Slashdot Mirror


Lawyer Demands Pacemaker Vendor Supply Source Code

oztiks writes "Lawyer Karen Sandler's heart condition means she needs a pacemaker to ward off sudden death. Instead of trusting that the vendor will create a flawless platform for the device to operate, Sandler has demanded to see the device's source code. Sandler's reasoning brings into question the device's reliably, stability, and oddly enough, security."

334 comments

  1. It's not forced on her by whoda · · Score: 5, Funny

    She could just let her heart regulate itself naturally.

    1. Re:It's not forced on her by Stormthirst · · Score: 1

      Mod up hilarious

    2. Re:It's not forced on her by Opportunist · · Score: 1

      Not so hilarious, just quite interesting. And consider the implications.

      We're not talking about a computer or a car. We're talking about a potentially life saving tool. Or, rather, not having it being life threatening. Not getting it is pretty much not really an option. But does that imply that someone has the right to force the manufacturer to open up their source code?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:It's not forced on her by AmberBlackCat · · Score: 1

      The same could be said about the telephone, broadband, & oil industries. They're not forced on you. You could just do without them. And unlike her situation, it won't kill you. Also, if I were her, I'd be more concerned about the hardware than the software.

    4. Re:It's not forced on her by Anonymous Coward · · Score: 0

      > Not getting it is pretty much not really an option

      What?!? She could still chose the option to NOT get the implant. Consequences may be obvious, but the choice remains.

    5. Re:It's not forced on her by Anonymous Coward · · Score: 1

      When I hold a gun to your head and tell you that you must give me all your money or I shoot you, you can still choose the option NOT to give me any money.

      Consequences may be obvious, but the choice remains.

    6. Re:It's not forced on her by Anonymous Coward · · Score: 5, Insightful

      If the pacemaker vendor doesn't want to make the source code available its perfectly within its right to refuse to supply the pacemaker. Lawyer can go look for someone else to acquiesce to her ridiculous demand, assuming she doesn't die waiting for someone to give in, but any delay is entirely of her own creation.

    7. Re:It's not forced on her by Anonymous Coward · · Score: 1

      Your analogy is flawed: in your analogy, the gun-holder is the one who has initiated the life-or-death decision. In the real world, life itself, karma, FSM, God, or whoever you decide, is the one that created the death scenario. The pacemaker creator is the one that offers up the life scenario. Also, you can have the pacemaker and NOT have access to the source code and still live.

      She is the one trying to do the forcing here, holding a legal metaphorical gun to the metaphorical head of the pacemaker manufacturer, demanding source code (money & metaphorical) or a legal battle (money & a slow, agonizing, metaphorical death).

    8. Re:It's not forced on her by TheRaven64 · · Score: 2, Interesting

      If you watch the talk, you'll see that there are several issues with this:

      First, the software is known to be buggy. In fact, it is remotely exploitable. One group found an exploit that lets you remotely control someone's heart rate.

      Secondly, because this is approved by the FDA, the manufacturer is exempt from liability for this kind of problem. The FDA does no review of the software at all, but their review of the hardware means that the manufacturer is completely immune to lawsuits if someone dies as a result of a bug in their software.

      --
      I am TheRaven on Soylent News
    9. Re:It's not forced on her by repvik · · Score: 5, Insightful

      But does that imply that someone has the right to force the manufacturer to open up their source code?

      Does she require the code to be "opened up"? AFAICT, she wants to check the code, nothing more.

      If I was the manufacturer of the device, she'd sign an NDA and get the code. Worst case, she spreads the code and gets sued. Best case, she improves the reliability or security of the code.

      I don't really see any problem here.

    10. Re:It's not forced on her by djdavetrouble · · Score: 1

      mod up insightful. In this data leaky day and age, companies are reluctant to share their source code, but this is pretty standard operating procedure. Many big contracts would not have been granted if a looky-loo at the source code wasn't part of the deal.

      --
      music lover since 1969
    11. Re:It's not forced on her by TubeSteak · · Score: 2

      Best case, she improves the reliability or security of the code.

      What makes you think anything she can do will improve the security of the code?
      How many times have we seen software makers just sit on bugs for months or years before someone publicly shames them into fixing it, usually by releasing exploit code??

      Someone just released a pile of metasploit plugins for SCADA systems.
      http://www.wired.com/threatlevel/2012/01/scada-exploits/

      Wightman and Peterson said they wanted to avoid the kind of situation that Beresford ran into last year when Siemens issued statements to customers downplaying the vulnerabilities he'd found and then swooped in at the last minute before his scheduled presentation to persuade him to cancel it until the company had more time to prepare patches.

      "I didn't want a vendor to jump out in front of the announcement with a PR campaign to convince customers that it wasn't an issue they should be concerned with," Wightman said.

      Peterson added that "a large percentage of the vulnerabilities" the researchers found were basic vulnerabilities that were already known to the vendors, and that the vendors had simply "chosen to live with" them rather than do anything to fix them..

      What good would it do to inspect the code under and NDA?

      --
      [Fuck Beta]
      o0t!
    12. Re:It's not forced on her by Anonymous Coward · · Score: 5, Informative

      Secondly, because this is approved by the FDA, the manufacturer is exempt from liability for this kind of problem.

      Untrue. Just because a product is FDA approved does not absolve a manufacturer from liability. This is not only true for medical devices, but pharmaceuticals as well.

      The FDA does no review of the software at all, but their review of the hardware means that the manufacturer is completely immune to lawsuits if someone dies as a result of a bug in their software.

      Once again, untrue. As a Software Quality Engineer for a major medical device manufacturer, I can tell you the FDA does review software and has regulations and guidance surrounding software development. In recent years the scrutiny of software based device has increased so much, that companies are having a difficult understanding exactly what the FDA excepts.

      Japan does not review software for devices, only hardware. However in order to get your product into the country it must be FDA approved.

    13. Re:It's not forced on her by Opportunist · · Score: 1

      I'd choose the legal battle. This time, time is on the side of the defendant...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    14. Re:It's not forced on her by Anonymous Coward · · Score: 2, Insightful

      Actually, it seems she is the one holding the metaphorical gun to her own head, DEMANDING to see the source code before allowing the pacemaker vendor to increase her life expectancy. If the vendor refuses to give in, she has to find a vendor who will dance to her tune, or go without. She has about as much influence on the vendor as a single music fan who refuses to buy from the iTunes store.

    15. Re:It's not forced on her by superwiz · · Score: 4, Insightful

      Usually, I wouldn't see how this is different from Coke not telling you what's in their secret recipe is. Ie, trade secrets are trade secrets. But if you listen to the interview, she makes, what I see, a compelling point: these devices have WiFi connections.

      So they can be potentially controlled by a 3rd party after the fact of installing them in the recipients. Certainly, there are some people who don't understand the full implications of a medical device having a WiFi connection. So no one can claim that a layman would have an informed consent unless independent experts have reviewed the code.

      --
      Any guest worker system is indistinguishable from indentured servitude.
    16. Re:It's not forced on her by Bright+Apollo · · Score: 2

      21 CFR Part 11. The FDA does in fact force pharmas and medical device makers to review and QA/QC software. There is no such shield from the FDA. You either lied or made it up, but you're sad either way.

      --#

    17. Re:It's not forced on her by TheRaven64 · · Score: 2

      Watch the video - it's a claim that she made. If she is wrong, then you should correct her.

      --
      I am TheRaven on Soylent News
    18. Re:It's not forced on her by Anonymous Coward · · Score: 0

      The moment anyone not working for the company or contracted by the company to develop the code has viewed the code, then that code has effectively been opened up.

      Worst case, if she spreads the code and gets sued would probably be to the delight of the information wants to be free zealots, but chances are good even if they allowed viewing the code it would be in their offices escorted by managers and also security. Doubtful they would send a copy of the code with a thank you letter for reviewing their code.

      Best case, she improves the reliability or security of the code would be entirely dependent on the amount of software engineering experience in an FDA regulated environment.

    19. Re:It's not forced on her by WrongSizeGlass · · Score: 1

      If the pacemaker vendor doesn't want to make the source code available its perfectly within its right to refuse to supply the pacemaker. Lawyer can go look for someone else to acquiesce to her ridiculous demand, assuming she doesn't die waiting for someone to give in, but any delay is entirely of her own creation.

      If she wants to review the code, with the implication that she can somehow improve it, let her buy the pacemaker, root it, write her own software and live (or die) with the results.

    20. Re:It's not forced on her by JoeMerchant · · Score: 2

      But does that imply that someone has the right to force the manufacturer to open up their source code?

      Does she require the code to be "opened up"? AFAICT, she wants to check the code, nothing more.

      If I was the manufacturer of the device, she'd sign an NDA and get the code. Worst case, she spreads the code and gets sued. Best case, she improves the reliability or security of the code.

      I don't really see any problem here.

      The problem is in the perception. If she finds "areas to improve" in the code, what does the manufacturer say to the tens (perhaps hundreds) of thousands of implantees with the code that "could be improved?" Swapping out the device before it's normal end of life is an additional surgery, which carries a slight but non-zero chance of death.

    21. Re:It's not forced on her by bws111 · · Score: 1

      Say what? Where do you get that silly idea? There are hundreds or thousands of lawsuits against medical device makers and drug makers.

      The only protection from liability is for vaccines, where there is a government program to pay lost lawsuits.

    22. Re:It's not forced on her by JoeMerchant · · Score: 1

      Best case, she improves the reliability or security of the code.

      What makes you think anything she can do will improve the security of the code?

      Short retort: what makes you think she cant? Flaws have already been demonstrated. Somebody (she, or her paid expert) can certainly remove them if they try.

      What good would it do to inspect the code under and NDA?

      It would give her the peace of mind that she knows better the true extents and seriousness of the flaws, the circumstances under which they might (and might not) arise, and the potential for somebody to remotely screw around with her heart rate against her will.

      The manufacturer is expecting you to trust this device they sell to regulate your heart rate 24/7/365 for many years. That's more trust than we put in most "things" in this life, especially software driven things.

      O.K. before you start giving me computer controlled aircraft examples, remember the redundancies and human elements in those systems, same for automobiles, ships and trains. A pacemaker is flying solo, 100% computer controlled with virtually zero oversight for months at a time, especially while you sleep.

    23. Re:It's not forced on her by Hognoxious · · Score: 2

      Lawyer, liar, it's all the same to me.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    24. Re:It's not forced on her by Hognoxious · · Score: 4, Funny

      But if you listen to the interview, she makes, what I see, a compelling point: these devices have WiFi connections.

      Tinfoil vest.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    25. Re:It's not forced on her by cdrguru · · Score: 2

      Two things here come immediately to mind. Let's assume that whatever is running in this system is non-trivial. If it was 1000 lines of code it could be validated the way they used to validate the Shuttle programming - mathematically. So it is probably 30,000 lines of code or more.

      First thing is how would anyone "look" at that volume of code without spending months going through it and learn anything from it? What sort of interrupt-driven race conditions can exist and how would you even begin to understand them without some kind of hardware simulation platform? This sounds like someone that heard something about programming in college 10 years ago and thinks this would be really cool.

      Second thing is probably why this company would not want to participate: very likely a pacemaker is pretty much down to commodity hardware and the only thing that differentiates one from another is the software. If they allow their software (the only thing of any value in the whole company), they stand to lose control of it. Once it gets into Chinese hands their product will be duplicated cheaply and they will be out of business forever. Sure. they could sue for the whole capitalization of the company - but they wouldn't get it.

    26. Re:It's not forced on her by turbidostato · · Score: 0

      "Consequences may be obvious, but the choice remains."

      Exactly. And given the options, he choices to get the device and litigate for access to its source code. If you consider resign himself to die to be a valid option, I consider this at least as valid.

    27. Re:It's not forced on her by pimpsoftcom · · Score: 5, Informative

      Mod Parent Up. I am currently a software developer with an FDA regulated product, and we have to sign a form explaining what we did when we check in. Yes, a hand written form, showing and explaining what was changed, how it was changed, and its impact on the product. Not just your normal check-in comments; this is a multiple page form/essay that what we checked in is what we said we checked in. Every time. The FDA has STRICT rules about software quality and security due to what in the FDA regulated software industry is known as "negative impact events".. basically anything that hurts the patient or has the ability to risk the patients health, even if they just have a worry (as stress can create physiological pain, etc). In this case, the security exploit by itself would be so negative that it can get a product pulled and the company selling it fined into oblivion. If anything the company that build this software is trying to cover its ass, and will fight as much as it can to not release the source code.. or risk death by FDA audit. And yes they exist; all FDA projects get audited sometimes, but when it happens its a massive company wide effort not to piss off the auditors or show them things they donty ask for explicitly as they are usually only raping with no lube.. it can get MUCH worse.

      --
      - d
    28. Re:It's not forced on her by pimpsoftcom · · Score: 1

      So what you are telling me is that if I wanted to, I could - hypothetically - write an iphone app that would detect people with this exploit in their chest, and if I wanted to and was evil enough to do so make them have a heart attack?

      --
      - d
    29. Re:It's not forced on her by AK+Marc · · Score: 3, Interesting

      If she dies because of the actions or inactions of the company, the company could be successfully sued, as they knowingly took an action that resulted in the death of a person. The car analogy is:
      You are driving down the road, you see someone preparing to jump from the bridge above you. You choose to not stop and the examination reveals they were killed by the impact with your car, if you had stopped, they likely would have died from the impact with the road. You would be held liable, as your failure to stop caused the death, even if the death was imminent anyway.

    30. Re:It's not forced on her by AK+Marc · · Score: 0

      Usually, I wouldn't see how this is different from Coke not telling you what's in their secret recipe is. Ie, trade secrets are trade secrets.

      Coke has its "secret" recipe on every can, by law (not all of it, but what's in it, the part you asked for). And there is no Cola out there stealing and mimicking it (and if they wanted to, they could use a spectrograph or such, even if the ingredients list were wrong.

    31. Re:It's not forced on her by AK+Marc · · Score: 1

      Yes. You could scan for and kill everyone with one of those affected models. And, from what I can tell, the software is non-upgradable, so you can kill them, but not fix the bug. That requires opening up their chest again.

    32. Re:It's not forced on her by Suddenly_Dead · · Score: 3, Informative

      Coke has its "secret" recipe on every can, by law (not all of it, but what's in it, the part you asked for).

      No they don't. A lot of it is hidden under "natural flavours". We know they use a flavouring agent from the Coca leaf, for instance, but that doesn't appear in the ingredients list. Exactly what colouring agent they're using also doesn't appear.

    33. Re:It's not forced on her by shilly · · Score: 4, Informative

      Jesus Christ on a bike, I know this is a US site but you are all being just a teensy bit US-centric here. I'm pretty sure that, what with the article appearing on a .com.au site, she's Australian. And therefore different rules may apply

    34. Re:It's not forced on her by shilly · · Score: 1

      Both incompetence and malice are fairly reasonable things to be concerned about:
      - incompetence: there are an ever-increasing number of devices with Wifi connections out in the wild. It is really not that far-fetched to accept that there is a possibility that one of them might interact in a dangerous way with her pacemaker via Wifi.
      - malice: there are hundreds of cases each year of people harming patients by interfering with their treatment / medical devices. In Britain, some of the most notorious cases include the Stepping Hill deaths last year (insulin tampering) and Harold Shipman (diamorphine ODs), but there are many many other cases. And for the *manufacturer*, I'd certainly think there is a real need to secure the devices against malicious attack. I'm sure there'll be a lot of dignitaries/high-value targets with pacemakers fitted, and it would be pretty trivial for a state agency to create the relevant attack, and the end result would be difficult to distinguish from natural death. So while this lady may not have anyone after her, it's almost certain that some other recipients do...

    35. Re:It's not forced on her by Ihmhi · · Score: 1

      Why the Hell does a pacemaker need a WIFI connection?!

    36. Re:It's not forced on her by tftp · · Score: 2

      If I was the manufacturer of the device, she'd sign an NDA and get the code.

      If I were the manufacturer, I'd tell her that the code can be reviewed inside of my SCIF, under supervision of one of my employees. If she pays for the costs incurred she can come and read the code all day long, every day. Of course nothing material leaves the SCIF, and she may not take notes.

    37. Re:It's not forced on her by HornWumpus · · Score: 3, Insightful

      So in your world, if some idiot holds a gun to your own head and demands all my money his heirs can sue me when I tell him: 'wait a second while I get the money' then come back with a gun of my own (after all he are armed) and a video camera and tell him 'fuck off! you're going to be on Rotten.com!'

      Even if the video includes me telling the idiot to 'fuck off' I'm legally free and clear.

      Your analogy is just simply wrong. If someone jumps onto the freeway in front of you, you are not liable. Their heirs will pay to fix your car. No reasonable person would expect him/her to jump. Should I lock up my brakes every time someone is walking on the sidewalk of an overpass?

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    38. Re:It's not forced on her by Anonymous Coward · · Score: 0

      Exactly what colouring agent they're using also doesn't appear.

      It does in Europe: E150d (Sulphite ammonia caramel)

    39. Re:It's not forced on her by Anonymous Coward · · Score: 0

      What makes you think anything she can do will improve the security of the code?

      Well... so the fuck what if she can't? Its already, apparently, buggy. And if she can't fix it, what harm did it do? Not a goddamn bit.

      How many times have we seen software makers just sit on bugs for months or years before someone publicly shames them into fixing it, usually by releasing exploit code??

      You know how much easier this is to accomplish ... using the source code, which is what the lawyer is asking for? Yeah.....

    40. Re:It's not forced on her by pimpsoftcom · · Score: 1

      So if I was really evil, I could just have this be part of the payload for a big, well established botnet and end up killing lots of people at once? This sounds like the FDA will not be happy..

      --
      - d
    41. Re:It's not forced on her by pimpsoftcom · · Score: 1

      This makes me wish I had an easy way to contact Karen Sandle; they could probably deny her request on the basis that she is a lawyer not a software person - despite her OOS credentials it would technically be true - but I bet they couldn't turn down a guy like me who already works on FDA software projects in Dev and QA; I would be happy to help in any way I can, even if it means looking at the source code and telling them they suck.

      --
      - d
    42. Re:It's not forced on her by tengu1sd · · Score: 2, Informative

      The FDA does no review of the software at all, but their review of the hardware means that the manufacturer is completely immune to lawsuits if someone dies as a result of a bug in their software.

      Once again, untrue. As a Software Quality Engineer for a major medical device manufacturer, I can tell you the FDA does review software and has regulations and guidance surrounding software development. In recent years the scrutiny of software based device has increased so much, that companies are having a difficult understanding exactly what the FDA excepts.

      The FDA provides minimal guidance on software. I'm working with a Medical Application Vendor now who insists that we install MS SQL Server 2005 SP3 (which is out of support) for their new released product. This is what the FDA approved. The FDA also has guidelines for commercial off the shelf software that require vendor comply with security updates. That isn't really a priority once something is approved, you see. Strictly speaking, the FDA considers devices using commercial off the shelf software to be end of life when any software vendor ends support. Medical Application Vendor's take is they have FDA approval, don't worry. We'll wind up installing this, but with enough conference calls and meetings to point auditors and lawyers at the vendor.

