Live data from Hacker News

My insulin pump controller uses the Linux kernel. It also violates the GPL

old.reddit.com

251–260 of 268 posts

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#251
post #45

Earlier quoted context omitted.

As far as I understand it, Richard Stallman has gotten his view about linking from FSF’s lawyers, who has advised the FSF about what does and does not count as a “derived work”, in the sense of US copyright law. If you want to argue that the FSF’s lawyers are wrong, please provide more detailed, and hopefully referenced, arguments (as opposed to plain assertions).

I would point towards Oracle v. Rimini, where the Ninth Circuit has specifically ruled (inside a complex and yet-unresolved case) that a system built to interoperate with a copyrighted program does not constitute a derivative work of that program. ( https://cdn.ca9.uscourts.gov/datastore/opinions/2024/12/16/2... ) They reference a less on point but better known case ( https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_…

i don't see how either of those cases applies to the FSF and GNU's attitude on library linking; in neither case were they creating a combined derivative work.

if I make an ai driven viewscreen that you can stick your paperback book into and it gives you a better reading experience of the book, your paperback book is still in there and you can take it out. My viewscreen may not work without the book, but it hasn't merged/modified the book with anything.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#252

Earlier quoted context omitted.

This is an open legal question, which the Conservancy v Vizio case will hopefully change; in that case, Conservancy is arguing that consumers have the right to enforce the GPL in order to receive source code.

This got buried on HN a few days ago which is a shame: https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ Linus rants that the SFC is wrong and argues that the GPLv2 which the kernel is licensed under does NOT force you to open your hardware. The spirit of the GPLv2 was about contributing software improvements back to the community. Which brings us to the question: what is this guy going to do with (presumably) the…

>Which brings us to the question: what is this guy going to do with (presumably) the kernel source?

it doesn't bring us to the question, but the answer to the question is, run a diff between the software that has this guys life in its hands, and the version it was derived from, to see if they inserted back doors, stray pointers, etc.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#253

Earlier quoted context omitted.

> it's the equivalent of flying a plane you built yourself A great analogy because people die that way. I personally would never push code to another person’s insulin pump (or advertise code as being used for an insulin pump) because I couldn’t live with the guilt if my bug got someone else killed.

I'm not aware of any deaths attributed to open source artificial pancreas systems. Meanwhile there have been multiple attributed to closed source glucose monitors.

Not attributed to. The FDA wording says "associated with" which is much weaker causally.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#254
post #13

Earlier quoted context omitted.

I’m aware of a few people working on REing the Omnipod 5. The furthest issue that I have seen is that when a PDM/Omnipod 5 app signs into your insulet id, it gets a private key from the API which is stored in the keychain (and uses SSL pinning to prevent MiTM retrieval of the private key). When pairing with the pod they exchange public keys and then a derived key from the devices private key+pods public keys, but hav…

Anyway to follow the progress? I attended the Nightscout conference and asked around regarding this but no one really knew of any group to follow. Or really knew of the latest developments on this effort.

I am not aware of any public groups to follow the progress, I have just met a few people on the Loop Zulip and have talked with them every few months whenever people have time to look into it.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#255
post #239

Earlier quoted context omitted.

Anyway to follow the progress? I attended the Nightscout conference and asked around regarding this but no one really knew of any group to follow. Or really knew of the latest developments on this effort.

Was going to ask the something. And also, so the omnipod app is not using android attestation but stores private key it got from omnipod server?

It seems to use the play integrity API when communicating with Insulet's servers which provide a private key to the PDM/app once it was registered with the user's account. However since the Pod doesn't have access to the internet, it has no way to check the play integrity signature AFAIK, so instead it checks that the certificate that the PDM/app presents to it is issued from the cert chain that it trusts.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#256
post #45

Earlier quoted context omitted.

As far as I understand it, Richard Stallman has gotten his view about linking from FSF’s lawyers, who has advised the FSF about what does and does not count as a “derived work”, in the sense of US copyright law. If you want to argue that the FSF’s lawyers are wrong, please provide more detailed, and hopefully referenced, arguments (as opposed to plain assertions).

