Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Tesla Fleet Telemetry (github.com/teslamotors)
214 points by shekhar101 on June 29, 2023 | hide | past | favorite | 130 comments


>At Tesla we believe that security and privacy are core tenets of any modern technology. Customers should be able to decide what data they share with third parties, how they share it, and when it can be shared. We've developed a decentralized framework: "Fleet Telemetry" that allows customers to create a secure and direct bridge from their Tesla devices to any provider they authorize.

Complete non-sequitur.

“We care about your privacy”

“Here’s a way to share private information with others”

Also, un-stated “there ain’t nothing you can do about sharing your private data with us”

Cool that they give you a way to access some of your data at all though, I guess


The current situation for third party apps (which do exist, plenty of them) is you either give them your Tesla account username/password (super bad) or an access token that you get by signing into your Tesla account, which is less bad but still gives the app the same access as your full Tesla account.

So yes, by building a framework to allow users to authorize third party apps to receive limited telemetry data without handing over their full Tesla account keys this may allow for an improvement in privacy for those who want to use such apps.


Hard agree. I give my Tesla creds to other third party apps willingly, because I want the benefits those apps offer (we own several Teslas, and both the historical data and remote vehicle control has value add). The effort to move to a more secure auth mechanism is welcomed, and it's my data, so I don't get the outrage. This is part of the value in my purchase decisions, and within the risk appetite of my threat model.

This is also more efficient on Tesla infra (streaming telemetry data), vs aggressive polling (what current apps do, typically slow polling when vehicle updates are minimal, such as when parked, and then switching up to aggressive polling when traveling at speed).


And if your local police department wants to buy that data? What if a large law firm wants to buy all the data for use in lawsuits? Once you have pass it on to "third parties" then there isn't much you can do to stop such things.

It happened a few decades ago as in-car GPS rolled out. Some rental car companies started issuing speeding tickets. That game lasted about a week.

>> Feb. 2002. A Connecticut man has taken a local rental-car agency to court, after the company used Global Positioning System technology and fined him $450 for speeding.

https://www.cnet.com/culture/rental-car-firm-exceeding-the-p...


I’m not ignorant of your concerns, but that’s what privacy laws are for. These third parties have been scrapping Tesla APIs at the behest of their customers for years. This is nothing new, simply more formalized.

If the laws are insufficient, that’s a call for better laws (which I agree are needed). The apps I use do not sell their customer data, but Tesla should probably stipulate API integrations aren’t permitted to as extra guardrails (with violations being an API access death sentence, killing the app business).


Or forget the laws. I will buy a car that doesn't stream data. My current vehicle doesn't and I have never felt the need. My next one wont either ... not if I have anything to say about it.


That doesn't change the fact that this framework is an improvement on the status quo for Tesla owners. And presumably most Tesla owners are not like you, so what you would do is not super relevant to this discussion.


The question is, why does a car have to at all? And no, the closest we are is a car that could share data with the OEM, if you wanted, and we don't. As long as possible, I'd pass hard on cars where you don't have that choice.


With a Tesla you do have that choice.

https://www.tesla.com/en_eu/legal/privacy


If it is in the EU, yes you do. Just compare the difference between what Toyota does with customer data in the US and the EU. Preferably, I can remove the sim card myself and all connectivity stops. If I cannot do that hardware wise myself, I havw to assume I am tracked.

The different OEM approaches between the US and EU show you how important legislation is. Especiqlly since Tesla's zrack record regarding privacy is abysmal.


> Tesla's zrack record regarding privacy is abysmal.

Any particular examples you can share with us?


Tesla employees sharing memes derived from intimate in car camera footage? Cuts it for me.

Also, why would I want cameras inside my car? But that question is off topic.


The times Elon has shared in car video feeds to try and blame the driver for autopilot crashes, without that driver's authorization to do so. Legal? Sure, according to every stupid, untested EULA that everyone has to sign, but you didn't ask about legality.


I've never seen an in-car video feed shared by Tesla. Nor can I find any reference to such an incident.


Wow, that is a really dock move.

Probably not entirely legal no matter what EULA says, at least not in EU


It seems to be an anti-Tesla lie. I can find no reference to such a video.


  > If it is in the EU, yes you do
Then complain about (the lack of) US consumer protections, not Tesla.


What bout California?


Cool, but there are people who like to look at data, like Wh/km and efficiencies at different temperatures etc.

