Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“I Want to Know What Code Is Running Inside My Body”

backchannel.com

Post reply on HN
Print view View original

191–200 of 217 posts

Re: “I Want to Know What Code Is Running Inside My Body”

#191

Post by hx87 »

jordigh wrote: post #173
michaelt wrote: post #152

Earlier quoted context omitted.

What happened to us? My theory is this is HN-specific - and what you saw on slashdot was slashdot-specific. Because HN started as part of YC its culture really likes VC-backed startups. And we think VCs want the kind of huge returns that are seen more often by closed source companies - they want to back the next Microsoft or Apple or Google or Facebook or Paypal or Amazon, not the next Red Hat or Canonical or MySQL.…

I see a similar lack of enthusiasm for free software everywhere, not just in HN (maybe confirmation bias), in Lobsters, Reddit, IRC. I really think that Unix in Apple and Android has given us what Steinbeck calls "a bored and slothful cynicism, in which rebellion against the world as it is, and myself as I am, are submerged in listless self-satisfaction." It's good enough for most people, we have some Unix under the…

Maybe it's just that the rebels these days are quieter and more establishmentarian, because they have /become/ the establishment. TBF, I quite like this state of affairs and don't miss the rebellion-for-the-sake-of-rebellion attitudes of yesteryear.

Re: “I Want to Know What Code Is Running Inside My Body”

#192

Post by grogenaut »

throwanem wrote: post #134
grogenaut wrote: post #100

Earlier quoted context omitted.

There have been medical devices external to the body for a long time. Therac 25 (1982) is world wide web (1989). Airplanes were first flight controlled by computer in 1958, and commercially in the concorde in 1969. Think about that for a minute. There has been an official government review process for safety of computer controlled airplanes since the 70s, and a good decade for medical devices (likely earlier) 10 year…

Uh, did you really just cite Therac 25 in favor of safety review? You do know that was the one that had a bug which slipped past review and killed some people, right? Your overall point is well taken, but maybe put a little more thought into the examples you pick to support it...

I cited it as a thing that killed people and caused an industry overhaul in how things were reviewed... Remember that toyota just was forced to do somthing like this only a few years ago. I'd say the FDA has been cognizant of life threatening code for a lot longer.

Re: “I Want to Know What Code Is Running Inside My Body”

#193

Post by kelson »

kefka wrote: post #169
augustl wrote: post #167

Earlier quoted context omitted.

This is interesting and quite philosophical. Is there a difference between procedures and data? Isn't it all just transistors and capcitors anyway? And is anyting really anything? Isn't it all just really quantum fields? Practically speaking, obscurity is a "platform" that lets you bypass everything, whereas knowing a password is more limited since it grants access to a single user. But practically speaking, obscurit…

If anything, I would use a lock analogy. Locks are rated in how many seconds/minutes they can withstand from a dedicated attacker. Perhaps that would be a way to determine a similar safety rating for passwords/crypto based systems. In passwords: how many passwords can you try per second before the server refuses? Then Password space/# per second = total seconds for guaranteed entry. Crypto: how many keys do you have…

We measure password and cryptographic key security based on their entropy (keyspace) and speed (key tests / second). Given current attacks (GNFS), a 2048-bit RSA key has ~112 bits of security^1 and would take ~20,000 years to brute force using every computer ever made^2. Passwords and cryptographic keys are selected as the single point of obscurity in these systems so that many eyes may secure the other components. If the system is otherwise secure, then it is as weak as the passwords/keys which are (hopefully) picked to be very strong.

Most individuals defending algorithmic security through obscurity believe that hiding the algorithm improves security. That may be true in an extremely technical sense (the attacker must recover the algorithm first), but it is very misleading and unprofessional commentary. Algorithmic security through obscurity is at best calculated in difficulty-to-reverse-engineer (or difficulty-to-steal), which doesn't provide per-use(r) specificity (per-user password) nor scale in complexity (a 256-bit key is generally 2^128 times stronger than a 128-bit key, but doubling the algorithm length increases reversing time by slightly less than a factor of 2).

Algorithmic security through obscurity provides negligible security, but what's the harm? Why should we care? Attempting to hide the algorithm provides a false sense of security, limits review to "approved" parties, and induces legal/social efforts to "protect" the secret. The limited review is particularly noteworthy since it promotes bugs in both the algorithm and the implementation. The end result is a facade of security, some very unhappy whitehats, some very happy blackhats, and more users betrayed through poor security practices.

[1] http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_p... [2] http://tjscott.net/crypto/64bitcrack.htm#INTELG

Re: “I Want to Know What Code Is Running Inside My Body”

#194

Post by abandonliberty »

etendue wrote: post #181
3chelon wrote: post #158

We hear a lot about how digital obsolescence is a growing problem, and almost all of it refers to not being able to access your old family photos and movies, or maybe old documents and spreadsheets. But what happens when your pacemaker is obsolete, the source code is long lost, and no-one knows how to update it? Is this problem being addressed in any real way? 50 years in the future some of today's devices may still…

The pacemaker or ICD generator is replaced when the battery is exhausted, typically 8–10 years. The procedure is not a big deal, it is commonly outpatient and done under local. Outside of some durable orthopedic implants, few implants will survive in the body for 50 years: it is a very hostile environment.

>it is a very hostile environment.

I've never thought of it this way, and you are right from both a technological and biological perspective.

Biologically we are wonderful containers of nutrients, but we have an army only the very sneaky or militant can overcome. Once that army stands down we are rapidly colonized - which is why we must be so careful with food/meat storage.

