Tesla, Linux and the GPL

[smac]

Well, I plan to try and confirm my method of entry still exists on current firmware before bothering to talk to Tesla about anything. I have a feeling it's been patched... and if it hasn't, someone is slacking pretty badly. This was one of those times where I literally facepalmed when I saw the root@cid-5xxxxxxxxxxxxxxx# prompt... mainly because I had initially thought to try it but assumed it'd be a waste of time and wouldn't work.

A well known Ubuntu vulnerability?

 

[dirkhh]

A well known Ubuntu vulnerability?

Contrary to a very very stubborn rumor, no, Tesla is NOT running Ubuntu. They run their own custom distribution. And they continue to be in violation of the GPL even though they have been approached several time with increasingly sternly worded requests to fix that.

 

[smac]

Contrary to a very very stubborn rumor, no, Tesla is NOT running Ubuntu. They run their own custom distribution. And they continue to be in violation of the GPL even though they have been approached several time with increasingly sternly worded requests to fix that.

Thanks for clearing this up. Is it from the ground up, or a branch of another distro ?

Either way it would seem to me they will always be behind the curve on patching compared to the mainstream distro's. (And as Jason has suggested probably less bothered about some of the potential vulnerabilities if they require hardware access). I guess that's part of my point, depending on the lineage of Tesla's OS a vulnerability in a common distro may sit uncorrected for a while after.

As for violating GPL, yes I'd heard this, not particularly enamored by it TBH. While I'm not a big OS contributor (I work in proprietary Windows stuff mainly to pay the bills), I am _very_ careful not to use GPL stuff in such projects as I fully respect the authors choice!

 

[wk057]

A well known Ubuntu vulnerability?

Contrary to a very very stubborn rumor, no, Tesla is NOT running Ubuntu. They run their own custom distribution. And they continue to be in violation of the GPL even though they have been approached several time with increasingly sternly worded requests to fix that.

Dunno. This would tend to disagree:

Linux cid 2.6.36.3-pdk25.023-Tesla-core-2014.1 #see_/etc/commit SMP PREEMPT 1202798460 armv7l GNU/Linux




[B]Welcome to Ubuntu![/B]
 * Documentation:  https://help.ubuntu.com/
Last login: Sat Dec 19 08:34:37 2015 from 192.168.90.99
tesla@cid-5YJSA1H11Exxxxxxx$

Granted, there is basically nothing left of ubuntu here, but, that seems to be where they started.

Wasn't an ubuntu exploit.

It's not the exploit, which I agree, if you have to have physical access to the car and dismantle it even a bit isn't a huge concern.

Posting pictures of the internal systems... Eh, i dunno. I have very mixed feelings about it.

*shrugs*

I think Tesla will have some convincing to do on that front. I could see them having an issue if I gave out instructions on how to do all of this. But there's nothing super secretive going on in the diagnostic data. I mean, there are settings for rear radars and stuff... but, who cares about that...

 

[dirkhh]

Thanks for clearing this up. Is it from the ground up, or a branch of another distro ?

I hear that it is a Debian fork.

Either way it would seem to me they will always be behind the curve on patching compared to the mainstream distro's. (And as Jason has suggested probably less bothered about some of the potential vulnerabilities if they require hardware access). I guess that's part of my point, depending on the lineage of Tesla's OS a vulnerability in a common distro may sit uncorrected for a while after.

They are on ancient versions on some of the libraries - the Qt WebKit used for the browser is so old it's not even funny.

As for violating GPL, yes I'd heard this, not particularly enamored by it TBH. While I'm not a big OS contributor (I work in proprietary Windows stuff mainly to pay the bills), I am _very_ careful not to use GPL stuff in such projects as I fully respect the authors choice!

Let's just say that this contains a bit of code that I have written, a TON of code that my company has written and is in violation of the copyrights (and, hehe, trademarks) of some of my closest friends. So I take this very personally.

 

[smac]

Dunno. This would tend to disagree:

Linux cid 2.6.36.3-pdk25.023-Tesla-core-2014.1 #see_/etc/commit SMP PREEMPT 1202798460 armv7l GNU/Linux




[B]Welcome to Ubuntu![/B]
 * Documentation:  https://help.ubuntu.com/
Last login: Sat Dec 19 08:34:37 2015 from 192.168.90.99
tesla@cid-5YJSA1H11Exxxxxxx$

Granted, there is basically nothing left of ubuntu here, but, that seems to be where they started.

lol, well that seems pretty definitive

 

[dirkhh]

Dunno. This would tend to disagree:

Linux cid 2.6.36.3-pdk25.023-Tesla-core-2014.1 #see_/etc/commit SMP PREEMPT 1202798460 armv7l GNU/Linux




[B]Welcome to Ubuntu![/B]
 * Documentation:  https://help.ubuntu.com/
Last login: Sat Dec 19 08:34:37 2015 from 192.168.90.99
tesla@cid-5YJSA1H11Exxxxxxx$

Granted, there is basically nothing left of ubuntu here, but, that seems to be where they started.

