20 ms·
The article, strangely, leaves out the name of the project it's reporting on. It's OpenAPS, http://openaps.readthedocs.io/en/latest/ http://openaps.readthedocs.
by jimrandomh 8y ago
The article, strangely, leaves out the name of the project it's reporting on. It's OpenAPS, http://openaps.readthedocs.io/en/latest/ http://openaps.readthedocs.io/en/latest/ . I use it and have worked on the code. It's a massive health and quality of life improvement over anything that exists which is FDA approved. The core problem is that the FDA-approved devices are optimized not for getting the best result, but for ensuring the manufacturer can't be blamed if something goes wrong. But that in practice means kicking most of the important things to the end user and their physician, who can't do nearly as good a job as software can.
- jonodubs 8y agoit's the FDA's job to keep the public safe, hence all the regulation and paperwork a medical company has to go through before releasing a product. If people want to hack their own health and be their own guinea pigs then that's fine- it's actually easier for the manufacturers.
- femto 8y agoFrom the docs: "One of the most frequently asked questions is “I have a 723 pump but it has version 2.5B software version. Has anyone figured out a way to make newer model Medronic pumps compatible? Like flash older version of software onto my 723 2.5B pump?” The answer is “No. The ability to downgrade software versions in the pumps does not exist. It has been investigated and nobody has made any successful progress to that end.”" I'm curious as to what form the investigation took. Are you aware of an online record of this investigation? Are compatible pumps rare enough that the need to preserve them is constraining reverse engineering efforts? --- Edit: For those wondering what these things look like, here is the FCC submission including internal photos. FCC is involved because of the integrated wireless link. https://fccid.io/OH21510 https://fccid.io/OH21510 https://fccid.io/OH21510/Internal-Photos/Internal-Photos-2399025 https://fccid.io/OH21510/Internal-Photos/Internal-Photos-239... Looks like a System-on-a-Chip with separate memory chips? Can't make out the numbers. Opening in GIMP, it looks as if the photo has been doctored to remove chip numbers? That 12-pin unpopulated footprint on the processor board is for a test/JTAG header?
- oh_sigh 8y agoSomeone should issue a challenge to hotz et al. My guess is that this the intersection between diabetics and reverse engineering hackers is only a very small number of people, so this kind of device or impact it could have on people might not even be generally known in the community
- sdmike1 8y agoAs a "reverse engineering hacker" who is a diabetic with one of these pumps (The 670G to be specific) I have black boxed the shit out of it, but because it is doing a good job of keeping me alive and the cost of a new one is high I have yet to disassemble it and do a thorough RE of it. In ~4 years when the warranty is up an insurance is willing to replace it then I will be disassembling it and hacking the shit out of it.
- femto 8y agoWhat happens to all the pumps that break? Chances are that the mechanics break before the electrics, so there will be a bunch of broken pumps with intact electronics somewhere in the wild. Can they be had as freebies for reverse engineering? Many would get returned to Medtronic under warranty, but there would be exceptions?
- sdmike1 8y agoI had one mechanically fail this summer and my options were turn it in or pay $3,600 and as much as I want to RE it I don't want to spend $3,600 on it. So far medtronic is doing a very good job of limiting the secondhand market on these. I do make regular ebay crawls looking for them through. so far nothing has really turned up :(
- LeonM 8y agoJudging by the PCB photo's, that device is much more complitcated than I'd expected. Anyway, I would love to help the community with some reverse engineering.
- 8y ago
- seehafer 8y ago> The core problem is that the FDA-approved devices are optimized not for getting the best result, but for ensuring the manufacturer can't be blamed if something goes wrong No, they're optimized for reducing risk as much as possible. The amount of scrutiny on a commercial product from a Fortune 200 company is about 2 orders of magnitude more than any DIY project would ever get.
- TangoTrotFox 8y agoYou're both saying the same thing from different worldviews. Regulations work to minimize risk, but in the process they can and often do also reduce effectiveness and/or progress in a field. To take a less sensitive example, NASA refused to allow SpaceX to do retropulsive soft landings for their Dragon crew/cargo capsules without a whole slew of regulatory work, which was just not a very effective allocation of resources for SpaceX. So instead of coming down retropulsively, similar to how they now regularly land their massive first stages with, the capsules come down using parachutes and a not-so-soft 'soft' landing as we've been doing since the 60s. So you could argue this is safer. But that's not clear. What is entirely clear is that the cost and time effort that would be required to abide the regulatory requirements resulted in the entire idea being scrapped, derailing technological progress on that front. Perhaps with some irony, the capsules will still have the thrusters on the capsules to be used in case of an emergency abort - they just can't use them to enable genuinely soft landings.
