Remix.run Logo
bri3d 4 hours ago

> limit or disable certain functionality in the vehicle: ... over-the-air updates, which provide new ... safety enhancements ...

I wonder what happens if you disable the e-SIM (in the US) and then a safety recall appears via software update - do dealers have any way to update control modules besides OTA?

This is a huge unresolved issue with EVs IMO; ICE cars are required to provide emissions-relevant updates over software which can operate using a J2534 passthrough device, which effectively means powertrain modules have to allow (potentially signed) updates over CAN using software that can be obtained by an end user (a lot of people don't know this; for almost any ICE car in the US, you can buy a 3-day or 1-week subscription to the dealership level diagnostic software for a somewhat reasonable fee and use it with a J2534 device).

But for EVs, there's no such rule and as far as I can tell it's entirely a gray area in the US now; the NHTSA require a "remedy" for recalls but nobody seems to have pushed back to determine whether OTA is truly a remedy. The traditional autos all offer dealerships as a backup option, but Tesla and Rivian have several recalls with only OTA remedies already. This seems sketchy.

tjohns 4 hours ago | parent | next [-]

> I wonder what happens if you disable the e-SIM (in the US) and then a safety recall appears via software update - do dealers have any way to update control modules besides OTA?

I would assume so. Even on older cars, service techs can typically manually push firmware updates over the OBD-II / J2534 port. Rivian's OBD-II port actually hides an Ethernet signal inside of it - so the interface is certainly there.

Fun fact: You can buy an Ethernet adapter directly from Rivian here to connect to the car's internal network: https://rivianservicetools.com/Catalog/Product/TSN00535-300-...

bri3d 4 hours ago | parent [-]

> Rivian's OBD-II port actually hides an Ethernet signal inside of it - so the interface is certainly there.

Nice. This is really normal now, for what it's worth - all of the European makes have moved this direction as well (DoIP over ENET). There's shockingly little documentation about Rivian online, though, probably because emissions regulation doesn't mandate it.

foresto 2 hours ago | parent | next [-]

For those unfamiliar with DoIP:

https://automotivevehicletesting.com/vehicle-diagnostics/doi...

https://www.iso.org/standard/13400-2

Hamuko 3 hours ago | parent | prev [-]

Yeah, I got a cable to update my 2017 BMW's infotainment system, and it's OBD-II to RJ45. Doesn't seem to be too new of a thing.

bri3d 3 hours ago | parent [-]

Yep! Depending on the vintage, BMWs have "real" DoIP or a BMW-ized version (sort of like how KWP2000 was the predecessor to UDS). For emissions modules, they still also have to support updates over UDS as well as ENET, though, for the above mentioned J2534 reasons (Ethernet wasn't added to J2534 until 2022).

dylan604 26 minutes ago | parent | prev | next [-]

What ever happened to take it to a dealer or authorized repair place to have it done? While I may be willing to take certain things apart that, the one thing in life I have resisted is any kind of monkeying with my car. There are certain things where I'm willing to accept that I took it apart and it no longer works because I bricked it, shorted something, or otherwise damaged it beyond my skill set to undo. My car is not one of them. However, I also do not want my car to be under the direct control of someone else that can decide I can no longer operate my car. If there's an update, I'll bring it in to have someone trained/responsible for that update.

codazoda 2 hours ago | parent | prev | next [-]

This is tangential, but Kia declined to cover an engine failure, under warranty that was extended by recall, because I had not done an update.

Edit: I eventually recovered most of the cost via a settlement court.

monegator 2 hours ago | parent | next [-]

Yeah, because you allegedly consented to them being able to update your ECUs via the mobile link in the cars when you bought the car.

As if I needed another reason to keep my 2014 skoda.

If i ever have to get a new car, i will disable telemetry, and i will buy it either without telemetry, or with the agreement that i do not consent to telemetry.

(read the fine print before getting a new car. the shit they can do that can go wrong and you have to pay for.. no wonder old cars cost as much as new ones.)

UqWBcuFx6NV4r 35 minutes ago | parent [-]

I assure you that “old cars costing as much as new ones” isn’t the result of the market force of people reading contractual fine print and/or freaking out about telemetry. Concentric circles of echo chambers over here.

freeopinion an hour ago | parent | prev [-]

Even more tangential: Kia declined to cover an engine failure, under warranty that was extended by recall because I change my own oil.

Kia's engines are known to fail predictably even within first 100K miles. They extended their warranty because of it. But then they weasel out of it unless you hire an attorney and go to war.

stronglikedan 4 hours ago | parent | prev | next [-]

> do dealers have any way to update control modules besides OTA?

I get some updates OTA, but the dealer has to install some others, and when I took it there they updated it with a USB stick.

bri3d 4 hours ago | parent [-]

Nice, thanks for the reply; this is surprisingly undocumented online. Presumably if they got cornered and the module under repair was updatable via this mechanism they'd have some ability to use that system, then. I wonder how charitable they will be about using it for non-recall updates for customers who have solely chosen to opt out.