I couldn't remember if they started from Debian or Ubuntu. Given how much they stripped away it doesn't really matter. My point is they aren't "running Ubuntu".
2.6.36. That hurts. Oct 2010. So they likely started from Ubuntu 10.10 and did the critical update to 2.6.36 (because .35 had serious issues) but haven't done much since then... And 2.6.36 has a TON of exploits - it hasn't received security updates in ages.

 

[smac]

I couldn't remember if they started from Debian or Ubuntu. Given how much they stripped away it doesn't really matter. My point is they aren't "running Ubuntu".
2.6.36. That hurts. Oct 2010. So they likely started from Ubuntu 10.10 and did the critical update to 2.6.36 (because .35 had serious issues) but haven't done much since then... And 2.6.36 has a TON of exploits - it hasn't received security updates in ages.

If I understand correctly this is v6.x, it could have moved on a chunk since then with v7.x (you'd hope at least)

- - - Updated - - -

I mean, there are settings for rear radars and stuff... but, who cares about that...

Tease

 

[Cosmacelf]

Gawd why didn't tesla use a commercial os, maybe even a real time os optimized for the task rather than hack away at freeware?

 

[Cosmacelf]

And it's pretty sad they didn't comply with the gpl. What would they have to do to be compliant?

 

[green1]

Yeah I have mixed feelings too. On the one hand I really love seeing this stuff but it's Tesla's intellectual property.

It seems that a fair amount of it is not Tesla's IP, and that they are using it illegally. In light of that, I'm not sure why anyone should feel bad about someone posting perfectly legal pictures of what they find doing perfectly legal things with a piece of hardware that they fully own.

 

[smac]

And it's pretty sad they didn't comply with the gpl. What would they have to do to be compliant?

Biggest hurdles are attribute copyright to FSF and publish their source code (well at least some of it, delineation can be a challenge). Both are unpalatable for proprietary business models.


http://www.gnu.org/licenses/gpl-faq.en.html#AssignCopyright

http://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourcePostedPublic


Given Tesla don't seem to want to do this, choosing a base other than a GPL'd source would have arguably been more sensible, but would have cost more back in the days they were tight on cost control. Cynic in me says "Lawyers fees" were less than "Licence fees".

 

[green1]

Biggest hurdles are attribute copyright to FSF and publish their source code (well at least some of it, delineation can be a challenge). Both are unpalatable for proprietary business models.

But that's also completely irrelevant. If I don't want to pay Microsoft for their license fees for Windows, that doesn't mean I can just use it for free. Same here, they didn't want to pay the "fee" (give attribution and post appropriate source) so they can't use the software, it's as simple as that.

I hope the FSF keeps pursuing this, they have proven very reasonable in the past, they don't tend to go after punitive damages and massive settlements, they only try to force compliance with the license.

 

[dirkhh]

Gawd why didn't tesla use a commercial os, maybe even a real time os optimized for the task rather than hack away at freeware?

That's a pretty sad statement. You realize that most every embedded device these days runs Linux. You had an MRI lately? That's a Linux box. You have a wifi router at home? >50% Linux. You have a smartphone? 70% Linux. Your TiVo? Linux. Basically every single car maker has their next gen IVI system running Linux. Audi, BMW, Mercedes, Toyota, Jaguar, Land Rover, Porsche... all running Linux. QNX and VxWorks are both shrinking fast in market share.

 

[smac]

But that's also completely irrelevant. If I don't want to pay Microsoft for their license fees for Windows, that doesn't mean I can just use it for free. Same here, they didn't want to pay the "fee" (give attribution and post appropriate source) so they can't use the software, it's as simple as that.

I hope the FSF keeps pursuing this, they have proven very reasonable in the past, they don't tend to go after punitive damages and massive settlements, they only try to force compliance with the license.

I'm with you on this! My meaning of unpalatable to Tesla because they don't want to do this, and they don't want to pay out for the true cost of writing a replacement that doesn't require GPL. So yes it is as simple as that!

As I said before I work in the proprietary side of the fence. I'm simply saying why the GPL model doesn't fit well when you are selling proprietary software. Pay a non GPL bound vendor for a royalty free distribution licence, or give up source of your own code base / copyright and use GPL.

Both have a cost one is monetary, one is more subtle (though ultimately can have monetary impact on business valuations).

