Tesla's response to me leaking info about the P100D?

[themetz]

@wk057 thought you'd like to know that you're now headline news over this side of the Atlantic!!
Hacker discovers plans for Elon Musk's P100D Tesla car hidden in software files | Daily Mail Online

 

[dirkhh]

I simply asked for someone to please post the Linux licence that Tesla supposedly breached.

kernel/git/torvalds/linux.git - Linux kernel source tree

Section 3 of that license reads:

3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)

Tesla is in violation of that clause.

 

[jgs]

Pirates act outside of the law and thus don't seek legal advice.

This sounds a little bit like "when the president does it, that means that it is not illegal".

I'm not an expert, but my understanding is that the main reason there isn't case law on enforceability of the GPL is that all violators have settled out of court so far. See for example https://en.wikipedia.org/wiki/Free_Software_Foundation,_Inc._v._Cisco_Systems,_Inc.

 

[apacheguy]

Magnuson–Moss Warranty Act - Wikipedia, the free encyclopedia

Thanks. I was aware of Magnuson Moss. I read the entire Wikipedia article and I see nothing that prevents a company from denying a warranty claim if a condition is not met, especially if that condition existed in the MVPA (which it does). Here's what the wiki did say:

The federal minimum standards for full warranties are waived if the warrantor can show that the problem associated with a warranted consumer product was caused by damage while in the possession of the consumer, or by unreasonable use, including a failure to provide reasonable and necessary maintenance.

I suppose "unreasonable use" could be construed to mean the removal of a sticker that reads "Warranty void", or it this case making modifications to the software which was not an intended use by the manufacturer. Can someone with a legal background clarify exactly under what conditions a warranty claim may be denied?

- - - Updated - - -

Ok, think I got it. So my router carries a "limited" warranty meaning that it is completely valid for the manufacturer to deny my claim if I break the sticker seal. Whereas Tesla provides a "full" warranty and cannot place limitations on the servicing under said warranty.

 

[dirkhh]

This sounds a little bit like "when the president does it, that means that it is not illegal".

I'm not an expert, but my understanding is that the main reason there isn't case law on enforceability of the GPL is that all violators have settled out of court so far. See for example https://en.wikipedia.org/wiki/Free_Software_Foundation,_Inc._v._Cisco_Systems,_Inc.

Indeed, there is very little case law in the US because going to court is very expensive (if you view the problem from the side of the copyright holders who would sue) and very risky (if you view the problem from the side of the accused violator).
There are a number of cases that went to court in Germany (and one is actually tried right now: VMware's GPL violation case rolls into German court • The Register ). A couple of the older cases are mentioned here gpl-violations.org - Wikipedia, the free encyclopedia - some more info on their own web site About the gpl-violations.org project | gpl-violations.org

 

[Discoducky]

Adding my 2 cents...

I appreciate what wk is doing, but hope for more due diligence in the future.

I'm a huge proponent of making the car as safe as possible and that means hardening and continually probing the attack surface. A never ending struggle that is greatly enhanced by the community... if the appropriate due diligence is practiced.

This slip isn't big compared to what it could have been.

 

[int32_t]

Really people? Tesla has included information on an unreleased model in software deployed to customer cars. If they wanted to keep this secret they should have done their jobs in firmware packaging. Tesla software team has been lazy and simply got caught with their pants down.

This is an impressive response. Tesla made a slip up here. And kudos to Jason for not releasing the info earlier, or more info than he did. There really is a high risk of Osborning the company. Jason did them a favor, both exposing the issue and in not doing more damage. And I also believe the Jason did not expect that his little tweet would be decrypted.

Issue? Preparing for future products by adding software and assets for them is an issue? While I'm waiting for my Model 3, I'd much rather they not be forced to worry about things like leaks and worry more about squashing bugs!

 

[Naonak]

kernel/git/torvalds/linux.git - Linux kernel source tree

Section 3 of that license reads:

Tesla is in violation of that clause.

I am not taking a side in this particular debate, but from a legal standpoint, you are making some very ... loose assumptions, namely:

That Tesla has modified the Linux-based source code at all. Having not looked into it, I am only speculating, but I can imagine several scenarios where the car runs the base OS of Linux and Tesla has created userspace programs that run on top of it to operate the car. This would not require them to provide any of their proprietary source code, since they built all of the software themselves, without using any OSS. More often than not, this is typically what you see happen in cases where people claim OSS license violations when there really aren't any. I'm not saying that is the case here, I'm just saying it's a possibility and a likely one at that. To me, it seems more likely than Tesla saying FU to the OSS community and not following the terms of the license.

 

[dirkhh]

I am not taking a side in this particular debate, but from a legal standpoint, you are making some very ... loose assumptions, namely:

That Tesla has modified the Linux-based source code at all. Having not looked into it, I am only speculating, but I can imagine several scenarios where the car runs the base OS of Linux and Tesla has created userspace programs that run on top of it to operate the car. This would not require them to provide any of their proprietary source code, since they built all of the software themselves, without using any OSS. More often than not, this is typically what you see happen in cases where people claim OSS license violations when there really aren't any. I'm not saying that is the case here, I'm just saying it's a possibility and a likely one at that. To me, it seems more likely than Tesla saying FU to the OSS community and not following the terms of the license.

