Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“I Want to Know What Code Is Running Inside My Body”

backchannel.com

Post reply on HN
Print view View original

61–70 of 217 posts

Re: “I Want to Know What Code Is Running Inside My Body”

#61

Post by jordigh »

randyrand wrote: post #20

By extension should every device I own require me to have access to the source code and output data? Not a rhetorical question.

Y'know, back in the early 2000's and the days of Slashdot, it was quite common to find people who advocated for free software everywhere.

Now we find people who like yourself have to specify that the radical position that all software should be free is something worthy of serious consideration. That they're not joking or trying to be deliberately provocative.

What happened to us? Why did we go from boasting about installing Linux on a dead badger and talking about how all software will some day be free to being afraid to seriously consider the proposition?

Re: “I Want to Know What Code Is Running Inside My Body”

#63

Post by jordigh »

taneq wrote: post #41
falcolas wrote: post #25

Earlier quoted context omitted.

Do you want to control the device, or do you want someone else to control your devices? If you're OK with someone else (who probably doesn't have your well-being anywhere in their list of priorities) controlling all of your devices, then the answer is no, you are not required to have access to the source code and output data. EDIT: I didn't realize this was such a controversial statement. I stand by it, though; even…

There's another whole level to this question of control, which is do you want someone else's algorithm, written in the past, to control your device, or do you want them to have realtime access to change your device's behaviour whenever they want? The latter is becoming more and more common and, I think, is far more disturbing than the former. (As an aside, the suggestion that a software developer writing firmware for…

> You wouldn't believe the amount of effort that goes into ensuring that critical systems behave properly.

I wouldn't either. I have seen some of it, and not that much effort goes into it. A lot of paperwork goes into saying that the effort was done, but the actual effort carried out pales in comparison.

It's more about finding someone else to blame than to make sure nothing bad happens. Organisations like the frickin' FDA who have no idea how software is developed are in charge of worldwide standards of medical software bureaucracy.

Re: “I Want to Know What Code Is Running Inside My Body”

#64

Post by yolesaber »

I saw a talk about medical device security (or lack thereof) at the Eleventh Hope a few weekends ago. Very scary. They started off with a story about patients in a hospital who became horribly addicted to morphine because they were able to hack the machine from resources found online (http://www.massdevice.com/hospital-patient-hacks-his-own-mor...). Go on Shodan and search for medical devices and terminology (e.g. "radiology") and you'll see the state of things. Sensitive machinery exposed on the open internet. A lot of medical devices have hardcoded passwords that are used for remote operations by technicians.

Open sourcing this code would do a lot to mitigate these issues.

Re: “I Want to Know What Code Is Running Inside My Body”

#65

Post by icegreentea »

pthreads wrote: post #19

Does anyone know if at least the FDA is allowed to review the source code for pacemakers? Or is it a complete blackbox? Personally I would be appalled if even the FDA is not allowed to.

In general, you do not submit source code for review - just all your procedures and results for testing.

In normal auditing, they will not inspect your source code - they may inspect everything around your source code (what you procedures for changes are, how you do your testing, etc etc).

However, I believe there's a general understanding that if you fuck up, your source code will be open to inspection - along with everything else. Cause you'll either voluntarily surrender it in hopes of getting on the FDA's good side, or cause they'll subpoena cause you killed someone.

Re: “I Want to Know What Code Is Running Inside My Body”

#66

Post by drdeadringer »

I am imagining that young folks have Library Anxiety, and old folks have "Google Anxiety".

Ask any question and you will find an answer. Any question you have, no matter how banal or left-field. What is the weather? Is my grandson a lesbian? How do I eat pizza in Italy?

Where is the biography section? How do I understand the Dewey Decimal System? What is in the Special Collections, and what are the hours -- and do I need an appointment? The computers are down... is there a way I can search for books offline without randomly roaming the stacks?

Re: “I Want to Know What Code Is Running Inside My Body”

#67

Post by [deleted] »

beachy wrote: post #59
HeyLaughingBoy wrote: post #38

Earlier quoted context omitted.

Medical device software is subject to a level of rigor in development process that little else is. Exactly what patient need do you believe open source would meet that is not being met by the current closed-source development process?

The need to avoid Therac-25 [1] type bugs in the proprietary code that are fatal to the patient. Open source in conjunction with a bug bounty would make me far more confident than simply trusting that some large corporate has got their shit wired tight when history throws up so many counter-examples. [1] https://en.wikipedia.org/wiki/Therac-25

[deleted]

Re: “I Want to Know What Code Is Running Inside My Body”

#68

Post by c22 »

whorleater wrote: post #10
kiba wrote: post #6

Earlier quoted context omitted.

Loss of competitive advantage There's a competitive advantage in keeping pacemakers' source code proprietary? Open source is not necessarily any safer (heartbleed bug ... ) It's a hell lot more amendable to inspection than proprietary software.

> There's a competitive advantage in keeping pacemakers' source code proprietary? There definitely is. If your company takes ~2 years to develop a pacemaker's software, it's not to your advantage to let your competitors catch up. I'm not saying it's a good thing that it's closed source, but there is definitely incentive to keep your research to yourself.

If every pacemaker manufacturer is required to publish source couldn't you just release it under a license that doesn't allow your competitors to use your code and wouldn't it be readily apparent if they did?

Re: “I Want to Know What Code Is Running Inside My Body”

#69

Post by function_seven »

tdicola wrote: post #50
pthreads wrote: post #19

Does anyone know if at least the FDA is allowed to review the source code for pacemakers? Or is it a complete blackbox? Personally I would be appalled if even the FDA is not allowed to.

Does the FDA have the knowledge and experts to really understand if the firmware is good or bad though?

That's a tough one to answer. The cynic in me says probably not. That they're so focused on pharmaceuticals and "analog" medical devices that they haven't developed those capabilities.

But I also know that the FDA is a massive organization, and there's no reason they couldn't hire for this specific purpose. But then the cynic says that government pay grades may not be up to snuff.

See the HCA rollout and subsequent rewrite.

Sorry, that was a long way of writing, "I don't know".

Re: “I Want to Know What Code Is Running Inside My Body”

#70

Post by beagle3 »

krapp wrote: post #36
falcolas wrote: post #25

Earlier quoted context omitted.

Do you want to control the device, or do you want someone else to control your devices? If you're OK with someone else (who probably doesn't have your well-being anywhere in their list of priorities) controlling all of your devices, then the answer is no, you are not required to have access to the source code and output data. EDIT: I didn't realize this was such a controversial statement. I stand by it, though; even…

In theory, open sourcing pacemaker software make sense, but in practice, the pool of people qualified to review and edit that software may not be very large. Most people would still be depending on someone else to control their devices in any case.

the editor pool is small, but the reviewer pool is large.
Post reply on HN