Comment by bri3d
15 days ago
> limit or disable certain functionality in the vehicle: ... over-the-air updates, which provide new ... safety enhancements ...
I wonder what happens if you disable the e-SIM (in the US) and then a safety recall appears via software update - do dealers have any way to update control modules besides OTA?
This is a huge unresolved issue with EVs IMO; ICE cars are required to provide emissions-relevant updates over software which can operate using a J2534 passthrough device, which effectively means powertrain modules have to allow (potentially signed) updates over CAN using software that can be obtained by an end user (a lot of people don't know this; for almost any ICE car in the US, you can buy a 3-day or 1-week subscription to the dealership level diagnostic software for a somewhat reasonable fee and use it with a J2534 device).
But for EVs, there's no such rule and as far as I can tell it's entirely a gray area in the US now; the NHTSA require a "remedy" for recalls but nobody seems to have pushed back to determine whether OTA is truly a remedy. The traditional autos all offer dealerships as a backup option, but Tesla and Rivian have several recalls with only OTA remedies already. This seems sketchy.
> I wonder what happens if you disable the e-SIM (in the US) and then a safety recall appears via software update - do dealers have any way to update control modules besides OTA?
I would assume so. Even on older cars, service techs can typically manually push firmware updates over the OBD-II / J2534 port. Rivian's OBD-II port actually hides an Ethernet signal inside of it - so the interface is certainly there.
Fun fact: You can buy an Ethernet adapter directly from Rivian here to connect to the car's internal network: https://rivianservicetools.com/Catalog/Product/TSN00535-300-...
> Rivian's OBD-II port actually hides an Ethernet signal inside of it - so the interface is certainly there.
Nice. This is really normal now, for what it's worth - all of the European makes have moved this direction as well (DoIP over ENET). There's shockingly little documentation about Rivian online, though, probably because emissions regulation doesn't mandate it.
For those unfamiliar with DoIP:
https://automotivevehicletesting.com/vehicle-diagnostics/doi...
https://www.iso.org/standard/13400-2
4 replies →
Yeah, I got a cable to update my 2017 BMW's infotainment system, and it's OBD-II to RJ45. Doesn't seem to be too new of a thing.
1 reply →
> Even on older cars, service techs can typically manually push firmware updates
Older cars have no concept of such updates.
Happy with my 70s and 80s and early 90s cars.
Actually almost any fuel injected vehicle can accept flash updates through the port to at least the ECU and PCM, frequently the BCU is also write enabled.
1 reply →
You can adjust the ECU for these 80s and 90s cars and “flash” them like anything else. There’s just a lot less settings! Not sure about the 70s but I’m sure some resto-mods also allow for this.
This is tangential, but Kia declined to cover an engine failure, under warranty that was extended by recall, because I had not done an update.
Edit: I eventually recovered most of the cost via a settlement court.
Even more tangential: Kia declined to cover an engine failure, under warranty that was extended by recall because I change my own oil.
Kia's engines are known to fail predictably even within first 100K miles. They extended their warranty because of it. But then they weasel out of it unless you hire an attorney and go to war.
This would be a violation of the Magnuson-Moss Warranty act of 1975 which requires they show the work done directly caused the failure.
If this were a widespread policy I bet class action lawyers would be all over it without you having to pay for it.
5 replies →
This makes me paranoid to buy a new car at this point. I would have to keep every single oil filter receipt and take a video of the DIY oil change.
Yeah, because you allegedly consented to them being able to update your ECUs via the mobile link in the cars when you bought the car.
As if I needed another reason to keep my 2014 skoda.
If i ever have to get a new car, i will disable telemetry, and i will buy it either without telemetry, or with the agreement that i do not consent to telemetry.
(read the fine print before getting a new car. the shit they can do that can go wrong and you have to pay for.. no wonder old cars cost as much as new ones.)
I assure you that “old cars costing as much as new ones” isn’t the result of the market force of people reading contractual fine print and/or freaking out about telemetry. Concentric circles of echo chambers over here.
