Karma: Chris Evans/Tesla fail part 2

Zoltan · November 24, 2016, 10:16am

Y'all remember this recent thread:

Tesla shill takes a ridiculous swing at Linux Linux - Other

So Chris Evans, a Tesla employee, has posted this very unlike scenario with a lot of publicity as a "zero-day exploit": He has not gone through the regular channels of security reporting in Linux, which are well known and very efficient. The situation he describes is not a Linux problem, but a proprietary software problem, because it's a problem of Chrome. Not even chromium would allow for this "security problem" to happen. Chrome nor Chromium are available in the Fedora repos, and the warnings of Fedora against using the crappily coded Google projects are well documented. Yet Chris Evans thinks that it's a serious security problem of Linux in general that a certain purely theoretical drive-by attack would be possible against Fedora 24 through Chrome. That is of course only if SELinux is not enabled and - as previously mentioned - the user would have installed the proprietary software Chrome, against which Fedora explicitely has warned, including the open source upstream project chromium, which has been kicked out of the Fedora repos because of lack of elementary quality, even though chromium is not concerned by this exploit. Furthermore is the exploit entirely dependant of an additional gstreamer-bad package that is not in the fedora repos, but has to be downloaded from rpmfusion. And after all this nonsense, the conclusion of Chris Evans at the bottom of his ridiculous hyped up article is: This was too easy. It should not be possible to find a serious memory corruption vulnerability in the default Linux desktop attack surface with just a few minutes of looking. Although it’s hard to say it, this is not the kind of situation that occurs with a latest Windows 10 default install. Is it possible that Linux desktop security has rotted? Of course... that explains everything... Tesla huh? Yeah, figures, probably employee of the month... one of those software developers at Tesla that couldn't make the new Autopilot compatible with the Tesla cars sold up to …

Well, seems like instant karma is a thing lol:

and

So the guy that stores authentication tokens in plain text in apps on third party platforms... yeah that's the guy from the other thread that took a swing at linux...

LMFAO

He's obviously a real pro... and updates necessary on Tesla's... sorry customers... no updates, Tesla sells obsolete cars that can't be updated because the new software is incompatible with your 100kUSD car...

And Volkswagen are the bad guys.... yeah right looooooooooool.....

Eden · November 24, 2016, 10:52am

They push updates all the time. Though not to their phone app. Apparently there's one soon .
That guy had an update with actual exploit code apparently.

BGL · November 24, 2016, 2:43pm

Nice one Tesla.

turin231 · November 24, 2016, 3:16pm

There is really not enough popcorn in the world for this shit...

Zoltan · November 24, 2016, 4:14pm

It was introduced by Keen labs staff as PoC (thistime a real PoC with video evidence), and as these things should be handled, they informed Tesla beforehand and waited with public release of the information until after Tesla could patch it.

But the nerve of this Chris Evans dude to say that linux' security is rotten in comparison to Windows X (I saw he even said on a different forum that linux was 15 years behind on Windows X in terms of security lol)... while he himself has made a software product that stores the key token in plain text on a third party platform lol... even just the fact that he didn't even flag password entries in his app as such, so that the Google keyboard keylogging is actually active on them... guess Google staff doesn't even need to call an Uber... they just take any Tesla at hand lol...