37 ms·

This situation is even funnier(and sadly very seriously flawed) in Japan. Medical equipment require an authorization to use. Any change to the medical equipmen

by ezoe 10y ago

This situation is even funnier(and sadly very seriously flawed) in Japan. Medical equipment require an authorization to use. Any change to the medical equipment requires another authorization or it's prohibited. By "any change" , it includes Windows Update(it changes the system obviously). The result: they use anti-malware software to protect(or rather, believed to protect) unpatched Windows. At least one anti-malware software company(Trend Micro), marketing that their software can protect the medical equipment in such situation.

exhilaration 10y ago
But... what about AV/malware definition updates? Doesn't that fall under "any change"?
- symtos 10y ago
  and what about security updates to the snakeoil they sell, eg. https://bugs.chromium.org/p/project-zero/issues/detail?id=693 https://bugs.chromium.org/p/project-zero/issues/detail?id=69...
Blackthorn 10y ago
> Any change to the medical equipment requires another authorization or it's prohibited. Honestly, this isn't a bad decision. If the device was tested and certified with specific software, a software upgrade is not guaranteed to not cause a problem.
- symtos 10y ago
  using software with known problems in order to avoid potential problems from an upgrade does not seem like a non-bad decision
  - Blackthorn 10y ago
    Is the medical device working right now? Yes. Could, upon upgrading, the device stop working, possibly in a subtle way that might kill somebody? Yes. The approval process for medical devices is rightfully difficult. Software upgrades, even if they seem trivial, should not be a backdoor process of bypassing testing and approval.
    - symtos 10y ago
      ...and could software deployed to the device by some random who just exploited some well-known security flaw that never got patched, kill people?
      - Blackthorn 10y ago
        This whole discussion has been about stuff air-gapped. That's not a guarantee when you have USB ports, but it does help.

by ezoe 10y ago

exhilaration 10y ago

But... what about AV/malware definition updates? Doesn't that fall under "any change"?

symtos 10y ago
and what about security updates to the snakeoil they sell, eg. https://bugs.chromium.org/p/project-zero/issues/detail?id=693 https://bugs.chromium.org/p/project-zero/issues/detail?id=69...

Blackthorn 10y ago

> Any change to the medical equipment requires another authorization or it's prohibited. Honestly, this isn't a bad decision. If the device was tested and certified with specific software, a software upgrade is not guaranteed to not cause a problem.

symtos 10y ago
using software with known problems in order to avoid potential problems from an upgrade does not seem like a non-bad decision
- Blackthorn 10y ago
  Is the medical device working right now? Yes. Could, upon upgrading, the device stop working, possibly in a subtle way that might kill somebody? Yes. The approval process for medical devices is rightfully difficult. Software upgrades, even if they seem trivial, should not be a backdoor process of bypassing testing and approval.
  - symtos 10y ago
    ...and could software deployed to the device by some random who just exploited some well-known security flaw that never got patched, kill people?
    - Blackthorn 10y ago
      This whole discussion has been about stuff air-gapped. That's not a guarantee when you have USB ports, but it does help.