10 replies →
How do you disable telemetry in a new car. I have a 2022 Kona. It's the first car I've had with telemetry. No idea how to disable it.
7 replies →
> do dealers have any way to update control modules besides OTA?
I get some updates OTA, but the dealer has to install some others, and when I took it there they updated it with a USB stick.
Nice, thanks for the reply; this is surprisingly undocumented online. Presumably if they got cornered and the module under repair was updatable via this mechanism they'd have some ability to use that system, then. I wonder how charitable they will be about using it for non-recall updates for customers who have solely chosen to opt out.
Rivian are probably the only major manufacturer I've never had a chance to look at in any RE capacity and I'm getting more curious by the second. The reaction their vehicles had to the infamous bricked-infotainment update actually represented a pretty good adherence to safety guidelines (the drivetrain as well as the speedometer and warning lights on the cluster still worked in a degraded format even when the infotainment was bricked) IMO, so they do seem to apply a reasonable degree of care.
I said this elsewhere, but I had trouble with Kia even for an issue covered by recall. Because I hadn’t had the update done, they refused to cover.
I wonder what happens if you disable the e-SIM (in the US) and then a safety recall appears via software update - do dealers have any way to update control modules besides OTA?
Yes.
You get a letter in the mail asking you to take your car to the dealer so they can install the update.
Been there. Done this.
Interesting, I reviewed every Rivian software update recall letter I could find before I posted this and they all said something like "If you have not already updated to software version 2025.18.30 or later, please do so to remedy this issue at no cost to you," with no mention of the dealership as a remedy - for example, https://static.nhtsa.gov/odi/rcl/2025/RCLRPT-25V585-0759.pdf . This is different from other manufacturers who explicitly mention the dealer, like this Ford EV recall: https://static.nhtsa.gov/odi/rcl/2025/RCAK-25V863-3736.pdf
Of course they don't mention it. They don't want you to bring it in and have to pay a tech to do the update for you. It doesn't mean the dealership can't do it.
Aren’t Rivian dealers relatively rare? I’d compare them to Tesla.
1 reply →
I wonder what happens if they issue a recall that you want to refuse.
What if they did the EV equivalent of Dieselgate[1]? Say it has a dangerous amount of torque or something, but you like that.
Could you just turn off the network and keep it in the desired (unsupported) state?
[1]: https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal
In the US, a vehicle with an outstanding recall technically isn't roadworthy, though consumer level enforcement of this is non-existent in practice. It's mostly enforced on dealers, who can't sell a vehicle with active recalls. The only way I can imagine it mattering to a consumer is if they sold it.
I can imagine car insurance refusing to pay out in the case of an accident
Doesn't being legally non roadworthy only apply to NHTSA safety recalls while there are other types of recalls for non compliance or manufacturer voluntary recalls?
2 replies →
...do dealers have any way to update control modules besides OTA?
Of course they do. It would be absolutely silly not to. And in the case of safety recalls, their duty to inform you would entail a more traditional and substantiated disclosure i.e. a letter.
"a lot of people don't know this; for almost any ICE car in the US, you can buy a 3-day or 1-week subscription to the dealership level diagnostic software for a somewhat reasonable fee and use it with a J2534 device"
Whoa, didn't know that. Well the caveat is finding a decent J2534 device, right? There are a lot of cheapo knockoffs. Then actually knowing how to use the software with it.
I'm pretty sure decent ones run about 50-80 dollars, a very good one.
Oh that's not bad at all, I thought it was like $500. My cheapo knockoff was $20.
2 replies →
My experience is J2534 support is sketchy and if you want to do the things you actually want to do you need a manufacturer approved device with an insane markup. Also the subscriptions are insanely expensive, not even close to reasonable and you need to be a company (at least you used to be with Ford last time I checked, but they accept the UK or Dutch royal residence as a valid company location so there is that...)
