Is an open-source pacemaker safer than closed-source?
williamedwardscoder.tumblr.com
Is an open-source pacemaker safer than closed-source?
1–10 of 23 posts
Re: Is an open-source pacemaker safer than closed-source?
#2Karen Sandler of the GNOME Foundation discussed an issue similar to this nearly a year ago at OSCON (2011):
https://www.youtube.com/watch?v=nFZGpES-St8
Indeed, the first thing that came to mind when I saw this presentation was RMS' comment, as mentioned in this article.
Re: Is an open-source pacemaker safer than closed-source?
#3Karen Sandler of the GNOME Foundation discussed an issue similar to this nearly a year ago at OSCON (2011): https://www.youtube.com/watch?v=nFZGpES-St8 Indeed, the first thing that came to mind when I saw this presentation was RMS' comment, as mentioned in this article.
yes, the abc story linked in the article touches on it; your video is much clearer source, I'll add the link too :)
Re: Is an open-source pacemaker safer than closed-source?
#4Re: Is an open-source pacemaker safer than closed-source?
#5>"Is an open-source pacemaker safer than closed-source?"
Yes, see arguments on "security through obscurity"
End of discussion.
Re: Is an open-source pacemaker safer than closed-source?
#6Karen Sandler of the GNOME Foundation discussed an issue similar to this nearly a year ago at OSCON (2011): https://www.youtube.com/watch?v=nFZGpES-St8 Indeed, the first thing that came to mind when I saw this presentation was RMS' comment, as mentioned in this article.
Sandler gave a much longer version of the talk at LCA https://www.youtube.com/watch?v=5XDTQLa3NjE
The paper both are based on is at https://www.softwarefreedom.org/news/2010/jul/21/software-de...
edit: Also, similar points can be made about other embedded and safety-critical software. security through obscurity in automobiles is scary, some materials on this at http://she-devel.com
Re: Is an open-source pacemaker safer than closed-source?
#7The article assumes that end users finding problems in the software would prove beneficial to the company. To the contrary, I'd expect the company would soon be sued into oblivion for "allowing" production release of such an "obvious" problem.
While certainly the malicious can figure out how to abuse a system without source code, the owner/author doesn't have to hand the means of abuse to the malicious on a silver platter.
Yes, end users (me being one) have an interest in identifying flaws in their physically internalized lifespan-affecting software. The company making the product has an interest in limiting access to that source code. There are plenty who would rather use the source code to destroy the latter than to benefit the former.
This is why we (in the USA) have the FDA: recognizing that the public has an interest in reviewing a product's engineering for safety purposes, yet respecting the company's need to ward off the malicious, representatives of the public are sent in to review the product for corrective improvement without exposing the company to malicious harm.
Re: Is an open-source pacemaker safer than closed-source?
#8Maybe I'm missing something here, but why is security from attackers a concern for pacemakers?
Re: Is an open-source pacemaker safer than closed-source?
#9Maybe I'm missing something here, but why is security from attackers a concern for pacemakers ?
Because medical devices are pretty shoddy right now? http://www.theregister.co.uk/2011/10/27/fatal_insulin_pump_a...
Re: Is an open-source pacemaker safer than closed-source?
#10An under-discussed point is change control on life-support software.
No doctor will want to be associated with installation of a life-support device which the patient can reprogram at will. Every change, starting from creation of the first blank main.c file, MUST be documented as considered, deliberated, implemented, reviewed, tested, verified, validated, and documented by certified personnel to the satisfaction of everyone from patient to surgeon to maintenance doctor to board of directors to sovereign jurisdictional government. We're not talking "oops, reboot" or "get the backup" or "revert to the previous version" failures should a mistake be made, we're talking "patient will die in 30 seconds flat if you screw up".
Writing a FOSS version of the software keeping me alive right now sounds lofty, but I don't think the surgeon who installed my pacer would have done so if he thought I might actually replace the software outright, and the doc & techs who maintain it certainly wouldn't continue to.
The potential positive benefits of an open-sourced pacemaker are obvious and well-expressed. Oft missed are the litigative & metabolic nightmare scenarios. One dangling pointer and I'm dead.