    43. Re:It's not forced on her by Darinbob · · Score: 1

      The FDA does do audits of software, bug reports, development processes, etc. And if someone dies from a bug the company is not immune.

    44. Re:It's not forced on her by complete+loony · · Score: 2

      She gave a keynote talk at linux conf au, the talk is now available on youtube.

      --
      09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
    45. Re:It's not forced on her by Obfuscant · · Score: 1

      But if you listen to the interview, she makes, what I see, a compelling point: these devices have WiFi connections.

      What is fascinating about this all is that the FCC has just approved the use of low power radio-based medical devices on a tertiary basis (meaning, third in line for the frequencies) in the 440MHz amateur band (where the US government is a primary and amateurs secondary).

      In other words, these medical devices must cause no interference to the other licensed users, and must ACCEPT INTERFERENCE from them. What is most amazing is that the FCC knows that a large number, if not majority, of the amateur users in this band are transient. That is, they are HT or mobile. They move around. Someone can walk into a hospital tomorrow with a radio on his belt and cause interference to every device in the building. Legally. I can park outside the building and dump 100W into the air, right on top of these devices. I have a radio system on top OF A HOSPITAL that radiates about 600W ERP.

      Seems kind of silly to put a new kind of medical device into such an environment, but the FCC did it. Now, what were you saying about dangers of having a WiFi interface on a pacemaker?

    46. Re:It's not forced on her by evil_aaronm · · Score: 4, Interesting

      I also work for an FDA regulated company - blood chemistry immuno diagnostics device - and we are certainly audited, periodically, but not to the extent that you portray. We have code check-in forms and the auditors look at traceability: can they show that the files checked in were traced back to a particular defect record or change request item, etc. And our check-in forms are simple "Who wrote this change? Who reviewed it? Who's the manager signing off on it." That's about it. No justifications, no explanation of changes - except changes due to issues found during a review - no summaries of potential impact, or anything really substantive.

    47. Re:It's not forced on her by Salgak1 · · Score: 1, Offtopic

      You obviously haven't been following the news. US Law is now Uber Alles. Ask anyone in us.gov, they'll tell you,. How else do you explain arresting someone who owns a company in Hong Kong and lives in New Zealand ???

    48. Re:It's not forced on her by Anonymous Coward · · Score: 0

      E150d is the coloring agent according to my bottle. Are you sure your Coke is genuine?

    49. Re:It's not forced on her by The_mad_linguist · · Score: 1

      If I recall correctly, the full formula was revealed when the US government sued Coca-Cola in the early nineteen hundreds.

      The case was titled United States v. Forty Barrels and Twenty Kegs of Coca-Cola

      Which would be a good name for a kaiju movie.

    50. Re:It's not forced on her by Anonymous Coward · · Score: 0

      Yeah.....living on an island of ancestral prisoners.....

      Regardless. They can't force the maker to sell her the pacemaker. Tell her to sign an agreement that it's "as is" to get it, or, you know, she doesn't get one. She doesn't have any right to get one on her terms.

    51. Re:It's not forced on her by Anonymous Coward · · Score: 0

      The analogy is not flawed. You make assumptions about motive and consequence while disregarding the reality of Sandler's.

    52. Re:It's not forced on her by Beeftopia · · Score: 1

      If I was the manufacturer of the device, she'd sign an NDA and get the code. Worst case, she spreads the code and gets sued. Best case, she improves the reliability or security of the code.

      I'm doubtful a lawyer would be able to do a useful code review. The company probably already has senior software engineers doing code reviews.

      Any code review madam lawyer would do would be to gauge the code's lawsuit potential.

    53. Re:It's not forced on her by AK+Marc · · Score: 0

      If someone jumps onto the freeway in front of you, you are not liable.

      Yes, you are. If you saw them coming, and you didn't take due care, you are responsible. I stipulated that the driver saw them and could have avoided them. That's felony manslaughter, even if not provable.

      Should I lock up my brakes every time someone is walking on the sidewalk of an overpass?

      You should never lock up your brakes, ever for any reason. Your incompetence in driving is showing. But yes, if you see someone who climbed up over the pedestrian barrier on most bridges and is poised to jump, you'd be criminally negligent to not at least change lanes to not be passing directly under them, as it would be manslaughter if they jumped and lived and then hit them. But then, an incompetent driver like yourself requires everyone else go out of their way to avoid you, and doesn't need to take care as everyone else should know to steer clear of you.

    54. Re:It's not forced on her by Anonymous Coward · · Score: 0

      A list of ingredients is not any more of a recipe than a pile of wood is a tree house.
      For example there is a mollusk that attaches itself to things using an extraordinarily powerful glue it produces. We know exactly what the glue is made of but we still can't reproduce it.

    55. Re:It's not forced on her by Suddenly_Dead · · Score: 1

      I know it lists it in Europe :P. The flavors are still obscured over there, though.

    56. Re:It's not forced on her by Tetra · · Score: 1

      I would advise my client the Pacemaker manufacturer to recall her device immediately to insure it was programmed properly.

      --
      Regards, tEtra
    57. Re:It's not forced on her by Anonymous Coward · · Score: 0

      Actually, in her LCA keynote this week Karen mentioned cars too: http://www.youtube.com/watch?v=5XDTQLa3NjE (I don't think the full talk was linked to in the article).

    58. Re:It's not forced on her by Anonymous Coward · · Score: 0

      Usually, I wouldn't see how this is different from Coke not telling you what's in their secret recipe is.

      I disagree. This is a device that is being incorporated into a person: it's actually a part of them. And, as a computer, it has the opportunity to pursue some actively malicious logic, rather than simply being passively malicious (addictive, say) like some consumable products.

      I'd like to see a requirement that the hardware and software of prosthetic devices be made completely available to their users. To do otherwise is likely to lead to some terribly abusive situations in a few decades' time.

    59. Re:It's not forced on her by blowdart · · Score: 1

      For setting it's run time parameters. I have a friend with a brain implant (from the same company). It sits on a nerve bundle and shocks it in order to stop cluster headaches. However it needs adjusting, both under his control and then it also needs proper recalibration every couple of years. He has a remote control, and the doctors can recalibrate without having to open up the back of his skull again.

      However it's not wifi (and I'd be surprised if the pacemakers were either), but it does have remote connections with, ummm, yea, seemingly no authentication whatsoever,

    60. Re:It's not forced on her by SeaFox · · Score: 2

      1) Does she have the device already, or is she still evaluating products? If she hasn't already had the device implanted the parent's point still applies. As a business they don't have to give her anything, and as a consumer she is within her rights to take her business elsewhere.

      2) If the software is already "known" to be buggy, and remotely exploitable why would you want to consider this device maker to start with? she should already be looking for someone else. And furthermore why wouldn't the FDA have already taken action on this maker?

      Sounds like this woman is an ambulance-chaser trying to make her own ambulance.

    61. Re:It's not forced on her by Anonymous Coward · · Score: 0

      So, at what point in history did a family member of yours jump in front of traffic?

    62. Re:It's not forced on her by Dunbal · · Score: 1

      No it doesn't. Just like you don't have the right to get to see Coke's "secret formula". It's a trade secret. The manufacturer created a devices that has had a known performance under extensive testing. Take it or leave it. There are other manufacturers, and if not, well, you don't HAVE to get an implant. You can let YOUR disease take its natural course.

      --
      Seven puppies were harmed during the making of this post.
    63. Re:It's not forced on her by Dunbal · · Score: 1

      DEMANDING to see the source code before allowing the pacemaker vendor to increase her life expectancy

      The pacemaker is not obliged to increase her life expectancy. It cannot prevent her from walking in front of a bus or getting cancer or jumping off a bridge. It just has to do its job and perform in the way it has been show to perform by testing. No source code inspection is necessary for this. If I were the pacemaker vender I would refer this client to my competitor with great pleasure.

      --
      Seven puppies were harmed during the making of this post.
    64. Re:It's not forced on her by Dunbal · · Score: 1

      If she dies because of the actions or inactions of the company, the company could be successfully sued,

      I am a doctor. I have no plans to treat this patient. I don't even live in the same country as this patient. And to be honest I couldn't care less about this patient. I challenge you to sue me for my inaction if anything happens to her.

      Get this in your head: DOCTORS ARE NOT OBLIGED TO TREAT ANYONE. That is why passive euthanasia is 100% legal all over the world. All doctors have to do is 1) Not harm the patient (you can't harm someone by not doing something to them) and 2) if and only if they decide to treat someone and that person consents to be treated, they must apply the norms and standard of care of their profession when doing so. However the latter option does not apply if you are not treating someone.

      This is why doctors are allowed to do things like go on holiday, sleep, go to the bathroom, retire, etc. Not treating someone is not doing anyone harm. The person has a medical condition which they acquired all on their own. This is not the doctor's fault. Should the person die, this is due to the disease. Not the doctor's fault. If you do not accept this, we step back 2000 years where doctors are blamed for the deaths of people who die from their illnesses. Doctors are educated people who understand anatomy, physiology, pathology and pharmacology. They are not miracle workers. They are not superhuman. And if they have a patient for long enough, that patients is going to die - because EVERYONE dies sooner or later. Doctors cannot prevent this because it's a fact of life.

      Now, if a patient dies because of the ACTIONS of a doctor, we're talking a whole new ball-game. A doctor's ACTION should never, ever cause someone to die. That's called homicide.

      --
      Seven puppies were harmed during the making of this post.
    65. Re:It's not forced on her by mcgrew · · Score: 1

      No it doesn't. Just like you don't have the right to get to see Coke's "secret formula". It's a trade secret.

      It's a trade secret because you can neither patent nor copyright a recipe. A patent would protect it for 20 years, after which progress will have surely rendered the tech obsolete. Copyright is, for all intents and purposes, forever.

      There are other manufacturers, and if not, well, you don't HAVE to get an implant.

      What the goddamned fuck??? No, she doesn't HAVE to get it, she can just DIE.What the fuck is wrong with your brain, boy? Christ, but some of these comments are stupid.

      (sorry for the inflammatory tone but my arthritis kept me awake all night and I'm REALLY cranky)

    66. Re:It's not forced on her by lsatenstein · · Score: 1

      Her demand is not ridiculous. I bet her background is in technology in a QA area, and she wants to make sure that she survives, should battery voltage drop, or if she should climbs stairs and find the pacemaker does not compensate for her temporary increased pulse rate. I know nothing about pacemakers, it could be they are really dumb devices with only a pump controlled by an analog timer. (The doctor adjusts the timer to match the patient's former natural pulserate).

      --
      Leslie Satenstein Montreal Quebec Canada
    67. Re:It's not forced on her by Hognoxious · · Score: 1

      I don't know, but it wasn't enough.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    68. Re:It's not forced on her by Hognoxious · · Score: 1

      Coke has its "secret" recipe on every can, by law (not all of it, but what's in it, the part you asked for).

      So in other words, it doesn't. I suspect the actual recipe wouldn't fit on a can and be legible to the naked eye.

      Just took one out of the fridge, it says "natural flavours (vegetable extracts)". Well that narrows it down a bit - I guess I can cross dead cat and powdered anthracite off the list of possibles now.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    69. Re:It's not forced on her by HappyPsycho · · Score: 1

      I'm curious, so lets say you switch lanes and now the person jumps across to the lane you are now in, can you still be charged for manslaughter? Simple reason I can think is if someone is trying to kill themselves and the drop is not deemed high enough the "victim" in this case could conclude that the extra impact with a moving vehicle would be necessary and that your car fit the bill.

      P.S. Lets keep this civil, if the term "slam on brakes" was used instead of "lock up my brakes" would that prevent such an outburst from yourself about incompetent driving?

    70. Re:It's not forced on her by superwiz · · Score: 1

      Coke is also incorporated into people... it's taken internally, you know.

      --
      Any guest worker system is indistinguishable from indentured servitude.
    71. Re:It's not forced on her by Anonymous Coward · · Score: 0

      I know a woman whose crack addicted son demanded $500 on the spot or he would blow his brains out. He had the gun in hand and did shoot himself in the head and die when she refused. She had to get forced psychiatric care as she came completely unglued and is now an alcoholic. It's an American tale.
                  Really i don't think she has any right to see the code for the pacemaker. It is her choice to use it or not use it and there are several brands of pacemakers available. If she dies from the delay that should be on her.

    72. Re:It's not forced on her by AK+Marc · · Score: 1

      I'm curious, so lets say you switch lanes and now the person jumps across to the lane you are now in, can you still be charged for manslaughter?

      You could have stayed home and still be charged with manslaughter. "charged" is a meaningless word with no legal minimums. As for whether you would have committed it, if you took reasonable care to avoid them, and were unable to, then no, you did not commit manslaughter. Much like a bus driver that is driving down the road and a suicidal person jumps out in front and dies, the bus driver is never charged. But if the person is a diabetic who, in a fit of confusion, is standing still in the road and plainly visible and the bus driver runs them down, then the bus driver would likely be charged. Why? Because all due care was being given in one case, and not in the other. Why is it that everyone on here pretends to not have any common sense or reasoning ability?

      P.S. Lets keep this civil, if the term "slam on brakes" was used instead of "lock up my brakes" would that prevent such an outburst from yourself about incompetent driving?

      If someone bragged about getting a computer virus after surfing porn and clicking "yes" on every pop-up, would you point out the link between the two and generally take their advice on the legality of computer viruses with a heavy dose of salt? I would. And someone that implies that locking up brakes is the best way to stop a car will get the same treatment, and I'll point out why so that nobody else mistakenly takes locket wheels to be a good way to slow a vehicle.

    73. Re:It's not forced on her by AK+Marc · · Score: 1

      I am a doctor. I challenge you to sue me for my inaction if anything happens to her.

      You are not in a position to help her. If I were shot in front of you and you turned around and walked away, refusing to treat me because you feel I deserved to get shot (perhaps I was a different race than you), I would sue you, and from what I've seen of hospital lawsuits, I expect I'd win.

      Now, if a patient dies because of the ACTIONS of a doctor, we're talking a whole new ball-game. A doctor's ACTION should never, ever cause someone to die. That's called homicide.

      If a patient comes in with something you correctly diagnose and then refuse to treat, you expect that you'd have no legal repercussions for such refusal? I'm not talking about someone demanding fringe treatment, but you see someone bleeding from an open wound and you are in a hospital, on duty, and standing next to the appropriate tools and have no reason to not treat that patient, if you were to just walk away and let them bleed to death, you think that's ethical actions by a doctor?

    74. Re:It's not forced on her by TheThiefMaster · · Score: 1

      Even if the ingredients are listed, the preparation process and relative amounts aren't. There's more to a "recipe" than the list of ingredients!

    75. Re:It's not forced on her by HornWumpus · · Score: 1

      She still made the correct choice.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    76. Re:It's not forced on her by HornWumpus · · Score: 1

      Locking your brakes is a figure of speech. Use panic stop if you prefer. I'll stand my decades of accident/ticket free driving up against yours anytime.

      Your incompetence in high school physics is showing. How long do you think it takes to fall 30 feet? How far does a car traveling 65MPH go in that time? What is human reaction time?

      All you have proved is that you are a moron.

      There is no time to avoid something dropped from a highway overpass. Stomping on your brakes every time someone is in position as the GP suggested is, as you point out, incompetent driving.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    77. Re:It's not forced on her by HornWumpus · · Score: 1

      BTW you live in Alaska. You should know that locking your brakes IS the fastest way to stop on gravel. Anti-lock brakes suck on dirt roads. Pull the fuse.

      You are still a moron.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    78. Re:It's not forced on her by Dunbal · · Score: 1

      If I were shot in front of you and you turned around and walked away, refusing to treat me

      You would not be able to do anything. I don't have to treat you. Now if you get shot and come to a hospital I am working in then I am obliged to treat you because there is an implicit agreement here - just going to the hospital means you are seeking treatment, and me working at the hospital means I am willing to take on the responsibility of treating people in exchange for a wage. But on the street? Nope, sorry, I don't have to treat anyone unless I'm wearing a lab coat and standing under a sign saying "medical treatment here".

      Now I'm playing the devil's advocate here because to be honest I probably would treat you EVEN if I didn't like you. I've treated all sorts of people in my career and everyone gets the same effort from me whether they are felons brought to me in custody or children or grand-mothers. But that is besides the point - doctors do not HAVE to treat anyone outside a hospital setting, and even in a hospital they don't have to treat everyone (example hostile or belligerent patients) although they do have the obligation not to leave them in the lurch and help defuse the situation or arrange for care for them.

      If a patient comes in with something you correctly diagnose Your point here was touched upon by my previous point - a hospital setting is different than a random situation in the street. However even in a hospital I am not obliged to treat people just because they want treatment. Hospital resources are limited and the physician is the one who decides how best to allocate those resources. How much fun is it going to be when the whole staff are busy treating people who think they have H1N1 influenza after watching the news and people with heart attacks start dying in the waiting room? While you might want a chest CT scan because you think you're dying, you're not going to get it unless we think you need it. Your going to get the cliché - "take two and call me in the morning".

      --
      Seven puppies were harmed during the making of this post.
    79. Re:It's not forced on her by pimpsoftcom · · Score: 1

      Thats probably because without going into too much detail, our code is part of the treatment

      --
      - d
    80. Re:It's not forced on her by Anonymous Coward · · Score: 0
    81. Re:It's not forced on her by Anonymous Coward · · Score: 0

      Ensure, not insure.

    82. Re:It's not forced on her by AK+Marc · · Score: 1

      I'll stand my decades of accident/ticket free driving up against yours anytime.

      Yes, the standard argument of the old and incompetent when people mention re-testing at 55 or 65. "I haven't killed anyone yet, regardless of my incompetence."

      Your incompetence in high school physics is showing. How long do you think it takes to fall 30 feet? How far does a car traveling 65MPH go in that time? What is human reaction time?

      About 1.4 seconds, 65 mph = about 95 feet per second 1.4 * 95 = 133. Listed as about 2s by the NHTSA and DOT, though most people would argue that to be an over-estimation.
      There is no time to avoid something dropped from a highway overpass. Stomping on your brakes every time someone is in position as the GP suggested is, as you point out, incompetent driving.

      The actual reaction time of a prepared human experiencing an expected event is about .1 second. I never suggested stomping your brakes. Your incompetence is speaking as if that's the *only* choice. If you were competent, you'd know there are more choices. If you are as competent as you assert, then you are a liar when you claim that brake-stomping is the only possible solution to the question. So, are you incompetent or a liar? That's where you have asserted you sit.

    83. Re:It's not forced on her by AK+Marc · · Score: 1

      It's also the fastest on packed snow. However, both road surfaces are quite rare under overpasses. I keep my arguments to reality, but you apparently have no such constraints.

