefits them in some way.

[meyum33]

I guess this mentality makes sense if your products’ failures may lead to actual people dying. And in VW’s case it’s the correct culture working as it is supposed to? My Toyota sometimes feels like it was designed by a lawyer. But I somewhat understand given their history of being badly sued. That being said, at this day and age they probably need to evolve to accommodate some UE principles from the consumer electronics industry. Especially given how cars are getting more computer centric. Hitting a good balance between the old compliance/safety mentality and UE mentality will be hard.

[inigyou]

They have to, because German society is extremely litigious and based on finding loopholes in rules.

You know how some religious groups will string a rope between two houses, count it as a roof as long as they're within a certain horizontal distance of it, so they can follow the rope on occasions when the religion says they have to stay inside, and they think God enjoys them finding these loopholes?

Germany is like that, but with lawsuits. If anyone with money finds a technicality to sue you on, they will. So you have to be extremely liability averse if you want to be successful in business. Also, liability is almost always unlimited. You can be bankrupted by a single bad lawsuit.

[rickdeckard]

No idea what's your source on this, but I see you're spanning quite some "rope" from

a.) a global company in the car-industry being cautious of exposing ANY risk-surface in a product because every issue making it to the field doesn't just bear the risk of very expensive recalls/fines but may also put people's ACTUAL lives in danger, to

b.) the country Germany and its whole society

> If anyone with money finds a technicality to sue you on, they will.

In the car-industry you don't need anyone with money to sue you. If you ship a car which is found to endanger participants of traffic, your company may not recover from the aftermath for years...

[treszkai]

What do you base this information on? I live in Germany and have no idea what you're talking about.

[deanishe]

Same. It doesn't sound at all familiar, but Germans are a relatively litigious bunch (so many have legal insurance). Suing your neighbour because their cigarette smoke wafts into your kitchen. That sort of thing.

But "unlimited liabilities" gives entirely the wrong impression. German courts do not award punitive damages, and fees are generally capped below that amount in dispute.

[inigyou]

Actual damages are unlimited.

[fooker]

It's more about rules than hypothetical liability for Germans.

It's inconceivable that someone would want to use a car outside of it's specified rules.

[like_any_other]

> The view everything through the lense of liability and compliance first.

Wow, so they must really want to avoid the liability of spying after their users and keeping all that data, and to be extra sure to comply with the GDPR, they must keep only the absolute minimum of data, right?

Wrong: https://www.theregister.com/security/2025/01/06/data-describ...

https://dailysecurityreview.com/security-spotlight/volkswage...

When a company behaves as your enemy, don't invent wild justifications how they're actually not. At least leave it to their PR team.

[zrn900]

> Their thinking is that if someone runs their app on a custom ROM and uses that to manipulate the app in any way, and that causes some extremely hypothetical damage, that they might be held liable for not having prevented this situation.

Unfortunately, due to the regulations that have blown up in the EU in the last decade, they are right.

[iamnothere]

I wonder if they would be ok with letting users sign a waiver to gain unrestricted API access.

[neya]

Yeah sure, the company behind Dieselgate and single handedly destroyed the diesel market is worried about compliance? Give me a break.

[bri3d]

Yes? These things directly follow one another: VW are obsessed with letter-of-the-law compliance, so things like end-runs around test routines are obvious solutions.

And VW didn't single-handedly destroy the diesel market; economics and physics did. Almost every other manufacturer was also fudging the tests results in some way. But more importantly, building a passenger car diesel that meets NOx targets doesn't work; by the time a passenger car diesel meets modern NOx targets honestly, the car contains a ludicrous precious metal loading in the catalyst and is only a few percentage points more efficient in terms of consumption and CO2 emissions than a petrol car and the math doesn't add up. Diesel is just not a practical solution for passenger cars; it never was in most ways, but it took the EU a long time to restrict NOx pollution to a sustainable level and expose the physical issues at hand.

[dreamcompiler]

You can have high-mileage diesel cars or low-emissions diesel cars but not both at the same time.

VW knew this but lied to customers and told them they could have both. Dieselgate was their attempt to convince everybody the lie was true.

[Hnedelin]

This was official EU policy, based on french reports, as the french and italian manufacturers actually came up with common rail diesels first. The EU then changed regulations to tax based on CO2, which diesels are better at. They also made diesel taxes lower, to offset the higher prices for diesel cars (often 2000+ euros more than the petrol versions). This was all done in the framework of reducing foreign oil imports.

