With the march of Moore's Law, it should currently be feasible for automobile controllers to actually run under a kind of hypervisor and keep a copy of the old system so that it can roll back. (Including by request of the owner.)

They could make the previous firmware easily restorable - like the BIOS on post-2008 computers - all of them have a shadow copy that can be restored if the new BIOS does not work. Hold two buttons and start the car or something :-)

You might want to turn off updates during road trips.

I feel like you've uncovered a horror movie plot from the future. Teen girls take off on a road trip in their Tesla Model Z, when an unfortunately timed OTA update leaves them stranded in a land of backwoods hillbillies... with secrets they'd rather stay secret.

Until that bug causes a car to drive unexpectedly into a wall in the interim time until you've sent out a patch. The importance of being bug-free is much more driven by the potential damage caused by a bug than how quickly you can update the software.

I would say that the easier it is to update software, the more likely it is to be bug free.

It's easier to test one change in isolation than to try to figure out which of these 20/200/2000 commits broke things.

I'm sorry, but no. No, most manufacturers update processes aren't actually secure in any meaningful way. Tesla's OTA process seems to use (I've not checked it myself) web standards, encryption, and signatures to verify that the OTA update is correct. The "Physical ethernet cable" that is used by traditional manufacturers can be done by any hobo on the street, in pretty much the same time. It's really only a matter of time before a script-kiddie-ready device that you plug-in and starts the car shows up; There's no security, no signature verification, etc. on the traditional manufacturers updates.

"do Teslas apply OTA updates while the car is underway"

Even your cellphone doesn't update when it's 'under way', what makes you wonder a moving automobile will? If you hazard a guess as to how OTA's are applied to automobiles, I would guess it'll be in Parked, plugged in, and prompted to update by pressing an "Accept & Update" button.

Is that true though? I mean, in my mind OTA makes it a given that the firmware is going to be fully signed and the channel will be fully authenticated. Whereas if a dealer is installing it, they could dismiss concerns with "we trust our service technicians." Seems the latter opens the door to a lot of social engineering possibilities.

But I was responding to a claim of the update being "poorly tested", not insecure. That's orthogonal to it being over the air. A poorly tested update delivered through a service center can also brick your car.

No, of course it does not apply the update while under way. When there's a firmware update available you get a nice big dialog box telling you so and button that says "would you like install tonight at [3 AM]". You can change the time or even cancel the update.

Furthermore, the message tells you it won't install unless the car is plugged in or has a certain level of charge.