Can I drop a pacemaker 0day? • Hacker News Board

Re: Can I drop a pacemaker 0day?

#171

Post by baddox » Thu, Jun 05, 2014, 5:37 PM UTC

thomasz wrote: post #144

baddox wrote: post #129

Earlier quoted context omitted.

> 1) You really shouldn't have an open conversation about knowledge that can easily kill people. You mean like guns, toxins, and martial arts?

sigh . This will get boring quite fast because a sizable portion of people participating in threads like that find the idea revolting that actions can have, you know, consequences , but what the heck... If you would find a recipe for a toxin that is deadly, untraceable and can be mixed together from common household items by a talented 14 year old, it's probably a bad fucking idea to post that to 4chan. The same goes…

This is an extensively amended and much weaker claim than your first.

Re: Can I drop a pacemaker 0day?

#172

Post by tripzilch » Thu, Jun 05, 2014, 10:43 PM UTC

ijk wrote: post #87

mindslight wrote: post #60

Earlier quoted context omitted.

> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…

> Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? Might be useful to distinguish between the ideal and the actual: in an ideal world, you of course shouldn't need a lawyer and the manufacturers should smilingly thank anyone who discovers an exploit and tells them. In this less-than-perfect w…

Interesting how digital rights, when they apply to privacy and outrage about eavesdropping it's "just the USA", but when they refer to liability in an out-of-control justice system it's as if does work the same way in the entire world.

Re: Can I drop a pacemaker 0day?

#173

Post by nl » Fri, Jun 06, 2014, 12:25 AM UTC

redthrowaway wrote: post #164

nl wrote: post #103

Earlier quoted context omitted.

I'd imagine the correct thing to do is use the FDA's "MedWatch Online Voluntary Reporting Form". Use the MedWatch form to report adverse events that you observe or suspect for human medical products, including serious drug side effects, product use errors, product quality problems, and therapeutic failures for:... Medical devices (including in vitro diagnostic products) [1] https://www.accessdata.fda.gov/scripts/medw…

That strikes me as a system that was set up with the best intentions, but which in practice acts as a barrier to, rather than facilitator of, change. The only way I can see it compelling a manufacturer to change is if someone is killed by this exploit and their family uses the existence of a report of that vulnerability to push for massive willful negligence damages in a lawsuit.

That strikes me as a system that was set up with the best intentions, but which in practice acts as a barrier to, rather than facilitator of, change

Hu?

I can see an argument that is is ineffective (maybe it just drops into the FDA bureaucracy), but I'm not sure how you can argue it is actually a barrier?

The FDA does actually have some pretty significant regulatory authority over medical devices. IANAL, but it appears this may be one of the limited cases where the FDA may actually be able to force a recall[1] as opposed to just requesting it. I suspect (and hope) the "recall" would actually be limited to a software update in this case. Even if they can't force it, a FDA-requested recall is a pretty significant thing.

[1] http://www.fda.gov/downloads/AboutFDA/Transparency/PublicDis...

Re: Can I drop a pacemaker 0day?

#174

Post by Anderkent » Fri, Jun 06, 2014, 11:30 AM UTC

zheshishei wrote: post #160

thomasz wrote: post #144

Earlier quoted context omitted.

sigh . This will get boring quite fast because a sizable portion of people participating in threads like that find the idea revolting that actions can have, you know, consequences , but what the heck... If you would find a recipe for a toxin that is deadly, untraceable and can be mixed together from common household items by a talented 14 year old, it's probably a bad fucking idea to post that to 4chan. The same goes…

>If you would find a recipe for a toxin that is deadly, untraceable and can be mixed together from common household items by a talented 14 year old, it's probably a bad fucking idea to post that to 4chan. Does this count as a straw man argument? Wouldn't the actual scenario would be more like disseminating the information that a deadly toxin that is deadly, untraceable, and can be mixed together from common ingredien…

Well, that depends on whether he dropped the actual exploit, or just talked about it. Which was the original question.