Security engineers, unfortunately, have a weaker voice at the table than do the marketers and bean-counters.

The more secure means would be to require the car be taken to a dealership -- but that's costly to the auto maker (they have to pay the dealers for updates they apply), and is deemed an inconvenience to the customer. They worry about the friction on the customer, and the cost.

With OTA updates, much of the security relies on using signed images. The SoCs in IVI systems are fused with the auto maker's key.

>marketers and bean-counters

Unfortunately, it's somewhat unfair to always blame the non-engineering folks. Many times is other engineering domains that run counter to good security. In my experience, cost or schedule are the leading factors but sometimes engineers want to push for certain features that are not compatible with good safety or security practices.

Remote no-interaction autoupdate is a remote code execution vulnerability, even if well-intentioned and cryptographically signed.

And yet security engineers, in a kind of circular madness, demand remote updating so they can update their protections against remote updating.

Well Tesla does it and their customers love waiting hours for software updates (I'm not being sarcastic, this is literally what we found through benchmarking)

I kept pleading that we don't have the marketing that Tesla has, our customers don't want to think about updates. Not to mention OTA costs money. Tesla can do it because they are sinking money and only have a few hundred thousand cars. My company sells millions of cars per year, OTA is significantly more expensive.

I'm not saying my company does OTA often, but the word Tesla cones up more often than it should.

> Well Tesla does it and their customers love waiting hours for software updates (I'm not being sarcastic, this is literally what we found through benchmarking)

I've done several OTAs on a Tesla. Most were about 1 month apart, and my longest update took 28 minutes. The average is closer to 15.

> Tesla can do it because they are sinking money and only have a few hundred thousand cars.

I won't get into whether they are sinking money, but they have about 1.6 million cars.

> my longest update took 28 minutes

How does it work? Is it automatic during the night when the car is parked and you're asleep (that would be ideal) or does it updates when you start the car and would be ready to go (that would be a nightmare)? Maybe something in between.

You get an update prompt on screen (and on your phone). The car asks you to schedule a time to install (normally 1 AM) or allows you to update immediately.

When an update is triggered (manually or on a timer) you get a 2-minute countdown to restart and then it will install.

So “we had to call an ambulance because the car was installing updates” is a real potential scenario?

> I've done several OTAs on a Tesla. Most were about 1 month apart, and my longest update took 28 minutes. The average is closer to 15.

Interesting. My Model X always estimates 25 but it's usually closer to an hour.