What VW did was to save money from ThinkBlue systems. Not every manufacturer failed the tests, especially the ones who used exhaust gas treatment did pass, and were more economical than petrol engines. After that, the EU changed emission standards and made them more strict, so VW switched to using dual exhaust treatment. Which made the cars more expensive.

What finally killed diesels was the removal of the tax reduction on diesel fuel. Since it is now taxed the same as petrol, there is no more any advantage that can offset the higher purchasing costs of the cars.

[adrianN]

VW is large enough that different parts of the company can have very different opinions.

[zelphirkalt]

That itself though speaks for a broken company culture. If one part of the company is completely disaligned with the values of good engineering, why should anyone still trust the company as a whole? It seems they at the very least severely lack a good vision then, to uphold the company values or what should be the company values.

[donkers]

That’s how megacorps are. VW has almost 700K employees. Enforcing a company culture on that scale is a very diffuse and difficult thing. If you are evaluating whether you should trust a company based on their ability to enforce values throughout all their orgs, you really shouldn’t trust any company unless it’s a tiny one where this sort of thing can be a lot easier to hold the line on.

[moooo99]

I mean, the app services department doesn't exactly have a track record of perfect compliance (privacy) either, so there is that.

[thyristan]

You don't understand, both comes from the same motivation and way of thinking: You see, compliance in Germany is about pretending to be super-compliant and not getting caught. Everyone will do the dance, make all the moves, and if you seem to make all the moves, you are assumed to be compliant. Supervisory authorities will not really check thoroughly except if you are annoying them or making them look bad. Especially if you are partially state-owned like VW.

In Dieselgate VW got caught, made the supervisory authorities and politicians look bad, which is why the authorities also weren't inclined to sweep it under the rug completely. They just shielded VW from the financial consequences in Germany (German VW customers got shafted).

Blocking GrapheneOS is the useless "pretending" part of compliance. They don't really want to do security, because that would cost money, so they pick some actions that seem drastic, harsh and don't cost them anything to implement. Later, when there is a security incident, they will point to their huge heap of pretend compliance, whine a bit about state sponsored actors, high criminal intent and other obvious deflecting bullshit. But they will get away with it, because they did the compliance dance, so they are obviously compliant and did nothing wrong. Nobody in authority will look twice als long as they are neither annoyed or made to look bad.

tl;dr: compliance in Germany is performative

[hwj]

This even has a name: German Angst.

[hparadiz]

Germans will talk a lot about data privacy but then do stuff like this regularly.

[Loranubi]

One is people one is companies.

[hparadiz]

It sends very weird signals when the EU will fine an American company over some data moving in a direction they don't like while at the same time EU governments will allow home grown companies to de facto force people into using products from those same American companies all while lecturing us about duopolies and privacy only to re-enforce those same problematic patterns. It is absurd.

[ahartmetz]

All countries are more lenient with their own companies. Remember who started grounding the 737 Max? It wasn't the FAA, an otherwise highly respected organization. Who is paranoid about Chinese routers while spying on everyone? Etc.

[mindslight]

No, it's not weird at all. They're each just an outcome of two different regulatory philosophies about how to protect users. We might want both because we're coming from an individualist hacker mindset, and thus see them as similar issues. But this is not how regulatory environments work (unfortunately).

From what I can surmise, the German/EU philosophy is more of a closed world approach - accepting that companies will keep control, then government regulates the companies to stop the companies-with-control from causing harm. If you don't like the harm, your recourse-focus is to petition the government to stop it (eg GDPR). Whereas the US philosophy is more open world - once someone "chooses" to patronize a company, then the company is free to do whatever they want. Your recourse-focus is to stop using that company.

They both have shortcomings and glaring loopholes, of course.

[nicce]

> I got an offer from a dealer three weeks ago and was going to order the car, then the API for the community integration got turned off. I decided to hold back and see what comes from it. Now this, which ultimately - since I am a GrapheneOS user - makes me completely cancel my plans.

Make sure that dealers know why you changed your mind.

[hydrogen7800]

>Make sure that dealers know why you changed your mind.

"Some nerd couldn't use their nerd phone."

What incentive does a dealer have to know or care about this?

[LollipopYakuza]

As a dealer, it would be frustrating especially because it is so silly. Basically, if they report any of this to HQ, it would be along the line of "I am losing the sale of a whole car over some stupid app block".

[theeyescanner]

Net Promoter Scores is the only thing that the marketing department cares about. So fill out that customer satisfaction survey, give them a 1 out of 5, and say why. Passives (2-4) are not even considered lol.