I agree that J2534 is sketchy. The standard isn't very good to start with, there's usually no matrix (ie x systems * y devices) conformance testing but instead just a brief QA step done at some compliance stage in a release process, and most manufacturers don't really want to support it (preferring their in-house dongles). So, a lot of dealer tools do non-standard stuff and a "conforming" J2534 cable doesn't actually work.
Many subscriptions are painful, yes - VW brands / ODIS for example are awful to try to get as an individual and annoying as an independent shop; I'm sure the fraction of independent shops who pirate it are quite high. It's funny you mention Ford though, as they are incredibly easy to buy from in my experience, although the login/licensing backend is frequently broken.
However, there's a good cottage industry of companies reverse engineering the compatibility issues back out, and for better or worse these companies are cloned almost immediately too. I recently did key programming on a newer Ford (where Forscan can't) using a $125 VXDiag cable which I could have bought cloned for $30 and a short-term FDRS subscription that cost $50.
What about using ForSCAN? It allows anyone with the software and a dongle to monitor and to update modules in the ECU AFAIK. I paid under $100 (can't remember) for a dongle and downloaded the free software and it is extremely handy working on one of my vehicles. The other two Fords I own are both pre-OBDII so there is less bullshit on them to begin with. Ford forums are full of owners who use ForSCAN to modify their vehicle's operation. Lots of hacks available.
Just do as /u/bigfatkitten suggests and get the service manuals when you purchase the vehicle.
ForSCAN is awesome but it's an orthogonal conversation since it's a reverse engineered diagnostic tool rather than a first-party one. If we expand the conversation to that space there are tons of options with varying capabilities depending on manufacturer, including also pirating the OEM tools directly. Also worth noting that ForSCAN also doesn't _quite_ support all common operations, for example Remote Keyless Entry enrollment on newer BCMs with push-to-start needs FDRS still.
1 reply →
> at least you used to be with Ford last time I checked
Certainly not any time in the last 15 years that I’ve been buying IDS/FDRS and service manual access.
What ever happened to take it to a dealer or authorized repair place to have it done? While I may be willing to take certain things apart that, the one thing in life I have resisted is any kind of monkeying with my car. There are certain things where I'm willing to accept that I took it apart and it no longer works because I bricked it, shorted something, or otherwise damaged it beyond my skill set to undo. My car is not one of them. However, I also do not want my car to be under the direct control of someone else that can decide I can no longer operate my car. If there's an update, I'll bring it in to have someone trained/responsible for that update.
The perfect modern consumer/sucker...
My car needed another key. The stealership quoted me >$400 for it. I took it as a personal insult and did the research and ordered an OBD device and also discovered you can order replacement keys on aliexpress, and they'll even cut them for you with a good picture of your existing key. It was actually a fun project and very satisfying when I was able to successfully program and link the RFID chip to the ECU to start the engine.
May not be feasible with more locked-down modern cars which I wouldn't touch with a ten-foot pole, but I was able to fix it for about $150, not including my time of course. But I have the OBD device to use next time now as well.
I needed a ford key, but only had a single key.
I bought a kit off of amazon "simple key" that included a programmer and a key with rfid chip. I think about $80.
You plugged the standalone dongle in the OBD2 port, did a procedure and it would take a few minutes and you would get an "original" key.
(The programmer said it was then locked to that VIN)
They key blank provided needed to get cut (did it at home depot).
I could then get additional rfid blanks for $7 and cut and program them.
Once you had two original keys, you could do the "DIY programming" method to make keys 3 and up.
The DIY method was something like "insert key 1, wait 3 seconds, remove, insert key 2 wait 3 seconds remove, insert new key, wait for something, remove" and you would get key 3, 4 ...
There were similar but separate ford procedures for programming the buttons on fobs to lock/unlock doors, etc
>May not be feasible with more locked-down modern cars which I wouldn't touch with a ten-foot pole
What's your plan for the future? I have an old car, but I know it won't last forever.
1 reply →
Which I read this a month ago. Mazda dealer charged me $450 for mine. I figures the entire system is propietiary, so they can charge whatever they want.