- jimrandomh 8y agoIt's the difference between risk of death, and risk of getting sued. The DIY project has a much lower risk of death, but (if a corporation were to do the same thing) a much higher risk of getting sued.
- seehafer 8y agoI disagree those two are decoupled. The DIY project has a much lower risk of getting sued, true. But lower of risk of death is highly dependent on edge cases and corner cases, and I'd challenge you to produce evidence that there is an overall lower risk of death. None of this is to say I'm against any effort to develop an artificial pancreas. I used to work at Medtronic Diabetes. The slothful pace with which this endeavor is proceeding, despite the mountains of money behind it and the obvious and profound unmet clinical need, pains all of us. But "why was it taken so long?" is a question to which there is no simple answer. And though FDA is very much in the corner of "let's get it done" now, that was not always so. For instance, the quote from the director at FDA re: "you can do everything but manage diabetes on your phone, you should be able to do that as well" masks the history of the med device industry for years trying to get applications on the iPhone approved by FDA and not being able to do so because you couldn't lock the iPhone down (i.e. prevent programmatically anyone from running any other program).
- dkarl 8y agoThank you for this work. Do you know why the applicability to type two diabetes is not as clear as for type one? I'd love to read more about that. The core problem is that the FDA-approved devices are optimized not for getting the best result, but for ensuring the manufacturer can't be blamed if something goes wrong. I live with someone who has a CGM (continuous glucose monitor) where the device came in a box with an insert saying "do not use this device to make medical treatment decisions." To see any of the readings you have to install an app whose start screen says it's experimental and, again, can't be used to make treatment decisions. But the user's manual has a chapter titled "Treatment Decisions" that tells you how to use it to decide when to take insulin and how much to take. It's frustrating that the messages have to be so contradictory. A final question: how essential is it to be tech-savvy to use this technology? Is it sufficient to have somebody tech-savvy close to you who is available every day but not every hour of the day, or is it something that should only be in the hands of someone who understands how it works?
- trampypizza 8y agoI can't answer your questions from a clinical perspective, however I'll have a stab at them. I'm a type 1 diabetic, diagnosed when I was 9. > Do you know why the applicability to type two diabetes is not as clear as for type one? I'm only stabbing at this, and it's anecdotal, but I believe it is likely due to the lack of consistency across type 2 diabetics. Whilst there is variation in Type 1 Diabetes, it is largely limited to lifestyle but the basic principle is the same - you don't produce insulin yourself. Type 2 diabetes is often caused by insulin resistance, and I guess varies wildly based on the individual, their lifestyle, and their genes. > I live with someone who has a CGM (continuous glucose monitor) where the device came in a box with an insert saying "do not use this device to make medical treatment decisions." To see any of the readings you have to install an app whose start screen says it's experimental and, again, can't be used to make treatment decisions. But the user's manual has a chapter titled "Treatment Decisions" that tells you how to use it to decide when to take insulin and how much to take. It's frustrating that the messages have to be so contradictory. I haven't been given a CGM for longer than a few weeks (NHS rules are a bit restrictive in my area if your control is good). However the rationale for not using the CGM to make decisions is based around how it gauges your blood sugar. Because it's relying on blood glucose levels in the skin tissue I have been told that there is a delay, and basically the CGM operates about 15 minutes behind your current glucose levels. This is ok when you're using it to track glucose levels over a day, but not particularly safe if you're relying on it to make a decision for obvious reasons. > A final question: how essential is it to be tech-savvy to use this technology? This is a question I have asked myself a few times. As mentioned above, it's pretty difficult to get a pump and CGM on the NHS in my area without proving that you can't treat yourself adequately with regular injections. I am unwilling to sacrifice my health to have a pop at getting a pump, so I had a look at private options. Whilst initially I think there's a fairly steep learning curve, there is quite a lot of documentation provided, and the community is pretty active and helpful. I suppose it's also helped by the fact that there is only a few pumps on the market (relatively speaking). The issue is that if something goes wrong in your config, which is not uncommon for a homebrew solution, then you have to go back to manually adjusting your insulin.
- pbreit 8y agoStrikingly similar to a buddy of mine's story who was underground to the point he became known as "Bigfoot": https://www.bigfootbiomedical.com/the-legend/ https://www.bigfootbiomedical.com/the-legend/
- agumonkey 8y ago> optimized not for getting the best result, but for ensuring the manufacturer can't be blamed read similar stories on r/medicine advanced surgeons coming into the operating room with their lawyer in mind, entirely logical, totally sad
- nhebb 8y agoFor anyone interested, Scott Hanselman wrote about the open diabetes ecosystem (including OpenAPS) a few years ago: https://www.hanselman.com/blog/ThePromisingStateOfDiabetesTechnologyIn2016.aspx https://www.hanselman.com/blog/ThePromisingStateOfDiabetesTe...