Oh my.
So what makes you an expert to talk about "More often than not, this is typically what you see happen in cases where people claim OSS license violations when there really aren't any."? Can you name a single instance of this happening? With a credible link to a source?
And no, Tesla DEFINITELY changed the kernel (the stock kernel that their build is based on doesn't even support the hardware platform they are running on). And based on Jason's observation they have changed several other components as well, for example the event delivery subsystem.

The number of people stating completely clueless dribble in this thread as "fact" is really becoming tiring. I have worked on Linux for the past 24 years. I actually understand this particular area really well - this is my day job and my main hobby.

 

[techmaven]

Oh my.
So what makes you an expert to talk about "More often than not, this is typically what you see happen in cases where people claim OSS license violations when there really aren't any."? Can you name a single instance of this happening? With a credible link to a source?
And no, Tesla DEFINITELY changed the kernel (the stock kernel that their build is based on doesn't even support the hardware platform they are running on). And based on Jason's observation they have changed several other components as well, for example the event delivery subsystem.

I thought both Ubuntu and NVIDIA had distros that probably matches well against the NVIDIA Tegra 2 and 3 modules that Tesla is using for visual computing modules. Matter of fact, I think the modules are built by NVIDIA for Tesla and therefore an older version of what is posted here might apply:

Linux For Tegra Archive | NVIDIA Developer

Still though, Tesla should post the source tarballs of the relevant portions.

 

[darthy001]

Issue? Preparing for future products by adding software and assets for them is an issue? While I'm waiting for my Model 3, I'd much rather they not be forced to worry about things like leaks and worry more about squashing bugs!

If you dont want said info to go public, then yes its an issue to distribute this info to thousands of customers. Tesla is in my view lucky that wk057 discovered this and not someone out to hurt Tesla and/or TSLA.

Why? Because it seems that wk shared only the most boring part of what he discovered. Potential Facelift-photos, AP 2.0 and other datapoints could easily lead to osbourning here.

That would indeed be a big issue.

 

[Lesifass]

I thought both Ubuntu and NVIDIA had distros that probably matches well against the NVIDIA Tegra 2 and 3 modules that Tesla is using for visual computing modules.

It doesn't even matter.

Whenever you distribute Linux in any form (e.g. as a precompiled BLOB on some storage in a Tesla), you MUST either
- distribute the Linux source code as well - no matter if you changed it or not. Even if you just use a precompiled kernel provided by someone else, you must distribute the source code for that kernel. And explain how to build the kernel from the source code (and AFAIK provide the tools / build system required to build the kernel or something like that… maybe the standard Makefile as found in every Linux tarball is enough?).
- or distribute a written offer for the source code.

AFAICT, Tesla just gives you a car, and that car has GPL'd software on it. So by not giving you a DVD / flash drive / URL / … containg all the source code for GPL'd software they use, they are violating the law. It doesn't matter if it's Ubuntu, precompiled, changed, whatever. They must provide source code. Of course, their proprietary programs like the user interface etc. are most likely running in user space, and the Linux copyright holders made it clear that anything in user space is NOT a derived (from the Linux kernel) work, so that code is probably not GPL'd (unless they use a GPL library for their own stuff). So they don't have to provide source for that. Only for the Linux kernel they use.

So IANAL, but as long as they don't do that, it's probably safe to assume that Tesla violates the license (at least in its intended meaning) and therefore copyright laws. There are LOTS of Linux copyright holders, fortunately (for Tesla) a lot of them don't care about the topic so much.

This is what Mercedes-Benz does to be compliant:
http://www4.mercedes-benz.com/manual-cars/ba/foss/content/en/assets/FOSS_licences.pdf

362 pages listing all of the Free Open Source Software licenses used in their cars. Note that almost all of their cars use software licensed under GPLv2.

 

[darthy001]

It doesn't even matter.

Whenever you distribute Linux in any form (e.g. as a precompiled BLOB on some storage in a Tesla), you MUST either
- distribute the Linux source code as well - no matter if you changed it or not. Even if you just use a precompiled kernel provided by someone else, you must distribute the source code for that kernel. And explain how to build the kernel from the source code (and AFAIK provide the tools / build system required to build the kernel or something like that… maybe the standard Makefile as found in every Linux tarball is enough?).
- or distribute a written offer for the source code.

AFAICT, Tesla just gives you a car, and that car has GPL'd software on it. So by not giving you a DVD / flash drive / URL / … containg all the source code for GPL'd software they use, they are violating the law. It doesn't matter if it's Ubuntu, precompiled, changed, whatever. They must provide source code. Of course, their proprietary programs like the user interface etc. are most likely running in user space, and the Linux copyright holders made it clear that anything in user space is NOT a derived (from the Linux kernel) work, so that code is probably not GPL'd (unless they use a GPL library for their own stuff). So they don't have to provide source for that. Only for the Linux kernel they use.

