• 0 Posts
  • 237 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle







  • “Recall” is a legal term defined by the National Highway Traffic Safety Administration. It means an issue was reported to them, they investigated it and determined that there is an unreasonable safety risk, or minimal safety standards have not been met. As part of that investigation they also work with the manufacturer to identify the range of vehicles involved. NHTSA then issues the formal recall notice, which legally requires the manufacturer to address the issue by notifying the impacted owners and either repairing or replacing the defect, or in extreme cases issuing a refund or buying back the vehicle. Again, this is all a legal process that NHTSA and the manufacturer must follow, and it makes no distinction between software and other components.

    I’ve actually had a car with a rather significant software issue that I had to go to a dealer to fix. Long story short, the battery would die every few weeks and leave me needing a jump start. I replaced the battery twice and even the brand new batteries would die quite often. I eventually found two recall notices on my own that perfectly described the symptoms I was seeing. The recalls documented bugs in the firmware in the ECU that would randomly disable the alternator, preventing the battery from charging. I had to bring the car to a dealer to have them update the ECU firmware since that’s not something you can do yourself.






  • Well that’s the thing about edge cases - by definition they haven’t been explicitly taken into account by the programming in these cars. It is literally impossible to define them all, program responses for them, and test those situations in real-world situations. For a self driving car to handle real-world edge cases it needs to be able to identify when one is happening and very quickly determine a safe response to it.

    These cars may already be safer than drunk/drowsy drivers in optimal situations, but even a drowsy driver will likely respond safely if they encounter an unusual situation that they’ve never seen before. At the very least they’d likely slow down or stop until they can assess the situation and figure out to proceed. Self driving cars also need to be able to recognize completely new/unexpected situations and figure out how to proceed safely. I don’t think they will be able to do that without some level of human intervention until true AI exists, and we’re still many decades away from that.



  • Couldn’t agree more. If all driving was easily predictable then “just better than humans” would be reasonable. But in my decades of driving I’ve encountered so many edge cases I’ve had to deal with that I seriously doubt true self driving will exist until we developed true AI (not just the LLM stuff that’s currently all the rage) that can react to events that aren’t pre-programmed.

    Just a few examples of things I’ve encountered:

    • A car fully engulfed in flames in the middle of a busy multi-lane intersection. I had a green light but I could hear (and barely see) emergency vehicles approaching from a different direction, so I had to give way.
    • Trees fallen entirely across the road.
    • I’ve seen a Tesla get confused by a landscaping truck hauling a trailer overflowing with tree trimmings so much that it looked like a giant bush. You couldn’t see the trailer, brake lights, license plate, etc. Would a Waymo car be able to tell the difference between a trailer like this and the above mentioned tree blocking the road?
    • Part of a one-way road near me was closed for a while so a water main could be repaired. People who lived on the street, delivery vehicles, etc. had to drive the wrong way to get out of there. Would a self driving car recognize when to do this?
    • I once stopped at a red light where a construction crew was working at the corner. I didn’t notice a cop standing near them was waving me through the red light until he walked up to my car and yelled at me to go. Would a self driving car recognize when a police officer overrides a traffic light?
    • Driving after heavy rain and encountering flooded roads where the sun & other reflections make it tough to spot at a distance.
    • And many, many more…



  • Oh there are definitely ways to circumvent many bot protections if you really want to work at it. Like a lot of web protection tools/systems, it’s largely about frustrating the attacker to the point that they give up and move on.

    Having said that, I know Akamai can detect at least some instances where browsers are controlled as you suggested. My employer (which is an Akamai customer and why I know a bit about all this) uses tools from a company called Saucelabs for some automated testing. My understanding is that our QA teams can create tests that launch Chrome (or other browsers) and script their behavior to log into our website, navigate around, test different functionality, etc. I know that Akamai can recognize this traffic as potentially malicious because we have to configure the Akamai WAF to explicitly allow this traffic to our sites. I believe Akamai classifies this traffic as a “headless” Chrome impersonator bot.


  • When any browser, app, etc. makes an HTTP request, the request consists of a series of lines (headers) that define the details of the request, and what is expected in the response. For example:

    
    GET /home.html HTTP/1.1
    Host: developer.mozilla.org
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:50.0) Gecko/20100101 Firefox/50.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate, br
    Referer: https://developer.mozilla.org/testpage.html
    Connection: keep-alive
    Upgrade-Insecure-Requests: 1
    Cache-Control: max-age=0
    
    

    The thing is, many of these headers are optional, and there’s no requirement regarding their order. As a result, virtually every web browser, every programming framework, etc. sends different headers and/or orders them differently. So by looking at what headers are included in a request, the order of the headers, and in some cases the values of some headers, it’s possible to tell if a person is using Firefox or Chrome, even if you use a plug-in to spoof your User-Agent to look like you’re using Safari.

    Then there’s what is known as TLS fingerprinting, which can also be used to help identify a browser/app/programming language. Since so many sites use/require HTTPS these days it provides another way to collect details of an end user. Before the HTTP request is sent, the client & server have to negotiate the encryption to use. Similar to the HTTP headers, there are a number of optional encryption protocols & ciphers that can be used. Once again, different browsers, etc. will offer different ciphers & in different orders. The TLS fingerprint for Googlebot is likely very different than the one for Firefox, or for the Java HTTP library or the Python requests package, etc.

    On top of all this Akamai uses other knowledge & tricks to determine bots vs. humans, not all of which is public knowledge. One thing they know, for example, is the set of IP addresses that Google’s bots operate out of. (Google likely publishes it somewhere) So if they see a User-Agent identifying itself as Googlebot they know it’s fake if it didn’t come from one of Google’s IP’s. Akamai also occasionally injects JavaScript, cookies, etc. into a request to see how the client responds. Lots of bots don’t process JavaScript, or only support a subset of it. Some bots also ignore cookies, and others even modify cookies to try to trick servers.

    It’s through a combination of all the above plus other sorts of analysis that Akamai doesn’t publicize that they can identify bot vs human traffic pretty reliably.