Phones are supported well beyond their average ownership lifetime. In stark contrast, automakers are struggling to work out how long their “smartphones on wheels” can be kept on the road.
More likely they're struggling to understand the minimum the public will tolerate and put that into acceptable marketing copy.
With the history of the automobile industry, they have a fabulous amount of data on how long vehicle bits last in different configurations. The only minor variable is the computerized bit. I say "minor" because they can use older COTS electronics to do all the things a car needs, and then stick an iPad[1] on the console.
1 - another tablet, touchscreen, whatever. Notwithstanding the arguments against touch interfaces in cars.
While their own stupid fingerprints are all over the footgun's trigger...I for-sure don't envy the auto makers here.
An "old" phone is what, 4 or 5 years old? At least on the iPhone side, Apple is [in]famously vertically integrated, to have the all the resources needed to update iOS.
And Apple kinda-famously issued a security patch for iOS 12 (released Sept'18) in Jan'23, because pre-2015-ish iPhones could not run any newer version of iOS.
Vs. the computing hardware and software in a modern car comes from how many different supplies, spread across how many tiers, with how little visibility from the PoV of the computers-ain't-their-forte auto makers?
And an "old" car can easily be 10 to 25 years old.
For a very long time, Apple refused to commit to any kind of update policy, but people could simply see their update history. I see they did commit recently (five years since release) and that was due to a legal requirement.
It's such a lucrative revenue stream that I doubt companies will be convinced of any utility in open-sourcing. Similar to AI regulation, the car companies can just claim that any public access to the code will make cars more dangerous.
VW's new Rivian-based UX platform is based on AOSP Android, without Google Automotive Services (GAS). Bad news: You don't get the Play Store. Good news: Rivian could choose to open source the parts of the system that replace the GAS bits.
My 2014 Acadia had Wifi, a 4GLTE modem, a phone app, and two streaming audio apps on the radio.
It was never updated.
Possibly because I wasn't going to give them $70 a month for On-star, internet, and GM super naggy status stuff. (Hey! Come pay more for an oil change with us, your car told us you neeeed it!)
It's one reason I want a car with CarPlay or Android Auto. My phone is updated all the time and the software is usually higher quality than whatever the automakers put out.
It's interesting that you mention GM because they are ditching CarPlay / Android Auto support in some of their vehicles. They think doing so will generate billions in revenue for them.
I expect at some point that stops being feature updates because new features rely on different hardware, but at minimum it means 15 years of security updates... in which case 15 years isn't enough. My last two cars were both on the road longer than 15 years. Thankfully they weren't connected to the internet.
And the other thing they don't commit to is that they'll have 15 years of updates where the maps app runs at more than 2 frames per second. So this had better not be anything like phone updates, where a 5 year old phone is sometimes allowed to run the modern OS update, but it doesn't run well. Will they maintain multiple branches based on different hardware requirements so they can keep shipping performant OS updates on old hardware?
It's a big reason I won't buy a car without CarPlay, I need the escape hatch of being able to run the new maps app from my phone manufacturer, on eventually 10+ years newer phone hardware. Even if the car's infotainment is amazing today, there's no guarantee it will be any good in 10 years and I'd rather have a backup plan.
> It's a big reason I won't buy a car without CarPlay
Isn't it a bit naive to suppose CarPlay will still be a thing in 10+ years? Maybe the iPhoneVR 28 glasses will have a completely different UX and the idea of letting it take over a small part of your car dashboard will be a historic curiosity.
Maybe, but when we're talking average price of around $50,000 for new car purchases, I'd just as soon hedge my bets that if CarPlay still exists in 15 years I'd rather have it than not have it.
Rivian's position is "you would have to close CarPlay to use the vehicle menus to open your frunk" which is a) not true, and b) says more about their being too cheap to have a frunk release button than it does about CarPlay.
Sigh... they aren't "computers". It really sucks that we've lost that word. What do people say now if they specifically mean a general-purpose computing machine?
Cars also depend almost entirely on the road infrastructure. The automakers don't support that. People need to realise if they want interoperability they need to choose open standards that their community can maintain. This isn't just a problem with cars.
Newer cars are probably less likely due to how arbitrarily locked down they are, rather than being incapable. The manufacturer could run DOOM on their car that you bought, but you probably can't.
Even then it's totally irrelevant to the point being made. The fact they happen to be made with computers with full operating systems etc. is curious but irrelevant here. People don't use cars as computers, but they may use them as "devices" to some extent. A computer is something on which you can install new software, including your own. Cars are not that.
It's like calling a window a door. Yes, they are holes in walls that can be used for ingress or egress, but they completely different expected use cases and designs.