    84. Re:It's not forced on her by AK+Marc · · Score: 1
      It might be different because of the Samaritan laws not covering doctors, but people have been successfully sued for not rendering aid (witnessing an event and not reporting it or anything), so unless the exceptions to the Samaritan laws also affect this (and they might, I've never looked closely at them, other than to know that I'm shielded from liability if I personally help to the best of my ability, which, given my ability and knowledge, is usually telling all the other people trying to help to get back and wait for the ambulance). Of course, anyone I'm trying to help, if they aren't going to exsanguinate before help arrives and their car is not on fire, they are safer if I do nothing, in most cases.

      How much fun is it going to be when the whole staff are busy treating people who think they have H1N1 influenza after watching the news and people with heart attacks start dying in the waiting room? While you might want a chest CT scan because you think you're dying, you're not going to get it unless we think you need it.

      I've spent 4 hours in the hospital waiting for the CT because the doctors thought I needed it, but I was lower priority than the guy with the heart attack. And I've also been the guy moved to the front of the line, pushing all others to the back, but I don't know who, if any, were in line at that point. I'm not discussing triage, but duty to care including refusals to treat.

    85. Re:It's not forced on her by Anonymous Coward · · Score: 0

      The problem is in the perception. If she finds "areas to improve" in the code, what does the manufacturer say to the tens (perhaps hundreds) of thousands of implantees with the code that "could be improved?" Swapping out the device before it's normal end of life is an additional surgery, which carries a slight but non-zero chance of death.

      The problem I see in current situation is that if they themselves find code that "could be improved", even if it's highly critical and they make a fix on newer device, they don't really have to say anything to those end users.

      I often wonder how people say that it is good and necessary to have areas of business, ie. medical equipment, where there are regulations that manufacturers need to follow (or get out of business) when talking about already existing laws & regulations but when someone suggests any new kind of requirements/requlations there is often a huge level of responses that seem to only look at the freedoms, loss of profits, extra resources needed, etc. negative effects on the companies of that area - and they may say "the manufacturer can decide not to sell their product for her", while they really should be asking "should the manufacturer be required to sell for anyone willing to pay?" - like finnish pharmacies are denied by law to ban person from store or otherwise limit on what people they serve or don't and I'm pretty sure that a huge load of Yanks would shudder is such law was suggested and start preaching about rights of the pharmacy owner without considering anything else at all (it seems to me that especially americans way more sensitive to any suggestions limiting current freedoms *if it's about business than they are about people).

      I think that what the company could say is that yes, their old device has bugs, they *should* inform their customers - at end user level - about this, they should prioritize fixing them for next model and if possible make the models software upgradeable for free (or they could even be demanded to guarantee that a version with critical bugfixes is given as a replacement for very low price for any old customers - which I think would make creating upgradeable model more sensible).
      I don't really care if it's sad for the company that they will actually have to take extra steps to *say something* to people relying on their devices *for life* when they discover possibly fatal bugs and/or flaws in their software - I mean come on, just go look away and ignore that your implant may have deadly flaws that could possibly have been discovered if they were open just blame me for being a dirty communist-hippie-terrorist and a threat to capitalism and probably a homosexual already, but I say:
      I don't care if the manufacturer will have to spend some extra money because of it or if it could actually save them money in the long run, I truly believe that any economical threats / benefits that don't make it impossible to profit at all from the product are irrelevant on this kind of device regulations and the source code should be preferably free open source under BSD license (usually I'm advocate of GPL but philosophical views why usually I prefer it are also irrelevant on this subject), however I would be satisfied by law demanding tho source to be easily accessible for anyone to read but proprietary (I'm not against proprietary software in itself, I just consider FOSS to be generally better for everyone).

      Finally I ask:
      By telling your issue or the problem you see, are you saying that it would be better for the people if they would not be given any information of issues found in their implants and fixed later models and that they would be better not knowing about them even if they ask? Because I kind of get that impression from your post and don't see how else would you see this as important problem, given that your emphasis seems to be on the patient...

    86. Re:It's not forced on her by Anonymous Coward · · Score: 0

      Awww, that's cute but you should really start viewing the world more as black & white, sonny. And put some more hate in your opinions!

    87. Re:It's not forced on her by rhalstead · · Score: 1

      Software even used to store information about devises must be validated to an FDA standard. I was a project manager installing Laboratory Information Management Systems or LIMS. We had to start with the log in, valid name and PW, print screen, hit [enter], and print screen again. Then it was valid name and valid PW + 1 character, print screen, hit [enter] and print screen, valid name - 1 character etc for *every single operation of the system including data entry/test results. The list of testing was about 1" thick. When we finished we had a stack of printouts over 4 feet tall and this was a relatively simple system. Any routines added or modified as well as hardware had to be proven the same way. All hardware on the network had to be tested and tracked. Changes had to be recorded AND once a month data transfer over the network had to be validated. That validated is not the validation of a project charter as in engineering to say this shows the project is complete...although we had to do that as well.

    88. Re:It's not forced on her by rhalstead · · Score: 1

      It's much like an ISO audit, but more is riding on it. You have to document what you do and do what you document and do so thoroughly BUT NEVER offer any information you were not asked for or show them anything they didn't ask to see.

  2. Broken image link by Anonymous Coward · · Score: 1

    TFA has a broken link of her image. Just goes to show that errors creep up in the damndest of places.

    1. Re:Broken image link by Anonymous Coward · · Score: 0

      No problem here. Probably an early SOPA test...

  3. I trust my life to Boeing every time I fly by gatkinso · · Score: 1, Insightful

    ...and incidentally every time one of their products flies over my house to land at the DC area airport I live close to.

    Yet I don't demand to audit their code.

    --
    I am very small, utmostly microscopic.
    1. Re:I trust my life to Boeing every time I fly by rtfa-troll · · Score: 5, Insightful

      Yet I don't demand to audit their code.

      Well, if you don't demand that somebody audits their code you are pretty stupid. Unaudited code and code which is proprietary and never shared with outside bodies (this doesn't have to mean the public; just at least someone external) just doesn't have a place in any critical parts of our infrastructure. It is as irresponsible as it would be if Boeing didn't have to hand over the mechanical specifications of their planes, which of course they do. However, If you had read the article you would have seen this quote:

      Regulatory authorities don't see or review the software either.

      She simply has to trust that the vendor is telling the truth and doing things right.

      I think you will find that aircraft software, whilst it isn't open source and available to everyone, gets a bit more review than that.

      Apart from that, the plane code isn't part of you and is, as a passenger, something you just visit for a short time. I think people have a right to understand fully, to the level of their own ability, things that are made part of their body.

      --
      =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
    2. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 1

      Your continued existence is not dependent on flying Boeing aircraft.

    3. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 1

      ...because you have a choice whether or not to fly and ultimately if you don't, you'll still live. Also, there are regulatory authorities controlling how planes are built and inspected.

      This person *must* have that device or she will die, but no 3rd party is looking at it for quality.

      I make analogies too when I don't fully understand a subject.

      But I usually keep my mouth shut when that's the case.

    4. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 1

      Yeah, 'cause having an Airplane fly over your house is the same as it being cramed up your ass....

    5. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      So, you're saying you're a prole?

    6. Re:I trust my life to Boeing every time I fly by hcs_$reboot · · Score: 1

      Nevertheless an important issue is addressed here.
      Software comes with the usual THIS SOFTWARE IS PROVIDED "AS IS" disclaimer. Of course, when it comes to safety / security / health ... one may want to get more than a disclaimer. But there are also (and still) devices where the poor programming (especially in the algorithms / intuitiveness departments) appears to be annoying for the user, while the device cannot be upgraded / updated (washing machines, pocket translaters, microwave, hi-fi...).

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    7. Re:I trust my life to Boeing every time I fly by hedwards · · Score: 4, Insightful

      GP lives in their flight path. Around here it's difficult to impossible to find a place to live where a rather large plane doesn't fly overhead on a regular basis.

    8. Re:I trust my life to Boeing every time I fly by NatasRevol · · Score: 1

      I've been to Charleston. Those are their top people working on it. Top people.

      Plus, that's part of the lower cost of labor which is why Boeing moved there. Gotta take the good with the bad.

      --
      There are two types of people in the world: Those who crave closure
    9. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      So your argument is, that you are a sheep, and so others should be too?

      Not a very good point.

    10. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      Those are their top people working on it. Top people.

      Hey, that's sexual discrimination! The bottoms should get a chance to work on it, too!

    11. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      Society is like McDonald's rejects. Idiots everywhere.

      FTFY

    12. Re:I trust my life to Boeing every time I fly by cp.tar · · Score: 1

      Well, in fact I do ask about details concerning certain dishes, especially whether milk is involved in preparation. I admit to not asking the whole source code, but I am asking about an aspect which deeply and, should I ingest it, violently concerns me.

      And that’s just about something that passes through my body.

      --
      Ignore this signature. By order.
    13. Re:I trust my life to Boeing every time I fly by JobyOne · · Score: 2

      Actually, people do that sort of thing *all the time*.

      I have a coworker who can't have wheat or dairy, and it takes a lot of questioning for her to get a meal at a restaurant. My mom is allergic to soy (including soybean oil), and since soy pops up in the darndest places that means it also takes a lot of questioning for her to get a meal at a restaurant. No, they don't audit the cooks, but they do demand information about what they're about to put in their body, up to a point required to ensure their own health to the best of their own knowledge and abilities.

      What were you saying about fantasies? I think you have a few.

      --
      Porquoi?
    14. Re:I trust my life to Boeing every time I fly by NevergoldMel · · Score: 1

      The FAA is all over it. There are specifications for the thread tape used on the wiring conduits. Different conduits are required to use difference types and brands of thread tape. The flashlight batteries have to have a certificate of airworthiness in every case. The paint pens for touching up the exterior paint have a 90 day shelf life. The flip-down trays on the back of the seat are inspected by the same people that inspect the engine components. The FAA also requires that the "stores" where the airlines keep the parts are always manned. Mechanics are not allowed in the "stores".

    15. Re:I trust my life to Boeing every time I fly by Apothem · · Score: 1

      Apart from that, the plane code isn't part of you and is, as a passenger, something you just visit for a short time. I think people have a right to understand fully, to the level of their own ability, things that are made part of their body.

      This right here just about sums it up. Honestly, you seriously wouldnt at least consider questioning what the hell is being put inside you at least a little bit? It just ever so happens that this guy just wanted to make sure things were up to spec.

    16. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      All products work, all products have bugs too. An audit of the source code is justified.

      However, I wonder when someone personally wants to see the source code--what is the motive? Is it really just to see how it works to make sure there are no problems? Or is it--force a company to open the source, now that the source is opened it gets released to the public, now others can develop similar products from the company's R&D without having to invest that much time and money of their own? Exactly what makes them more qualified to review the source code than who the company hired to do the code reviews?

      So yes, I am quite biased against anyone calling for a company to open up closed source. So I tend to think it's more towards the second--force a company to open the source, now that the source is opened it eventually gets released to the public, now others can develop similar products from the company's R&D without having to invest that much time and money of their own. I'm not saying it is definitely that way in this case--but I am saying that when I do read or hear of a request or demand to open up otherwise closed source code, that is what I personally believe, even moreso if the person hires a lawyer or is a lawyer.

      Also, a person can understand fully, to the level of their own ability, what a thing that is part of their body is doing--without seeing the source code line by line.

      Finally, they can choose a different vendor, but they too may keep the source code closed.

    17. Re:I trust my life to Boeing every time I fly by dotancohen · · Score: 1

      Ok then, do you demand the recipes of dishes that you order out in restaurants? And if they do provide them, do you then audit the cooks to make sure the recipe was followed exactly?

      I do ask if they use MSG. And if the waitress doesn't know what MSG is, I go to the back and ask the chef myself rather than explain it to her and let her ask. Because I _will_ find out later if I don't.

      --
      It is dangerous to be right when the government is wrong.
    18. Re:I trust my life to Boeing every time I fly by TheRaven64 · · Score: 1

      Any safety-critical system in a commercial aircraft is subject to FAA approval. This requires things like multiple independent teams working on implementing the same specification, formal methods employed during the development, and so on. I'm not sure if the FAA audits the code, but I'm pretty sure that they can require a third-party audit. In addition, if a software bug causes an aircraft to crash, the customers' families will sue the airliner and the airliner will sue boeing.

      Now, compare that with this case: The software is known to contain remotely exploitable vulnerabilities. The FDA approved the device without doing any code review, or even with access to the code. The FDA's approval means that the manufacturer is not liable for any flaws in the device.

      --
      I am TheRaven on Soylent News
    19. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      All the bottoms are too busy being worked on ;)

    20. Re:I trust my life to Boeing every time I fly by oztiks · · Score: 1

      I wonder if you could sue your parents for passing on a disability or illness, last time I checked my folks were not FDA approved.....

      Interesting can of worms here. Where does the buck stop? Whose responsible? Philosophically no easy answer and the defense could pose counter arguments that I'd imagine by the time a verdict is presented could mean the plaintiff could die of old age.

    21. Re:I trust my life to Boeing every time I fly by Ofloo · · Score: 1

      But that's not directed at you directly, .. it not the same, .. if something happend to the plane it could crash in an ocean, .. if that hart fails at any time any place she'll die.

    22. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      All products work, all products have bugs too. An audit of the source code is justified.

      However, I wonder when someone personally wants to see the source code--what is the motive? Is it really just to see how it works to make sure there are no problems? Or is it--force a company to open the source, now that the source is opened it gets released to the public, now others can develop similar products from the company's R&D without having to invest that much time and money of their own? Exactly what makes them more qualified to review the source code than who the company hired to do the code reviews?

      The impression I get is that this is an FDA-approved device, but the FDA only considers the hardware -- so there's no guarantee of any real oversight regarding the software component. IMO anyone is more qualified to do it than no-one at all -- and without oversight, it's conceivable that whatever problems are found by internal or contracted audits go to /dev/null.

      The test would be whether this person would be satisfied by third-party code review (with public results) and/or access to the source under an NDA. Of course, this being /., I did not RTFA, so maybe it says whether or not said lawyer would accept said solutions.

    23. Re:I trust my life to Boeing every time I fly by HornWumpus · · Score: 0

      Do you eat celery?

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    24. Re:I trust my life to Boeing every time I fly by JoeMerchant · · Score: 2

      ...and incidentally every time one of their products flies over my house to land at the DC area airport I live close to.

      Yet I don't demand to audit their code.

      There is also a pilot and co-pilot in command of the aircraft. Most of the time they're sober enough to recover any software glitches before a crash, and they're usually awake during takeoffs and landings.

    25. Re:I trust my life to Boeing every time I fly by Hognoxious · · Score: 1

      Logically, then, McDonald's is not part of society. Hmm. Actually, no problem. As you were.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    26. Re:I trust my life to Boeing every time I fly by Hognoxious · · Score: 1

      cause having an Airplane fly over your house is the same as it being cramed up your ass....

      I hope you're not a proctologist. Or a cardiologist, for that matter.

      Well, I hope your not mine. But feel free to treat as many lawyers if you like.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    27. Re:I trust my life to Boeing every time I fly by AK+Marc · · Score: 1

      The buck stops with the company that made and sold the device. And they are expecting lawsuits based on their faulty software. And so they will not let the software out into the hands of a lawyer. She may not be allowed to use it against them (based on an NDA when released) but she could read it enough to realize they'd win a class-action suit, and sue again for the code for that purpose.

      The question I have with this, is why does everyone here defending the medical company hate the free market? The free market requires informed consumers. When the iHeartYou app is released that can stop the heart of everyone within 50 meters using one of these devices, who is to blame? The consumer for choosing to use a broken device or the company for making it. I say that if we had a free market, the user would be responsible, but they can't be when they were lied to by the company making them.

    28. Re:I trust my life to Boeing every time I fly by electroniceric · · Score: 4, Informative

      In the 90s, the FDA realized that even if it could see the could, there was no way it could realistically audit code for all the devices it is required to review annually. So they switch from attempting to verify devices directly to insisting that devices be design and developed under a very high quality engineering paradigm.

      So instead of looking at code trying to find problems, what they do is demand artifacts of a very disciplined design development and test process, reasoning that if people are in fact actually writing out test cases, doing internal code reviews with documented changes arising from them, maintaining requirements traceability matrices linking each line of code to a user requirement and then a lower level system requirement, then that process will result in better code than the FDA could accomplish by their own audit or that of a 3rd party. So the woman should be asking to see the details of the company's FDA submission, presumably under NDA from the company.

      Now, whether the FDA is employing Design Control in a strict enough way is definitely a fair question - in particular the 510k (predicate device) submission process has left a lot of loopholes (due to its risk class, a pacemaker does not go through 510k, it goes through the more demanding PMA process). But to suggest that she or someone she hires will just be able to wade through the code to decide if she thinks it's high quality seems to me more like grandstanding than anything else.

    29. Re:I trust my life to Boeing every time I fly by zevans · · Score: 2

      Actually, people do that sort of thing *all the time*.

      They do... and restaurants often say "we can't be sure, so you'll have to eat elsewhere" because they can't be bothered with it. So by your analogy (which I like) there is a risk that pacemaker manufacturers will do the same.

      --
      "... and more and more now there are all kinds of electronic goodies available" -- Pink Floyd 1972
    30. Re:I trust my life to Boeing every time I fly by Hognoxious · · Score: 1

      And do you go out and check the farms where the veg are grown and the animals are raised...

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    31. Re:I trust my life to Boeing every time I fly by Hognoxious · · Score: 1

      Well, if you don't demand that somebody audits their code you are pretty stupid.

      Not as stupid as someone who assumes a lawyer will have a clue how to ask someone to google for where to start.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    32. Re:I trust my life to Boeing every time I fly by Darinbob · · Score: 1

      Medical device software, and software in many other applications, is not legally allowed to come with a "provided as-is" disclaimer.. These devices must pass through the country's medical standards and reviews, and in most major countries that mean an extensive auditing and cumbersome approvals process. Manufacturers in many countries come with a regulatory compliance officer that is allowed to over-rule the CEO and Board.

      For a pacemaker these rules and regulations are the most stringent sort and taken the most seriously. This is not like some shoddy voting machine.

    33. Re:I trust my life to Boeing every time I fly by dotancohen · · Score: 1

      Do you eat celery?

      I do not avoid celery. Until I saw your post I was not aware that there are celery-sensitive people. That is rather interesting, thanks.

      --
      It is dangerous to be right when the government is wrong.
    34. Re:I trust my life to Boeing every time I fly by oztiks · · Score: 1

      Okay, that's cool but shes running a fools errand. She's wanting the code she hasn't asked the supplier to have it independently audited.

      Where's the iso standard? Where's the compliance rating? Where's industry watch dog?

      She's a lawyer she had to pass the bar hmmm .... So again where does the buck stop really?

    35. Re:I trust my life to Boeing every time I fly by HornWumpus · · Score: 1

      Celery contains natural MSG. It's a single blind test for the self described 'super sensitive to MSG people'.