Funny thing I wanted to point out though, you sound like one of those people who say "I will buy a car that runs on gas, I've never wanted a vehicle that runs on electricity and my next one won't either... Not if I have anything to say about it".

I feel like I've seen so many of those comments lately... I want to ask why?

It's like me saying something like "my phone doesn't have a screen. I've always had an analog connection and I've never felt the need to have a digital screen and any smart apps on my phone... Etc etc not if I have anything to say about it."

Or perhaps even something like not wanting an automatic transmission because a manual transmission is the only way to go lol..


That's clearly not the point here.

The parent isn't rooting for ICE, he's rooting for having a vehicle that doesn't stream data to the outside.

There is nothing that mandates that a vehicle -whatever its technology-, must send all its data to external servers.

I, and many others, want to have the right to possess a car that isn't relying on external connections to work, and doesn't send all its data out.

It's more akin to wanting a TV that's not connected online. Some people like the added features of a smart TV, but some just want a dumb screen that doesn't sell their viewing habits, or screenshots of what's on the screen to third-parties.


> I’m not ignorant of your concerns, but that’s what privacy laws are for.

It's a shame then that the few laws we have protecting consumer's privacy are not adequate to the task. It's reasonable then to do our best to avoid products and services that exploit the weakness of our laws until that situation is improved.

As an aside, how do you know that the apps you use aren't selling your data? Is it only because of their entirely non-legally binding statements and privacy polices? What do think could happen to that data when those apps/companies are sold or otherwise acquired by someone else? Even if they were telling the truth about not selling your data right now, do you think that means it isn't readily available to police or the discovery process in a legal dispute? Do you think that data collected or displayed by the apps could be exposed to Google or Apple and collected?


To answer your questions (I could not tell if they were rhetorical or not), worst case outcome is that someone either legitimately or illegitimately has the history of my vehicles’ locations and commands issued to the vehicles. As mentioned, in my grandparent comment, within my risk appetite. It could happen, but I don’t care enough to worry about it.

> It's reasonable then to do our best to avoid products and services that exploit the weakness of our laws until that situation is improved.

Agree to disagree. If the cost of loss is low, to go without the product or service is more costly than potential data loss. The services I use within this context are very likely not actively lying about their privacy policies.


> worst case outcome is that someone either legitimately or illegitimately has the history of my vehicles’ locations and commands issued to the vehicles.

That is hardly the worst case outcome. The worst case outcomes would be those where that data is used against you because it was sold/leaked/subpoenaed. There's no end to the ways it could be used against you either.

Maybe a future potential employer doesn't like how often you visit bars, or what church you attend, and you are passed over for a job you want.

Maybe your car's recorded proximity to where a crime took place makes you a suspect in a crime you had nothing to do with and it costs you tens of thousands in legal fees to clear your name. (similar to what happened to this guy: https://www.nbcnews.com/news/us-news/google-tracked-his-bike...)

Maybe that data gets pulled up in a divorce or custody battle. GPS records and toll transponders are already being used in such cases to show things like patterns of working late hours, visits to girlfriend's houses, or undisclosed income

Maybe that data is used by advertisers to more effectively manipulate you into parting with more of your money.

Maybe your insurance company (health or auto) buys it up and their algorithm decides to jack up your rates because you hit up a fast food drive thu once too often or you speed too much or drive to many hours.

Maybe you visit or even park too close to a gay bar, mosque, or planned parenthood and you get harassed by an extremist group or dragged into a Texas courtroom.

Because the data never goes away, it can follow you for the rest of your life and be used by others again and again at any time in whatever way the person who gets their hands on it feels will benefit them.

> Agree to disagree. If the cost of loss is low,

Everybody is free to decide for themselves what level of risk is acceptable to them. With some kids you can tell them that the stove is hot and they will leave it alone, while others have to touch it and get burned.

I hope that you never suffer a consequence that makes you regret the data you gave away, assuming that you can trace it back to that data in the first place. At least you can say you were informed about the dangers and made an informed choice to roll the dice. I worry a lot more about the folks who don't even realize what data is being collected, the ways that it can be used against them, or who assume that they can count on laws and privacy polices to protect them from harm.


> Maybe a future potential employer doesn't like how often you visit bars, or what church you attend, and you are passed over for a job you want.

Take this as my opinion only, and I appreciate that some people don't have the luxury of this opinion, but for me there is zero Venn diagram overlap between jobs I want and employers who are as creepily obsessed with my private life as that.

> Maybe that data is used by advertisers to more effectively manipulate you into parting with more of your money.