One could make the point that cars contain electronics with firmware which is so hopelessly broken that it needs constant updates. But the point in the article is even further from that and just that they are expected to interoperate with other things like remote services etc.
But like I said, the word is lost and people call iPhones computers too. I wish I hadn't written it now because it wasn't really my main point...
Is there a reason to make a distinction between "computers" and "devices that happen to have computers" besides convincing people they should accept not being able to compute on their computer?
Lots of things "are computers" (thermostats, refrigerators, cameras, etc.), but most of those things don't get updates. They're shipped in working order, and they go in working as intended through their service life.
Why are cars different? Personally, I would rather not have the UX of my car be subject to arbitrary change.
Cars used to be the same as everything you cite as examples of ordinary embedded systems. Adding Android Automative-based UX, for example, puts a general purpose OS and app suite in your car. It will probably work better than the Android refrigerators. Probably.
Because they need updates to fix security holes in the network stack that is required for doing the updates, don't you know? And of course also to facilitate all that juicy surveillance backhaul and anti-ownership decommodification. What we've needed the whole time is mandated open standards and open documentation for both the local buses and any WAN communications. There's really no reason that center console units from cars aren't widely interchangeable with each other, rather than being specific even down to the model year. But instead, companies use software complexity as a hook to perform wealth extraction, and then respond to any public pushback by marketing the extractionary dynamic as "innovation" and trumpeting the revenue numbers as if they represent legitimate economic activity.
Cars are more than UX. There is an awful lot of computer control in the engine and transmission theses days and issues crop up commonly where the programming cab cause excessive damage and wear to components.
Well, cars have mechanical components that have problems too. Those get fixed through the recall process. If there's a significant problem with the software, that should also get fixed through the recall process.
There's no need for regular updates. Fix problems the way they're normally fixed, and other than that, don't update anything.
So long as both manufacturers and executives are willing to assume unlimited liability for all direct, incidental, and consequential losses caused by both updates themselves and any security vulnerabilities in the update mechanism, and are held criminally liable in cases where negligence leads to injury or death, I have no problem with this.
Why would they be, anymore than for the original product?
Also, do you have a single example where there was a security vulnerability in the update mechanism of a car that resulted in an attack? Do you have a single example of a loss caused by an update (that would not also occur during offline servicing)?
> Fix problems the way they're normally fixed
I think that's the problem. Putting your car into a garage to get it looked at and fixed is expensive to the manufacturer and the loss of time to me.
As opposed to my car getting an OTA update overnight and the only thing I notice is the reversing beep is now a slightly different tone.
> and they go in working as intended through their service life
Unless they are connected to the internet and end up as part of a botnet due to shoddy firmware. Or the manufacturer decides to shut off a cloud service that is needed for their operation for some reason and they get bricked.
IoT devices are the opposite of the example you want to use for stable, functional computers in electronics.
That's difficult with oil though.
At least my airbags aren't stolen every few months like with some brands here since the manufacturer made it hard to swap them between cars.
> Because of this, it should be mandated that 3rd parties be allowed full hardware access/documentation once the warranty period expires.
Mandating that would also mean the 3rd party also would have to take responsibility that the updated software conforms to spec and doesn't kill someone. Who's going to pay for that?
How so? Swapping parts can still result in people's deaths. That is what concerned you right?
Besides it's not like people have only "swapped parts". People have basically entirely rebuilt engines and many other systems in the car. You are underselling what what has commonly always been done.
So yeah, I don't really feel like you've answered my original question:
> Haven't third parties been repairing cars for all automotive history?
Ok, let me state it like this:
Car repair consists of diagnosing a finite amount of components with known failure states and swapping them with known parts that are pre-approved and suitable for the car that's being repaired.
Software 'repair' consists of managing thousands of dependencies and building new firmware from scratch. Modern cars contain a lot of mandatory safety systems, from ABS to emergency braking, pedestrian detection, emergency SOS calls, active steering with lane assist, speeding notifications, driver fatigue detection etc. Knowing how software companies operate, I presume they got it just about working per spec. I don't know if you can expect a third party to manage such a complex stack and update it in a way that's up to spec and satisfies all legal requirements. And even if that's possible I don't think it will be cheaper anyway. Computers are a very different world, just as car manufacturers are still discovering.
You don't mandate updates, you mandate support. So if a key piece of functionality breaks after N years, or if there's a new security exploit discovered, the manufacturer is obligated to fix it. They can't say "well it's been 2 years, the car isn't supported anymore, just buy the new model".