[unethical_ban]

What is the risk of letting them know that someone lost trust in VW's features due to a boneheaded decision of their software group and decided not to buy that brand at all?

[SapporoChris]

I wonder what a Venn Diagram of people that use GrapheneOS and people that wish to purchase a Volkswagen vehicle looks like. As of April 2026, the operating system had approximately 400K active users. https://en.wikipedia.org/wiki/GrapheneOS

I wish that Volkswagen would care about this, but I suspect they have little incentive to do so.

[thiht]

Volkswagen has a 10% market share in Europe (25% if you consider the whole group: Audi, Cupra, etc.)

Assuming 25% (might be overinflated) of GrapheneOS are European, that’s 10000 European GrapheneOS users who would buy a Volkswagen car (assuming an unbiased distribution of GrapheneOS users, which is probably not the case though).

I don’t think Volkswagen is in a strong position to say they don’t care about 10000 sales in Europe only.

[SapporoChris]

Good point. I wasn't considering the different concentrations of interests by area.

[theandrewbailey]

That number might grow substantially when Motorola releases GrapheneOS phones.

[sowbug]

You could make a similar argument about voting in democratic elections. It's still important to vote.

[sufficientsoup]

What incentive does a dealer have to know or care why a sale fell through? Bizarre question

[hydrogen7800]

I'm thinking that the effort required to make that one sale in a thousand is not worth it. The 999 others didn't complain about that.

[nicce]

I think that it is not fair comparison. More likely X % changed their mind and did not go through the purchase. Nobody except this one told the reason? If only this is said aloud, dealers might even make assumptions that maybe others did the decision for same reason, but just did not say it.

[OsrsNeedsf2P]

VW is obviously not thinking that any noticable portion of the userbase uses Graphene, and someone (somewhere) is going to get a promo by making VW infra adhere to "standards" or something

[riedel]

Actually we need to force our European governments to use services that do not depend on foreign services (ie. Google or Apple). Then I guess it will only then become obvious to them how crazy the situation has become.

The company's have done their thing to ensure that the average guy wouldn't even try escaping their lock-in. So chances are becoming smaller and smaller to hope for a critical mass of users to complain.

[J-Kuhn]

Yes, the EU calls it "digital sovereignty" and is currently "in" with the EU.

[echelon]

I don't use Graphene, but now I'm out of the market for a VW.

Vendor lock-in to Play services is ridiculous.

A car is a big purchase, and ideally not something I discard after a few years. I'd like it to not treat me like a second-class citizen and renter who can't make decisions over how to extend the life of my purchase.

[zamadatix]

It's ridiculous, but are we only saying that because we're on HN or is it because the portion of the userbase who thinks it's actually a bad thing is the larger one?

[tarxvf]

Who cares if it's the larger one, so long as they are the correct one?

[zamadatix]

VW, presumably.

[znort_]

which is why shaming them is a valid attempt to get them to "think". it has worked in the past (particularly with bmw!).

specially because no car really supports grapheneos, but it can be used in any car supporting regular android provided google play is installed which ensures google's certification and validation is being preserved. if i get this right bmw is actively blocking this, which would be just a dick move.

[Lio]

I've had the same Golf since I bought it new in 2014. I like my Golf, so it should be an easy sale for VW to sell me a replacement.

However, VW just seem to make gaff after gaff. Collecting information they shouldn't, exposing information they shouldn't have to hackers via lax security practices.

How many rakes can a company step on?

Now, they're blocking GapheneOS? They've got two hopes of selling me another 'Dub.

(Bob and No).

[port11]

They appear to have no clue about what customers want. We’ve had VWs in the family for as long as I can remember. After I sold my Polo, a car I truly liked, that was the last of it.

Nobody wanted the crazy touch dashboards, data collection, emissions nonsense, etc.

Just make the damn car you’ve always made. Be reliable.

[EspadaV9]

I've had a Golf from new since 2016. I love it. It's the only car I bought new (only car I've ever bought actually), and wanted one since renting cars when I lived in the UK (had no need to own a car (cycle/public transport), so only rented as needed). I recently started looking for at EVs just to be prepared in a few years and know where things are at, and I honestly doubt I would get an VW car now. Unfortunately, I'm not expecting there to be anything much better, with most companies locking things down more and more, adding more tracking, etc.. Perhaps it'll just be better to buy a several year old EV.

[scns]

> How many rakes can a company step on?

All of em.