      If you eat celery you can stand a some level of MSG. Look it up for yourself.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    36. Re:I trust my life to Boeing every time I fly by dotancohen · · Score: 1

      Celery contains natural MSG. It's a single blind test for the self described 'super sensitive to MSG people'.

      If you eat celery you can stand a some level of MSG. Look it up for yourself.

      Thanks. I won't look it up, I will eat celery next weekend when I can afford to have an unproductive 24 hours. I am genuinely interested, and I know how much "both sides" will confuse the issue online. I have no problem being a guinea pig if it means that I will know more about my situation for the future.

      Thanks.

      --
      It is dangerous to be right when the government is wrong.
    37. Re:I trust my life to Boeing every time I fly by cp.tar · · Score: 1

      No, I know that part is checked by someone else. In this case, apparently, nobody really checks the source code, so I do think the request is quite appropriate.

      --
      Ignore this signature. By order.
    38. Re:I trust my life to Boeing every time I fly by Anonymous Coward · · Score: 0

      >> Well, if you don't demand that somebody audits their code you are pretty stupid.

      I simply said *I* don't audit their code.

      BTW, I am waiting for your feedback regarding Amtaks new realtime brake subsystem.

  4. first, we kill all of the lawyers by Anonymous Coward · · Score: 3, Insightful

    This sort of demand is why lawyers are disliked. The life science industry has to follow the FDA directive to perform a source code review. It is very unlikely that the source code in these devices have any remaining bugs due to the length of time that these devices have been used.
    In addition to the source code for the software running the device, which is most likely to be extremely robust given the long time that these devices have been in use (+25 years), she might as well ask for the manufacturing process details for the battery, the casing, the electronic components, and the design of the microprocessor.
    This is pointless since any qualified experts on the code are likely to be working for the device manufacturer.

    1. Re:first, we kill all of the lawyers by beelsebob · · Score: 1

      And what if the bug is that it stops working on march 3rd 2012?

    2. Re:first, we kill all of the lawyers by NatasRevol · · Score: 5, Funny

      Did you just seriously say that there are no more software bugs in their code?

      You're the reason lawyers exist.

      --
      There are two types of people in the world: Those who crave closure
    3. Re:first, we kill all of the lawyers by mrsquid0 · · Score: 1

      I wish that I had some mod points today so that I could mod this as funny. Now that I think about it, I seem to remember that David Parness, years ago, proved that it is not possible to guarantee that code is bug free, but perhaps I am misremembering something.

      --
      Just because you are paranoid does not mean that no-one is out to get you.
    4. Re:first, we kill all of the lawyers by Stormthirst · · Score: 3, Informative

      No - lawyers are disliked because they charge absorbent fees for sitting in an office and talking, or standing in a court and talking. They make nothing, and have the moral values of a squashed tomato*

      You're assuming that the device she's due to have fitted is exactly the same design and construction as the ones they used 25 years ago. This is obviously false. For example, the original pacemakers paced the heart all the time, and as a result had a very limited battery life. Pacemakers these days are far more intelligent, and sense when a regulating beat is needed.

      Having said that, your point about the qualified experts still holds.

      * I'm probably going to get sued now by some lawyer representing squashed tomatoes for defamation of character.

    5. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 5, Insightful

      There are many assumptions here that should be questioned.

      Source code reviews are highly imperfect ways to ensure stable and accurate software, and good ones are extremely hard on the developers involved. Techniques like test driven development and paired programming offer a much better solution at lower cost.

      New medical devices are released all the time and they have new code operating them, even if that general type of device has been in use for decades. New models with new or modified code have new bugs.

      Perhaps owners of electronic devices that have caught fire or misbehaved in other physical ways have learned to start inquiring about manufacturing, mean time between failure and other manufacturing and quality issues.

      I have worked in the medical software industry for thirty years as a developer, and was at one time an employee of Medtronic. I have a Medtronic pacemaker/defibrillator embedded in my chest which can be remotely accessed and controlled. I am professionally qualified to study and understand my device's software, development and testing methodology, and security issues - but Medtronic declined to share with me their source code when asked. The technical manuals for my devices which appear to provide all necessary information for hacking my pacemaker/defibrillator are available online.

      I think that more can and should be done with oversight of medical device manufacturers and their software than the FDA currently requires, but this is true of all mission critical software like military and aerospace systems as well. The problem is neither uppity lawyers nor uncaring medical device manufacturers but instead the way we build software. Anyone with personal experience in the software industry who relies on a programmable medical device but who is not concerned over the accuracy and stability of the software running it is not thinking clearly.

    6. Re:first, we kill all of the lawyers by kdemetter · · Score: 1

      So because it's difficult, we should just trust the manufacturers ?

      She is not saying that all pacemakers should be open sourced btw , she just wants to be sure the device is safe.
      You need an external party that reviews the device and software thoroughly ( which is not happening for the software currently ).

      That's the only way to insure that it's safe ( you cannot just trust the company on this, there are too many lives at stake ).

    7. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 3, Funny

      I assume you meant to say "exorbitant" although you could say that lawyers excel in absorbing their clients' money.

    8. Re:first, we kill all of the lawyers by hoggoth · · Score: 1

      Then just delay releasing the source code until March 4th. Problem solved.

      --
      - For the complete works of Shakespeare: cat /dev/random (may take some time)
    9. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 0

      No, this is the law/legal system doing what it is supposed to be doing. Protecting our asses from the stupidity and mistakes of others. Audits are essential to ensure that things work the way manufacturers claim they do; this goes for hardware, so why should it be any different for software?

    10. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 0

      It is very unlikely that the source code in these devices have any remaining bugs due to the length of time that these devices have been used.

      You don't know the nature of software very well, do you? Even if this software has a very small number of lines of code (which may be the case for a pacemaker), even if it's been subjected to Mars-lander-level scrutiny, even if it's been in use for a long time, there are almost sure to be bugs. The only question is how often (and under what circumstances) they will trigger – and whether they will seriously harm or kill the patient.

    11. Re:first, we kill all of the lawyers by Opportunist · · Score: 2

      Why the heck would someone put a real time clock into a pacemaker?

      That's the stupid question I've been asked time and again in 1999. But will $device work in 2k? With $device being something that has no chance in hell to have a RTC.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    12. Re:first, we kill all of the lawyers by beelsebob · · Score: 2

      The point I was making was "I've tested it for 25 years" is not a proof in any way that it's bug free. It being the 3rd of march 2012 was simply an example of a condition that's never been tested in those 25 years... Others might include sun storms, unseasonable warmth, a certain bacteria in the patient, ........

    13. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 1

      I suggest you do some reading. You can start here:

      http://www.ncbi.nlm.nih.gov/pubmed/11497532

      The conclusion: "Pacemaker and ICD recalls and safety alerts occur frequently, affect many patients, and appear to be increasing in number and rate. With the growing number of device implants and expanding indications for device therapy, the number of patients affected by device advisories will likely continue to increase."

      There are more hardware recalls than software related, but they are far from free from software defects.

    14. Re:first, we kill all of the lawyers by michael_cain · · Score: 1

      You need an external party that reviews the device and software thoroughly ( which is not happening for the software currently ).

      So who, that is competent to conduct such a review, is willing to do so? Reading the code for one such device pretty much precludes ever being able to write code for similar devices, at least for a considerable period of time. The case law was settled back in a variety of reverse-engineering cases: anyone who has ever seen the source code for the software in question is hopelessly tainted, and is not allowed to write (or even, in some cases, read) the code going into the reverse-engineered device. How many people are there competent to review the code for an embedded medical device who are also willing to give up writing code for such devices?

    15. Re:first, we kill all of the lawyers by sonamchauhan · · Score: 1

      oops... wrong mod

    16. Re:first, we kill all of the lawyers by Vellmont · · Score: 1


      Why the heck would someone put a real time clock into a pacemaker?

      Obviously so you can correlate a patients symptoms and or activity with the monitoring built into the pacemaker/defibrillator. These devices aren't just simple, dumb pacemakers anymore, and havent been for many years. My father has had one of these devices for nearly a decade now, and several times has been worried about what he thought were jolts from the defib. (They turned ot to be not a jolt from the defib thankfully). These devices have had the capability of storing event data from any arrythmias they detect, and any debrillations it administers.

      It's an obvious use case that you'd want to know WHEN the arrythmia or defib occoured to be able to diagnose what caused it.

      --
      AccountKiller
    17. Re:first, we kill all of the lawyers by Lumpy · · Score: 2

      I loved those questions. My answer was always , "No it will fail dangerously, you had better give it to me so I can dispose of it safely"

      I had in my office 3 toasters and other assorted silly things all tagged with the big red "NOT Y2K SAFE" sticker on them.

      --
      Do not look at laser with remaining good eye.
    18. Re:first, we kill all of the lawyers by rubycodez · · Score: 1

      logging? component maintenance warnings?

    19. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 0

      The issue here is that you are assuming that the value of this software is
      worth more than the lives that depend on it.

      Plenty of people have the skills to improve this software -- and it is almost
      a certiantly that it can be improved.

    20. Re:first, we kill all of the lawyers by Opportunist · · Score: 1

      True, but auditing the SOFTWARE will not help there. Because software can actually be fully tested, you can follow every single branch and check the results.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    21. Re:first, we kill all of the lawyers by Opportunist · · Score: 1

      Yes, but this will be for logging purposes and must not influence its function. If it can in any way have an influence on operation then yes, you have a critical bug in the software.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    22. Re:first, we kill all of the lawyers by Opportunist · · Score: 1

      And that should have any influence on the basic operation? It should log, all right and fine, but if logging fails, the basic operation should not cease.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    23. Re:first, we kill all of the lawyers by Opportunist · · Score: 1

      Damn, why didn't I think of that? Maybe because I had no use for ancient VCRs (that cannot be programmed to a certain date but only "now +x days, +y hours..."), refrigerators and (and that was the best) a hairdryer.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    24. Re:first, we kill all of the lawyers by beelsebob · · Score: 2

      Sure you can make sure your tests have 100% code coverage, but that doesn't mean you've proved your program correct. Example, here's an (incorrect) program to print "Hello World" iff argv[1] exists and begins with 'a':

      int main (int argc, char ** argv)
      {
          if (argv[1][0] == 'a')
          {
              printf("Hello World");
          }
          return 0;
      }

      I test it with two inputs... "apple", and "cat", I achieve 100% code coverage, but the program is still erroneous, and crashes if I don't provide any argument.

    25. Re:first, we kill all of the lawyers by wbr1 · · Score: 1

      Lawyers produce two things that I am aware of, turds and opinions.
      One is tangible with no large market, the other is intangible but has a huge market.

      --
      Silence is a state of mime.
    26. Re:first, we kill all of the lawyers by rubycodez · · Score: 1

      you are correct, should not in any way be tied to performance of it's life critical operation. but I can see much value in having RTC, because a person might travel to where no records are available.

    27. Re:first, we kill all of the lawyers by tomhudson · · Score: 1

      I'm glad you're not a lawyer. That means I can't accidentally hire an idiot as my lawyer.

      Your naiveté is touching. So obviously an idiot lawyer will have no problem relieving you of your money.

      Lawyers don't take cases because they think they can win, but because they get paid either way - and as long as they can lose convincingly, they can milk the same case for a decade (SCO).

    28. Re:first, we kill all of the lawyers by tomhudson · · Score: 1

      She is not saying that all pacemakers should be open sourced btw , she just wants to be sure the device is safe.
      ...
      That's the only way to insure that it's safe.

      Short answer - NO device ever made is 100% safe. Can't be done. Even simple every-day no-tech things that we've had a thousand years experience (stairs, ladders, rocking chairs, for example) still have design and manufacturing issues, because you can't anticipate every scenario without rendering them entirely non-functional, or, in plain English, useless.

      Take your dinner knife as an example - ohhh - it's sharp! Someone might get hurt! Make it dull so it can't cut anything!

      Bottom line - with the right circumstances, you can kill someone with nothing more than an empty box or even bubble gum (or bubble bath), in the wrong place, at the wrong time. Nothing is 100% safe, 100% of the time.

    29. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 0

      And yet as an embedded software guy, I've seen more than a few designs that do have an RTC even though there's no obvious need for them in the task the product performs. The answer, of course, is RTCs are cheap and logs are valuable (even if engineers with a debug interface are the only ones who can ever access them); a lot of devices have a lot more going on than it says on the label.

      Granted, timestamping logs with an RTC is highly unlikely to cause a crash at any date/time -- you're just writing data to be read out wholesale, and any processing that might barf on the next date being 01 Jan 1900 are in the PC analyzing the logs. Just saying, RTCs are all over places they don't strictly "need" to be.

    30. Re:first, we kill all of the lawyers by Zironic · · Score: 2

      That's branch coverage, what you also want is input domain partitioning.

    31. Re:first, we kill all of the lawyers by Abreu · · Score: 1

      Yes, you certainly meant "exorbitant" instead of "absorbent".

      I'm glad you're not a lawyer. That means I can't accidentally hire an idiot as my lawyer.

      No, that's when you represent yourself in court...

      --
      No sig for the moment.
    32. Re:first, we kill all of the lawyers by JoeMerchant · · Score: 1

      This sort of demand is why lawyers are disliked. The life science industry has to follow the FDA directive to perform a source code review. It is very unlikely that the source code in these devices have any remaining bugs due to the length of time that these devices have been used.
      In addition to the source code for the software running the device, which is most likely to be extremely robust given the long time that these devices have been in use (+25 years), she might as well ask for the manufacturing process details for the battery, the casing, the electronic components, and the design of the microprocessor.
      This is pointless since any qualified experts on the code are likely to be working for the device manufacturer.

      The medical device industry I worked in for 20+ years was highly unlikely to open a can of approved worms. Once the software receives permission to market, it's mostly locked down to avoid the appearance of weakness, the potential for recall of affected devices, and the liability of admitting fault in devices already distributed for use.

    33. Re:first, we kill all of the lawyers by pbhj · · Score: 1

      >"It is very unlikely that the source code in these devices have any remaining bugs due to the length of time that these devices have been used."

      I gather that the space shuttle wasn't flown over a year end because the clocks didn't roll over correctly ... that has to be some of the most well reviewed and expensively developed code ever; far more care was taken on it than on some random companies pacemaker code I'd be sure. Yet there was this huge bug ...

      http://slashdot.org/story/06/11/06/2320235/computer-date-glitch-may-limit-next-shuttle-launch

      Also, basically your point appears to be that having the code won't make any difference. Well then the company can just divulge it; what difference will it make?

    34. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 0

      All true, but you used 'should' three times in that post. Things don't always work as they should.

    35. Re:first, we kill all of the lawyers by cachimaster · · Score: 1

      This sort of demand is why lawyers are disliked. The life science industry has to follow the FDA directive to perform a source code review. It is very unlikely that the source code in these devices have any remaining bugs due to the length of time that these devices have been used.
      In addition to the source code for the software running the device, which is most likely to be extremely robust given the long time that these devices have been in use (+25 years), she might as well ask for the manufacturing process details for the battery, the casing, the electronic components, and the design of the microprocessor.
      This is pointless since any qualified experts on the code are likely to be working for the device manufacturer.

      First, those devices have wifi, I doubt the wifi code has 25 years.
      Even if it were 25 years old, we find 20+ year old bugs in BSD code all the time, old code does not implies bugless code as naturally not all codepaths are likely to be tried.

      What this code needs is 25+ years of code review, and it has to be done by a security expert. A regular code review won't do.

    36. Re:first, we kill all of the lawyers by evil_aaronm · · Score: 1

      "Qualified experts" still fuck up. Example: I performed a common UI operation to show the parameters for a portion of the configuration on the ready-for-release version of a blood chemistry diagnostic tool that my mega-global-corp sells. Simply requesting that UI screen immediately crashed the machine. Curious, I tried it on another machine in the lab: same results. It's not like I asked it to do 10 complicated things at the same time: I merely asked it to display some information from the database on the UI that's been in place for over 10 years. I didn't write that part of it, but I know the guys that did and I'm not one bit surprised that it crashed. That's not even the dumbest crash I've seen from this software.

    37. Re:first, we kill all of the lawyers by Anonymous Coward · · Score: 0

      pacemakers do have real time clocks. it's useful to record dates/times when the pacemaker/ICD senses an arrhythmia or, in the case of an ICD, shocks to defibrillate. It also provides the date for the ERI (elective replacement indicator), when the pacemaker is due for replacement. but i doubt that the clock has any relation to the pacing/defibrillating function of the device. yes, i'm a cardiologist and interrogate pacemakers, and before that I was an EE. I also think the lawyer has no business demanding the source code. where would be the end of her requests? The BP/pulse ox machine? IV pumps? Transducers for arterial lines? I believe in FOSS but this is just lawyer bullshit.

    38. Re:first, we kill all of the lawyers by pommiekiwifruit · · Score: 1

      "should". Ha ha. You mean like the Ariane 5 rocket should not have exploded when some unimportant logging function failed. Behold the mighty power of hardware traps on exceptions.

  5. CTL-ALT-DEL by ColdWetDog · · Score: 4, Insightful

    Oh, come on. The source code is not going to tell you a whole lot, it would be only comprehensible to experts and it says nothing about the little hardware bits. Does Mr. Lawyer want Medtronics to go over the schematics with him? Explain the physics?

    Sometimes you just have to settle down and let things go. Yes, regulatory agencies should review operations of medical devices closely. No, they don't need to peek inside.

    I don't even think the FAA looks at the code for the flight control computers on airliners. They test the planes (or actually they watch the manufacturer test the planes) but they don't get every part off the aircraft and look at it under a microsope.

    --
    Faster! Faster! Faster would be better!
    1. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      Mrs. Lawyer.

      But otherwise yeah

    2. Re:CTL-ALT-DEL by CAPSLOCK2000 · · Score: 5, Insightful

      Oh, come on. The source code is not going to tell you a whole lot, it would be only comprehensible to experts and it says nothing about the little hardware bits.

      Experst are for hire.

      I'm not an architect. The blueprints of my house are useless to me, but I can hire an architect to read them for me. That architect can than tell me if the house I'm living in is well designed or not. He won't be able to tell if the building-materials are of sufficient quality, but if the design is not sound the materials used don't even matter.

      I'm dissappointed in Slashdot. One would expect that over here people would see the value of having access to the source of the software that keeps you alive.

    3. Re:CTL-ALT-DEL by rtfa-troll · · Score: 3, Insightful

      No, they don't need to peek inside.

      Think about how much cheaper for everybody it would have been to have one small government testing lab verifying medical implants that it is going to be having to replace all of the breast implants in France / UK etc. etc. Think how much compulsory insurance is going to cost.

      This is typical of the corporate welfare attitude that small people have to pay for the mistakes of big companies but no big company has to pay for anything.

      --
      =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
    4. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      I know a guy who worked for Garmin. The FAA doesn't look at the code, as far as I know, they just insist that every code path is thoroughly tested (through unit testing). This requires interesting things like code injection and such when you need to break those things that should never break (idiot checks and sanity checks and stuff).

      Presumably they do integration testing as well.

