> The use of radio was a feature specifically to allow updating and management of the pacemakers while avoiding the serious risks of surgery. In other words,

> The use of radio was a feature specifically to allow updating and management of the pacemakers while avoiding the serious risks of surgery. In other words, it's a ready-made vector for potential attacks, as long as an attacker can get close to a pacemaker with a radio. You could probably even put a powerful device near a hospital and pick up random people coming and going. > Or do you want to let the community at least _attempt_ to find the bugs first? The promise of open-source security has always been that you let many eyes look for problems, then you patch ahead of potential attackers. Logistically, that's extremely problematic for embedded devices. Every time a vulnerability is found, you ask the patient to go back to the doctor to get it updated? That doesn't scale at all. The idea that device manufacturers will change their entire engineering and security philosophy is somewhere between idealistic and naive. I sincerely hope it's the former and not the latter.