Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My insulin pump controller uses the Linux kernel. It also violates the GPL

old.reddit.com

Post reply on HN
Print view View original

31–40 of 268 posts

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#31

Post by mlsu »

fyhn wrote: post #27
Group_B wrote: post #8

Oh well. The whole thing has already been reverse engineered. Look up Loop or Trio or OpenAPS. Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices. This isn’t really that big a deal. What we need right now is help REing the Omnipod 5

Not all though, I've been looking at Minimed pump reverse engineering (which would be just reading glucose data, not controlling the pump), and that's not solved yet, at least not for the 780G. But I hope it will be, and perhaps I'll be able to contribute.

I don't work for Medtronic. But it's extremely unlikely that will happen. It's not merely a matter of reverse engineering -- after the original medtronic "hack" / reverse engineer efforts (the ones that lead to the original openAPS system being developed) the FDA put out new guidance on cybersecurity protections for insulin pumps.

The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices.

> Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices

Absolutely not true, not any more.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#32

Post by robomartin »

abigail95 wrote: post #25

I get mad triggered by software license violation discussions. Please for the love of all that the FSF thinks is holy - just file a damn lawsuit if you are telling me they are violating the law. State your claim and have a court sort it out. It costs hundreds of dollars. For a medical device? Seems like a good deal.

In what planet does a lawsuit cost hundreds of dollars?

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#33

Post by kkjjjjw »

jimrandomh wrote: post #29

If the only GPLed component used is the Linux kernel, you probably aren't entitled to any noteworthy source code. It's well established that using the kernel doesn't create a GPL requirement userspace software running on the same device, and the most likely arrangement here is a completely-uncustomized kernel paired with an open-source userspace program that does all the interesting bits.

Then it should be trivial for them to provide the source code.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#34

Post by mlsu »

lacoolj wrote: post #30

So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)? Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"? Kinda feels like that just screams data-stealing, regar…

Until recently, if you offered a pump that _could_ be controlled by another device (such as a phone) you would have to offer your own "controller" device, even if 99.9% of your customers have a phone already.

So, this companion device is kind of a thing that Insulet had to release. You'll see this with CGM's too -- there's a small companion device sold with the Dexcom G7 (the "controller"), even though everyone just uses their phone.

This is kind of a regulatory quirk; basically from the FDA's point of view you had to have a complete standalone system, that did not include the phone, in order to be able to prescribe it. I think they do not require companion devices any more, it's OK to release something that requires the user to have a phone.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#35

Post by kgwxd »

jstanley wrote: post #11
teddyh wrote: post #6

> I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it. This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that: 1. The GPL requires the company to send the user a written offer of source code. 2. The user uses this offer to request the source code from the company. 3. If the…

Are you saying that in the general case if you send someone a written offer for something and then don't honour it, you are in breach of contract? That doesn't sound right to me. A written offer is not the same thing as a contract.

I think they're just saying the GPL doesn't really cover consumer/distributor (dis)agreements, it only covers copyright. While the spirit of the GPL is user-first, it still has to be realized within the confines of copyright law. Even though many people might conflate the spiritual goal and the legal agreement, it doesn't grant "users" any extraordinary legal powers.

It's not illegal to not honor written offers, it's illegal to distribute copyrighted material in violation of it's license.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#36

Post by abdullahkhalids »

teddyh wrote: post #18
dspillett wrote: post #16

Earlier quoted context omitted.

The written offer is part of the licence, as is the need to respond to that offer with the source code offered. It is all part of the same agreement. A written offer on its own would not normally be directly enforceable in many (most?) jurisdictions, for the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contr…

I don’t think so; I can’t recall any support for such a connection between the written offer and the GPL itself written into the GPL license text.

From section 4 [1]

> If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.

Similar clauses in Sec 6.

[1] https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#37

Post by martin_bech »

lacoolj wrote: post #30

So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)? Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"? Kinda feels like that just screams data-stealing, regar…

Security… The PDM is walled off completely, it cant install apps, its not on wifi, you cant change any settings. The issue is that a PDM technically could easily kill you, by giving you a lethal dose of insulin.

Funny thing is that the newer Omnipod 5 from the same company works with regular phones now, but only in th US.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#38

Post by martin_bech »

mlsu wrote: post #34
lacoolj wrote: post #30

So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)? Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"? Kinda feels like that just screams data-stealing, regar…

Until recently, if you offered a pump that _could_ be controlled by another device (such as a phone) you would have to offer your own "controller" device, even if 99.9% of your customers have a phone already. So, this companion device is kind of a thing that Insulet had to release. You'll see this with CGM's too -- there's a small companion device sold with the Dexcom G7 (the "controller"), even though everyone just…

Its also for security.. outside the US, you still cant use a regular phone with the omnipod.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#39

Post by lacoolj »

mlsu wrote: post #34
lacoolj wrote: post #30

So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)? Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"? Kinda feels like that just screams data-stealing, regar…

Until recently, if you offered a pump that _could_ be controlled by another device (such as a phone) you would have to offer your own "controller" device, even if 99.9% of your customers have a phone already. So, this companion device is kind of a thing that Insulet had to release. You'll see this with CGM's too -- there's a small companion device sold with the Dexcom G7 (the "controller"), even though everyone just…

So essentially, it's like this?

"we plan on users having a phone to connect to it and use primarily. FDA requires a primary/backup. well it's already phone-controlled, go find a phone that works with it. needs to be cheap, cuz no one will really use it anyway"

That makes a little more sense. I was imagining the development process involving both devices, rather than one device first, then determining what the second would be later.

Thanks for the insight!

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#40

Post by teddyh »

abdullahkhalids wrote: post #36
teddyh wrote: post #18

Earlier quoted context omitted.

I don’t think so; I can’t recall any support for such a connection between the written offer and the GPL itself written into the GPL license text.

From section 4 [1] > If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code. Similar clauses in Sec 6. [1] https://www.gnu.org/licenses/old-licenses/lgpl-2.1.htm…

That section (and similar in section 6d) is not about the written offer of source code. The written offer of source code is instead covered in section 6c.
Post reply on HN