I’ve written far too many times on this blog already about the abysmal engineering management practices of Tesla.

It really is an example of how not to run a company, given its atrocious safety record and sub-par quality compared to other brands.

Explanations are very easy to come by… for one thing the CEO is a serial liar. A complete lack of integrity is always bad for quality control.

Second, consider that the CEO repeatedly flaunts and ignores science. He recently sent an email to all workers that distractions should be enjoyed even when they affect focus on safety.

An associate just sent me a note asking if we could have one ear bud for music so the other ear can listen for safety-related issues. That sounds fine to me.

What problem do you think the CEO is trying to solve here?

OSHA smacked down this line of thinking in 2020…

The reason for not allowing employees to listen to music while working should be crystal clear, OSHA says. “Listening to music may produce a safety hazard by masking environmental sounds that need to be heard…” […] Even in the absence of a specific regulation regarding use of headphones, employers still could face enforcement actions if OSHA finds that they have violated the General Duties Clause, which requires all employers to maintain safe workplaces. “The key takeaway from the letter is that employers must address employee use of headphones to listen to music on the worksite, even if there is not a specific OSHA standard prohibiting it…”

You should probably read the CEO email as thumbing his nose at OSHA (“Tesla Had 3 Times as Many OSHA Violations as the 10 Largest US Plants Combined”).

It’s subtle encouragement to flaunt safety to juice the rate of vehicles made while ignoring more safety-related issues. The only problem the CEO really seems to care about is preventing slow down in production, nothing else. He has literally said a trip in one of his vehicles should be marketed as something that will isolate and then kill you (“risk of fatality will be high“) like a trip backwards into South African apartheid.

Musk has used the medium of dreaming and exploration to wrap up a package of entitlement, greed, and ego. He has no longing for scientific discovery, no desire to understand…

That means measuring only raw numbers shipped, regardless of harms to workers or consumers, because that means easy thoughtless profits short term while totally overlooking long-term fundamentals like recalls, deaths and all the reality of problems engineers are meant to care about solving.

Hint: Tesla’s deaths are astronomically higher than other vehicles.

Their newest model is literally killing an unheard of average of 30 people per year! (Pinto infamously destroyed Ford’s brand with just 27 deaths total).

Well, allow me to step aside now as Consumer Reports officially declares Tesla bottom of the pile.

Tesla’s Model S, Model Y, and Model X all got below-average reliability scores…. Tesla’s quality issues have been well-documented over the years as the company has raced — perhaps too quickly at times — to accelerate production and deliver more vehicles.

Consumer Reports also dropped a hammer on those trying to gin up weak excuses.

“There’s no reason fully electric cars can’t be as reliable or even more reliable than traditional vehicles with internal combustion engines,” Fisher said. “It’s how they implement the technology.” Electric drivetrains weren’t the problem. Instead, Fisher blamed unnecessary high-tech bells and whistles. “For EV introductions, there is a tendency to just add so much tech that is not necessary,” Fisher said.

That’s a subtle criticism of the fact that Tesla focuses almost entirely on tech that is not necessary, and not at all on real engineering issues.

…the firmware is now competing with logs for space on the eMMC… definitely some kind of oversight in general that was missed in the engineering… newer cars are at higher risk of [media control unit] problems than the older ones… every MCUv1 has high probability of failure.

To put it another way, Tesla makes a lot of unnecessarily dumb engineering mistakes and isn’t very good at solving problems.

It’s unclear whether they will get the falcon wing doors right ever.

Consumer Reports even emphasized that the hardest engineering is being done by other brands and yet producing the most reliable and safest cars, further driving home the rudimentary failures of Tesla.

“What stood out is that the most reliable was actually compact hybrids and plug-in hybrids,” Fisher said. “This may be counterintuitive. They are probably the most complex when it comes to the powertrain.”

Tesla is, to put it simply, a dangerous scam.

The car is not only dangerous to workers and customers, though; it’s dangerous to anyone in or around a Tesla.

It’s easy to find numerous examples of the even the latest Tesla software failing to avoid oncoming traffic (failing to navigate turns, failing to stay in lane), which foreshadows tragic news like this November 7, 2021 crash in Florida:

Police say around 7:30 a.m., Philip Henkin, 58, was driving his Tesla northbound in the southbound lane of Lizards Tail Road near Park Center Drive at a high rate of speed. While Henkin was steering along a curve, officers say he hit a bicyclist head-on before crashing into a tree.