[askvictor]

Or, for the Australians: Buckley's and none

[bojan]

Same here. I'll be in a market soon and I had my eyes on a VW i4 or a Škoda Enyaq, but this makes me seriously reconsider. I really wanted to support local industry and buy a European product this time, but they are making it seriously difficult (no, don't get me even started on Stellantis).

[goobatrooba]

I was hesitating between a VW ID.4 and Peugeot 5008 (7 seater, much space). In the end I went for the Peugeot and it's fine. The ID was much more fun to drive, but I would have lost space and paid a lot more.

Peugeot is reasonable and works. Charging could be faster and WLTP longer, and once I had the screens restart while on the motorway which thankfully did not affect driving but was pretty terrifying. All that to say - go ahead and buy European. You'll have some issues but for me all better than to get a china car with who knows what data exfiltration and hidden issues, or a Tesla that will lock you in when the car burns. EU companies are too boring to spy and too risk averse to have tesla-like issues..

[bogeholm]

Mercedes has some interesting EV options, and they have some models at the moment that are not necessarily that expensive. Through the grapevine I overheard something about surplus production due to mandate to build a certain number of EVs.

If you don’t want/need a new car, the used car market in Germany is pretty active with EQAs and EQBs.

[martin_a]

Mercedes is terrible for EVs. Adaptive Cruise Control for example is a paid feature with a recurring subscription. Don't encourage "Car as a Service" concepts.

[bogeholm]

Didn’t know, thanks

[martin_a]

No problem!

Former colleague had an EQB and I nearly hit another car on the Autobahn because cruise control was not breaking when I got closer. That was really unexpected as that was a standard feature in my Hyundai...

[FabCH]

Renault makes good electric vans.

Not quite an SUV, but maybe fits the same use case?

[joe_mamba]

Go with Dacia, though their EVs seem to have very low range.

[abyssin]

2022 Dacia Sandero is a great car. Analog buttons, good build quality, well designed. And it’s cheap.

[isoprophlex]

Possibly the single ugliest recent car though

[WarOnPrivacy]

> Possibly the single ugliest recent car though

I checked it out. It seems like the 100th indistinguishable car design in our sea of nearly identical cars.

This to say that the "est" part of ugliest confuses me a little.

[kolmogorov]

looks completely generic. I googled it expecting a new Fiat Multipla or Chrysler PT Cruiser and I was disappointed.

[nickserv]

And yet still has more personality than the latest Ferrari.

[aucisson_masque]

You're speaking of a company that made special programs to cheat on CO2 emissions during car inspections.

[oaiey]

I think there was no specific thinking in that space at all. They went for attestation of the app for security reasons of the API and their testing only runs on normal android and iOS devices. Consequently, they realized later this and write a response pointing to their tested platforms.

So understanding why they drop it is IMHO easy. Understanding why they use only attestation based API despite and forcing their third party ecosystem out is stupid. Companies do not understand open communities.

[snarfy]

I can't even consider them after diesel gate. When I start thinking about it, it's quite sad how many car brands are terrible. I own two Mazdas. Still terrible but the least I could find.

[ActorNightly]

Its simple really

VW is for people that can't afford a BMW or Audi.

BMW/Audi is for people who can't afford a Porsche

Porsche is for people that can't afford a Ferrari.

Once you understand that ladder, just stay off of it, and its all good.

[amelius]

Companies just don't realize how personal computing is.

An analogy is trying to make users wear certain clothes when they use your product, and then asking why it doesn't fly.

[y-c-o-m-b]

> Volkswagen brands were at the top of my list for many reasons

You should definitely reevaluate how you constructed your list. VW has a history of being scummy (https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal) and their ICE cars are notorious for being unreliable compared to the Japanese car-makers. To be fair, EVs do change the equation a bit, but given their scandal plagued past, there's no way I would put them at the top of any list.

[michalhosna]

> their ICE cars are notorious for being unreliable compared to the Japanese car-makers.

I always read this online, but my personal experience in EU doesn't match that at all in quite a sample of people and cars over the last ~15 years. At least not for older cards. The reliability after 100k km seems to be somewhat similar.

The repairability of VW-group stuff in 3rd party services is soo much better and cheaper. The WV-group is huge and many models across the brands share same parts and full engines. There exist non-OEM alternatives and people know how to fix those cars.

I have never bought new car. But driving anything but VW got expensive fast.

Toyota cars can have bespoke parts even between different months of the same year for the same model. Continuous improvement isn't really that cool for cars.

