> Researchers who find at least one valid “rooting” vulnerability will receive a permanent SSH certificate for their own car

It feels like this is something you should get by being owner of the car, and not have to do free speculative research for the manufacturer to get it.

Having shell is extremely handy for further discovery. SO handy that if they were just gonna patch the bug and lock you out, you would simply not disclose it.

If they don't give root, researcher may have incentive to keep vuln secret for root access. Looks reasonable.

That’s quite a weak confidence in their own platform security if finding a root level vulnerability is not one-off event, but it’s a program expected to have multiple people routinely finding those.

It's a mixed bag. This only applies to the infotainment system and not the autopilot computer.

They've also revoked certificates from researchers personal cars in the past

Imagine having to hack your device, then having to submit a request to actually own it.

The interesting part is this implies that Tesla cars have static certifcates that don't rotate. (Whoops.)

Diagnostic Trouble Codes?

I spent the last week successfully reverse engineering my car / various scan tools to get the right information to diagnose a fuel pump problem (and to do so without the incredible awkwardness of many of the tools)

It's pretty amazing what Claude + Ghidra + knowledgable coaching can accomplish. It was basically just setting direction, setting up an incremental workflow with the right kind of documentation, and questioning some of its theories and assumptions from time to time.

I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone (specifically the things which definte the protocol to talk to the car and mapping of what various things are reported vs what they actually mean.

That's super cool, I'm currently struggling with scan tools for a 1999 Mercedes E300 Turbodiesel. I had one that worked OK for about a decade (Autel something or other) with a 38pin connector, but it recently bricked itself with a message like "connect via USB to Updata" which I assume means its firmware somehow erased itself. Cannot figure out how to "updata" it, doesn't seem to connect via USB, the Autel software runs under Wine but doesn't appear to recognize the device... gave up and bought an iCarsoft device which sorta kinda works. It can talk to every module except for the ECU (Bosch MSA 25.1 I believe?) however if I tell the device that my car is a different model (1995-1997 naturally aspirated) I can blindly clear ECU DTCs, which is good enough because this thing is barely more complicated than a toaster. All that is to say, this space is ripe for some open hardware/software love.

Not saying there's anything wrong with your perspective (lots of terms get in muddied waters, it's common and not a problem if everyone is on the same page), but this is what I just found on Wikipedia:

"Early on, the notebook computer and LCD vendors commonly used the term LVDS instead of FPD-Link when referring to their protocol, and the term LVDS has mistakenly become synonymous with Flat Panel Display Link in the video-display engineering vocabulary."

https://en.wikipedia.org/wiki/Low-voltage_differential_signa...

LVDS with Fakra connectors is pretty standard in automotive for cameras and displays. The protocols used over it are often proprietary though.

Most modern laptops no longer use LVDS for connecting the screen, but they use eDP (embedded DisplayPort).

So LVDS is more likely to linger in automotive displays, while in less obsolete devices it has been replaced by either eDP or by MIPI DSI (used e.g. in smartphones).

SpaceWire is also just LVDS with an uber-minimal routing protocol. It runs on a lot of satellites.

>then I needed to find a brake controller that can work with the higher voltage (14.4v vs the normal 12v)

Put a voltmeter on the battery terminals of a regular car at 2000rpm and note the voltage. You'd be surpised (the alternator can produce as high as 15V on some cars).

> But then I needed to find a brake controller that can work with the higher voltage (14.4v vs the normal 12v)

Not understanding this sentence. Most running ICE vehicles product closer to that 14.4 than 12v. I think a standard controller would have worked fine?

Just put it online somewhere

That particular statement is also wrong. For this particular setup you can also buy the correct cable (making sure to not get the one that inverts some pins!!!) for cheaper. Mine was around 15$.

Violet HSD Code D 4+2 Pin Female to D Female Jack Connector 6 Pin HSD LVDS High Speed DataTransmission Harness Wire LVDS Cable https://a.aliexpress.com/_EuGOh9e

Honestly I love it. Few things develop a more fun camaraderie than a bringup bootcamp with two precious/priceless new samples on a large conference table, and everyone being very careful to keep cups/mugs very far away.

And a soldering robot with a specialist a few rooms away to beam down the latest errata into physical form, at times.

Tracy Kidder just died, and Soul of a New Machine was a favorite of my formative years as an engineer. Once I started in headunit ECU development it felt very familiar to me at times.

I'm a software guy, but the gear has a lot of allure.

What you're describing is a lab power supply. (The "instantly disarm on short circuit" is overcurrent protection, which is a standard feature.) The name brands like Keysight or Rigol are kind of expensive, but there are a lot of no-name models on Amazon which will do the job well enough.