- hamilyon2 8y agoThis comment finally explains what article is about. Thank you.
- dekhn 8y agoHi- I used to work in regulated pharma and I want to be clear: " The core problem is that the FDA-approved devices are optimized not for getting the best result, but for ensuring the manufacturer can't be blamed if something goes wrong" is a misleading statement. The reason everything is regulated is that sometimes things do go wrong, and it's necessary to have root cause attribution so the problem can be remedied and a fix deployed, and, if somebody did something illegal or dumb, they can be sanctioned. I wish your project success, but I think (and I've got a bit of experience) if you can't accept that regulation of health products is almost certainly necessary, and that not producing the "best" results is a reasonable if conservative approach, I will never trust your product.
- davidgrenier 8y agoSomehow I can't help but read you've smuggled endorsement for: It's ok if the product is more dangerous when bundled with the benefit that we can blame it on some organization.
- Infinitesimus 8y agoThe more generous interpretation is: We value life and try to reduce the risk of severe damage when making drugs. And regulatory bodies exist to combat the incentive to just ship whatever works without adequate regard for what could go wrong
- dekhn 8y agoYes, this is what I meant. Thanks for being generous.
- candiodari 8y agoAnd what do you suggest we do when an open-source "biohack" results in something like this ? https://en.wikipedia.org/wiki/Thalidomide https://en.wikipedia.org/wiki/Thalidomide Note the mistake made, and just how subtle it was. During testing a somewhat more ad-hoc process was used to produce the drug that did not result in the bad isomere, and then it was sold with multiple isomeres in the actual drug. Regulators at the time thought that isomeres did not matter and it took years for the effects to become clear. Of course regulators did not test for things they didn't know about. Neither did the companies (not just one). Crucially the drug was NOT tested for the effect on pregnancies (and was therefore not to be taken by pregnant women, like many drugs and even some non-drug products like famously alcohol). Furthermore: there is at least some amount of "guilt" on the part of some of the mothers: the medicine was NOT approved for use during pregnancy, and stated this. Result: >10.000 crippled children. Where is the guilt to be placed for this incident ? I would argue that the primary guilt is with the regulator (government) and a small amount with (most of) the mothers for taking unapproved medicine, with the rest of the mothers following doctors' prescriptions (which of course means those doctors prescribed unapproved medicine). Needless to say, the company was blamed, and forced to pay (essentially in trade for not going to prison). The German government denied any responsibility, and several other governments (famously Spain) went further: they denied anything had happened at all. So let's say there is a timing bug in this "open source pancreas", and it starts pumping insulin into the patients bodies without cause, say at the unix epoch transition. I would guess that at least half of them won't survive. What happens next ? Given the Thalomide incident we can make an educated guess: whatever the law says, and despite patients "accepting the risk", even when the patients explicitly make mistakes in the treatment, you can bet the government will go after whoever they can arrest, and force them to pay millions of euros, or throw them in jail for the rest of their life. People cannot be trusted to accept responsibility for the result of picking their own treatments, even when fully informed about the risks.
- nutjob2 8y agoYou're sort of skipping over the bit where a bug in the software (or a hardware issue) kills the user. That's the crux of "being blamed" and regulation. You might say in response it will "almost never" happen, but when it happens to your loved one it most certainly matters a lot.
- jimrandomh 8y agoThe risk-of-death is actually quite well understood. If a user gets too much insulin, and doesn't feel when their blood sugar is low and doesn't get a low-blood-sugar alarm or doesn't respond to the alarm, then they could die. So if the closed-loop system incorrectly commands too high a dose of insulin, that could be fatal. But the alternative isn't that too-high doses of insulin never happen. The alternative is that all insulin doses are selected by a human, and subject to human error. And having a low blood sugar event due to too much insulin is not a rare occurrence for T1 diabetics at all.
- jkeller_86 8y agoThey actually aren't leaving out the name of the project, it's called Loop - the system that she's on is not actually OpenAPS. I've tried both systems, OpenAPS lacks a clean, user friendly UI. As a result, most people (according to a recent survey) are running Loop instead of OpenAPS.
- pimeys 8y agoAnd if you have different hardware (Combo, DanaR/RS), AndroidAPS gives a clean and nice UI and is based on the OpenAPS algorithms.
- jimrandomh 8y agoCorrection: It's Loop, which has some code overlap with OpenAPS but is a separate project. (Apologies to the Loop developers, your name was less Ctrl+F'able.)