“I Want to Know What Code Is Running Inside My Body”

Post by taneq » Tue, Aug 09, 2016, 1:57 AM UTC

falcolas wrote: post #25

randyrand wrote: post #20

By extension should every device I own require me to have access to the source code and output data? Not a rhetorical question.

Do you want to control the device, or do you want someone else to control your devices? If you're OK with someone else (who probably doesn't have your well-being anywhere in their list of priorities) controlling all of your devices, then the answer is no, you are not required to have access to the source code and output data. EDIT: I didn't realize this was such a controversial statement. I stand by it, though; even…

Post by llukas » Tue, Aug 09, 2016, 2:00 AM UTC

HeyLaughingBoy wrote: post #38

pdonis wrote: post #14

Earlier quoted context omitted.

> If your company takes ~2 years to develop a pacemaker's software, it's not to your advantage to let your competitors catch up. Why should the patient who has the pacemaker implanted care? This seems like a clear situation in which the patient's interests trump everybody else's. Pacemaker manufacturers should be competing in how well their devices meet patient needs. Closed source doesn't meet a key patient need.

Medical device software is subject to a level of rigor in development process that little else is. Exactly what patient need do you believe open source would meet that is not being met by the current closed-source development process?

Post by whorleater » Tue, Aug 09, 2016, 2:05 AM UTC

llukas wrote: post #35

whorleater wrote: post #15

Earlier quoted context omitted.

As heartless as this sounds: the patient isn't the only person in the equation. There are investors that fund the medical research, a company has employees to pay, the hospital wants the best pacemaker available, etc.

Sure - why not ask patient for paid subscription for privilege of using pacemaker? Somebody please think of the investors...

Post by ikeboy » Tue, Aug 09, 2016, 2:09 AM UTC

stordoff wrote: post #30

mankash666 wrote: post #4

Reasons to NOT open up the code: 1> Loss of competitive advantage 2> Open source is not necessarily any safer (heartbleed bug ... ) 3> If software for the pacemaker is allowed to be updated like that on a computer, someone will update it with buggy software that can cause adverse side effects. Who owns the liability in that case?

None of these are particularly compelling reasons IMO. > 1> Loss of competitive advantage Patient safety trumps business considerations. Skipping clinical trials would be a major competitive advantage (lower costs, quicker to market etc.), but we don't allow that for the same reason > 2> Open source is not necessarily any safer (heartbleed bug ... ) I'll agree, in so far as saying making it open source doesn't necess…

Post by wadetandy » Tue, Aug 09, 2016, 2:12 AM UTC

smallnamespace wrote: post #12

iokanuon wrote: post #9

Earlier quoted context omitted.

3> has nothing to do with the code being OS, wherether or not a device is locked down is independent of that.

Maybe in a complete vacuum, but in reality, having access to source certainly makes it easier to look for vulnerabilities, and if the same software is in many devices, the cost of finding vulnerabilities is amortized. Security by obscurity obviously doesn't stop a determined attacker, but it does raise the barrier to entry for script kiddies.