And that comes not long after a September 14, 2021 crash in Florida:

Coral Gables police Officer Kelly Denham said the driver of the Tesla crashed the car into a tree. Cellphone video taken after the crash shows the vehicle engulfed in flames. Denham confirmed that two people inside the car were killed.

And that comes not long after a September 4, 2021 crash in Florida:

…heading north on Manning Road in a 2021 Tesla Model S Plaid at a high speed when the driver failed to stop at a stop sign…hit the embankment while going through the intersection, launching the car in the air before it crashed into a house on Caird Way, going through the home’s exterior rear walls. […] The FHP said the car hit and killed one of the three residents at the home, a 69-year-old woman.

Killed a cyclist on the opposite side of the road. Killed a passenger. Killed a woman sitting in her home….

Here’s a simple graph I made months ago to illustrate how tragic stories like this keep piling up more and more under the Tesla brand.

To be clear, other brands had the safest records in history, improving at the same time that Tesla’s record is getting worse and worse.

A GM electric car sold 150K units and averaged a death rate of less than ONE person each year over a decade (again, I must reiterate that Tesla’s newest model in just its first three years has been killing an average of 30 people each year).

Volvo continues to speak about a goal of ZERO deaths even while selling more cars than Tesla and switching their fleet to electric. Tesla is like night compared to the sunlight of other car manufacturers.

So here is what the Tesla graph looks like today (each bar updates as more and more news reports are found, even from past years).

Nature cannot be fooled. Tesla is a scam.

A serious and fresh vulnerability discovered in September led to a notice in November from NETGEAR. As you might expect, that company “strongly recommends that you download the latest firmware as soon as possible”.

Fine. That sounds normal until you consider the totality of vulnerable products versus the ones getting updates (those models under active firmware maintenance are fixed, other models are… uh-oh):

Note that big caveat/footnote from the researcher that a previous NETGEAR fix “broke” GRIMM’s exploit code. An odd perspective on something being fixed for users, calling it “inadvertently broken” for adversaries…

Speaking of perspective, it’s worth noting that perhaps GRIMM smelled blood in the water after NETGEAR had to disclose major issues in March and June.

I mean this kind of attention gathering could help explain why summer months turned into two additional unique September disclosures (1 and 2) before now.

To be fair, 2020 was an even noisier vulnerability banner year for NETGEAR disclosures with 22 unique CVE assigned (mostly XSS).

As bad as all this year’s unauthenticated bypass disclosures sound, still we’re talking UPnP in the latest one. Thus it’s also worth mentioning that Shodan probes give a clear “honeypot” warning for those scanning the globe right now.

This timeline is published by Randori itself, disclosing “authorized use” of a zero-day in Palo Alto products.

• 2020-10-26: Randori began initial research on GlobalProtect.
• 2020-11-19: Randori discovered the buffer overflow vulnerability.
• 2020-11-20: Randori discovered the HTTP smuggling capability.
• 2020-12-01: Randori began authorized use of the vulnerability chain as part of Randori’s continuous and automated red team platform.
• 2021-09-22: The buffer overflow vulnerability was disclosed by Randori to PAN.
• 2021-10-11: The HTTP smuggling capability was disclosed by Randori to PAN.
• 2021-11-10: PAN released patches and a security bulletin assigning the vulnerability CVE-2021-3064.
• 2021-11-10: This report was published.

CVE-2021-3064 is a buffer overflow that occurs while parsing user-supplied input into a fixed-length location on the stack. The problematic code is not reachable externally without utilizing an HTTP smuggling technique. Exploitation of these together yields remote code execution under the privileges of the affected component on the firewall device. The smuggling capability was not designated a CVE identifier as it is not considered a security boundary by the affected vendor. In order to exploit this vulnerability, an attacker must have network access to the device on the GlobalProtect service port (default port 443). As the affected product is a VPN portal, this port is often accessible over the Internet.

What does this mean? While it’s tempting to focus on the ethics of Palo Alto for “authorizing” behavior, or for the ethics of that behavior… the reality on the ground is Randori has painted a very large target on themselves as a suspicious repository of zero-day information.

In related news of very large targets, even though this sounds like a headline from a decade ago, Sky admits just now that it left 6 million consumer network devices vulnerable for 1.5 years.

…researchers say it took Sky 18 months to address. The vulnerability could have affected anyone who had not changed the router’s default admin password.

The BBC headline really should have been “The Sky is failing” as in Sky was “failing to meet numerous deadlines they set themselves”.