6 ms·

Absolutely. It's the only way that large institutions will come to properly value the security trade-offs of their decision to buy closed-source, proprietary s

Absolutely. It's the only way that large institutions will come to properly value the security trade-offs of their decision to buy closed-source, proprietary systems. Why should the VA get to externalize part of their purchasing decision on to Microsoft?

ch4s3 9y ago
What do you want health systems to do here? They can only buy FDA approved devices. If there aren't any that run linux that are approved, then they can't buy or use them. Want to change that? Go write a bunch of drivers and DICOM related software for CentOS, then start a device company, then build a device, then wait 10 years for it to get approved, then sell it. And while you're doing all of that, remember to stay ahead of the competition and not run out of cash. These devices run embedded Windows because they all always have. There's almost no competitive advantage in changing OS vendors in the space, because it doesn't differentiate the product. Even if a device ran CentOS or whatever, you wouldn't be able to update it significantly without going back to the FDA.
- SomeStupidPoint 9y ago
  > What do you want health systems to do here? Lobby to change the market instead of externalizing costs; pool money to change the market instead of externalizing costs; etc. I'm sick of people defending poor long-term decisions by saying they're short-term efficient. The providers aren't helpless entities these things are just happening to: they chose to go down a route that was expensive long-term, but cheap short-term and now are asking to not have to face the consequences of that. I can guarantee that every single institution facing this concern received a technical report pointing out exactly this issue -- and chose to ignore it so a manager could have a bigger bonus. Instead of addressing the problem, they're asking to be let off the hook of their poor decision making and laying the groundwork for the same mistake. Continually bailing out such poor decision making isn't prudent. Why would they ever change if there's no consequence? This isn't a long-term strategy we can afford to support, so we're obligated to let it blow up in their face.
  - ch4s3 9y ago
    > pool money to change the market instead of externalizing costs You're going to need to clarify what you mean by that. >I'm sick of people defending poor long-term decisions by saying they're short-term efficient I'm not defending poor long term decisions, I'm simply describing the reality of a complex set of intersecting political and business systems. Sure, maybe it would be good to lobby the FDA to change rules about updating embedded software, but what should the new rules look like? How do you make sure new linux drivers for an x-ray machine won't have a buffer overflow or off by 1 error that kills people? It has happened. I'm not even sure that Linux is definitively the right answer for embedded operating systems for safety critical systems. Do you have any evidence to support that claim, which you seem to be making? I'll be happily persuaded if you can clarify why open source is intrinsically better for long lived embedded systems like this.

ch4s3 9y ago

What do you want health systems to do here? They can only buy FDA approved devices. If there aren't any that run linux that are approved, then they can't buy or use them. Want to change that? Go write a bunch of drivers and DICOM related software for CentOS, then start a device company, then build a device, then wait 10 years for it to get approved, then sell it. And while you're doing all of that, remember to stay ahead of the competition and not run out of cash. These devices run embedded Windows because they all always have. There's almost no competitive advantage in changing OS vendors in the space, because it doesn't differentiate the product. Even if a device ran CentOS or whatever, you wouldn't be able to update it significantly without going back to the FDA.

SomeStupidPoint 9y ago
> What do you want health systems to do here? Lobby to change the market instead of externalizing costs; pool money to change the market instead of externalizing costs; etc. I'm sick of people defending poor long-term decisions by saying they're short-term efficient. The providers aren't helpless entities these things are just happening to: they chose to go down a route that was expensive long-term, but cheap short-term and now are asking to not have to face the consequences of that. I can guarantee that every single institution facing this concern received a technical report pointing out exactly this issue -- and chose to ignore it so a manager could have a bigger bonus. Instead of addressing the problem, they're asking to be let off the hook of their poor decision making and laying the groundwork for the same mistake. Continually bailing out such poor decision making isn't prudent. Why would they ever change if there's no consequence? This isn't a long-term strategy we can afford to support, so we're obligated to let it blow up in their face.
- ch4s3 9y ago
  > pool money to change the market instead of externalizing costs You're going to need to clarify what you mean by that. >I'm sick of people defending poor long-term decisions by saying they're short-term efficient I'm not defending poor long term decisions, I'm simply describing the reality of a complex set of intersecting political and business systems. Sure, maybe it would be good to lobby the FDA to change rules about updating embedded software, but what should the new rules look like? How do you make sure new linux drivers for an x-ray machine won't have a buffer overflow or off by 1 error that kills people? It has happened. I'm not even sure that Linux is definitively the right answer for embedded operating systems for safety critical systems. Do you have any evidence to support that claim, which you seem to be making? I'll be happily persuaded if you can clarify why open source is intrinsically better for long lived embedded systems like this.