If you want to frame advertising as manipulation, then I suppose so. Personally I don't see it that way. If I see an advertisement for something I want and I end up buying it, that isn't any more manipulative than seeing a particularly attractive banana in the supermarket and buying it.

Advertisements are a way for people who make things or do things to find people who want those things. Successful advertising isn't a bad thing so long as it isn't dishonest. I think if there's a 1% chance that I'm more likely to become aware of a product that actually interests me, I see that as a win for me. I have finite money and I'd rather spend it on things I want more than things I want less.

> I hope that you never suffer a consequence

I'll happily wear that risk. I greatly prefer it to the alternative, which is the guaranteed suffering which results from being obsessively paranoid.


> there is zero Venn diagram overlap between jobs I want and employers who are as creepily obsessed with my private life as that.

I feel the same way, but employers aren't going to tell you they're digging into your personal life or why you were turned down for the job. You just get ghosted. The problem isn't limited to employers either. It could be a landlord, or a bank. Part of the problem is that you aren't allowed to know when it's happening which makes it hard to avoid.

> If you want to frame advertising as manipulation, then I suppose so. Personally I don't see it that way.

Ads can be informative, but when was last time you saw an ad that wasn't in some way manipulative? If you can't even see that it's happening, you're likely more susceptible to the effects, but even you know it's happening you're still influenced by manipulation. We all are. Ads are carefully designed to exploit flaws in our brains. Ad companies have spent massive amounts of money and research to maximize the effects, even experimenting on children to learn things like how early a child can recognize a brand.

> I'll happily wear that risk. I greatly prefer it to the alternative, which is the guaranteed suffering which results from being obsessively paranoid.

You know what the say, it's not paranoia if they're really out to get you. The examples I gave of the harms that can result from abuse of your personal data are based on things that have already happened. People might be happier if they are blissfully ignorant or can convince themselves to ignore what's going on, but I feel better if I take some simple steps to avoid potential harms and stay aware of what's happening in the world. It's pretty easy to just not buy a car that collects your location 24/7 and even easier to avoid giving that data to unnecessary apps.


> but employers aren't going to tell you they're digging into your personal life or why you were turned down for the job.

So I don't learn why I didn't get a job I definitely wouldn't want. Perhaps not the ideal outcome, but not far from it. I really don't understand what the problem is here.

Would I prefer if I accidentally ended up working for an awful person because I never gave them a chance to reveal their awfulness? Absolutely not. I don't want to work for an awful person even if they never get a chance to be awful to me personally.

> even [if] you know it's happening you're still influenced by manipulation

I reject your framing but to the extent there's any truth to it, I'm going to be manipulated by ads no matter what. Given that, I'd rather be manipulated by ads that are better targeted to me. This is an important point — manipulation is mostly orthogonal to targeting. Especially since hyper-targeting quickly becomes overtly creepy and loses its manipulativeness.

Considered holistically, there's no downside for me being targeted rather than broadcasted. In fact if targeting means that a company's customer acquisition costs are lower, there's a non-zero chance it could result in me paying a lower price for something I would have bought anyway.


> So I don't learn why I didn't get a job I definitely wouldn't want. Perhaps not the ideal outcome, but not far from it.

Would you say the same about the house you wanted to buy/rent or the loan you needed? It just makes it easier to hide discrimination that would otherwise be illegal. At least the bigoted HR person in charge of screening applicants is probably not someone you'd interact with once hired.

> I'd rather be manipulated by ads that are better targeted to me.

I doubt I can change your preference for targeting advertising, but I will offer you a few perspectives on the subject you might not have considered:

It was manipulation through ad targeting that made that whole Cambridge Analytica situation such a problem.

Targeted ads artificially limit what new products and services you get exposed to only those things companies "think" you want, or what advertisers want you to buy, or whatever will make them more money vs things you might really be into or prefer if you'd had the opportunity to hear about them. It allows them to shape culture and segregate populations. This is a similar problem to the "filter bubble" found in search engines.

knowing that we're vulnerable to advertising, I'd much rather be tricked into forming an irrational association linking happiness, or acceptance, or well-being and a product that I know I'll never or rarely buy than have that kind of trickery influence my choice between two products of a category I buy often.


No one is forcing anyone to use a data logging app for their Tesla. It’s not only purely opt in, you usually have to buy them


Correct! There are several apps that I've wanted to use over the years but the main blocker (for me) has been authorization. With this new feature from Tesla that all changes. I'm much more willing to purchase these apps now that I can limit their reach.