I too hope FSF take this up and make Tesla comply. Being a high visibility business, with "doing good for the world" image, shouldn't be enough to let them ride roughshod over the wishes of the original authors!

 

[dirkhh]

Gawd why didn't tesla use a commercial os, maybe even a real time os optimized for the task rather than hack away at freeware?

Biggest hurdles are attribute copyright to FSF and publish their source code (well at least some of it, delineation can be a challenge). Both are unpalatable for proprietary business models.


http://www.gnu.org/licenses/gpl-faq.en.html#AssignCopyright

http://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourcePostedPublic


Given Tesla don't seem to want to do this, choosing a base other than a GPL'd source would have arguably been more sensible, but would have cost more back in the days they were tight on cost control. Cynic in me says "Lawyers fees" were less than "Licence fees".

Attribute copyright to the FSF? Heck no. The FSF holds no copyright on Linux. About 15000 different developers (including yours truly) hold copyright to the Linux kernel. Linus holds the trademark.
And all they need to publish are the sources for their changes to the Linux kernel. All the software above follows its own licenses. I happen to know that they hold a commercial license to Qt, so all of their user facing applications they do not need to open source, unless they based them on something that had a reciprocal license to begin with (like the kernel).

- - - Updated - - -

But that's also completely irrelevant. If I don't want to pay Microsoft for their license fees for Windows, that doesn't mean I can just use it for free. Same here, they didn't want to pay the "fee" (give attribution and post appropriate source) so they can't use the software, it's as simple as that.

I hope the FSF keeps pursuing this, they have proven very reasonable in the past, they don't tend to go after punitive damages and massive settlements, they only try to force compliance with the license.

I repeat, the FSF has nothing to do with this whatsoever. Please.

Several of the copyright holders have contacted Tesla. We have been ignored for a while. After a bigger industry consortium representing many of the companies heavily contributing to Linux (and defending Linus' rights) contacted them they at least responded, but after many promises they still haven't actually released the source. They may be confused that in the legal world Tesla Time is not applicable.

 

[AWDtsla]

Contrary to a very very stubborn rumor, no, Tesla is NOT running Ubuntu. They run their own custom distribution. And they continue to be in violation of the GPL even though they have been approached several time with increasingly sternly worded requests to fix that.

This is something Tesla should be a leader in. It's almost a letter to Elon moment. They should open source the whole stack, and unhide the service center stuff while they are at it. In this day and age all the diagnostics and service functions should be accessible to anyone, before the law makes you do it...

Tesla could be getting patches sent back to fix bugs, for free...

 

[dirkhh]

As I said before I work in the proprietary side of the fence. I'm simply saying why the GPL model doesn't fit well when you are selling proprietary software. Pay a non GPL bound vendor for a royalty free distribution licence, or give up source of your own code base / copyright and use GPL.

Both have a cost one is monetary, one is more subtle (though ultimately can have monetary impact on business valuations).

I too hope FSF take this up and make Tesla comply. Being a high visibility business, with "doing good for the world" image, shouldn't be enough to let them ride roughshod over the wishes of the original authors!

No - most every large corporation uses GPL code all the time. Microsoft, IBM, Amazon, Facebook. Every major investment bank. Nearly all of the major car makers. Apple is the outlier. They used to use a ton of GPL software but hated to have to comply to the licenses so they have gone out of their way to reduce their dependency on GPL code.

And yes, the actual copyright holders are pursuing this (but NOT the FSF - please, leave them out of the conversation... completely different rat hole). No one is trying to extract money from Tesla. But at some point they will get sued and that will cost them money. It's mainly just freaking annoying because they have this do-good image and that loud mouth joker at the helm who talks about "open sourcing patents" when his company can't even comply with the inbound license of the software that they use in their product.

- - - Updated - - -

This is something Tesla should be a leader in. It's almost a letter to Elon moment.

Trust me. Many a letter to him has been written. Many.

They should open source the whole stack, and unhide the service center stuff while they are at it. In this day and age all the diagnostics and service functions should be accessible to anyone, before the law makes you do it...

Tesla could be getting patches sent back to fix bugs, for free...

I don't know if that's true. If they asked me (and we all know they don't) then I'd advise them against open sourcing the rest of their stack.

 

[AWDtsla]

No - most every large corporation uses GPL code all the time. Microsoft, IBM, Amazon, Facebook. Every major investment bank. Nearly all of the major car makers. Apple is the outlier. They used to use a ton of GPL software but hated to have to comply to the licenses so they have gone out of their way to reduce their dependency on GPL code.

But they still publish non-GPL stuff. opensource.apple.com

 

[dirkhh]

But they still publish non-GPL stuff. opensource.apple.com

<really off topic now> Yes they do. They just open sourced Swift. They are actually quite active in open source. They just have a GPL-allergy