So IANAL, but as long as they don't do that, it's probably safe to assume that Tesla violates the license (at least in its intended meaning) and therefore copyright laws. There are LOTS of Linux copyright holders, fortunately (for Tesla) a lot of them don't care about the topic so much.

This is what Mercedes-Benz does to be compliant:
http://www4.mercedes-benz.com/manual-cars/ba/foss/content/en/assets/FOSS_licences.pdf

362 pages listing all of the Free Open Source Software licenses used in their cars. Note that almost all of their cars use software licensed under GPLv2.

If I remember correctly, from Dirks previous post on this subject, the userinterface is built using Qt and similar license-issue are applicable there, but my memory might be flawed on this subject.

 

[dirkhh]

If I remember correctly, from Dirks previous post on this subject, the userinterface is built using Qt and similar license-issue are applicable there, but my memory might be flawed on this subject.

The UI is indeed built using Qt. Qt is available either under LGPL or under a commercial license. It is possible that Tesla has a commercial Qt license which would allow avoiding the requirement to release sources. But there are several other pieces of software in the image that are under GPL and require source release.

 

[nikolai]

Has anyone actually asked for the source? IIRC aren't required to freely post it online or anything, but they must respond to requests for the source. Even then, they can still charge for the release of their modified (or unmodified for that matter) source.

 

[darthy001]

The UI is indeed built using Qt. Qt is available either under LGPL or under a commercial license. It is possible that Tesla has a commercial Qt license which would allow avoiding the requirement to release sources. But there are several other pieces of software in the image that are under GPL and require source release.

Ah, that explains my somewhat spotty memory here

 

[ozweepay]

I didn't read all 42 pages of this thread, but I skimmed the first 5.

Questions:

1) How did you get CLI (and root) access to your car?

2) Beware the DMCA. Not sure if anyone has mentioned it yet, but it has been applied very broadly to people who rev-engineer software even if it's not for the purpose of violating copyright.

3) It's always better to clear announcements through the company before going rogue with stuff you figure out. I don't know if you (wk057) tried to contact Tesla first and were ignored? Or if you just went public?

Tesla is very much into their "big announcements" and they try and time things just right and pick the right venues (like any tech company would). If you steal their thunder, they won't be happy, ofc.

Finally, and you surely know this... if Tesla gets angry enough with you they can disable your car. Even with tun0 down (that's the VPN virtual NIC, but there are other ways). Of course you then have legal grounds against them, but I wonder who has more money and more lawyers?

 

[nctalkinghead]

I didn't read all 42 pages of this thread, but I skimmed the first 5.

Questions:

1) How did you get CLI (and root) access to your car?

2) Beware the DMCA. Not sure if anyone has mentioned it yet, but it has been applied very broadly to people who rev-engineer software even if it's not for the purpose of violating copyright.

3) It's always better to clear announcements through the company before going rogue with stuff you figure out. I don't know if you (wk057) tried to contact Tesla first and were ignored? Or if you just went public?

Tesla is very much into their "big announcements" and they try and time things just right and pick the right venues (like any tech company would). If you steal their thunder, they won't be happy, ofc.

Finally, and you surely know this... if Tesla gets angry enough with you they can disable your car. Even with tun0 down (that's the VPN virtual NIC, but there are other ways). Of course you then have legal grounds against them, but I wonder who has more money and more lawyers?

Perhaps you should have read those 42 pages...

 

[Drivin]

This is what Mercedes-Benz does to be compliant:
http://www4.mercedes-benz.com/manual-cars/ba/foss/content/en/assets/FOSS_licences.pdf

362 pages listing all of the Free Open Source Software licenses used in their cars. Note that almost all of their cars use software licensed under GPLv2.

Remember, Tesla is trying to be different from the other manufacturers.

- - - Updated - - -

Oh my.
So what makes you an expert to talk about "More often than not, this is typically what you see happen in cases where people claim OSS license violations when there really aren't any."? Can you name a single instance of this happening? With a credible link to a source?
And no, Tesla DEFINITELY changed the kernel (the stock kernel that their build is based on doesn't even support the hardware platform they are running on). And based on Jason's observation they have changed several other components as well, for example the event delivery subsystem.

The number of people stating completely clueless dribble in this thread as "fact" is really becoming tiring. I have worked on Linux for the past 24 years. I actually understand this particular area really well - this is my day job and my main hobby.

Careful!
If you are actually going to add actual facts and highly relevant experience into these discussions you will be drowned out by the people who "feel" certain ways about Tesla and "The Mission".

 

[bonnie]

Careful!
If you are actually going to add actual facts and highly relevant experience into these discussions you will be drowned out by the people who "feel" certain ways about Tesla and "The Mission".

Hah. You must be new here. Dirk has no problem being heard.