The real bonus is that it appears as if this update will help isolate the app from the vehicle. What I mean is that the current way these apps work is they poll the vehicle for data. This is bad because it (potentially) wakes up with vehicle and increases battery consumption. The way I understand it, this new method will allow apps to "poll" Tesla instead, which is a much better operation.


In my case, the third party I'd most be interested in sharing with is my local home assistant instance.

(zero points for anyone pedantically pointing out that this is technically first party sharing)


The police won't pay they will just subpoena any data they want, from Tesla or from whoever manufactures your car.


Some companies charge police for the work it takes to fulfill their requests. I suspect that once it becomes a revenue stream, they are less likely to pushing back against requests for data where they might otherwise.


> both the historical data and remote vehicle control has value add

What value does it add?


> The current situation for third party apps (which do exist, plenty of them) is you either give them your Tesla account username/password (super bad) or an access token that you get by signing into your Tesla account, which is less bad but still gives the app the same access as your full Tesla account.

In 2023, I'm amazed that this is still a thing. I'm also sad that users are so uncaring about their data that they are cavalier to just provide credentials to 3rd parties just because they pinky swear they'll not be evil and the use of their app is super worth it. I still remember the first time a coworker was singing the praises of some money/finance app that I decided to try. I immediately stopped and said nope when I realized they needed my user/password to all of the banks I wanted to connect. I feel sorry for people that feel the juice is worth the squeeze, especially when they get squeezed dry. Maybe it's not the 3rd party company, but the possibility of hackers that attack said 3rd party. Just too big of an ask


> give them your Tesla account username/password (super bad)

Only slightly related, but buying a Tesla they encourage you to use Plaid for payment. Which involves… giving your banking account username and password to a third party.

Extremely bad. I can’t believe anyone would do this.


First off, Plaid uses OAuth when possible to do things the right way. So you really have nothing to worry about if your bank is competent.

Second, Plaid will use app passwords if you have 2FA enabled and your bank supports them. This is the correct way to handle that scenario.

Third, Plaid saves me a lot of trouble and I have come to trust them. I am happy to delegate responsibility to them.

Why is it inherently bad to trust a 3rd party?


I use a non-enormous regional bank. I have no idea if it qualifies as competent.

Also, have a quick look at the "data we collect" section of their privacy policy and see if you still feel the same way: https://plaid.com/legal/

It's shockingly broad, and 99% of it is stuff that they have no business collecting when all I'm trying to do is buy a car.


Of course they collect this data! Do you understand what Plaid does?

Here's what happens:

Tesla says I want to verify that a human is purchasing a car, take a deposit, and get the information needed to pre-approve the customer for the loan required to buy it.

Plaid says, we can do that for you. Plaid has you link your bank account so it can 1) verify your identity, and 2) give Tesla the information needed to debit your account. Then Plaid pulls your account history and asks you to link additional accounts as needed to get the relevant information for the underwriting process.

This allows Tesla to complete this process entirely online without a dealership in about 2 minutes. If you've ever bought a car traditionally, applied for a loan, or even linked bank accounts into a budgeting app, this is an incredible UX win for the user. Shocking, even.


> So you really have nothing to worry about if your bank is competent.

US Banks not only use SMS for 2FA, many of them REQUIRE it for 2FA.

They also tend to require "security questions" that are usually easily guessed or researched. Again, information that makes it easier, not harder, to get into your account.

Good luck trying to find a bank that uses hardware tokens.

> Why is it inherently bad to trust a 3rd party?

Because doing so substantially increases the attack surface and historically third parties have done a terrible job.

For example: every app that uses SMS 2FA inherently trusts the customer's cell phone company. Companies which have done little to address identity thiefs porting out numbers, requesting replacement SIMs, etc.


Sorry that US Bank leaves you exposed to a sim-jacking attack which, if they use Twilio, is mitigated by their verify API. I don't need hardware tokens and full custody of my financial information. I Just Don't. That's literally the entire point of a bank. They do that for me.

You don't need to lecture me on how trust delegation works. I mean you use a bank right? You trust a 3rd party with your actual cash. Plaid hasn't demonstrated incompetence, have they? In fact it seems quite the opposite. There isn't any legitimate case against using them aside from "I literally don't trust anybody" which is hypocritical if you use a bank in the first place.


They’re not subject to banking regulations. Their privacy policy is a dumpster fire. They offer me no benefits.

Why would I use them?