Re: “I Want to Know What Code Is Running Inside My Body”

#195

Post by kelson »

TickleSteve wrote: post #180
type0 wrote: post #174

Earlier quoted context omitted.

Agree. But one should design software without the obscurity layer, then it's okay to explain how obscurity can be set up during deployment.

absolutely... given everything else is equal... adding obscurity is a positive.

The flaw may be assuming everything else can be equal in the real world. Obscuring the algorithm has downstream consequences that may/will reduce overall security.

For example, hiding the algorithm from whitehats may prevent/discourage them from hunting/reporting bugs.

Re: “I Want to Know What Code Is Running Inside My Body”

#196

Post by CaptSpify »

TickleSteve wrote: post #99

You most certainly don't want people to be able to modify safety critical code within a pacemaker. What most developers don't realise is the level of engineering strictness that goes into anything safety-related. The rules and regulations related to anything that affects the human body is in a different league than what most developers are familiar with. What is a problem here, is that the design (not the code) appar…

I used to Reverse-Engineer medical equipment (MRIs, CTs, etc). The lack of engineering strictness in theses systems was amazing to me. They are horribly insecure, BY DESIGN

My experience is that, no, this is not an acceptable solution. I have no reason to believe that implanted medical devices will be any better.

Re: “I Want to Know What Code Is Running Inside My Body”

#197

Post by smallnamespace »

pdkl95 wrote: post #122
smallnamespace wrote: post #79

Earlier quoted context omitted.

Even if embedded devices are updatable in principle, in practice how often do they receive security patches? Pointing to a feature list isn't a realistic evaluation of what actually happens. We live in a world where even phones don't get patched as frequently as they should; you expect end users to patch their pacemakers? Putting them online and allowing auto-patching would probably be worse since it also increases t…

> in practice how often do they receive security patches? I have no idea what the current patch rate is for pacemakers, but they do happen. The use of radio was a feature specifically to allow updating and management of the pacemakers while avoiding the serious risks of surgery. The pacemakers would be patched when the patient shows up for their next checkup appointment, which is probably every 1-2 months. They alrea…

> The use of radio was a feature specifically to allow updating and management of the pacemakers while avoiding the serious risks of surgery.

In other words, it's a ready-made vector for potential attacks, as long as an attacker can get close to a pacemaker with a radio. You could probably even put a powerful device near a hospital and pick up random people coming and going.

> Or do you want to let the community at least _attempt_ to find the bugs first?

The promise of open-source security has always been that you let many eyes look for problems, then you patch ahead of potential attackers.

Logistically, that's extremely problematic for embedded devices. Every time a vulnerability is found, you ask the patient to go back to the doctor to get it updated? That doesn't scale at all.

The idea that device manufacturers will change their entire engineering and security philosophy is somewhere between idealistic and naive. I sincerely hope it's the former and not the latter.

Re: “I Want to Know What Code Is Running Inside My Body”

#198

Post by jordigh »

hx87 wrote: post #191
jordigh wrote: post #173

Earlier quoted context omitted.

I see a similar lack of enthusiasm for free software everywhere, not just in HN (maybe confirmation bias), in Lobsters, Reddit, IRC. I really think that Unix in Apple and Android has given us what Steinbeck calls "a bored and slothful cynicism, in which rebellion against the world as it is, and myself as I am, are submerged in listless self-satisfaction." It's good enough for most people, we have some Unix under the…

Maybe it's just that the rebels these days are quieter and more establishmentarian, because they have /become/ the establishment. TBF, I quite like this state of affairs and don't miss the rebellion-for-the-sake-of-rebellion attitudes of yesteryear.

Yeah. If you don't hurry up to change the world, then the world changes you.

http://www.sylvialiuland.com/2012/01/mafalda-classic-cartoon...

Re: “I Want to Know What Code Is Running Inside My Body”

#199

Post by 3chelon »

etendue wrote: post #181
3chelon wrote: post #158

We hear a lot about how digital obsolescence is a growing problem, and almost all of it refers to not being able to access your old family photos and movies, or maybe old documents and spreadsheets. But what happens when your pacemaker is obsolete, the source code is long lost, and no-one knows how to update it? Is this problem being addressed in any real way? 50 years in the future some of today's devices may still…

The pacemaker or ICD generator is replaced when the battery is exhausted, typically 8–10 years. The procedure is not a big deal, it is commonly outpatient and done under local. Outside of some durable orthopedic implants, few implants will survive in the body for 50 years: it is a very hostile environment.

Useful to know. Of course, batteries get better and electronics gets lower powered - I can imagine in the near future implanted devices being effectively passive (such as RFID)... but your point about the body being a hostile environment is definitely something I hadn't considered before.

Re: “I Want to Know What Code Is Running Inside My Body”

#200

Post by tn13 »

subway wrote: post #3
tn13 wrote: post #2

Very soon we would have FBI and NSA requiring these pacemakers to have a kill switch to kill whoever they don't like.

They don't need to. Private industry has shown time and again that the device will remain insecure until consumers care (that is, indefinitely).

Those are two different things. Private industry's safety assurance will grow up steadily as the demand from consumers goes up. Currently we are just thankful to be alive.

For example if someone invents an artificial device that helps me get rid of diabetes I would be super happy. It is only a generation later we would demand that device meet certain quality floor. That is the case with all innovations.

Government however can put a very hard nail into the head of an innovation.

Post reply on HN