Tesla's policy of pirating open-source software misses the whole point of open-source software.
They aren't pirating anything - I understand the MCU's software-stack is largely built with Qt on Linux and they're using both in accordance with their respective licenses (GPLv2 for Linux, and Qt's commerical license) - and they're probably using a smattering of Apache, BSD and MIT-licensed libraries too. The problem we have is the "
Tivoization" issue where companies are technically compliant with GPLv2 despite not giving users any way to modify and install the software on the hardware because the devices themselves are locked-down - if Linux was GPLv3 - or it's discovered they're using anything under GPLv3 then we'd have a case - but until then we're stuck.
Getting to the firmware isn't straightforward - we can't simply intercept the downloads (e.g. by disabling the LTE radio so the car uses Wi-Fi, with our own proxy set-up) because the connection is likely encrypted and there's no way to install a new root CA or trusted certificate list in the car so the proxy wouldn't see anything. Another issue is that the firmware updates are incremental, not complete - so intercepting firmware downloads, even if we could decypt them, won't give us the full picture.
...instead we'd have to dig out the MCU from the car and mount the flash storage chips on another computer assuming they aren't encrypted with some machine key stored on a TPM-like device (a la Bitlocker), in which case the difficulty is now tenfold.
I'm personally not willing to tear-apart the MCU computer in my car, but if someone like RichRebuilds could send-off an MCU to someone who could do it then we'd have a viable method to poke around.
I remember ages ago some people said they were able to access hidden menus and whatnot in the MCU software which I speculated could only be done by tinkering with the firmware - I wonder how they did that.
It's far more likely there's a vulnerability in the USB stack or even the web-browser in the MCU which would allow for the execution of unsigned code, but I wouldn't know where to begin with this - assuming Tesla hasn't aggressively locked-down that avenue. But given that a firmware update can break the heated steering wheel then maybe we shouldn't be so pessimistic?