    5. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 2, Insightful

      Before I started reading the comments, I knew it would skew heavily against the lawyer because, well... he's a lawyer. No other reason.

      You dweebs here on /. get your panties in a bunch about *any* product for which source code is kept private. Operating systems, video card drivers, voting machines, etc.

      But oh, god forbid a lawyer advocates for his client, WHOSE LIFE DEPENDS ON THIS FRIGGIN' DEVICE, and you go all 4chan on him.

      No, the lawyer is NOT going to review the code. He's going to get a pacemaker software nerd to do that for him. That's assuming not all the pacemaker software nerds are posting this bullshit about him on /.

      Really, the measure of your character is whether you stick to your stated beliefs (code should be available for review), even when the people trying to exercise those beliefs don't belong to your clique.

      Idiots.

    6. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      Oh, come on. The source code is not going to tell you a whole lot, it would be only comprehensible to experts and it says nothing about the little hardware bits. Does Mr. Lawyer want Medtronics to go over the schematics with him? Explain the physics?

      Casual Sexism at play. Pay attention, "Mr Lawyer's" name is Karen.

    7. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      They actually do. Avionics must be certified by the FAA just like everything else that goes into a plane. So yes the airline industry is heavily regulated.

      The source code is going to tell you a lot, and there have been instances in the past where unregulated medical devices have killed people. Google Therac-25.

      Also, SHE will probably pay a expert to go over the code with her.

    8. Re:CTL-ALT-DEL by Teancum · · Score: 2

      With statements like you've made in this post, you would be surprised what the FAA does require when they issue a flight worthiness certificate. No, the inspectors from the FAA don't review every line of code nor do they demand x-rays and microscopic details of all critical parts, but manufacturers to keep track of much of that information and have it stored away "just in case" there is an accident investigation board held on that aircraft that is being made. This is even more true when somebody sell a vehicle to the U.S. government.... where the paperwork for most vehicles weighs more than the vehicle being delivered.

      No, I'm not kidding here either. There are warehouses larger than most aircraft hangers (including more than a few former aircraft hangers themselves) that hold boxes and pallets of this paperwork. Some of it has been put into microfilm or digitized.... but that seems to just increase the stack of paperwork even more. When the proverbial stuff hits the fan, all of that is examined including every single line of code used in the flight control computers as well.

      The situation is analogous here, where if somebody dies from a pacemaker or life-saving device, that all of that will come out into the open. That somebody is being preemptive and expecting this ahead of time is the only difference. Good engineers document everything they do. Lousy engineers sort of pretend to document everything..... but the worst thing you can do is to sit in a deposition and have to explain to a room full of lawyers why you didn't make the documentation when a major screw up happens. I've seen it happen, and it isn't pretty.

    9. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      The FAA are extremely thorough when reviewing source code and process used to develop that source code. Many of us will review source code before running something on our computers, it's perfectly reasonable to want to review the code that is keeping you alive from hearbeat to heartbeat. I think I might even shop for an open source pacemaker if it exists.

    10. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      The source code will tell you a lot. Are you even a software engineer? I see code frequently that I can't understand to some degree or other on first, second, or third reading but it tells me right away about the people who wrote it. I wouldn't want to depend on the unaudited work of people who do the following:
      * Variable names / comments that contain obsenities or clear typos
      * Comments that spell out the author didn't actually know how something works / why something was happening / what a certain value indicates
      ** Bonus: comments that spell out that a component supplies ambiguous and possibly conflicting values, and the client code must "guess" or "assume worst-case"
      * Exception swallowing / unchecked error flag clearing (as was done in the Breathalyzer code)
      * TODOs in final product
      * Inappropriate monolithic methods / inappropriate inlining
      * Undocumented / unnamed non-obvious constants
      * Copy-paste-partially-edited code
      * Questionable switch case fall-through
      * Super-complicated / overly-complicated / inconsistent inversion conditionals
      * Inappropriate cunning-or-crazy (hard to tell sometimes) code, e.g. coincidentally-works-right code and side effects
      * Noob mistakes
      * Extra code, either very similar to or very different from actually-used code

      Part of a trustworthy device is it was made by trustworthy people under trustworthy conditions.

      [[(the FAA) don't get every part off the aircraft and look at it under a microsope.]]
      They often do when it crashes and kills everyone on board. Literally, every part off/of the aircraft, and literally a microscope.

    11. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      > I don't even think the FAA looks at the code for the flight control computers on airliners.

      I worked on software for two new airplane projects at Boeing. I know from first hand experience that the FAA does not look at the source code.

    12. Re:CTL-ALT-DEL by Opportunist · · Score: 2

      When having to side with closed source or lawyers, the choice is quite easy. Hell, when choosing sides between lawyers and mass murderers it is.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    13. Re:CTL-ALT-DEL by Idbar · · Score: 1

      I agree with you there is value. But two me, there are two ways for an inventor to keep its leading edge: patents and trade secrets. Do you sincerely prefer patents and litigation or the freedom to reverse engineering the product? I hadn't seen anyone asking for the ingredients of coca cola because they "consume" their product, they're perfectly free of not doing so.

    14. Re:CTL-ALT-DEL by kdemetter · · Score: 1

      If they don't peek inside the software, how will they know how safe it is ?
      If someone comes to check the electric wiring in your house, would you accept it if they only looked at the outside ?

      I have seen enough software to know that just because 'experts' created them , it doesn't mean i'd trust my life with it.
      I would certainly not go with the latest and greatest device for my heart. It should be as rigorously tested as a Debian stable release.

    15. Re:CTL-ALT-DEL by Dark$ide · · Score: 1

      Oh, come on. The source code is not going to tell you a whole lot, it would be only comprehensible to experts and it says nothing about the little hardware bits.

      Perhaps she wants to make her own backup pacemaker using the Arduino she's just bought from Sparkfun.

      --

      Sigs. We don't need no steenking sigs.

    16. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      "If they don't peek inside the software, how will they know how safe it is"

      The code is a tiny part of the story.

      Start here:
      http://en.wikipedia.org/wiki/DO-178B

    17. Re:CTL-ALT-DEL by six11 · · Score: 1

      I'm dissappointed in Slashdot. One would expect that over here people would see the value of having access to the source of the software that keeps you alive.

      100% agree. It seems most of the other posters on this story saw the word "Lawyer" and went temporarily stupid. Slashdotters emit blood curdling screams when they can't get open access to video codecs, but are indifferent when medical device vendors don't share code that literally keeps people alive. To those of you want to keep this code secret, I hope your electric spleen shocks you toasty brown someday.

    18. Re:CTL-ALT-DEL by superwiz · · Score: 1

      She has an engineering degree from Cooper Union.

      --
      Any guest worker system is indistinguishable from indentured servitude.
    19. Re:CTL-ALT-DEL by HornWumpus · · Score: 1

      You are not looking for an architect. You are looking for a structural engineer.

      Quote: 'A house designed by an architect might fall down, but a house designed by an engineer should be torn down.'

      That's the best defense architects can come up with.

      Architects can tell you if your house is good art or not. Not if it's even buildable in the first place.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    20. Re:CTL-ALT-DEL by HornWumpus · · Score: 1

      Bad example. Silicone is safe. Only shysters have muddied the waters and created enough fear to cause millions of unnecessary surgeries and frightened stupid people.

      The lawyers are the bad guys in that story. No doubt they are killing people (that many unnecessary surgeries and someone sure to die) to make a euro.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    21. Re:CTL-ALT-DEL by JoeMerchant · · Score: 1

      One of my favorite arguments for a wiki in a corporate documentation system is the early nuclear submarines (which were indirectly behind the development of hypertext documentations systems) and their paperwork which literally weighed more and occupied more volume than the submarine itself.

    22. Re:CTL-ALT-DEL by Spiked_Three · · Score: 1

      yea, I once sat next to an FAA agent watch test conducted by my boss. The wool pulled over his eyes must have been 6" thick.
      Somehow that memory, and the implanted pacemaker I now have do not make good feelings.

      --
      slashdot troll = you make a compelling argument I do not like the implications of.
    23. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      Yeah, you sure told me off. Retard.

    24. Re:CTL-ALT-DEL by HornWumpus · · Score: 1

      Punchline: You shoot the lawyer 3 times.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    25. Re:CTL-ALT-DEL by scubamage · · Score: 1

      Actually, the FAA most likely does. Similarly, the UN demanded the source code for windows prior to allowing it to be installed on their machines - and they still demand access to new editions of the OS. Also, as you don't know the woman, you have no idea what her background is. She could very likely be an engineer and fully capable of understanding how it works.

    26. Re:CTL-ALT-DEL by Vairon · · Score: 3, Interesting

      I agree comment posters *seem* to acting very hypocritical today but it could be possible that a different set of people are objecting for a different set of reasons.

      Also just to correct something which keeps being misrepresented in comments this laywer is a female. She also has an engineering degree and is a programmer. She intended to review the software herself with the help of fellow programmers.

      Also people might be interested to know that she worked as a pro bono counsel for the Software Freedom Law Center from 2005 until 2011 and now works as an executive director for the GNOME foundation. She still accepts pro bono cases from the SFLC and is the SFLC treasurer.

      http://www.softwarefreedom.org/about/team/
      http://www.youtube.com/watch?v=5_pRH8lzaQo

    27. Re:CTL-ALT-DEL by AK+Marc · · Score: 1

      You are advocating they use both. The point of patents and copyrights is to get devices into the hands of the public. If a device is in the hands of the public, but the code necessary to make it work is a trade secret locked up and destroyed when the product is no longer profitable, does it matter if the device itself is available as it isn't usable?

    28. Re:CTL-ALT-DEL by cffrost · · Score: 1
      --
      Thank you, Edward Snowden.

      "Arguments from authority are worthless." —Carl Sagan
    29. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      Yeah even the FAA checks the approved software iaw standards set forth in 8110.49, 8110.105 and 8110.110. Something about whether something could kill people if it doesn't work right seems to get even politicians to check this stuff out. The European union have their various laws as well. If you think this is an unfortunate example look up the certification guide lines for elevators, trains (on board at least) control systems.

      I would also like to point out that in cases where their has not been at least a certification process that at least recently we have seen signs of failure. Search for that Polish boy who controlled a train because he wanted an after school project (it was not that hard or him to do.)
      http://news.scotsman.com/latestnews/Dozens-injured-as-boy-wreaks.3662874.jp.

      Going back to medical units though if you look at people suffering from radiation poisoning from the Therac 25 units in the 1980s. Where due to a software glitch some people received over 100 times the normal amount of radiation.

      Somehow I think she doesn't want to die just because some kid tries to connect to her heart via wifi (which many units now have for "convenience" sake) or something.

    30. Re:CTL-ALT-DEL by rtfa-troll · · Score: 1

      Bad example. Silicone is safe. Only shysters have muddied the waters and created enough fear to cause millions of unnecessary surgeries and frightened stupid people.

      The lawyers are the bad guys in that story. No doubt they are killing people (that many unnecessary surgeries and someone sure to die) to make a euro.

      Possibly so. It's still a good example because the testing lab would probably have meant that the implants were "safe" according to whatever the practical standard is, so the lawyers wouldn't have a leg to stand on. Even if that had failed, they would still be able to test and rate the danger. This is not just about things being made safe. It's also about things being seen to be made safe.

      --
      =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
    31. Re:CTL-ALT-DEL by Anonymous Coward · · Score: 0

      Provided that the patents are of a limited term (comparable to the technology cycle time in that industry) - yes, I do prefer patents to trade secrets. That's the whole purpose of patents - so that eventually the exclusive technology will become non-exclusive, and other people can improve upon it (or fix its bugs). Trade secrets can last forever, holding up progress.

  6. Who owns data that an implanted device collects by davidannis · · Score: 5, Interesting

    A related story on NPR today points out that as a patient you don't have access to the data collected in and about your own body. The story focuses on one man's attempt to see his own data. He's looking for someone with technical skills to help him get at the data. Seems to me that somebody on /. should be able to help. http://www.onthemedia.org/2012/jan/20/who-owns-data-inside-your-body/

    1. Re:Who owns data that an implanted device collects by howardd21 · · Score: 1

      Thanks for sharing; should be modded up as interesting.

      --
      no comment
  7. makes sense by burne · · Score: 1

    Many (all?) pacemakers can be read and its settings altered via a datalink.

    Ignoring malice, who's to guarantee that a shoplifting detector gate doesn't interfere with your pacemaker?

    Even devices that were intented to be secure fail miserabely, so if it's your life, are you gonna trust the manufacturer?

    1. Re:makes sense by TheRaven64 · · Score: 2
      And, as she said in the talk:
      • The device sends data unencrypted (isn't that a HIPA violation?).
      • The device accepts external commands without authentication (WTF?).
      • An attacker can relatively easily cause cardiac arrest in someone implanted with one of these.
      • FDA approval means that the manufacturer is not liable for any of the above.
      --
      I am TheRaven on Soylent News
    2. Re:makes sense by shaiay · · Score: 1

      As someone working in implanted device development I can assure you that there are many regulations in place to guarantee that not much can interfere with your pacemaker.
      For the specific case of shoplifting detector gates, there exists such labs as GTRI which has specific tests for them, and for other types on interference there are many standards (PC-69, EN-45502, and more).
      Implanted device software is highly regulated and is developed and tested according to the relevant IEEE standards.
      Also note that pacemakers are quite old technology ~1958 and quite mature. So, although it is conceivable that there are bugs in pacemaker software, please give the relevant hw/sw engineers some credit

    3. Re:makes sense by shaiay · · Score: 1

      Most devices that I know of need to pair physically with their programmer -- something needs to touch the skin above the implant to initiate communications.
      At this range, the would-be-assassin can just as well inject something to harm a person, no need for sophisticated communication gear. (a PC analogy: if the PC can be physically compromised, using SSL to access gmail won't help you ...)

    4. Re:makes sense by JoeMerchant · · Score: 1

      And, as she said in the talk:

      • The device sends data unencrypted (isn't that a HIPA violation?).
      • The device accepts external commands without authentication (WTF?).
      • An attacker can relatively easily cause cardiac arrest in someone implanted with one of these.
      • FDA approval means that the manufacturer is not liable for any of the above.

      FDA approves nothing, they give permission to market. FDA accepts no liability in the event of a problem with the device, that still falls on the manufacturer, and the physician and hospital which installed it and monitored it.

    5. Re:makes sense by AK+Marc · · Score: 1

      The device sends data unencrypted (isn't that a HIPA violation?).

      HIPAA explicitly states in the law "this is not intended to imply encryption is required" or something like that (long since I worked HIPAA, I don't have the docs handy anymore). Of course, all the consultants took that to mean they could talk anyone into expensive and silly encryption systems, and the health care industry bought in and demands encryption where not required as if it were.

      FDA approval means that the manufacturer is not liable for any of the above.

      There is no indemnification in FDA approval. There have been plenty of lawsuits over "approved" devices or drugs.

  8. Open source pacemker anyone? by dietdew7 · · Score: 1

    Who is with me on this? We could model it after the Arduino project.

    1. Re:Open source pacemker anyone? by drinkypoo · · Score: 1

      It seems a worthwhile subject for study. Problem is testing...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Open source pacemker anyone? by Opportunist · · Score: 2

      You're in luck, I know a lawyer who wants one.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:Open source pacemker anyone? by drinkypoo · · Score: 1

      That solves the ethical issues, but raises its own problems of ambivalence.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    4. Re:Open source pacemker anyone? by Opportunist · · Score: 1

      I'm against testing on animals as long as there are still lawyers available!

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    5. Re:Open source pacemker anyone? by Vairon · · Score: 2

      That's really rude. The lawyer this store is about, Karen Sandler, worked pro bono for the Software Freedom Law Center helping to protect people's software freedoms. Which would normally be considered a very good and moral thing around here, would it not? She currently works for the GNOME foundation.

    6. Re:Open source pacemker anyone? by dietdew7 · · Score: 1

      All the lawyers that are my personal acquaintances are decent honorable men and women. However, lawyer jokes are always appropriate and funny.

  9. FDA requirements (21 CFR 820) by jbeaupre · · Score: 5, Informative

    It's called software validation and it's a pain in the ass. It's such a pain for medical devices that everyone avoids it unless absolutely needed. Which is why medicine is 10 years behind when it comes to electronics.

    For a "quick" overview, here's a start: http://www.fda.gov/RegulatoryInformation/Guidances/ucm126954.htm

    --
    The world is made by those who show up for the job.
    1. Re:FDA requirements (21 CFR 820) by JoeMerchant · · Score: 1

      It's called software validation and it's a pain in the ass. It's such a pain for medical devices that everyone avoids it unless absolutely needed. Which is why medicine is 10 years behind when it comes to electronics.

      For a "quick" overview, here's a start: http://www.fda.gov/RegulatoryInformation/Guidances/ucm126954.htm

      I always thought AAMI 62304 summed it up better... but, either way you look at it, the main effect of the regulations is to slow things down, make them more costly, and therefore less subject to rapid reinvention.

      Along about 1978, new medical devices were coming out so quickly that doctors and regulators couldn't keep up, so we got the 510(k) regulations. Then about 1990 or so they realized that they had to do something about software and the design process, too, so the "design controls" regulations rolled in in the mid 1990s. There's some minimal merit in the formalization of the product and software development process, but the real desired (and achieved) effect in the marketplace is to throttle the number of new types of devices coming to market so that only the best, and best understood, make it over the initial cost to market hurdle. I think the regulation also serves to stifle improvement of the devices that have made it to market, since the investment to get there is so great, business leaders are very wary about doing anything that might put a successful device "at risk," such as pointing out a flaw by improving it.

    2. Re:FDA requirements (21 CFR 820) by Anonymous Coward · · Score: 0

      You mean they don't code it using current hip language and don't assign interns to the project?

    3. Re:FDA requirements (21 CFR 820) by Anonymous Coward · · Score: 0

      The goal = better public health outcomes, and innovations of new devices can help achieve this goal. Regulations must strike a delicate balance that promotes both innovation and ensures patient safety. A different perspective about the purpose of regulation: it's also true that absent regulation, the industry has caused horrible human tragedies. Over 10,000 children were born with severe birth defects such as missing limbs as a result of a drug called thalidomide, marketed for treating morning sickness. These birth defects largely happened outside the USA where regulations did not require adequate safety studies. The FDA refused to approve the drug in the USA, citing the need for more safety studies. The manufacturer balked until it was discovered how many children were harmed or killed.

      http://www.nytimes.com/2010/09/14/health/14kelsey.html?_r=1&ref=science
      "Put your mind at rest" with thalidomide marketing: http://www.bonkersinstitute.org/medshow/thalidomide.html
      http://en.wikipedia.org/wiki/Thalidomide

      Regulation has a purpose, and we should not take safety for granted.

  10. thump by Anonymous Coward · · Score: 5, Funny

    10 thump
    20 thump
    30 sleep 1s
    40 go to 10

    1. Re:thump by NatasRevol · · Score: 1

      BUT WHAT ABOUT THE COMPILER'S BUGS!!!!