Excellent. Sounds about what I’ve paid.
eBay key fob (new) + local locksmith, easy and no insults!
There's really no reason to be scared working on your car. I have no formal training and I have never paid a shop to fix my car in my 20 years of car ownership.
The mechanical parts of a car haven't changed much in the last 25 years, and are easy to understand just by watching a few YouTube videos.
The electronics have certainly gotten more complex, but if you can understand basic computer networking and low voltage electronics it's still quite simple.
If you are interested in learning how to fix your own car, there is a great guy who runs an auto repair business on YouTube and his tagline is: "Remember folks If I can do it, you can do it."
https://www.youtube.com/@SouthMainAuto/videos
Some people like messing with cars. They take the time to understand what's happening and learn the process and pitfalls. Hobbyists wiil never be as good as trained professionally but we can still get the job done. I went through the trouble to diagnose and replace a bad alternator on my civic after the battery started dying too fast. I did it cause it was fun.
The other reason i did it is because the dealership and other shops quoted me over 10 times the cost of parts, and I literally did not have the money to take them up should i have wanted to. Car maintenance is expensive, _especially_ at the dealership.
Some how, we've changed the direction of the conversation to something you lost vs a software update to the brains of the car. I'm guessing just to make the obvious point the dealership is not the cheapest place for repair.??? This isn't change the tire or get an oil change. This is something a consumer has deliberately done to prevent the manufacture from making an OTA software update. These are the kinds of changes that I want someone available right then and there to be responsible if the update borked the car.
1 reply →
What's special about EVs that gives them this loophole? Is it something to do with not having dealerships and going direct to consumer?
Emissions. Most things about ICE cars come through EPA and CARB.
I'm pretty sure that the only diagnostic codes that an ECU is required to output are emissions-related codes. Since EVs have no emissions, I'm gonna guess they can force all diagnostics through the dealer if they really want to.
without oil change and wear of brakes there is little need for inspections.
Ball-joints and tires are still consumables, and they go faster as weight goes up.
1 reply →
WiFi. Flip it on for an update, then leave it off.
> do dealers have any way to update control modules besides OTA?
Yes.
WiFi is, err, still OTA, although it does answer the eSIM question. I assume the truly concerned/paranoid wouldn't want to connect to WiFi either, since presumably telemetry / tracking metadata could be uploaded at that time too.
Anyone concerned about preventing telemetry from being uploaded would probably also be concerned about taking it to the dealer for an update, though. Because how do you know the dealer won't just do an update by turning the car's e-SIM back on, then turning it off before giving the car back to you? Which would then allow the car to upload all the stored telemetry you're concerned about. (Note: generic "you" meaning "the person concerned about telemetry", not bri3d in particular). Or, as long as they've connected a device to the car that can upload data, how do you know that that device won't also download stored data, which the dealership can then upload over their own WiFi?
I believe the truly concerned/paranoid will not want to take their car to the dealership for updates at all. Which would, IMHO, be a mistake: having known security holes in your car's software is more likely to lead to a privacy invasion (via getting your car hacked at some point) than letting the dealership get their hands on it for a few hours.
(I should note that all of this is theoretical for me: I drive a car that's old enough it doesn't have any software).
EDIT to add this P.S.: Actually, I can think of one category of people who would be concerned enough to turn off the car's ability to connect to the Internet, but feel fine about taking it to a dealer for updates. That would be people who want to turn off the car's Internet connectivity not because of privacy concerns, but because they don't want anyone to be able to disable the car (either via hacking or via "legitimate" means, i.e. the manufacturer does it) while they're driving. Such a person would care a lot about the car's Internet access being completely off while they are driving, but not care about it being turned on while it is at the dealership.
2 replies →
I kinda assume the dealer does this as part of any service they do. Either that, or they update some other way. My software notices went away when I had my service done, even though I’ve opted out of everything (and verified again after).
can you leave it off? Tesla wifi can be turned OFF, but will flip to ON next time the car is used. same with bluetooth. deliberately promiscuous.
[dead]
[flagged]