[erxam]

The keyword here is "in the EU".

Outside Western Europe, VW is priced like a premium upmarket brand (not quite luxury). Maintenance and general upkeep for a VW are easily two to three times the cost of an equivalent Japanese car.

Which wouldn't be an issue if the cars were actually built to their price point. But the VW cars we get here are shittier versions built in nasty factories. They break down if you look at them wrong. The build quality is nonexistent. They are absolutely an awful deal, no matter how you look at them. You also have to personally import parts from wherever they're available, because otherwise only the dealerships have parts and they are absurdly overpriced.

Also, European brands are afraid of exporting EVs. If you want an EV, you buy a Chinese car. There is no other option. It is as simple as that.

[brikym]

It depends which market you're in.

[moooo99]

I currently own a 10 year old Seat Leon with not a single out of maintenance repair (if we ignore the cosmetic repair due to a wildlife encounter). My parents have owned multiple VW vehicles, with each of these lasting >15 years without major issues. I know they have a reputation of being unreliable compared to Toyota, but that hasn't been my personal experience and equally important: they do not look like a Toyota. And Mazda has awful EVs

Putting these factors aside: they are usually cheaper than their peers in insurance and they have dealerships absolutely everywhere. I've had multiple Skoda and VW EV rentals and the experience has been nothing but pleasant. Hence my priorities.

[port11]

Seat has been a refreshing alternative since the Arona came out, specifically the one with the amazing sound system. They’ve come a long way and are making some no-nonsense cars.

[jstanley]

The emissions scandal is completely different, because in that case they were illicitly making the car work better for its owner.

[bogeholm]

Unless, of course, said owner cared for the environment

[B1FF_PSUVM]

> cared for the environment

It wasn't "more CO2" grade, it was "more NOx" grade. This in urban settings will actually kill more people with respiratory problems.

VW's "clever hack" probably, statistically, killed people.

[jstanley]

They can always drive less frequently or more slowly, that's within their power.

[port11]

Cute. If I buy an A+ washing machine, but it turns out to use tons of electricity to wash the clothes better than expected, the solution isn’t to wash less clothes or do so less often — it’s calling the shop and returning it because its rating is fraud.

[bluGill]

Said owner cares about their experience above the environment. Sure people care about the environment, but it is always lower than all the other factors in their personal list of things they worry about.

That is why so many rich fly private jets to environment conferences. People put Greenpeace and similar bumper stickers on their SUVs that never go off road and rarely have more than one person inside. They care about the environment, but only when it doesn't impact anything else in their life.

[plqbfbv]

> Sure people care about the environment, but it is always lower than all the other factors in their personal list of things they worry about.

Emissions scale with performance, and inversely of fuel efficiency. So the environment may not be the most important point, but I'm pretty sure fuel efficiency is high on the list when you're picking a compact or long-range car that is supposed to be fuel efficient.

Also, by advertising as compliant to green specs something that wasn't, means people may have been swayed to purchase irregular cars despite them not being really green, only due to the fact that they may have received rebates and contributions for the purchase, regardless of whether "being greener" ranked high on their decision metrics.

[teamonkey]

Data point: I bought a Skoda because of its claimed efficiency. It wasn’t the only factor, but in the balance of weighing things up, I cared that the stated emissions and fuel efficiency were better than some of the competitors.

I was lied to. Had I known that was the case there is a good chance I would have gone with a different car.

My car was recalled and reprogrammed and it no longer had the torque it had at first.

Of course now it’s clear that most if not all manufacturers were doing the same trick, they just weren’t caught at it.

[formerly_proven]

As opposed to the rest of the auto industry which has a stellar track record of adhering to emissions and fuel economy regulations /s

https://en.wikipedia.org/wiki/Diesel_emissions_scandal https://en.wikipedia.org/wiki/Defeat_device

[netsharc]

And they lobbied governments to keep the tests a joke (e.g. test emissions on downwhill roads):

https://www.theguardian.com/environment/2015/sep/24/uk-franc...

Of course the governments probably lobbied for this stuff because it improves their car industry tax profits/employment numbers.

[joe_mamba]

They all cheated and everyone knew it. It was the only way diesels could be so economical yet so powerful.

[jp191919]

Not sure if Tesla is on your list, but FWIW Tesla app works fine on GrapheneOS

[antonvs]

Oh it’s on a list alright

[moooo99]

Indeed it does, but Tesla is firm on my no buy list

[dzhiurgis]

Insane take for HN. It's either Rivian or Tesla.