Got this for ~50$ a while ago. It works perfectly for this exact setup (Tesla MCU on a bench), tested it, and used it for a lot of other projects.

https://a.aliexpress.com/_EvT5Kog

Those were called something like desktop power supplies.

https://www.mouser.com/c/power/power-supplies/power-supplies...

AT $5k it better make me breakfast, too.

They have variable dc power supplies on amazon on the cheap.

If you want that sort of reliability it will probably go towards 100$.

They hit Odin. Odin is the diagnostic tool of Tesla. The tasks they've seen are like "TEST_BRAKE_X_STIFFNESS-TEST-PRESSURE-BURNISHED" and are used to test different components of the car. They're also used for example to reset FSD strikes.

In Tesla terms, the infotainment does much more than just playing music - it has full access to the rest of the car.

I'd guess they fail not on their own, but because they are human interface devices and take the brunt of abuse... e.g. iPhone screens are a popular repair despite being reliable components.

Some newer models have better (bigger) screens, and some are incompatible since they've slightly changed the connector. Old models (pre highland/ jupiter facelift) have used the same display shown in the article for a very long time across M3 and MY. What usually happens is that they physically break because people are not that careful, so the touch screen ends up breaking - although you really have to put a lot of force to break that display.

My 2016 Model S LCD panel developed the well-known fault of delamination and leaking some kind of sticky fluid.

Turns out the early Model S vehicles used consumer grade LCD panels that weren’t designed for the prolonged high heat you get in a metal and glass box left outside in the sun all day.

Tesla since upgraded their vehicle screens to proper automotive-grade LCDs which are excellent.

My point is, automotive-grade hardware is higher spec than regular consumer computer hardware, hence the high prices.

As an aside, I upgraded my whole computer and screen from MCU1 to MCU2 and it was worth the upgrade.

Credit to Tesla for building a retrofit computer upgrade for old vehicles. Thats a non-trivial thing to engineer and I appreciate their effort. Other car manufacturers would prefer you were compelled to buy their latest vehicle instead.

I thought I saw an HDMI connector, but maybe I was wrong.

How many PoE adapters would it take to charge a Tesla?

Interesting take–– I feel the total opposite; I love the UI.

It's glass...

> how could someone be this deep into a project of this depth and not realize this

I think this is a software guy who occasionally dips into hardware things (to hunt bugs).

Even if you know that cars consist of a single wiring harness, it's not implied that they aren't modular and the individual cables cannot be purchased separately.

> and to Tesla's credit they have amazing free docs

Not to Tesla's credit, they had to be dragged kicking and screaming into it (primarily by Massachusetts) and their right to repair legislation through a solid chunk of malicious compliance:

1. When told that they had to have a site for people to order parts, Tesla put up a site that had every single item as "Call us", including the most simple of bolts. And when a few places called, "Sorry, that's not available to you".

2. The service manual was originally only available in a few locations in MA, and had strict conditions: you had to book in advance, there was a $100 fee per booking, and you could only view the manual on premises, and could not bring electronic devices into the room with you, just pen and paper.

The docs they have are great, and who knows how their attitude would have changed over time, but they absolutely didn't want you to have it, initially.

> I was really surprised to read this at the end of the article -- how could someone be this deep into a project of this depth and not realize this?!

Usually, for most other vehicles, the connectors are either standardized (e.g. radios, ISO 10487 [1], high-current chargers by VG 96917) or the foundation plugs, sockets and re-pinning tools are readily available by the vehicle manufacturer or by aftermarket suppliers.

Tesla truly went out of their way to make the life of third parties (such as wire harness repair shops) more miserable here.

[1] https://de.wikipedia.org/wiki/ISO_10487

I will say I’m surprised how far apart the two boxes are in the car. I guess they’re not where I thought. I would assume they’re both up near the dash.

EVS have actually managed to reduce the number of wire bundles (mostly due to switching to Ethernet instead of CAN Bus)

Software people tend to overestimate their knowledge of other disciplines, writing it off as "easy" or work beneath them. Being overpaid compared to your peers certainly doesn't help dispel this feeling. Some people have built entire careers around designing wire looms.

I'm sure you're an expert, pro at everything.

It actually stands for "lizard brain"... it is (or at least was) an Infineon Aurix control and monitoring microcontroller, they may have changed to a newer one.

As a result of this and the child comments…

As an Australian. I often find myself saying things like “the wiring hardness, or loom, or cable, or whatever were calling it this week”.

Exasperated by living in a state other than the one I grew up in. South Australians are often easily spotted by their pronunciation of certain words.

And, of course, Germans have a dedicated composite noun for it: Kabelbaum (literal translation: cable tree).

So what do you call the tubing around the wire bundle? That’s what we call “loom”.