They also serve as an auditing service, of sorts. Instead of you having to gather a bunch of bank statements to verify income, Plaid pulls those numbers for the service provider. The service provider can trust Plaid as an intermediary whose reputation would be damaged if they helped people lie or were otherwise delivering unreliable information. In my experience Plaid is a huge UX improvement and if you use them in OAuth mode you literally have no reason to criticize because the entire argument falls apart (they don’t store your credentials and can only do what you authorize granularly, using the system as designed).

Anyway my bone to pick is with the “3rd party instantly bad” mentality. Your bank probably uses 1000 and 1 3rd parties too. Our banking regulations are focused on making sure money depositors aren’t taken advantage of and harmed by unhealthy or risky asset management practices. If you don’t find Plaid valuable then thats fine, you do you. I do wonder how you can know that without using them though…


I’m not taking out a loan, I’m sending money. Everything they offer is irrelevant to me.


Why not just an access token that only has certain perms?


Tesla doesn't provide this. Also, its beside the point...

Which is: Tesla doesn't even want collect telemetry and then re-share it to 3rd parties. Tesla wants to provide a mechanism for the car to connect directly to a customer-authorised 3rd party telemetry collection service. This relieves Tesla from having to function as a middle-man and facilitate things like claims in tokens and granular permissions.


Because the first party vendor, in this case Tesla, doesn't provide that kind of mechanism?


That's what I'm saying though, instead of allowing permissioned access to their existing telemetry, they're publishing a platform that duplicates all of that functionality.


>At Tesla we believe that security and privacy are core tenets of any modern technology.

Seeing this after the whistleblower/leak regarding Tesla employees having unfettered access to onboard camera footage (and that embarrassing/compromising footage of customers was actively shared internally) is... rich.


That sounds like a subtle mischaracterization of the leak to me. The leak sounded more like, "the teams responsible for tagging data uploaded by Teslas had access to data uploaded by Teslas". The fact that they could share them amongst themselves is also not particularly surprising.

While I understand the alarm, it was also completely unsurprising even based purely on the company's public statements about how they use data from the cameras.


If an employee at a photo lab was keeping and sharing copies of compromising pictures there would be huge outrage and rightfully so. Just because they have to handle personal data doesn't mean it's acceptable to share and laugh with your colleagues; it should be handled with the utmost respect for your users' privacy.


I have bad news for you. This exact topic has been discussed on my local radio station (in a medium sized city) and loads of callers described working at a photo lab where there was a drawer full of copies of "noteworthy" photos.

I think it's apples and oranges though. With a photo lab the customer has deliberately handed over whatever images they want developed, whether the images are private or not. Tesla employees sharing images from cameras that some people may have plausibly not even known were there feels like much more of a violation.


If an employee at a hotel planted secret cameras and...

If an vacation rental landlord planted secret cameras and...

Bad news all around.


You can go to jail for having a surveillance system in your own home: https://www.cbsnews.com/news/navy-doctor-guilty-of-making-se...


Hidden surveillance of the unsuspecting in restrooms, bathrooms, and bedrooms -anywhere where people can expect to have privacy- should of course be illegal. Nannycams in living rooms and other "public" rooms in private homes probably should be legal for obvious reasons.


"I have bad news for you."

Yes, secret cameras can get the host in trouble, but poke around at airbnb listings and you'll see cases where everyone reports highly visible internal cameras.

I'm not saying its good.


That's what I mean about a mischaracterization. There's no indication of long term retention, but rather of pointing and laughing.

Remember the olden days of photo labs at the mall that would run the pictures visibly in front of the window?

They don't do that any more, but the employees still point and laugh while they are in their possession. Right or wrong, it is human nature, when they all technically have access.


I think few who enabled Sentry Mode thought it was reasonably likely that Tesla employees would share titillating personal moments spotted by their cars for the luls.


Exactly. People shouldn't have to worry about their car being a serious privacy risk.

Video footage being shared with/accessible by Tesla should be strictly opt-in - especially for "sentry mode", which is the most likely to catch someone in their skivvies (or worse) in their garage.


I think few who read the comment he was replying to thought that we were discussing what people thought about Sentry Mode data labeling privacy issues and instead about "unfettered access to onboard camera footage".


I get your point there, but I bet not all of these were sentry. But even with sentry, there's some smarts to it about object detection. If you know how that works, you'd expect some human-in-the-loop labeling.

I'm not saying that it is right. There's a real lack of transparency here, especially considering how many people seem blissfully unaware.