Zeekr is getting up there too, but Tesla is going to be leader for ages - most car availability, easiest to service, most hackable software, best in class privacy, tons of third party options.

[moooo99]

I am in Germany, so even if I was in the market for a truck (which I am absolutely not), Rivian does not have vehicles here.

Beyond the politics involving Tesla, I just do not like the car. I had a Test ride with a Model Y and it just was not a good experience. I hate the touchscreen centered everything, etc. Beyond that, I just want a compact vehicle, which Tesla simply does not offer.

Given Tesla‘s features like the Live camera access and their allegations of employees sharing pictures recorded with the interior cameras of the car, I have as little trust in Teslas privacy promises as with any other manufacturer. They‘re also very expensive in insurance

[dzhiurgis]

I guess if small car is more important than actually hackable smart cart - then I get you. Rivian will be bringing R2 across the world FWIW.

I'm dealing with my parents Kona EV right now and I can't help but cringe how out dated it feels. Three buttons just to start the car and I need to lock it myself. FFS. And that's on top of myriad of reliability issues.

I get it, Tesla has a bad omen for some who mingle deep in far left. But from technical standpoint it is incredibly well executed. Its touchscreen is second to none. Climate is easier to use than hardware buttons on many cars. It can be intimidating at first, simply because people assume you'll be fiddling with it all the time, but it's simply not the case.

[Toutouxc]

> I get it, Tesla has a bad omen for some who mingle deep in far left

That doesn’t sound like you get it at all.

[jp191919]

Tesla has been the benchmark for a long time. Longer than I thought they would be actually.

[Toutouxc]

Rivian barely exists. Their market share is a rounding error. Škoda Enyaq (yes, the one model) is outselling Rivian, the entire company, by a factor of two.

[jp191919]

Being that the Enyaq is basically an ID.4. I think it would be safe to assume the app would not work on GrapheneOS as well.

[theeyescanner]

Uh the driving assist is pretty bad for north american roads. I wonder if Germany has immaculately painted and well maintained roads?

My buzz loves trying to jerk the steering wheel when it can't figure out how the lanes work.

[moooo99]

I have had some fairly challenging trios and the travel assist did a very good job, even at autobahn construction sites (which we have plenty of).

No clue how much vehicle generations affect this performance tho. Since they were rentals, all the vehicles were pretty new

[Kyuren]

It's just a direct security risk for them no. Less control can lead to unpredictable behavior from their cars in the future. Why would they want to allow the environment which enables that.

[gslepak]

I'm kinda glad that it's VW blocking GrapheneOS users in a cynical way. When my parents got a VW Jetta they never stopped complaining about it and never bought one again. So it tracks that they'd also be the car manufacturer to block GrapheneOS and stomp on their user's privacy.

It's an easy market to win at this point. The bar has been lowered so much. Already have a nice car? Just don't display utter disdain for your user's privacy and you get our $$.

[Hikikomori]

What else was on your list? Haven't looked seriously but WV, kia, Polestar has been on my list.

[moooo99]

I've test driven pretty much all VW brands (that fall within my budget) and thus far, the Cupra Born has been my favorite.

I have test driven the Kia EV4 and EV3, but I am not a huge fan. I do not enjoy the look of the EV3 and while the EV4 was a nice drive, I kept bumping my leg against the direction selector (which is below the handle for the wipers; But this is a huge nitpick since I am fairly tall, so not really an issue for 99% of drivers).

The main issue with Kia across the board is that their are so darn expensive for insurance. At my current provider, the EV4s insurance would have been 500 EUR more expensive than an roughly equally priced Cupra Born.

Not a huge SUV fan, but the Skoda Elroq and Skoda Enyaq were very nice vehicles as well

[Hikikomori]

Been mostly interested in ev6. Just compared insurance cost and Polestar 2 was almost double. Born was also 50% more than kia ev4. Maybe different in the us if you are there?

[moooo99]

No, located in Germany here.

[Hikikomori]

Weird how much cheaper kia is on sweden then.

[HDBaseT]

Let me get this straight, you are considering buying an EV, or any modern car for that sake, but you care about privacy (by using GrapheneOS).

You are driving the biggest trojan horse of spyware ever created. You voluntarily drive around with that thing spying on you AND me. I hate parking at a parking lot now because every car and its 300 cameras are spying on me, putting my face, car and appearance in a database used to track everyone around you.

I genuinely don't know how people like you sleep at night knowing you're raping everyone around you by enabling mass privacy violations. Grow a spine.