Reasons to NOT open up the code: 1> Loss of competitive advantage 2> Open source is not necessarily any safer (heartbleed bug ... ) 3> If software for the pacemaker is allowed to be updated like that on a computer, someone will update it with buggy software that can cause adverse side effects. Who owns the liability in that case?
Number 2 isn't reason NOT to open up the code. You can't just claim because it doesn't do something that it's a good reason. Open source software isn't necessarily faster or more efficient either. So?
Reasons to NOT open up the code: 1> Loss of competitive advantage 2> Open source is not necessarily any safer (heartbleed bug ... ) 3> If software for the pacemaker is allowed to be updated like that on a computer, someone will update it with buggy software that can cause adverse side effects. Who owns the liability in that case?
3> has nothing to do with the code being OS, wherether or not a device is locked down is independent of that.
Maybe in a complete vacuum, but in reality, having access to source certainly makes it easier to look for vulnerabilities, and if the same software is in many devices, the cost of finding vulnerabilities is amortized.
Security by obscurity obviously doesn't stop a determined attacker, but it does raise the barrier to entry for script kiddies.
Reasons to NOT open up the code: 1> Loss of competitive advantage 2> Open source is not necessarily any safer (heartbleed bug ... ) 3> If software for the pacemaker is allowed to be updated like that on a computer, someone will update it with buggy software that can cause adverse side effects. Who owns the liability in that case?
Even if we assume that these arguments are sound (which they aren't), they do not appear to provide a proper justification for letting a human being die.
Put another way: If you had to explain Marie Moe's death to one of her relatives, which of your three points would make the relative understand your position?
Loss of competitive advantage There's a competitive advantage in keeping pacemakers' source code proprietary? Open source is not necessarily any safer (heartbleed bug ... ) It's a hell lot more amendable to inspection than proprietary software.
> There's a competitive advantage in keeping pacemakers' source code proprietary? There definitely is. If your company takes ~2 years to develop a pacemaker's software, it's not to your advantage to let your competitors catch up. I'm not saying it's a good thing that it's closed source, but there is definitely incentive to keep your research to yourself.
> If your company takes ~2 years to develop a pacemaker's software, it's not to your advantage to let your competitors catch up.
Why should the patient who has the pacemaker implanted care? This seems like a clear situation in which the patient's interests trump everybody else's. Pacemaker manufacturers should be competing in how well their devices meet patient needs. Closed source doesn't meet a key patient need.
> There's a competitive advantage in keeping pacemakers' source code proprietary? There definitely is. If your company takes ~2 years to develop a pacemaker's software, it's not to your advantage to let your competitors catch up. I'm not saying it's a good thing that it's closed source, but there is definitely incentive to keep your research to yourself.
> If your company takes ~2 years to develop a pacemaker's software, it's not to your advantage to let your competitors catch up. Why should the patient who has the pacemaker implanted care? This seems like a clear situation in which the patient's interests trump everybody else's. Pacemaker manufacturers should be competing in how well their devices meet patient needs. Closed source doesn't meet a key patient need.
As heartless as this sounds: the patient isn't the only person in the equation. There are investors that fund the medical research, a company has employees to pay, the hospital wants the best pacemaker available, etc.
> If your company takes ~2 years to develop a pacemaker's software, it's not to your advantage to let your competitors catch up. Why should the patient who has the pacemaker implanted care? This seems like a clear situation in which the patient's interests trump everybody else's. Pacemaker manufacturers should be competing in how well their devices meet patient needs. Closed source doesn't meet a key patient need.
As heartless as this sounds: the patient isn't the only person in the equation. There are investors that fund the medical research, a company has employees to pay, the hospital wants the best pacemaker available, etc.
Reasons to NOT open up the code: 1> Loss of competitive advantage 2> Open source is not necessarily any safer (heartbleed bug ... ) 3> If software for the pacemaker is allowed to be updated like that on a computer, someone will update it with buggy software that can cause adverse side effects. Who owns the liability in that case?
Even if we assume that these arguments are sound (which they aren't), they do not appear to provide a proper justification for letting a human being die . Put another way: If you had to explain Marie Moe's death to one of her relatives, which of your three points would make the relative understand your position?
These are sound arguments. Medical devices have to be certified in all applicable jurisdictions and companies want to protect their competitive advantage. This is no different from, say, new drugs, which are similarly proprietary and the maker retains exclusivity for several years. Further, medications too are risky black-boxes towards end-users.
Does anyone know if at least the FDA is allowed to review the source code for pacemakers? Or is it a complete blackbox? Personally I would be appalled if even the FDA is not allowed to.