      (laugh, it's funny and full of filter letters)

      --
      There are two types of people in the world: Those who crave closure
    2. Re:thump by Anonymous Coward · · Score: 0

      20 if rand>0.01 then thump //hack to occasionally skip a beat

  11. Yeah so.. take your time... by ieatcookies · · Score: 1

    I smirked just a little when I thought: wouldn't it be funny if her heart kicked it while she was "analyzing" the source code... I'm no lawyer (in fact I'm a software engineer) but I'd be getting that thing in my body pretty quickly if I needed it to survive.

  12. Stallman and the EFF jumping in 3... 2... 1... by Anonymous Coward · · Score: 1

    Don't blow it by making a pass at this poor woman, Richard.

  13. Answering questions from TFA by Nidi62 · · Score: 4, Insightful

    How do we know the software works as advertised? How do we know it's secure?

    Well, let's see, what is the failure rate of pacemakers? A quick Google search brought this result (http://www.post-gazette.com/pg/06116/685028-114.stm):

    In one study, Dr. Maisel and FDA researchers analyzed reports that pacemaker and ICD manufacturers were required to submit to the federal agency between 1990 and 2002. During that period, more than 17,000 malfunctions resulted in removal and replacement with a new device, researchers found. Battery, capacitor or electrical problems accounted for half the failures. Thirty deaths were attributable to pacemaker malfunction and 31 deaths to malfunctions in ICDs. The annual replacement rate for pacemaker malfunctions decreased during the study period, from 9 per 1,000 implants in 1993 to 1.4 in 2002. But the ICD replacement rate, after decreasing from 38.6 in 1993 to 7.9 in 1996, increased in the latter half of the study, peaking in 2001 at 36.4.

    So, there is a failure rate of 1.4 per 1000 in 2002, and half of those were related to hardware issues. Only 30 people ended up dying. This article (http://circ.ahajournals.org/content/105/18/2136.full) claims 3,000,000 people worldwide with pacemakers in 2002, with 600,000 implanted yearly. That means in 2002 .001% of people with pacemakers died. Assuming hardware failure accounted for half of that, then the chances of being killed by a software defect in a pacemaker is extremely small. So, I'd say it's safe to assume that the hardware "works as advertised".

    --
    The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
    1. Re:Answering questions from TFA by TheRaven64 · · Score: 2

      Perhaps instead you should read the paper that this woman wrote. It lists statistics for the number of pacemaker recalls for software defects, and some of the reasons - pretty scary how poor quality the software is, as many of them would have been caught by even basic testing.

      I admit that the fact that it's possible to remotely stop Dick Cheney's heart using simple off-the-shelf hardware seems like it might be a useful feature...

      --
      I am TheRaven on Soylent News
    2. Re:Answering questions from TFA by Anonymous Coward · · Score: 0

      I'm just putting it out there that there's a good chance of under reporting of pacemaker malfunctions - a patient with known heart problems dies of a heart problem, what's there to investigate? It's easy for malfunctions resulting in death to be mistaken for normal operation.

    3. Re:Answering questions from TFA by JoeMerchant · · Score: 1

      I think one of the major software flaws in most implanted devices is that many of their communication protocols rely on security through obscurity. If the code were revealed, you could literally drop some implantees dead as they walk in or out of a Wal-Mart by modulating the inventory control system emitted fields as they pass.

      Historical failure rates say nothing about what malicious intent might achieve in the future.

    4. Re:Answering questions from TFA by cowboy76Spain · · Score: 1

      So, there is a failure rate of 1.4 per 1000 in 2002, and half of those were related to hardware issues. Only 30 people ended up dying. This article (http://circ.ahajournals.org/content/105/18/2136.full) claims 3,000,000 people worldwide with pacemakers in 2002, with 600,000 implanted yearly. That means in 2002 .001% of people with pacemakers died. Assuming hardware failure accounted for half of that, then the chances of being killed by a software defect in a pacemaker is extremely small. So, I'd say it's safe to assume that the hardware "works as advertised".

      I remember a joke in a WWII film, a soldier was forced to paradrop. As he was not quite willing to leave the plane, he was assured by his officer than "only one in 20.000 parachutes fail to open", to which he asked "and mine which number is?".

      The question is, if the software fails and kills someone, you cannot say than the software* works as advertised. How many deaths would be necessary for the software to be considered "unfit"?

      Also, you are confusing worldwide data with data from an study whose scope is unknown (USA? An USA state? One city?) Apples and oranges.

      The real point to the question would be deaths by a pacemaker not being enough perfect vs deaths by not having such a pacemaker available (and having to deal with older models or not pacemakers at all).

      *I understand that in your last line you meant software, for your text to make sense.

      --
      Why can't /. have a rich-text editor? Editing your own HTML is so XXth century.
    5. Re:Answering questions from TFA by Anonymous Coward · · Score: 0

      One of the tricks in medical device design, that me and my team have used on many an occasion, is to engineer the hardware in such a way that no matter what the software says, the hardware will not take an action that results in a serious injury or fatality.

      This is often codified in the design process as an FMEA (Failure modes and Effects Analysis) and is a mandatory part of many device design processes that are harmonized with the FDA and other regulatory requirements. So I am not really surprised by that statistic. For software there is an equivalent called the Software Hazard Analysis, that is at a more abstract level than that, and consequently a bit more wishy washy.

  14. Who will do the audit, and how? by bradley13 · · Score: 1

    Numerous questions:

    - Do you suppose the patient actually has someone who can do the audit?

    - Is it realistic to audit the code without understanding the hardware interface? Probably not, so...

    - Are they also going to demand hardware documentation? Free support?

    Really, the source code along is not going to buy them much. I wonder what's really going on here?

    --
    Enjoy life! This is not a dress rehearsal.
    1. Re:Who will do the audit, and how? by hedwards · · Score: 1

      You do realize that there are experts that you can hire, right. I'm not personally an expert in motorcycle crashes, but if I ever have one and need to sue, I'm going to hire an expert that knows a hell of a lot more than I do about that.

    2. Re:Who will do the audit, and how? by Anonymous Coward · · Score: 0

      The real issue is that she (and I) believe that there is a good chance that
      the system can be made more robust with a code review.

      What is really going on here is that an army of pacemaker trolls are weighing
      the value of human life versus the value of source code.

    3. Re:Who will do the audit, and how? by Vairon · · Score: 2

      http://www.youtube.com/watch?v=nFZGpES-St8 OSCON 2011
      http://www.youtube.com/watch?v=5_pRH8lzaQo Freedom: From my heart to the desktop
      http://www.youtube.com/watch?v=GcWlD2Y6HNM OSCON 2010 Free Software on Medical Devices: Unchain My Heart

      Karen Sandler, the lawyer this article is about is also a programmer and has an engineering degree. She works for the GNOME foundation and before that the Software Freedom Law Center...I think she can find a few people who are also programmers to help her as well.

  15. How about no? by Anonymous Coward · · Score: 0

    No is the answer, no one forces her to use the product. If there is alternative, then use the alternative. Invent one, get a group of geeks to support you and invent one for you. It is her choice, sudden death and her family can sue the pacemaker company for millions (lawyer specialty, right?) or just die of natural cause of heart failure.

    Don't argue that there is no alternative, because only handful of vendors produce it. She always has the alternative choice, die as her defect progress. I know it is a horrible burden with a time bomb strap in your chest (believe me, I knew, I had one strapped to my head) If not, come to term, you don't always know and able to control everything. I don't see her demand the entire life span history of her food. If her client demand her to produce her secret dairy before hiring her?

    Yes, this make people hate lawyers, and I hate lawyers, particularly the one in congress, senate and white house. Those are the worse kinds.

    1. Re:How about no? by Anonymous Coward · · Score: 0

      You're under the assumption that her Health Insurance Provider lets her choose.

      They might have a deal, that if the Provider uses ICD they get a "kickback" or "Administration Fee" (whatever terminology is deemed legal)
      If the Patient refuses or decides on another Pacemaker, the Provider decides not to cover the operation under the policy.

  16. wow by unity100 · · Score: 4, Informative

    It is very unlikely that the source code in these devices have any remaining bugs due to the length of time that these devices have been used

    hahahahaahaha ahaahah.

    you spoke like someone who has zero experience in software development.

    1. Re:wow by Anonymous Coward · · Score: 0

      You speak like someone who has zero experience in reliability engineering

      True, time in the field is not everything. But it is a very BIG something.

  17. Fair enough by Anonymous Coward · · Score: 0

    The buyer is entitled to know exactly what he/she is buying.

    Conversely, any buyer is entitled to try the product and/or returning it for a refund if found unsatisfactory. And this should include software, movies and songs.

    After all, we're serious about protecting them by combating piracy (and everything remotely resembling it), then why shouldn't we be serious about protecting the customer as well?

  18. Not even the FDA has audited the code yet by SgtChaireBourne · · Score: 5, Insightful

    If you read the article or ones on the same topic from last year, you'll find that the reason she is making the request is that not even the FDA has audited the code. It's just there.

    Other embedded hardware has been found to be easily crackable and able to deliver fatal doses of medication. Someone has to audit the code, since the FDA is not doing it, Karen is making an issue of it. In these cases, there is no excuse for the code not being 100% open. People's lives hang in the balance.

    --
    Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
    1. Re:Not even the FDA has audited the code yet by green1 · · Score: 2

      I must say I was shocked when I found out that the settings on these things can be modified wirelessly. While it's very convenient for the hospital to be able to make changes without surgery, it's also more than a bit worrysome from a security standpoint...

    2. Re:Not even the FDA has audited the code yet by JoeMerchant · · Score: 1

      there is no excuse for the code not being 100% open. People's lives hang in the balance.

      Security through obscurity has served that industry well for many decades - and it is a VERY good reason to not release the source code.

      Yes, they should use better security methods, but most of them haven't yet.

    3. Re:Not even the FDA has audited the code yet by Darinbob · · Score: 1

      If it's sold in the US then the FDA has audited the code.

    4. Re:Not even the FDA has audited the code yet by evil_aaronm · · Score: 1

      Categorically not true. I was lead developer for over 7 years for a blood chemistry diagnostics tool sold in the US and under FDA regulation. I never once saw an actual FDA auditor nor did I have to produce any code listings for their audits. They wanted to see check-ins and make sure every form was properly signed. Didn't give a whit about the code.

    5. Re:Not even the FDA has audited the code yet by dbIII · · Score: 1

      Yes, I heard about this a bit over a decade ago via a guy in RSA that said the pacemakers were going wireless and the manufacturers were thinking about security.
      There are a lot of useless companies out there but the last time I looked Diebold Election Systems were not working on pacemakers.
      That said, SOME third party should be involved.

  19. Why just software? by trout007 · · Score: 1

    As a mechanical engineer I feel a little insulted. Why does the lawyer want the software code but not all of the design documents?

    --
    I love Jesus, except for his foreign policy.
    1. Re:Why just software? by JoeMerchant · · Score: 1

      As a mechanical engineer I feel a little insulted. Why does the lawyer want the software code but not all of the design documents?

      At least with the software, there's a good chance that it's delivered as specified. Design documents might point out a design flaw, but more likely the mechanical flaws will be in production's execution of the design.

    2. Re:Why just software? by pbhj · · Score: 1

      I'm going to guess that it's something to do with action at a distance. The hardware has shown to be of pretty good quality with low failure rates but the wireless interaction built in makes the user vulnerable to targetted attack in a way in which a hardware defect doesn't. Also that the appropriate health authorities, it seems, don't bother to review code but do look at mechanical and electrical construction.

  20. Special lawyer rights by loufoque · · Score: 4, Insightful

    It she weren't a lawyer, we wouldn't even be speaking about it.

    It's funny how lawyers seem to have extra rights in our society. They can make demands, we cannot.

    1. Re:Special lawyer rights by Opportunist · · Score: 1

      Nonono, lawyers can't make those demands, they just make them, feeling entitled to making them.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Special lawyer rights by PolygamousRanchKid+ · · Score: 1

      It she weren't a lawyer, we wouldn't even be speaking about it.

      Is she weren't no lawyer, she wouldn't be able to afford one to litigate for her . . . or maybe she is litigating for herself . . .

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
    3. Re:Special lawyer rights by Anonymous Coward · · Score: 0

      Perhaps it never crossed your mind that you have the same rights as lawyers.
      It is just easier and cheaper for them to ask in a way that demands an answer.

    4. Re:Special lawyer rights by ffflala · · Score: 1

      It she weren't a lawyer, we wouldn't even be speaking about it. It's funny how lawyers seem to have extra rights in our society. They can make demands, we cannot.

      Here's what your complaint seems to me, restated in car analogy: automobile mechanics often make modifications to their own cars that others cannot. Thus, automobile mechanics seem to have extra rights in our society.

      I don't understand why you'd perceive an attorney's effective advocacy as some fundamental social injustice, rather than a matter of the natural consequences of formal, professional study in an area of specialization. In order to become an effective advocate, she studied for years, and practiced for years beyond that. She's good at it; and almost certainly more effective than people who didn't bother to work towards her goals.

      It is an attorney's job to assert the rights and interests of their clients. Lawyers are generally more educated about how to effectively assert the same rights that nonlawyers have, and are often more informed as to how to effectively pursue any given interest.

      As a lawyer, she probably writes more effectively than most people. Is that also because she has extra rights that others do not?

    5. Re:Special lawyer rights by loufoque · · Score: 1

      You seem to be implying that anyone couldn't do the job of a lawyer. It's not that hard to read publicly available material and go through the clauses to see when the law applies and when it doesn't.

      What she got from her studies is not skill, it's just the right of communicating officially with judiciary instances and being heard and listened to in a tribunal.

  21. It's not surprising a lawyer has a defective heart by trout007 · · Score: 5, Funny

    I thought they had their hearts removed when they passed the bar at the same place that performs MBA lobotomies.

    --
    I love Jesus, except for his foreign policy.
  22. Modern pacemakers have WiFi built in. by Vellmont · · Score: 5, Informative

    The summary is pretty bad, but one of the more salient points is that modern pacemaker/debrillators have Wi-Fi in them. Yes, WiFi. According the the recording, someone at defcon has already managed to hack into an insulin pump equipped with WiFi and been abe to manipulate the delivery rate (which could kill the patient). So the security concerns aren't completely unwarranted.

    Demanding the source code is a bit silly. How many people are really going to be able to review the source code for a pacemaker/debriliator? Very very few. Even if they do, there's a hell of a lot more to a pacemaer/debrillator than the software, so why is it just the software that's her concern?

    A more sane approach would be demanding the software follow basic security rules like not allowing the wi-fi connection to ever change anything in the medical device. (It's supposed to be a reporting mechanism so the doctor can follow the progress of the patient). I can't believe she has anylegal grounds to demand source code, so this is a fight for the minds of the public rather than a legal one. Demanding source code is a bit silly since most of the public doesn't even understand that there is such a thing as source code. The public is by now very aware of security problems and hackers, so ensuring that the wi-fi is read-only would be an easier battle to win.

    --
    AccountKiller
    1. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      According the the recording, someone at defcon has already managed to hack into an insulin pump equipped with WiFi and been abe to manipulate the delivery rate (which could kill the patient). So the security concerns aren't completely unwarranted.

      This is false and was vastly overblown by media all over the internet.(unless it's a different story and you have a source). Someone made a white paper saying "OMG the pump uses RF Signals! Someone could do something with that!"

    2. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      Former Vice-President Dick Cheney has an implantable defibrillator in his chest. I don't know if it's wi-fi capable, but you can sure as hell bet the software of the device was reviewed by someone in the government. If I were to need one, I'd want the model Cheney has.

    3. Re:Modern pacemakers have WiFi built in. by Vellmont · · Score: 1


      Someone made a white paper saying "OMG the pump uses RF Signals! Someone could do something with that!"

      It's a little bit more than that. The lawyer was wrong about the wi-fi, it's a proprietary protocol. But from the abstract the hack was quite a bit more than writing a white paper and mentioning the device uses RF. I found the abstract from Defcon, which reveals some more details:

      Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System

      As a diabetic, I have two devices attached to me at all times; an insulin pump and a continuous glucose monitor. This combination of devices turns me into a Human SCADA system; in fact, much of the hardware used in these devices are also used in Industrial SCADA equipment. I was inspired to attempt to hack these medical devices after a presentation on hardware hacking at DEF CON in 2009. Both of the systems have proprietary wireless communication methods.

      Could their communication methods be reverse engineered? Could a device be created to perform injection attacks? Manipulation of a diabetic's insulin, directly or indirectly, could result in significant health risks and even death. My weapons in the battle: Arduino, Ham Radios, Bus Pirate, Oscilloscope, Soldering Iron, and a hacker's intuition.

      After investing months of spare time and an immense amount of caffeine, I have not accomplished my mission. The journey, however, has been an immeasurable learning experience - from propriety protocols to hardware interfacing-and I will focus on the ups and downs of this project, including the technical issues, the lessons learned, and information discovered, in this presentation "Breaking the Human SCADA System."

      --
      AccountKiller
    4. Re:Modern pacemakers have WiFi built in. by mkremer · · Score: 1

      So you are saying if the doctor needs to make a adjustment to the operation of the device based on the data downloaded from it they should need to preform surgery instead of using the wireless interface?

    5. Re:Modern pacemakers have WiFi built in. by oztiks · · Score: 1

      But the argument can be made for a lot of things, recently Russia hacked a US UAV and was able to land it. Does that mean passengers of commercial airliners can request code audits on the planes because they transmitt RF? Or home wifi's, does that mean buying a wireless modem gives you code access ....

      Closed source intellectual property should be given some protection.

      Maybe my opinion on this is one sided because I sell property code that I've written to customers knowing that if having source access denied me money for over 5 - 7 years or development, research and my own personal sacrifices.

      I believe open source has it's place, it belongs to the academics and people who have the time to do things purely for passion and the love.

      As for pacemakers the software can bug out, the little pump or whatever, motor or any of the little bits within the device could fail. What this person should do is invest in knowing fall over processes, choose a product that hosts a DR approach (keeping in line with the software spirit of things).

      All this screams to me is the arrogance of one person thinking they are better than the professionals at their jobs. She would have to be some down right prodigy to be able to see into the code and make such insightful judgements and then what pose them as valid?

    6. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      The public ought to know there is a thing such as source code, and this request helps in this regard.

      What you have assumed is that the value of this software is worth more than the lives of the people
      who depend on it. It may be difficult for you, but reading software is actually quite easy for many
      people. It is clear that libre software should include the right to assess the risk to your own
      life.

      Besides, what possible harm could come from this? Do you think that the source code somehow makes
      it easier to enter the pacemaker marketplace? Perhaps it makes it easier for competetors to improve
      their software so that even more faults are avoided. The only think troubling about this debate are the
      obvious trolls who are gambling with peoples lives.

      It may never be know how many pacemaker faults could have been avoided with full software reviews.