"Upon investigation, we do not believe this to be a serious issue" is a thing that affects even software-focused companies [0]. The chief difference, in this case, is that you cannot impersonate the CEO to publicly state that there is, in fact, a security issue.
Why would a high-end car need regular updates? The only thing it needs to do that isn't guatanteed to not change without physical service is entertainment, and it's a safe bet anyone who can afford one has a smartphone they keep updated. Just make the pocket supercomputer do all the work and use the car as an input/output interface. This problem was solved decades ago on the internet, funnily enough by the same guy who founded this forum. Why is the industry at large so bad at retaining good practice knowledge?
Eventually, the input/output interface between the car and smartphone will also require an update to work correctly. Android Auto and Apple CarPlay are only 9 or 10 years old, not quite "new", but approaching the time where companies want to make major, incompatible changes.
I do not know if I would take a bet that a user can seamlessly connect CarPlay on their 2014 car with their brand new iPhone 25.
I always love when people with background in software talk about the car industry.
Noone is interested in Software. Software is what is outsourced to India. Software is the super-annoying thing on there very annoying thing(electronics) that is sadly necessary to keep the mechanical marvels developed by the wrench-swinging monkey equivalents of real engineers relevant.
Most in-car ecus are not updatable, that would be 10ct more expensive per part.
If updates are possible, please pay through your nose at the certified repair shop for them to plug a SD card in you have to buy.
Most Car Execs think of software as something that is developed in the same process as a bearing. And it shows.
Software in cars is more than just the entertainment system UI. If you think systems like ABS, drive by wire, transmission control, auto braking, lane change assist, engine control and fuel injection are being outsourced to the lowest bidder in India, you haven't been in the industry for at least two decades.
Interestingly, I am in that Industry. That's why I have such a cynical view of it and why I drive an ancient shitbox. Interestingly, a lot of Automotive EEs I know do. I wonder why...
The only scenario I can think of not being a safety issue is if the car has no endpoints that’s externally accessible. Unfortunately, a lot of these cars have wifi, cellular data, and even satellite network access.
I work on vehicle ECUs and we tend to generate updates for a really, really long time. There aren't really any technical issues preventing, say a dealer, from having the capability to update vehicle firmware easily. It's mostly a question of manufacturers making a commitment to do this.
Yeah. Nothing stopping dealers from charging out the ass for a few gb of data transfer. A scam as old as time, I remember my mom almost paying $500 in the early 2000s for a new maps DVD for her lexus. I found the iso on usenet and did it myself.
I was recently charged for a few updates to the head unit to fix issues that had a TSB, and that was annoying and I think that kind of thing should be free.
However maps data is licensed so the cost makes more sense for that.
65 comments
[ 0.32 ms ] story [ 136 ms ] threadWith the history of the automobile industry, they have a fabulous amount of data on how long vehicle bits last in different configurations. The only minor variable is the computerized bit. I say "minor" because they can use older COTS electronics to do all the things a car needs, and then stick an iPad[1] on the console.
1 - another tablet, touchscreen, whatever. Notwithstanding the arguments against touch interfaces in cars.
An "old" phone is what, 4 or 5 years old? At least on the iPhone side, Apple is [in]famously vertically integrated, to have the all the resources needed to update iOS.
And Apple kinda-famously issued a security patch for iOS 12 (released Sept'18) in Jan'23, because pre-2015-ish iPhones could not run any newer version of iOS.
Vs. the computing hardware and software in a modern car comes from how many different supplies, spread across how many tiers, with how little visibility from the PoV of the computers-ain't-their-forte auto makers?
And an "old" car can easily be 10 to 25 years old.
It was never updated.
Possibly because I wasn't going to give them $70 a month for On-star, internet, and GM super naggy status stuff. (Hey! Come pay more for an oil change with us, your car told us you neeeed it!)
It's interesting that you mention GM because they are ditching CarPlay / Android Auto support in some of their vehicles. They think doing so will generate billions in revenue for them.
I expect at some point that stops being feature updates because new features rely on different hardware, but at minimum it means 15 years of security updates... in which case 15 years isn't enough. My last two cars were both on the road longer than 15 years. Thankfully they weren't connected to the internet.
And the other thing they don't commit to is that they'll have 15 years of updates where the maps app runs at more than 2 frames per second. So this had better not be anything like phone updates, where a 5 year old phone is sometimes allowed to run the modern OS update, but it doesn't run well. Will they maintain multiple branches based on different hardware requirements so they can keep shipping performant OS updates on old hardware?
It's a big reason I won't buy a car without CarPlay, I need the escape hatch of being able to run the new maps app from my phone manufacturer, on eventually 10+ years newer phone hardware. Even if the car's infotainment is amazing today, there's no guarantee it will be any good in 10 years and I'd rather have a backup plan.