I would point towards Oracle v. Rimini, where the Ninth Circuit has specifically ruled (inside a complex and yet-unresolved case) that a system built to interoperate with a copyrighted program does not constitute a derivative work of that program. ( https://cdn.ca9.uscourts.gov/datastore/opinions/2024/12/16/2... ) They reference a less on point but better known case ( https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_…

> (https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_Inc._v._Nin...., for some reason you have to manually add the period at the end of the link)

On some sites it's possible to work around this type of linkification bug by percent-encoding the last character (percent symbol followed by 2 hex digits representing the ASCII character):

https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_Inc._v._Nin...

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#257
post #154

Earlier quoted context omitted.

Not really.

You can tariff a single company.

Or you could just prevent the goods from being sold, rather than making the American tax payer foot the bill for that company's crime.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#259

Earlier quoted context omitted.

In what planet does a lawsuit cost hundreds of dollars?

$405 https://www.caed.uscourts.gov/caednew/index.cfm/attorney-inf...

This is a fantasy. OK, well, if the intent is to waste time and lose a lawsuit, sure, a few hundred dollars will give you that experience. In the real world, no way. A single deposition can cost many times that figure.

You can choose to disagree, of course. My guess is that you have never done this and you have never been involved in a nontrivial legal dispute outside, perhaps, small claims court. You probably don't even own a nontrivial business. Not one person running a business would ever suggest a lawsuit could cost a few hundred dollars.

Like I said, in the real world things are different. I know people who have burned through over $50K in seemingly simple cases (one of them self-represented) only to bow out once they realized they only scratched the surface. In one case they went broke, had to sell their home to pay for the losses and move to a lower cost state just to survive. Tragic. And, BTW, they didn't lose the case. They just got to a point, tens of thousands of dollars later, where they simply had to drop it or face ending-up in a far worse situation.

When I was much younger (and really stupid as most young know-it-alls are) I decided to go after a company that owed me $100K in contractually agreed-upon consulting fees. They had already paid me over a million dollars over a couple of years, so this was not about a little $100K contract.

There was a change in management and they simply decided not to pay vendors. They did this as the simplest method (aside from laying people off) to improve financials. The new CEO and his wife also happened to own a law practice.

So, I hired an attorney (no way to do this on your own for $400). $11K later I finally understood that the balance of power was not in my favor. I may have won. It may have cost me somewhere around $75K to do so.

However, then the other reality would kick in: Collecting. Yup. Collecting was probably going to cost money and maybe even another lawsuit. Not to mention the time, measured in years, for the full experience. Not to mention the real potential of them filing for bankruptcy to gift me the experience of using my judgement as rough toilet paper.

In fact, that is precisely what they did about 18 months later to other vendors, who, like me, where chasing payment. They took a year to transfer all assets to a new corporation. When the original corporation had no assets whatsoever, the went ahead and filed BK and told everyone to go shove their judgements (if any).

I was actually glad that I only burned $12K to learn an important lesson: The legal path is only viable when you are talking about going up against an equal. Like anything, there are exceptions to this, however, in general, this is the way the real world works.

Still don't believe me? If you happen to be a budding entrepreneur looking for investors, do this: During your meeting, tell them that you are not concerned about lawsuits because they can be sorted with $405. Don't blink or you'll miss to witness just how quickly they leave the room. Really.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#260

Earlier quoted context omitted.

I'm not aware of any deaths attributed to open source artificial pancreas systems. Meanwhile there have been multiple attributed to closed source glucose monitors.

Not attributed to. The FDA wording says "associated with" which is much weaker causally.

I can guarantee you, from my personal experience of being diabetic for 30 years, that every day—and in the most incredible ways—I have managed to “almost kill myself.” Whether when I used finger-prick testing, sensors, injecting insulin with pens, or managing insulin with a pump. Our life is always a delicate balancing act between too little, too much, and way too much—the kind where this time I really kick the bucket

By personal choice I use a commercial CGM (if I could “touch it,” I’d be firmly on the side of certainty about killing myself through sheer stupidity), but reading something like “associated with” really makes me angry. Before making such subtle insinuations about the open-source world (the source of the revolution of the last 10 years in this field), regulatory bodies should open their eyes to what is actually happening with the quality of current sensors and the real problems they are causing.

Post reply on HN