You can also have to opt-in data/video collection manually when getting the car in the first place, at least here in Europe.


Yep, it's the same in the US


  The fact that they could share them amongst themselves is also not particularly surprising.
It's not that the could, it's that they did.


But of course they did. They are human, and baser instincts are hard to overcome. Especially in the age of share everything with everyone all the time. I would not be surprised to learn that the youngest generations have never been taught to not share everything if not quite the opposite.


That is also not surprising, if you have been around people for your whole life.


Anything that can be shared, will be shared.

- Murphy's Law of Sharing


Our Teslas sends an insane amount of data home, even down to event calls for rolling down the window or opening the car door. But you kind of know that going into it - ok not everyone does but anyone who is reasonable technical and most likely to care about privacy and understand the issues is aware. And it's technically in the small print which of course everyone reads fully when they buy the car. /s

They also record the road and the way you drive it using cameras in the vehicle you own and paid for, upload it using your home internet connection and improve their self driving model which will no doubt represents $billion's, maybe $ trillions of enterprise value over time.

A Tesla is not a normal 'dumb' car, and you accept that going into it. Allowing consumers to have fair access to that data in a safe manner that doesn't involve sharing usernames and passwords is actually the right and responsible action on Tesla's part.


> “there ain’t nothing you can do about sharing your private data with us”

FWIW there are settings in the car to disable certain things. Not sure how much it _actually_ disables though.


Disable and delete seem to just mean "hide from the end user" these days.


"Soft delete", and it's a requirement in almost everything


So is 'the right to be forgotten' under GDPR. As such, Tesla, OpenAI, etc. cannot legally train their models on EU customer data because we can at any point request a hard delete, and they wouldn't be able to comply without removing it all from the dataset and retraining.

In reality though, I assume they still do it and merely pretend they comply with it.


>“there ain’t nothing you can do about sharing your private data with us”

You can turn off lots of data sharing and monitoring settings in the standard UI in the car, last I looked it wasn't even hidden behind any dark patterns.


Privacy isn't "no one can know anything about me, ever, even if it is my choice to tell them". By this logic you are violating your own privacy when you introduce yourself to someone with your name.

The actual concept of privacy is entirely in line with their idea that you "should be able to decide what data [you] share with third parties, how [you] share it, and when it can be shared"


Same as apple. "privacy is a fundamental human right"

...can't activate a phone without connecting to apple

...privacy policy is hundreds of pages

...can't block apple


You must love Big Brother. It is not enough to obey him: you must love him.


"others"

I.e. my own home server.


> Also, un-stated “there ain’t nothing you can do about sharing your private data with us”

Are predditors now coming to this site to spread their "spaceship man bad" propaganda? There are obvious switches that toggle data sharing. A quick googling would have revealed that: https://electrek.co/wp-content/uploads/sites/3/2017/05/tesla...


Privacy advocates should reconcile themselves with the idea that sometimes people want to share their data. If I owned a Tesla, I’d enjoy using this framework to put data about my driving into a google sheet.

Private information means the user controls their data. They will often do things privacy advocates don’t like or think are dumb. That’s the privacy advocate’s problem, not the user’s.


If you're using the data yourself, how is that "sharing" your data?


Google Sheets can't be self hosted, so the data must be shared with Google in their scenario.


Every time Tesla refers to the cars they sold to customers as their ‘fleet’, I get the feeling they don’t really recognise they are no longer the owner of those vehicles.

Fleet as defined in Oxford Dictionary: “A number of vehicles or aircraft working together, or under the same ownership.”

(edit: use actual Oxford definition)


It's in reference to a company owning a fleet of Teslas, not Tesla owning the fleet.[1] The point of this reference implementation is to make it easier for companies that own a bunch of Teslas to collect data about their cars.

1. https://www.tesla.com/fleet


Tesla does collectively reference all (connected) vehicles as the fleet, though: https://twitter.com/Tesla/status/1658301638514298880?s=20


"Operated as a unit" is not an inaccurate description of Tesla's footprint. Every one of their cars, assuming factory-ish conditions, is sending live, realtime data back to Tesla-owned servers. That data is analyzed, and the output of that analysis impacts the driving behavior of the vehicles in the future (training their AI models). Commands are sent from Tesla's servers to change the operational state of the car every single day (most of the time, I hope, at the behest of the owner, e.g. "turn on the AC").

That's a fleet. You may not like it, but that's what Tesla owners knowingly opt-in to.


