Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My insulin pump controller uses the Linux kernel. It also violates the GPL

old.reddit.com

Post reply on HN
Print view View original

151–160 of 268 posts

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#151

Post by conartist6 »

gpm wrote: post #107
AnthonyMouse wrote: post #104

Earlier quoted context omitted.

Wouldn't that imply that end-user license agreements are all unenforceable because the software was sold through a retailer, and even if it wasn't you could just a get a secondhand copy?

By my understanding EULAs are based on contract law and having a clickwrap agreement that requires you agree to it before using the software, not copyright law. Except perhaps to the extent that copyright law would prevent you from creating a derivative work that doesn't require you to agree to that clickwrap agreement prior to using the software.

So too is the GPL a contract, or at least nobody has proven that it is not a contract and the SFC will fight to prove that it is

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#152

Post by faidit »

teddyh wrote: post #6

> I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it. This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that: 1. The GPL requires the company to send the user a written offer of source code. 2. The user uses this offer to request the source code from the company. 3. If the…

Doesn't seem incorrect if, extra steps aside, the company is ultimately obligated to provide the source code by the terms of the GPL.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#153

Post by gpm »

conartist6 wrote: post #151
gpm wrote: post #107

Earlier quoted context omitted.

By my understanding EULAs are based on contract law and having a clickwrap agreement that requires you agree to it before using the software, not copyright law. Except perhaps to the extent that copyright law would prevent you from creating a derivative work that doesn't require you to agree to that clickwrap agreement prior to using the software.

So too is the GPL a contract, or at least nobody has proven that it is not a contract and the SFC will fight to prove that it is

Sure, maybe anyways but let's assume it is, the parties to that contract are the manufacturer and the copyright holder. The contract allows the manufacturer to distribute it to the distributor without requiring the distributor to agree to the terms and itself become a party. The distributor can then sell the device with the software on it on without acquiring a license and becoming a party to the contract because the copyright has been exhausted (first sale doctrine).

EULA's get around this by forcing the end user to become a party to the contract via a click wrap agreement. There is usually no such click wrap agreement binding the distributor in the case of the GPL. And the GPL doesn't require the creation or maintenance of such a click wrap agreement so the manufacturer would be free to remove it even if the original software had one.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#156

Post by tzs »

teddyh wrote: post #6

> I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it. This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that: 1. The GPL requires the company to send the user a written offer of source code. 2. The user uses this offer to request the source code from the company. 3. If the…

> The GPL requires the company to send the user a written offer of source code

It should be noted that this is just one of three options that someone who wants to distribute binaries of GPL code can choose from. It's the most commonly chosen one, and one is only available for noncommercial distribution, so the odds are good that this is the option they are using.

The other available option is to accompany the binary with the source code.

That one leads to an interesting possibility where someone could end up with a binary and there is no one obligated to provide source to them. As far as I know this has not actually arisen, but it seems like something that is bound to happen sometime.

Suppose company X decides to make a generic hardware platform that other companies can buy to build their products on. X's platform is basically a small single board computer with WiFi, Bluetooth, dual, USB ports, a couple Ethernet ports, and some GPIO ports. X ports Linux to their hardware.

When X ships a system it comes with an SD card with a Linux distribution installed including their custom kernel. It is configured to boot from the first SD card slot, and then to run a custom login system that looks at the second SD card slot and if there is a card in there it mounts it, looks for an executable on its root name application.exe, and runs that as root. X includes in the box a small thumb drive with a copy of the source code for everything on the SD card.

The idea is that a company Y that wants to make something like a WiFi access point or an air quality monitor can buy these boards from X, put them in a case with whatever peripherals or sensors they need like air quality sensors, write the software for the application, put it on an SD card, and put that in the second SD card slot.

So lets say Y buys 1000 of these systems from X, builds 1000 of their access points or whatever from them, and sells them.

One of their customers asks Y for the source code of the GPL parts. Does Y have to provide it?

I'd say they do not. They are not making copies or derivative works. They are just receiving physical copies from X and passing those on unmodified to their customers. This should fall squarely under the First Sale Doctrine in US copyright law, and similar rules in other jurisdictions.

How about if they ask X for a copy?

X has made copies and derivative works and distributed them. But X satisfied their GPL requirements by including a thumb drive with the source with each board they shipped to Y.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#157

Post by ijustlovemath »

sarusso wrote: post #129
mlsu wrote: post #31

Earlier quoted context omitted.

I don't work for Medtronic. But it's extremely unlikely that will happen. It's not merely a matter of reverse engineering -- after the original medtronic "hack" / reverse engineer efforts (the ones that lead to the original openAPS system being developed) the FDA put out new guidance on cybersecurity protections for insulin pumps. The communication between your phone/pump or glucose sensor/pump is encrypted now for a…

> The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices. May I ask where did you get this info? And what “newer” means here?

This person is referring to this guidance document: https://www.fda.gov/medical-devices/digital-health-center-ex...

I'm a medical device developer working on this exact problem (glucose control)

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#158

Post by firtoz »

chii wrote: post #131
jacquesm wrote: post #116

Earlier quoted context omitted.

I know people die that way (GA). But someone is working for the companies that make insulin pumps and they are not as a rule equally motivated so I would expect them to do worse , not better. And to the best of my knowledge none of the closed-loop people have died as a result of their work and they are very good at peer reviewing each others work to make sure it stays that way. And I'd trust my life to open source in…

> I would expect them to do worse, not better. which is why lots of systems and processes (sometimes called red tape) exist to try and prevent the undesired outcome, and dont rely on the competency of a single person as the weak link!

There are more financial reasons to violate and cheat the red tape than there are incompetent open source hackers in the world.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#159

Post by ianburrell »

lacoolj wrote: post #30

So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)? Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"? Kinda feels like that just screams data-stealing, regar…

One thing is that you need to tell the insulin pump when you eat food so it can deliver insulin to cover the food. I bet that is a lot easier in an app than some separate controller device.

Insulin pumps are paired with glucose monitor. I bet it is handy to check glucose levels to make things are stable and correct if off.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#160

Post by ivell »

Joker_vD wrote: post #103
dspillett wrote: post #16

Earlier quoted context omitted.

The written offer is part of the licence, as is the need to respond to that offer with the source code offered. It is all part of the same agreement. A written offer on its own would not normally be directly enforceable in many (most?) jurisdictions, for the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contr…

> the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contract or other promise) The hell? Over here, the price tags are a sort of public contract, to which the seller pre-commits. The seller forgot to change the tags? That's not the buyer's problem.

Since money has not exchanged hands, you could always decide not to buy at the counter. So atleast in the countries I have been, it is not legally binding.
Post reply on HN