    7. Re:Modern pacemakers have WiFi built in. by Vellmont · · Score: 1

      No, I'm saying they should use a mode of communication that requires you to be within a few inches of the patients chest, like say the magnetic communication that's been used in pacemaker/defibs for many, many years. If someone puts a weird device up to your chest to hack into your pacemaker/defib, you're going to notice it.

      Doing this via wi-fi from tens of feet away is idiotic and negligent. (I have no idea if this is possible, but I hope to god not).

      --
      AccountKiller
    8. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      Demanding the source code is a bit silly. How many people are really going to be able to review the source code for a pacemaker/debriliator?

      How's the weather in Redmond Ballmer?

    9. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      Without auditing the source code and the hardware, it's impossible to know if the security rules are being properly enforced by the software. Because of this, hackers (white and black hat) make a living.

    10. Re:Modern pacemakers have WiFi built in. by Vellmont · · Score: 1


      What you have assumed is that the value of this software is worth more than the lives of the people
      who depend on it.

      Where do people get such weird, binary ideas? Why do you believe the only way to protect the public is releasing source code, and furthermore that NOT releasing source code is a direct valuation of code vs lives? Isn't possible there's much better ways to ensure these devices are safe? I just don't agree that safety and source release are a zero sum game.


      It may be difficult for you, but reading software is actually quite easy for many
      people.

      You're thinking on too granular of a level. I can read source code. I've done software development for over a decade now. The ability to read source code, and understanding the use case and what constitutes a bug are two entirely different things. I'm sure anyone could find some trivial buffer overflows in source code, but how many are going to be able to understand the critical pieces of code that determine if you need to send the patient a shock or not? Very, very few.


      It may never be know how many pacemaker faults could have been avoided with full software reviews.

      There's an infinity of things that will never be known. There's an infinity of things that if we knew the answers, we could save lives. The resources we have are always finite. So the question is always "which thing do we devote resources to to do the most good?". It's not "we should find out everything we can about everything". Your statement is merely trying to dredge up fear of the unknown, which is already infinite.

      --
      AccountKiller
    11. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      Yeah, it's not Wifi. All CIED's (cardiac implantable electronic devices) utilize wireless communications in the MICS band. And you can't just go war-driving for them: in order to get the device to communicate over MICS, you first have to get a wand within 3" of the device to initiate MICS. And when you're done communicating, which is called interrogating the device, MICS transmission stops.

      So yeah, you could hack it. But you'd have to have physical proximity to the patient to do anything harmful. And since the MICS receivers on the devices have a range of about 10 feet, I'd say its pretty safe.

    12. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      You mean like rfid, which is supposed to be short range, but I've seen physical demonstrations of it working up to 30 feet. Dude read my passport's id, which is supposed to be a short range tag, from 30 feet away. It takes a fairly large antenna for it to work, but handily enough he built it into one of those poster sized signs you see sitting in front of stores at the mall.

    13. Re:Modern pacemakers have WiFi built in. by barry99705 · · Score: 1

      Aww, the above post was mine. Didn't notice I wasn't logged in....

    14. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      > Demanding the source code is a bit silly. How many people are really going to be able to review the source code for a pacemaker/debriliator? Very very few.

      What? That's an absolutely riciculous claim.

    15. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      They should install a plug behind her neck to control it.

    16. Re:Modern pacemakers have WiFi built in. by AK+Marc · · Score: 1

      All this screams to me is the arrogance of one person thinking they are better than the professionals at their jobs. She would have to be some down right prodigy to be able to see into the code and make such insightful judgements and then what pose them as valid?

      So, if you have symptoms of something, do you go see a doctor without ever checking any other resources? If you are diagnosed with something and the treatment itself is life threatening (say, cancer) do you ask questions about the options and details about the treatments? If you would take any responsibility for your own health, then you are the arrogant person you complain about. It's my health, I am responsible for it, even more so than the professionals, even if I'm much less trained. I'd go get a second opinion for things of great importance, and she's asking for no more than that, a second opinion on the device.

    17. Re:Modern pacemakers have WiFi built in. by oztiks · · Score: 1

      Okay, but requesting the code? No, we have and entire industry built on system auditing, data3, dimension data for instance.

      She has absolutely no right to code, it's showing a) lack of industry knowledge b) assuming she knows better than the developers of an FDA approved system.

      If the article read "cyborg lawyer demands a code audit on pacemaker". 10-20k later (far cheaper then court costs) we wouldn't even hold a point of discussion.

    18. Re:Modern pacemakers have WiFi built in. by Anonymous Coward · · Score: 0

      Demanding the source code is a bit silly.

      It is not even a little bit silly. It is an obvious way to get objective review of a dangerous device.

      How many people are really going to be able to review the source code for a pacemaker/debriliator? Very very few.

      So what? Even one is much better than none. Your automatic assumption that the manufacturer will do the right thing is the silly assumption here. I've been behind closed doors like these and the amount amateur nonsense going on hidden from the public is just scary.

  23. Re:It's not surprising a lawyer has a defective he by NevergoldMel · · Score: 4, Insightful

    The MBA lobotomy is a very precise operation, they only remove the parts of the brain that remember to pay taxes and how to truthfully report corp. earnings.

  24. Re:It's not surprising a lawyer has a defective he by newcastlejon · · Score: 3, Insightful

    The MBA lobotomy is a very precise operation, they only remove the parts of the brain that remember to pay taxes and how to truthfully report corp. earnings.

    You forgot empathy.

    --
    If God forks the Universe every time you roll a die, he'd better have a damned good memory.
  25. Secure? by Anonymous Coward · · Score: 0

    Really? Last time I saw anything on a pacemaker, it had no communications interface. That's as secure from intrusion as you can get. You want to stop someone from tinkering with it physically, don't let them cut your chest open.

  26. not so easy to get scrutiny of flying procedures by waterbear · · Score: 1

    Well, if you don't demand that somebody audits their code (for airplanes/airlines) you are pretty stupid.

    Agreed in principle that it's desirable/vital to get that job done. But it's not so easy to achieve in practice, and I think it's not just stupidity (on the part of consumers/customers) that blocks it.

    Some years ago I was a regular flier with a certain airline, and then they flew a couple of my work colleagues into the ground [ :( ]. The circumstances brought their operating procedures into question -- human code, if you will. I quizzed them about the relevant points. They told me to get lost. If it wasn't in the official accident report (which turned out to be a whitewash, btw) then I would not be permitted to know it.

    Needless to say, I never flew with them again, but that's not much good, the other lines might misbehave in a similar way.

    I suspect that maybe there is not as much external scrutiny of these things as some of the posters in this thread optimistically believe or expect.

    -wb-

  27. Sigh... by Anonymous Coward · · Score: 1

    As someone who works in the industry, this is all very silly. If you look at the complication rates and failure mechanisms published by the companies, you'll see that software bugs are not what this woman should worry about. The weak link the system is the wire that connects the device to the heart (the lead). They tend to dislodge from their intended location, and fatigue due to the heart's beating (400 million cycles in ten years). In fact, she's should audit the hospital's sterile procedures. She's more likely to get an infection at the implant site. It's like this: you might want want to audit your iphone's OS before you buy it, but you're more likely to break your phone by dropping it on the ground.

    Even if she wants to hire an expert to review the code, good luck. Each of the three major companies has unique algorithms anyway. You'd have to find a retired or disgruntled former engineer that worked at the company in question. No one else is going to understand whether the device's auto-capture algorithm has been implemented in a reasonable way.

  28. Re:It's not surprising a lawyer has a defective he by paiute · · Score: 5, Funny

    The MBA lobotomy is a very precise operation, they only remove the parts of the brain that remember to pay taxes and how to truthfully report corp. earnings.

    You forgot empathy.

    If you had measurable empathy in the first place, they wouldn't have let you in.

    --
    If Slashdot were chemistry it would look like this:Cadaverine
  29. The source code is no use to her by Anonymous Coward · · Score: 0

    After all, it's gone through a compiler, and it's the compiled code which runs the machine. They should send her a hex-dump of the executable so she can be reassured she's seeing exactly what is running on the pacemaker.

  30. Mutual dependencies often go unrecognized here by jbn-o · · Score: 1

    There are very few Slashdot posters who distinguish freedom from skill, appreciate freedom for its own sake, and acknowledge that real life requires us all to depend on each other as you apparently do. I see many more posters who post arguments based on myths of pulling oneself up by one's bootstraps, not being entitled to anything one isn't forced to need, and not seeing force outside of a loaded weapon aimed at someone.

  31. Somebody gets it by gweihir · · Score: 1

    Seems this lady does understand the issue. Very cool! I bet she will also find people qualified to do a thorough analysis and I hope she manages to publish the results. I expect they will be fascinating and a lot worse than what many people expect. The other thing she should ask for is the documentation for architecture, design and develop, and process.

    I hope she survives her condition for a long time and with good quality of life. And if she succeeds in her quest, this will benefit everybody.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  32. Pacemakers have communications interface by ODBOL · · Score: 1

    The pacemaker that is controlling my heart rate at this moment has two communications interfaces that I know about. One is short-range radio of some sort, and the other is normally connected through a device placed externally within an inch of the device. I have no information about the actual effective range of either interface. I am appalled at the willingness of a number of people, not only this anonymous one, to post speculations with no apparent basis in real observation.

    --
    Mike O'Donnell http://people.cs.uchicago.edu/~odonnell/
  33. My pacemaker appears to have a real-time clock by ODBOL · · Score: 2

    My heart rate is controlled by a pacemaker at this moment. I do not have access to the specifications, so I cannot determine directly whether it contains a real-time clock. But the behavior seems to require one. The pacemaker stores records of its behavior and its sensor readings, and transmits them whenever its short-range radio can reach a satellite/cellular interface. It is extremely likely that a real-time clock in the pacemaker is used to time-stamp the data that are transmitted at unpredictable times hours after they are recorded.

    --
    Mike O'Donnell http://people.cs.uchicago.edu/~odonnell/
    1. Re:My pacemaker appears to have a real-time clock by Opportunist · · Score: 1

      Again, for logging, yes, for operation, no.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:My pacemaker appears to have a real-time clock by itsme1234 · · Score: 2

      You seem to insist with this idea that somehow logging is totally separated and not part of the "operation" when most likely it is. You can probably design a "desktop" system where no matter what you do with the logger you can't affect the system logging (for example put it on another network, another power grid, put some kind of one-way firewall and log over UDP). But here you have very tight constraints and I'm positive that any logging is done using the same CPU, RAM, flash, power supply as what you call "operation". You can of course sandbox to some extent some of the operations if you have enough resources but I somehow doubt this is the case.

    3. Re:My pacemaker appears to have a real-time clock by Opportunist · · Score: 1

      The point is, it MUST NOT stop working if the logging function fails. It may inform you that something is not running right in your pacemaker, but it MUST NOT simply cease to work. Hence I consider such a RTC for logging a non-critical component of the pacemaker's function.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  34. Which license? by unixisc · · Score: 1

    She should put her heart where her mouth is, and add to that that the pacemaker firmware be made available under GPLv3. She can then freely exercise freedom 2 and distribute it so that she can help her neighbors.

    Incidentally, wonder whether she works for the FSF or is related to rms?

  35. So what youre REALLY saying is ... by tomhudson · · Score: 1

    Posting AC from Boeing's 787 plant in Charleston, SC.

    The operators who build these planes are like McDonald's rejects. Idiots everywhere.

    ... that these planes will be the safest in the world, because they will never get off the ground.

    You don't have to be all that intelligent to follow a well-written step-by-step procedure. A procedure designed so that morons can follow it will result in consistent quality - same as the CrapBurger you get in Houston is the same as the CrapBurger you get in Newark (except for the extra toxins from the N.J. air).

    Does the person have the right to ask to see the code? Sure, free world, yadda yadda yadda ... Does the company have to give it to them? Absolutely not.

    Have they ever drunk a Coke? Can they ask Coka-Cola Corp. for the formula? Sure. Will they get it? No - but they could ask PepsiCo, who were able to replicate it during the New Coke fiasco. And Pepsico would probably also say No.

    1. Re:So what youre REALLY saying is ... by AK+Marc · · Score: 1

      Have they ever drunk a Coke? Can they ask Coka-Cola Corp. for the formula? Sure. Will they get it? No

      Yes, they will. They will get the ingredients list. And when problems are found (the formula contains an ingredient not properly labeled by law), someone could sue for the whole process and recipe so that they can evaluate the safety themselves, as Coke has already arguably violated the law to reduce their safety. They may not win, but they'll not get laughed out of court at the first hearing.

    2. Re:So what youre REALLY saying is ... by tomhudson · · Score: 1
      There's no grounds for discovery to produce the list of ingredients of Coke, just like there's no grounds for discovery to produce the software for the pacemaker - they would have to show harm first, or at the very least, a significant chance of harm - as well as a high likelihood that their review of the code would reduce that harm, and she's obviously still alive and kicking, along with a lot of other people, and as other posters have pointed out, this stuff is so customized on a per-manufacturer basis that you'd need a disgruntled ex-employee to review it - along with all the hardware.

      Under those circumstances it smacks of the same "logic" as prior restraint - a no-no.

    3. Re:So what youre REALLY saying is ... by AK+Marc · · Score: 1

      they would have to show harm first, or at the very least, a significant chance of harm -So you are saying is that if you were the judge, you'd deny any such motion. Good thing you aren't a judge. If they did show everything you assert they must, then you are asserting that they would be compelled to provide it. So you agreed with me in the most disagreeable manner possible.

    4. Re:So what youre REALLY saying is ... by tomhudson · · Score: 1

      they would have to show harm first, or at the very least, a significant chance of harm -So you are saying is that if you were the judge, you'd deny any such motion. Good thing you aren't a judge.

      Of course the motion right now should be denied as a matter of law. Since they haven't even met this minimal standard, they haven't a hope in hell. This isn't like, say, the Ford Pinto case. You don't get to go fishing in other people's junk just because you have a fear of "something that might" happen, with nothing to back it up. And then there's the issue of standing - if you haven't been harmed, or can show that you were put at risk, you have no right to bring an action.

      Just like you can't sue Ford over a Ford Fiesta that functions fine because you're afraid because of what happened decades ago with the Pintos.

      So I'd say it's a good thing YOU aren't a judge. These are basic concepts.

      If they did show everything you assert they must, then you are asserting that they would be compelled to provide it. So you agreed with me in the most disagreeable manner possible.

      What you are now arguing is a hypothetical, "... if they show everything you assert they must" - otherwise known as a straw man argument. Of course I'm going to disagree with it. It's insulting to think that I'd fall for that one.

      They haven't shown any harm, or even a likelihood of harm. Now, if you want to argue about a different set of circumstances, that's fine - but that would be for another article, not this one.

      There's also the question of whether divulging the source would actually make it more secure. One of the more moronic chants is "security through obscurity is no security". If you believe that disclosure makes things more secure, then email me your user accounts and passwords.

    5. Re:So what youre REALLY saying is ... by AK+Marc · · Score: 1

      You don't get to go fishing in other people's junk just because you have a fear of "something that might" happen, with nothing to back it up.

      I thought this was the model that has proven wireless vulnerabilities. There's not "just a fear of a might" but a proven fault and she wants to know *how* faulty, not whether it is.

      What you are now arguing is a hypothetical, "... if they show everything you assert they must" - otherwise known as a straw man argument. Of course I'm going to disagree with it. It's insulting to think that I'd fall for that one

      You shouldn't use big words like "straw man" when you don't know what it means. It makes you look stupid for lecturing someone else for not knowing things when you obviously don't know the words you are using.

      And accepting the premises of the "opposition" then addressing the rest of their argument is commonly done. Your ignorance isn't proof of the opposite.

    6. Re:So what youre REALLY saying is ... by tomhudson · · Score: 1

      You don't get to go fishing in other people's junk just because you have a fear of "something that might" happen, with nothing to back it up.

      I thought this was the model that has proven wireless vulnerabilities.

      Try to get a court to agree with that logic - that you have a right to break into or otherwise snoop in OTHER PEOPLE'S stuff. You don't, and they won't. Or you could ask Google how all that wireless password password sniffing went SO well for them ... I'm sure that they'd like to hear your legal theories defending it.

      There's not "just a fear of a might" but a proven fault and she wants to know *how* faulty, not whether it is.

      Until it actually causes a problem, it's not, as you allege, a "proven fault". That someone has to wave a wand 3 inches from her chest to change the settings is a far cry from "ZOMG I BE H4XOR3D". I think she'd notice. Transmitting data (as opposed to changing settings) over wifi is preferable because it is more convenient for the patient - and I'm sure in an emergency, she'd not be knocking it so quickly.

      As for the rest - your argument was a straw man - it wasn't the actual situation at all, but an entirely manufactured one that you attempted to have stand in its place with as little real substance as a Potemkin Village.

      So quick - go call Google and tell them it's okay to sniff passwords and stuff. Better yet, why not submit it as an article for slashdot. Educate us unwashed masses.

    7. Re:So what youre REALLY saying is ... by AK+Marc · · Score: 1

      Try to get a court to agree with that logic

      She did. You are wrong.

  36. Re:It's not surprising a lawyer has a defective he by newcastlejon · · Score: 2

    *facepalm*
    Of course! Curse this properly formed brain of mine.

    --
    If God forks the Universe every time you roll a die, he'd better have a damned good memory.
  37. not sure myself by Anonymous Coward · · Score: 0

    If she doesn't already have the device implanted (no, I'm not going to read the story), then they should not let her get it done.
    If she does already have one, then, it should be removed.

    On a related note, does she have the source-code for the computers in her car? Microwave? What about the elevator controller in her office?

    On the other hand, is she ready to pay for the code review?

  38. What if it's all hardware logic? by Khyber · · Score: 1

    What source code is there if it's all hardware? I don't think it would be that difficult to make a no-software electrical stimulator, we have large ones at the sex shop, making a tiny one shouldn't be any more difficult.

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    1. Re:What if it's all hardware logic? by JoeMerchant · · Score: 1

      What source code is there if it's all hardware? I don't think it would be that difficult to make a no-software electrical stimulator, we have large ones at the sex shop, making a tiny one shouldn't be any more difficult.

      The original pacemakers were all hardware, but it's a lot more convenient to adjust settings when you don't have to cut the patient open and turn a set screw.

      There's not a whole lot of difference between a TENS (transcutaneous electrical neurostimulator) from the sex-shop and an implanted device, well, except for the whole bio-compatible implant case and lead wires, electrodes you can place safely on the surface of a beating heart, batteries that last 7 years, etc.

  39. So much of interventional cardiology is a scam... by Paul+Fernhout · · Score: 1

    According to Dr. Fuhrman: http://www.drfuhrman.com/library/PCI_angioplasty_article.aspx

    Now, she may well need a pacemaker, but she should also look into things like nutritional issues, omega 3s and good fats, vitamin D, and other similar things, if she has not. Links here: http://www.changemakers.com/discussions/discussion-493#comment-38823

    --
    A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
  40. I saw her talk by Anonymous Coward · · Score: 5, Informative

    Last year at OSCON. Sadly the line was too long for me to shake her hand and say thanks for starting this.