"fleet" is also just used as a collective noun for cars, ships or aircraft.


For example... U.S. auto fleet fuel efficiency flat in 2021 as Detroit Three lag https://www.reuters.com/business/autos-transportation/us-aut...

> WASHINGTON, Dec 12 (Reuters) - The U.S. new vehicle automotive fleet's fuel efficiency was flat in the 2021 model year as automakers sold more sport utility vehicles and pickup trucks compared to cars, while the Detroit Three lagged behind foreign competitors and Tesla.

> The U.S. Environmental Protection Agency said on Monday the fleetwide real-world average was 25.4 miles per gallon in the 2021 model year, the same as in 2020. The EPA estimates the 2022 fleetwide efficiency average will rise to 26.4 mpg.

That's referring to every car in the United States with the collective noun "fleet". It implies no ownership.


This is referencing your own fleet of Tesla vehicles though, like company cars or rental fleet. Not a reference to the Tesla company's fleet.


Terms can change. To me it brings to mind that all the vehicles are sharing training data as a network to improve self driving capabilities.


They can still control them remotely, so there's that.


Dropped my Model Y off for a warranty repair a few weeks ago. Asked the service desk if they needed the key, they said no. Apparently they can access the car whenever they like.


All car manufacturers have had master keys for the past 100 years, it’s not a new concept.


Well it’s the first time I’ve ever had to not give keys when handing a car over, so clearly something is different.


this is standard industry parlance


This is cool, I've been thinking about building an application that polls the reverse engineered Tesla API, but an officially supported solution sounds much better. Is there any documentation about how users authorize applications?

Seems like this allows vehicles to connect directly to your own server instead of having a Tesla server act as intermediary. Will it be free to use then? I guess Tesla is still footing the bill for cellular bandwidth used, so it probably won't be free.



Teslamate is awesome. I've been running it for almost a year and it just keeps on trucking without any issues. Completely open source written in Elixir uses Phoenix LiveView, data in Postgres and provides prebuilt Grafana dashboards as well.

Also authentication tokens are done locally and refreshed nicely so no fear of leaking tokens/passwords.


Same positive experience here. I love that tool!


Yes, that is an example of an application that polls the reverse engineered Tesla API. Not the application I wanted to build and not something using this officially supported method (understandably because this is new).


> Fleet Telemetry is a server reference implementation. The service handles device connectivity, receives, and stores transmitted data. Once configured, devices establish a websocket connection to push configurable telemetry records. Fleet Telemetry provides clients with ack, error, or rate limit responses.

I assume this means that Tesla devices can be configured to speak the client end of this protocol, and that fleet operators might enable it. If so, that’s kind of neat.

Of course, it would be nice if Tesla telemetry non-fleet vehicles worked the same way and could be turned off.


congratulations your motor vehicle is now dependent on kubernetes

pov you are headed for a collision and something is wrong. you issue a describe command ...

  Type    Reason  Age
  ----    ------  ----
  Normal  Sync    100s (x3 over 100s)
Is that an expected status for this component? The distance narrows ...


The Kubernetes implementation is on the server side, not the car. The only way to control the car is through Tesla's API,[1] and that doesn't let you do dangerous stuff like turn the wheel while someone is driving.

Even if you could overwrite the software on the car, you'd still have to contend with the physical controls available to the driver. The steering wheel is physically connected to a typical rack and pinion setup. The brake pedal is physically connected to hydraulic lines just like every other car on the road. And like most cars, the brakes are more powerful than the motor.

1. There's no official documentation but a big chunk of it has been reverse engineered: https://tesla-api.timdorr.com/vehicle/commands


The only concern is someone hacking Tesla's HSMs that sign their firmware and software updates, since then they could craft a malicious payload disguised as a software update that flashes new firmware onto the BMS and as such causes your car to explode the next time you plug into a supercharger, for example.



it sounds from the article like this is on either 1 or 3 planes and hopefully that number has decreased since 2019

hoping 'deployed in 45 days' doesn't mean what I think it means


Good grief


I may be missing something but how do you get your specific client_config deployed to your car? The quickstart says, "Share with Tesla" - do you like send them an email asking nicely?


I had the same question. There doesn't seem to be any information regarding next steps once the server is running.


> Tesla strongly encourages providers to only collect data they need, limited to frequency that they need.

If only...


The problem with data is that they can often reveal information you need, but didn't even know you need.