Isn't it a bit naive to suppose CarPlay will still be a thing in 10+ years? Maybe the iPhoneVR 28 glasses will have a completely different UX and the idea of letting it take over a small part of your car dashboard will be a historic curiosity.
Rivian's position is "you would have to close CarPlay to use the vehicle menus to open your frunk" which is a) not true, and b) says more about their being too cheap to have a frunk release button than it does about CarPlay.
Cars also depend almost entirely on the road infrastructure. The automakers don't support that. People need to realise if they want interoperability they need to choose open standards that their community can maintain. This isn't just a problem with cars.
> What do people say now if they specifically mean a general-purpose computing machine?
"General-purpose computer" seems fine to me.
Newer cars are probably less likely due to how arbitrarily locked down they are, rather than being incapable. The manufacturer could run DOOM on their car that you bought, but you probably can't.
It's like calling a window a door. Yes, they are holes in walls that can be used for ingress or egress, but they completely different expected use cases and designs.
One could make the point that cars contain electronics with firmware which is so hopelessly broken that it needs constant updates. But the point in the article is even further from that and just that they are expected to interoperate with other things like remote services etc.
But like I said, the word is lost and people call iPhones computers too. I wish I hadn't written it now because it wasn't really my main point...
Why are cars different? Personally, I would rather not have the UX of my car be subject to arbitrary change.
Price.
Safety
There's no need for regular updates. Fix problems the way they're normally fixed, and other than that, don't update anything.
I disagree, cars should be fully updated OTA. It's cheaper than a recall and easier for the consumer. New features increase the longevity of the car.
Also, do you have a single example where there was a security vulnerability in the update mechanism of a car that resulted in an attack? Do you have a single example of a loss caused by an update (that would not also occur during offline servicing)?
As opposed to my car getting an OTA update overnight and the only thing I notice is the reversing beep is now a slightly different tone.
That's progress to me.
Unless they are connected to the internet and end up as part of a botnet due to shoddy firmware. Or the manufacturer decides to shut off a cloud service that is needed for their operation for some reason and they get bricked.
IoT devices are the opposite of the example you want to use for stable, functional computers in electronics.
You basically sign up the consumer to an ever-escalating security war against devices by malicious actors.
I just don't want my car to be connected to the internet, full stop, ever. Let it receive GPS signals, and that's it.
Because of this, it should be mandated that 3rd parties be allowed full hardware access/documentation once the warranty period expires.
Automaker wants you to use their software forever? Good. They can out-compete the third parties.
You are allowed to buy third party auto parts, no reason you shouldn't be allowed 3rd party software.
They're working damn hard to prevent that with signing.
Mandating that would also mean the 3rd party also would have to take responsibility that the updated software conforms to spec and doesn't kill someone. Who's going to pay for that?
Besides it's not like people have only "swapped parts". People have basically entirely rebuilt engines and many other systems in the car. You are underselling what what has commonly always been done.
So yeah, I don't really feel like you've answered my original question:
> Haven't third parties been repairing cars for all automotive history?
Software 'repair' consists of managing thousands of dependencies and building new firmware from scratch. Modern cars contain a lot of mandatory safety systems, from ABS to emergency braking, pedestrian detection, emergency SOS calls, active steering with lane assist, speeding notifications, driver fatigue detection etc. Knowing how software companies operate, I presume they got it just about working per spec. I don't know if you can expect a third party to manage such a complex stack and update it in a way that's up to spec and satisfies all legal requirements. And even if that's possible I don't think it will be cheaper anyway. Computers are a very different world, just as car manufacturers are still discovering.
[0] https://www.nbcnews.com/technolog/one-way-get-facebooks-atte...
Because they have Internet connections now, which means they can have remotely exploitable security vulnerabilities.
I do not know if I would take a bet that a user can seamlessly connect CarPlay on their 2014 car with their brand new iPhone 25.
Noone is interested in Software. Software is what is outsourced to India. Software is the super-annoying thing on there very annoying thing(electronics) that is sadly necessary to keep the mechanical marvels developed by the wrench-swinging monkey equivalents of real engineers relevant.
Most in-car ecus are not updatable, that would be 10ct more expensive per part.
If updates are possible, please pay through your nose at the certified repair shop for them to plug a SD card in you have to buy.
Most Car Execs think of software as something that is developed in the same process as a bearing. And it shows.
However maps data is licensed so the cost makes more sense for that.
But this is what I expect, unless you maintain your auto at the dealership paying exorbitant prices for simple things, no updates will ever be done.
It is time for a federal law on this.