    There's a few points I'd like to add, many already covered.

    1) She's qualified to do this. Not to review the software. But she has plenty of good colleagues for that.

    She's a director of GNOME (I know, I know...), former GC of the SFLC, an attorney... and ... from listening to her talk, she either genuinely gets software -- or someone that did wrote her whole speech for her.

    2) This is a real, not a hypothetical problem.

    People commenting without RTFA need to understand--These devices are 802.11 enabled. Remote exploits /have/ been demonstrated.

    This is not a wholly uncommon situation -- one of my coworkers has a daughter with a computerized glucose pump that has also had remote compromise demonstrated.

    And even a trivial interest in breathatlizers reveals there has been...myriad incidences of these devices not just being a total failure of design, but having rollover and similar bugs in their implementations.

    3) People may be correct that it would be hard to get people to understand the code. That is wholly irrelevant and a false front of an argument. I don't care what your medical experience is in your industry or company. What your experience with regulators or lawsuits are. There's companies that commit fraud, lie, cheat, steal. They exist. This is indisputable. There's places where MBA's and biologists that can barely write a hello world by themselves compose pointer arithmetic, hit compile, hit test, and go home at the end of the day. I've worked at places like that on applications that could kill if they failed. It is why I do not as of two years ago.

    I presently work with a woman that could not compose a CSV in a basic ETL from another filetype without help. She has the language being used using on her resume. Her workflow involved copy/paste off of the internet, and then changing one line at a time, saving it as file.### and trying to run it. If it didn't crash, she'd examine the output and try to put in what she thought would fix it. If it did, she'd try to find the error. When I offered a hand, she was currently at over her 500th revision.

    So let me be damend clear -- even an unqualified person can do a basic code review just by running a fucking linter on it and looking at the warnings. Because if it generates one or a million -- that says something about the quality right there.

    Why? Because unless you're in a business whose core business *IS* software, my personal experience is that 80% plus of the developers have never heard of one, and 95% don't know how to use it if they have. And that is why my code has less bugs than my colleagues.

    Now -- even if my experiences are anecdotal, and "invalid" -- I've just proven the existence of the problem.

    This is her life we're talking about. Her life entrusted to a piece of cybernetics that has had a demonstrated remote exploit.

    Please /., have a little bit of humanity for once. This isn't about corporate profits, NDAs, lawsuits. This is about someone asking to read something to make an informed choice about their continued existence.

  41. The only perfect (flawless) device is... by gravel+junkie · · Score: 1

    The only perfect (flawless) device is...the one you don't make (manufacture).

  42. There is no security by obscurity... by Anonymous Coward · · Score: 0

    ... to paraphrase Bruce Schneier, one of the most respected experts in the computer security field in the world.

    I am a professional software engineer, member of the IEEE, director of an IEEE affiliate organization, and Senior Systems Engineer for one of the largest electronics corporations in the world, and have 30+ years in embedded systems engineering. I KNOW how badly the software for a lot of these embedded systems are designed and written. If the company in question was confident in the quality of their code, then they would not have a problem allowing a customer of a life-critical device, or a knowledgeable representative for her, to perform a code review. If, on the other hand, they have their own concerns for that, then they would act as this company is doing. Ergo, they have a lot to hide! In my case, if I had to have a pacemaker or other such device implanted in my body, I would insist that I be able to review not only the software design, but the hardware design, and I would want to look at their design documents (circuit diagrams, software UML diagrams, etc) as well. If they wouldn't, or couldn't, do that, then I would indeed look for another supplier who will!

    1. Re:There is no security by obscurity... by tsa · · Score: 1

      Bullshit. If you need one you only have one thing on your mind: staying alive. I know because I have one and I've been there. All this talk about checking the source code etc. is easy to say when you're healthy. And do you really think the people who work for pacemaker companies are completely incapable of doing anything right? If they were they would be out of business in no time.

      --

      -- Cheers!

    2. Re:There is no security by obscurity... by javanree · · Score: 1

      And of course, in need of such a pacemaker you'd have all the time in the world to first review all that data, then request additional information in area's where the design isn't clear enough for you. Then.... PEEEEEEEEEEEEEEEEEEEEEEEP (flatliner) oops, too late.No need for further reviews, just a coffin will do.

      She's a lawyer, she should know ALL about delaying tactics. Guess what the manufacturer(s) will do.... If I were here I'd get over it and just get one, maybe argue about it later IF things go wrong. And if not send the manufacturer a nice 'thanks for keeping me alive' note instead of bitchin'

  43. wireless cant be remotely activated by Anonymous Coward · · Score: 0

    The wireless interface can not be activated remotely but only through the coil induction communication interface. In other words you must place the programmer "head" over the device, interigate the device and then activate "wireless" . There is no possibility of someone remote controlling your heart! Then after a few minutes wireless turns off and has to be reactivated.

  44. The Personal Split by Flipstylee · · Score: 1

    I was on the fence for a while here, alot of good points as usual,
    But the split here, for me, is when this piece of hardware
    and software become a part of my body. Permanent or not.

    I'd much rather have a man try to hack to my heart the hard way,
    my odds are better, and in a separate vein entirely, what ever
    happened to good old peer review?
    Are these "trade secrets" THAT important?

  45. OK Beavis. by HornWumpus · · Score: 1

    I'll never use the following variable names again: assumedValue, GunButterRatio etc etc.

    Also there is no such thing as a 'final product'. There is always a ToDo. It belongs in bug tracking _and_ source.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  46. Coke is Caramel by Anonymous Coward · · Score: 0

    Today’s Coke is darkened with caramel color.

    Caramel color is produced by a reaction of sugars with ammonia and sulfites under high pressure and temperatures to create 2-methylimidazole and 4-methylimidazole.

    Mmmm. Yummy. Personally, I'm a fan.

  47. Mod parent up by tengu1sd · · Score: 1

    Mod parent up. Once a medical device or application has passed FDA review and has a golden ticket, the vendor will plant their feet and avoid any changes. The bottom line drives this, it costs them to get FDA review and if they have an approved product, there's no reason to rock the boat.

  48. I Have One by Anonymous Coward · · Score: 0

    I am a 25 year old C coder. I was born with Tetralogy of Fallot's and developed a cardiac block, and I currently have a Medtronic pacer implanted to stop sudden death from bad rhythms.

    When your life utterly depends on something you do get a different view on things - and yes, I would like to read the source for the device. Ultimately, a life is at stake, and really as many eyeballs as possible would be the best. From a personal, and objective poiint of view, I feel any other approach puts profit over life (and being in the UK under social medicine that doesn't seat well with me).

    It's interesting this lawyer chose to do this, and I think I shall get in support to wish encouragement.

  49. Re:So much of interventional cardiology is a scam. by Anonymous Coward · · Score: 0

    Isn't Dr. Fuhrman a family doctor and not a cardiologist? That page you linked to even has a disclaimer that it's only for informational and education purposes only and that you should consult a doctor first.

    I tend to distrust websites like drfuhrman.com which in my opinion seem more oriented towards selling books, audio books, membership plans or a set of DVDs than providing me health information.

    Imagine if Slashdot had an article about how awesome a new model of wireless router was and then on the side of that page Slashdot was trying to sell you that very same router. Wouldn't you be just a little bit skeptical?

  50. And speaking of straw-man arguments ... by tomhudson · · Score: 1
    When this lawyer argues about how she needs to see the code because of "the possibility of the company going bankrupt and the software not being maintained", that's another straw man.

    First, there is no indication that the company is in financial trouble, so this is totally bogus on its' face.

    Second, if it were to go bankrupt, the debts would be shed in a Chapter 11 filing, and the company would be more, not less, able to continue to support the code. Alternatively, the company gets acquired (minus the debts) by another company, since it is producing a product of high value, high utility, and an inelastic market demand. It's not like we're talking about an abandonware game here.

    Studies show a high percentage of people with pacemakers have brain damage. This lawyer looks to be one of them, or a con artist using this as a revenue and publicity generator.

    1. Re:And speaking of straw-man arguments ... by AK+Marc · · Score: 1

      First, there is no indication that the company is in financial trouble, so this is totally bogus on its' face.

      Ahh, how cute. You almost used "its" correctly this time. Maybe next time.

      Studies show a high percentage of people with pacemakers have brain damage.

      Likely because there's no such thing as a safe surgery, and so people would have had a heart attack or worse before getting one, and a heart attack could be the better correlation, as interrupted blood flow causes problems.

      This lawyer looks to be one of them, or a con artist using this as a revenue and publicity generator.

      I don't doubt that, but you are asserting that you know the law better than a lawyer. I'm sure you are better at everything than everyone else on the planet, but sometimes others might just call you on it. And you see such caution as a fault, when everyone else sees it as justified.

    2. Re:And speaking of straw-man arguments ... by tomhudson · · Score: 1

      Aw lookie lookie, wanna-be troll can't cut it. News at 11.

      You;re going to have to do WAY better. All your attempts to draw attention away from the fact that you're wrong by swapping the actual situation for one that doesn't exist (we call that "lying" up here) are lame.

      As for the law, if you want to win, you need an actual case with actual facts. Not the hypothetical case that she is presenting with bogus "facts" that not only haven't been proven, but don't exist.

      The "what if the company goes bankrupt scenario" is one such example that only someone with no case hoping to get some publicity would pull, and if I were the manufacturer, since she's made those statements outside a courtroom, I'd sue for slander.

      Besides, you have yet to prove that opening the code will make it more secure, when history shows the opposite. Take Windows, for example - most of the malware today came after Microsoft source was stolen from a server. BTW - when are you going to "improve your security" by "open-sourcing" your passwords?

    3. Re:And speaking of straw-man arguments ... by AK+Marc · · Score: 1

      You are asserting that the lawyer is wrong about the law, and the judge is wrong about the law and we should trust some random jackass on the Internet that every legal professional involved is wrong and you are the one and only one person on the planet that knows the truth. You should file a Amicus curiae to inform everyone. Short of that, I'll trust the legal opinions to the legal experts (not you). You asserted the case has no merits. That's false, as it wasn't dismissed on the first hearing. That proves you wrong on every point. Any discussion of more detail about the case is lost by your assertions that you are right and everyone else is wrong, and your inability to even conceive a reality where the court would disagree with you (as they already have).

  51. Re:So much of interventional cardiology is a scam. by cowboy76Spain · · Score: 1

    If I was her, I would follow my doctor advice (with second opinons of course) than a comment of /.

    Just saying...

    --
    Why can't /. have a rich-text editor? Editing your own HTML is so XXth century.
  52. open source by MidGe · · Score: 1

    The manufacturer has the right not to give access to the code. The patient has the right to refuse that particular offering.

    Having said that, I think the manufacturer is an a*hole for not allowing it. I hope there are alternatives.

    I suggest that for that type of device the manufacturer ought to open the source code. Opening the source code does not mean distributing it freely. It would be very easy for them to identify "plagiarism" and sue any company doing so.

    I, for one, would be much, much more comfortable with code able to be reviewed and my bet would be that bugs would be found. I would nearly stake my life on it.

    The expertise of the patient is irrelevant, there are many experts out there that would love to demonstrate their skills and gain the kudos associated with improving a marvelous invention.

    1. Re:open source by funky_vibes · · Score: 1

      That's just a modern definition of snake oil.
      If you don't show us your ingredients, so we can know whether it works or can kill you, it should be punishable by law to sell.

  53. Silly suggestion by dbIII · · Score: 1

    like not allowing the wi-fi connection to ever change anything in the medical device

    Sorry kid, but you are writing about the interface which was added to allow changes to be made in the first place without having wires sticking out of the patient. To make things more clear the wireless access is there by design so that things can be changed in the medical device. I don't know much about the security other than RSA being involved with at least one pacemaker over ten years ago. I believe that made decent security a desirable sales bullet point if nothing else so it's likely all the competition followed.

  54. Access to implantable medical devices for research by Anonymous Coward · · Score: 0

    Folks with legit ideas for research to improve the security of implantable medical devices should peruse the Open Medical Device Research Library. They loan/accept explanted medical devices for research. Why hypothesize and do armchair engineering when you could work with the real thing? http://omdrl.org/

  55. Re:not so easy to get scrutiny of flying procedure by rtfa-troll · · Score: 1

    Do me a favour if you will/can. Please name the airline and give a link to the accident report.

    Generally I agree with your point; many people try to hide wherever they can; customers may not be able to get what they demand; but that doesn't mean that customers shouldn't make the demand in the first place.

    --
    =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
  56. no bugs by flok · · Score: 1

    It is very unlikely that the source code in these devices have any remaining bugs due to the length of time that these devices have been used. My chess program played over 100.000 games in 6 years. Yesterday I found a bug in the en passant code.

    --

    www.vanheusden.com - home of Multitail, HTTPing, CoffeeSaint, EntropyBroker, rsstail, bsod, listener, nagcon, nagi
  57. Re:So much of interventional cardiology is a scam. by Paul+Fernhout · · Score: 1

    "Low vitamin D linked to heart disease, death"
    http://www.reuters.com/article/2011/11/26/us-vitamind-heartdisease-idUSTRE7AO1UM20111126
    ""We expected to see that there was a relationship between heart disease and vitamin D deficiency; we were surprised at how strong it was," Dr. James L. Vacek, a professor of cardiology at the University of Kansas Hospital and Medical Center, told Reuters Health. "It was so much more profound than we expected." ... After taking into account the patients' medical history, medications and other factors, the cardiologists found that people with deficient levels of vitamin D were more than twice as likely to have diabetes, 40 percent more likely to have high blood pressure and about 30 percent more likely to suffer from cardiomyopathy -- a diseased heart muscle -- as people without D deficiency."

    http://www.livestrong.com/article/440011-can-low-potassium-cause-an-irregular-heartbeat/
    "A potassium deficiency, or hypokalemia, is an electrolyte imbalance that may cause heart arrhythmias. ... Reviewing your dietary intake may reveal a potassium deficiency. Foods that contain high concentrations of potassium include all meats, fruits, vegetables, legumes and dairy products. High-sodium foods that lower potassium stores include processed, prepackaged foods such as soups, prepared pizza, Mexican food, frozen meals, sodas, potato chips and restaurant meals. ..."

    http://www4.dr-rath-foundation.org/NHC/irregular_heartbeat/cellular_solutions.htm
    "Conventional medicine has invented its own diagnostic term to cover the fact that it does not know the origin of most arrhythmias. âoeParoxysmal arrhythmiaâ means nothing other than âoecauses unknown.â As a direct consequence, the therapeutic options of conventional medicine are confined to treating the symptoms of irregular heartbeat. Beta-blockers, calcium antagonists and other anti-arrhythmic drugs are given to patients in the hope that they will decrease the incidence of irregular heartbeat.
    However, the most frequent known side effect of these drugs is an increased risk for new arrhythmias! Slow forms of arrhythmias with long pauses between heartbeats are dealt with by implanting a pacemaker. In other cases, heart muscle tissue that creates or conducts uncoordinated electrical impulses is cauterized (burned) and eliminated as a focus of the electrical disturbance in the heart muscle. Without an understanding of the primary cause of irregular heartbeat, the therapeutic approaches by conventional medicine are not specific and frequently fail.
    Modern Cellular Medicine now provides the breakthrough in our understanding of the causes, prevention and adjunct treatnent of irregular heartbeat. The most frequent cause of irregular heartbeat is a chronic deficiency of vitamins and other essential nutrients in millions of âoeelectricalâ heart muscle cells that generate and conduct the electrical impulse responsible for a normal heartbeat. Long-term deficiencies of essential nutrients in these cells cause or aggravate disturbances in the creation or conduction of the electrical impulses and trigger arrhythmias. The primary method for preventing and correcting irregular heartbeat is an optimum supply of specific vitamins and other cellular nutrients.
    Scientific research and clinical studies have already documented the value of magnesium, carnitine, coenzyme Q-10 and other important components of my Cellular Health recommendations in helping to normalize different forms of irregular heartbeat and improve the quality of life for patients.
    A Double-Blind Placebo-Controlled Clinical Study Confirms Vitamins and

    --
    A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
  58. Re:So much of interventional cardiology is a scam. by Paul+Fernhout · · Score: 1

    AC wrote: "Isn't Dr. Fuhrman a family doctor and not a cardiologist? That page you linked to even has a disclaimer that it's only for informational and education purposes only and that you should consult a doctor first. I tend to distrust websites like drfuhrman.com which in my opinion seem more oriented towards selling books, audio books, membership plans or a set of DVDs than providing me health information. Imagine if Slashdot had an article about how awesome a new model of wireless router was and then on the side of that page Slashdot was trying to sell you that very same router. Wouldn't you be just a little bit skeptical?"

    I actually agree with disliking Dr. Fuhrman's site for the commercial slant. You are right to be skeptical. That said, he generally knows what he is talking about and has done a lot of people a world of good (including me).

    A deeper problem is all the conflicts of interest in medicine. To extend your router example, would you trust a cardiologist who says you need a heart operation, when he or she is the one who is going to make $10K from performing it? Would you even trust a second opinion from another cardiologist who also makes $10K from such operations? (Or whatever the amount is the cardiologist gets out of the $50K to $250K total costs.)

    As another parallel, if you go to a new car salesman and ask, do I need a new car, mine is three years old, what do you expect to hear? If you go to another one down the road, do you expect to hear anything different?

    Please also see my other reply in this thread about other (Non-Dr.Fuhrman) links between nutrition and vitaimin D and heart disease.

    By the way, I want to take a moment to add that I agree with the lawyer that the software of medical devices should be open to examination, at the very least by those who receive it. A broader generalization on that theme:
    http://www.pdfernhout.net/on-funding-digital-public-works.html

    Thanks for the skeptical comment. I hope you direct that same amount of skepticism to the medical profession, for reason I outline here, including this quote by Marcia Angell
    http://www.pdfernhout.net/to-james-randi-on-skepticism-about-mainstream-science.html#Some_quotes_on_social_problems_in_science
    "The problems I've discussed are not limited to psychiatry, although they reach their most florid form there. Similar conflicts of interest and biases exist in virtually every field of medicine, particularly those that rely heavily on drugs or devices. It is simply no longer possible to believe much of the clinical research that is published, or to rely on the judgment of trusted physicians or authoritative medical guidelines. I take no pleasure in this conclusion, which I reached slowly and reluctantly over my two decades as an editor of The New England Journal of Medicine."

    For what it is worth, I've had two relative (a sister and a father) die soon within a year or so of major heart operations, including getting a pacemaker etc.. :-( I wish I knew then what I know now, thanks to Dr. Fuhrman and many other conscientious and skeptical and inquiring people like him.

    --
    A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
  59. scumbags can wreak havoc anywhere by Anonymous Coward · · Score: 0

    this guy, a professor in University of Washington hacked a defibrillator to deliver deadly electrical jolts ...

    source: http://www.cs.washington.edu/homes/yoshi/