Rivian are probably the only major manufacturer I've never had a chance to look at in any RE capacity and I'm getting more curious by the second. The reaction their vehicles had to the infamous bricked-infotainment update actually represented a pretty good adherence to safety guidelines (the drivetrain as well as the speedometer and warning lights on the cluster still worked in a degraded format even when the infotainment was bricked) IMO, so they do seem to apply a reasonable degree of care.

codazoda 2 hours ago | parent [-]

I said this elsewhere, but I had trouble with Kia even for an issue covered by recall. Because I hadn’t had the update done, they refused to cover.

traderj0e 2 hours ago | parent | prev | next [-]

"a lot of people don't know this; for almost any ICE car in the US, you can buy a 3-day or 1-week subscription to the dealership level diagnostic software for a somewhat reasonable fee and use it with a J2534 device"

Whoa, didn't know that. Well the caveat is finding a decent J2534 device, right? There are a lot of cheapo knockoffs. Then actually knowing how to use the software with it.

surge 2 hours ago | parent [-]

I'm pretty sure decent ones run about 50-80 dollars, a very good one.

traderj0e 2 hours ago | parent [-]

Oh that's not bad at all, I thought it was like $500. My cheapo knockoff was $20.

roflchoppa 42 minutes ago | parent [-]

Have you flashed anything? I need to flash the gearbox on my CRV, really wanted to DIY it at home and not get upcharged by the stealerships.

https://www.crvownersclub.com/attachments/tsb-15-086-crv-tra...

traderj0e 23 minutes ago | parent [-]

No, but I'm not a good person to ask. My two cars are on opposite extremes, one is simple and doesn't need anything beyond OBD2, and the other is too scary to mess with digitally.

xmprt an hour ago | parent | prev | next [-]

What's special about EVs that gives them this loophole? Is it something to do with not having dealerships and going direct to consumer?

bri3d an hour ago | parent | next [-]

Emissions. Most things about ICE cars come through EPA and CARB.

froh an hour ago | parent | prev [-]

without oil change and wear of brakes there is little need for inspections.

flounder3 3 hours ago | parent | prev | next [-]

WiFi. Flip it on for an update, then leave it off.

> do dealers have any way to update control modules besides OTA?

Yes.

codazoda 2 hours ago | parent | next [-]

I kinda assume the dealer does this as part of any service they do. Either that, or they update some other way. My software notices went away when I had my service done, even though I’ve opted out of everything (and verified again after).

bri3d 2 hours ago | parent | prev [-]

WiFi is, err, still OTA, although it does answer the eSIM question. I assume the truly concerned/paranoid wouldn't want to connect to WiFi either, since presumably telemetry / tracking metadata could be uploaded at that time too.

rmunn 2 hours ago | parent [-]

Anyone concerned about preventing telemetry from being uploaded would probably also be concerned about taking it to the dealer for an update, though. Because how do you know the dealer won't just do an update by turning the car's e-SIM back on, then turning it off before giving the car back to you? Which would then allow the car to upload all the stored telemetry you're concerned about. (Note: generic "you" meaning "the person concerned about telemetry", not bri3d in particular). Or, as long as they've connected a device to the car that can upload data, how do you know that that device won't also download stored data, which the dealership can then upload over their own WiFi?

I believe the truly concerned/paranoid will not want to take their car to the dealership for updates at all. Which would, IMHO, be a mistake: having known security holes in your car's software is more likely to lead to a privacy invasion (via getting your car hacked at some point) than letting the dealership get their hands on it for a few hours.

(I should note that all of this is theoretical for me: I drive a car that's old enough it doesn't have any software).

EDIT to add this P.S.: Actually, I can think of one category of people who would be concerned enough to turn off the car's ability to connect to the Internet, but feel fine about taking it to a dealer for updates. That would be people who want to turn off the car's Internet connectivity not because of privacy concerns, but because they don't want anyone to be able to disable the car (either via hacking or via "legitimate" means, i.e. the manufacturer does it) while they're driving. Such a person would care a lot about the car's Internet access being completely off while they are driving, but not care about it being turned on while it is at the dealership.

reaperducer 2 hours ago | parent | prev | next [-]

I wonder what happens if you disable the e-SIM (in the US) and then a safety recall appears via software update - do dealers have any way to update control modules besides OTA?

Yes.

You get a letter in the mail asking you to take your car to the dealer so they can install the update.

Been there. Done this.

bri3d 2 hours ago | parent [-]

Interesting, I reviewed every Rivian software update recall letter I could find before I posted this and they all said something like "If you have not already updated to software version 2025.18.30 or later, please do so to remedy this issue at no cost to you," with no mention of the dealership as a remedy - for example, https://static.nhtsa.gov/odi/rcl/2025/RCLRPT-25V585-0759.pdf . This is different from other manufacturers who explicitly mention the dealer, like this Ford EV recall: https://static.nhtsa.gov/odi/rcl/2025/RCAK-25V863-3736.pdf

bombcar 2 hours ago | parent [-]

Aren’t Rivian dealers relatively rare? I’d compare them to Tesla.

sieabahlpark 4 hours ago | parent | prev | next [-]

[dead]

juleiie 3 hours ago | parent | prev [-]

[flagged]