The way I understand Tesla's meaning of "data they need" is the data that you know exists, know is useful, and has a predefined purpose. However, blind data mining can often bring insight that may give you an edge over competition, so the unethical data collectors have an advantage.

On the other hand, collecting all available data makes you biased by the particular nature of data collected - not everthing that is measurable is important, and not everything that's important is measurable. Even 100% accurate data can lead you astray if it gives you an incomplete picture. That's how we got algorithms that optimize outrage, because outrage and stress create massive engagement.


> That's how we got algorithms that optimize outrage, because outrage and stress create massive engagement.

I mean, in this case, it's not a "problem", it's a predetermined goal. It's not some sort of accident that they optimize for engagement, it's explicitly what they want to optimize for. The fact that it causes harmful interaction isn't an unwanted side effect, at least for the social media company, but a means to an end.


It is absolutely an accident. Engagement recommender systems do not optimize for outrage, they optimize for engagement. It just turns out that outrage causes engagement. The difference is that at no point is there a human who says "Let's cause outrage!" It's the algorithms that figure out the connection, which is the point being made by the person you replied to.


The second it became clear that outrage causes more engagement than anything else, using an engagement optimizing system became equivalent to pushing for outrage. You cannot do otherwise without EXTREME intervention.


The assumption is that engagement = good for business. I personally believe it isn't, as I've personally quit all social networks (notwithstanding HN and a few private communities) because they made me addicted and unhappy. Unhappy users stay because they're addicted, and a part of them quits. Happy users stay because they want to.

Not making people unhappy is good for business. Or at least I hope it is...


Then you get the weird software engineers that are very defensive of spying on their users lol.


I mean, it's all logging how users use your product. For things that aren't cloud-dependent, there are toggles in the car the user can click to turn them off, and it doesn't harm almost any functionality (of course disabling app camera access in the car will prevent you from seeing your live sentry cam in the app; it'll still record locally to the USB though).


I wonder if they started building this API to comply with the newer Massachusetts right to repair law, then just made it public when the feds told automakers to ignore the Massachusetts law.


That was the first thing I thought of when I saw this post and read the code a bit.

Also fuck the National Highway Traffic Safety Administration for telling auto makers to ignore a very well intentioned state law.


Agreed. It was well intentioned, but I think it went too far by trying to prescribe the solution. Their 2012 law was much better written and it was easy for automakers to implement (I did the technical implementation for one automaker).


Seems like the idea here is to provide a public API for third party integrations, which currently use a private API.


Like that other Elon Musk company!


If you're referring to Twitter it actually has had a legendarily awful track record with API access. Reddit is trying its best to dethrone it though.


Based on the message spec[0], it doesn't look like this can be used to track Full Self Driving disengagements which is a shame. However, for its intended purpose which is presumably to help 3rd parties (eg Hertz) manage fleets it seems like a boon.

[0] https://github.com/teslamotors/fleet-telemetry/blob/main/pro...


That’s great and all, but I’d settle for my Model 3 Autopilot staying in its lane and not trying to slam me into the median.


I've used many brands of adaptive cruise control with lane centering and none of them are absolutely trustworthy. I don't see why anyone would expect Tesla's adaptive cruise control with lane centering to be any different. Especially considering they called it "autopilot", a term which can refer to the performing of rote tasks without self-awareness.[0]

[0] https://www.macmillandictionary.com/dictionary/american/on-a...


Which brands did you try and how much did you try them?


I'm a kubernetes noob, in https://github.com/teslamotors/helm-charts/blob/main/charts/...

why do they do `helm repo add teslamotors https://teslamotors.github.io/helm-charts/` instead of

`helm repo add teslamotors https://github.com/teslamotors/helm-charts/` ?

isn't the first one a webpage rather than a repo?


The github.io site that they include the link to is the actual repository that can be read by Helm, in particular by it polling the known "index.yaml" file at https://teslamotors.github.io/helm-charts/index.yaml. Something _could_ be done using Github's "/raw" endpoint, but generally speaking Github pages works better for this sort of purpose and also is built to be a CDN, meaning it has additional caching layers in front of it that make it more performant.


Wow this is a surprising roll-out. The k8s recommended deployment seems a bit overkill, perhaps thrown over the fence, but it shouldn't be hard to knock out a much more manageable docker compose configuration instead.


Is there an accompanying architecture diagram that goes with this?

I'm not sure which bits and pieces are included without poking through the code


"What Tesla really means by Fleet Telemetry"

https://www.reuters.com/technology/tesla-workers-shared-sens...




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: