3 ms·

If the certification disallowed extra garbage that would do it without a gun. > It's easy to sit back and cast judgement when you don't deal with that industry

by sqeaky 9y ago

If the certification disallowed extra garbage that would do it without a gun. > It's easy to sit back and cast judgement when you don't deal with that industry I work making special purpose appliances right now, well maybe not right this second, clearly I am posting on HN, but I am at my desk where I should be writing software for one of these appliances. I am only describing exactly what my team is doing. We have a certification process too. I know exactly how painful it is. Bitching about the current and acting like it is immutable law won't fix it. Deciding on what "fixed" looks like then trying to change conditions to get there is one possible way to fix it. There are surely others but throwing our hands up and giving while making excuses isn't one of them.

tw04 9y ago
>If the certification disallowed extra garbage that would do it without a gun. So someone who has a device in them and lives for another 30 years is forced to undergo surgery in order to update to a newer version? And you SERIOUSLY think that's going to fly? I guess we can just agree to disagree.
- sqeaky 9y ago
  We were talking about hospital infrastructure (but your example is worth discusing), I was not advocating re-certifying already deployed implants. Things like the software that runs MRI machines or stores medical records is buggy bloated crapware for the most part, and generally in need of whole replacement to stand a chance of resistant an actual attack. But your notion of how implants work is interesting. At present pacemaker batteries need to be replaced every 5 years (sometimes sooner if they stop responding by radio). Most pacemakers are only certified for 2 battery replacements. The situation you describe is actually much better than reality right now. Did you know there is a count of people who die to pacemaker bugs each year? Did you know that most pacemaker recipients have no right to see the software or pay to have an expert review the software in their pacemaker? I don't know what you think is going on in medicine now, but there is much that is deeply fucked up with it. Also your point is pretty ridiculous when you consider two points. We can do some updates to implants wirelessly and without surgery. Then consider that when regulations change there is often a subset of things that are grandfathered in from the old rules. There are still cars driving around with no seat belts and it is legal (in most places) because they were manufactured before seatbelt laws and maintained.

by sqeaky 9y ago

tw04 9y ago

>If the certification disallowed extra garbage that would do it without a gun. So someone who has a device in them and lives for another 30 years is forced to undergo surgery in order to update to a newer version? And you SERIOUSLY think that's going to fly? I guess we can just agree to disagree.

sqeaky 9y ago
We were talking about hospital infrastructure (but your example is worth discusing), I was not advocating re-certifying already deployed implants. Things like the software that runs MRI machines or stores medical records is buggy bloated crapware for the most part, and generally in need of whole replacement to stand a chance of resistant an actual attack. But your notion of how implants work is interesting. At present pacemaker batteries need to be replaced every 5 years (sometimes sooner if they stop responding by radio). Most pacemakers are only certified for 2 battery replacements. The situation you describe is actually much better than reality right now. Did you know there is a count of people who die to pacemaker bugs each year? Did you know that most pacemaker recipients have no right to see the software or pay to have an expert review the software in their pacemaker? I don't know what you think is going on in medicine now, but there is much that is deeply fucked up with it. Also your point is pretty ridiculous when you consider two points. We can do some updates to implants wirelessly and without surgery. Then consider that when regulations change there is often a subset of things that are grandfathered in from the old rules. There are still cars driving around with no seat belts and it is legal (in most places) because they were manufactured before seatbelt laws and maintained.