5 ms·

Yep. I am terrified for the people who are running open-source medical devices via community-based code and reversed-engineered medical devices. Something bad i

Yep. I am terrified for the people who are running open-source medical devices via community-based code and reversed-engineered medical devices. Something bad is bound to happen. Specifications and details here: https://openaps.readthedocs.io/en/latest/ https://openaps.readthedocs.io/en/latest/ The code is hosted on GitHub, and is against Microsoft's Terms and Conditions, for obvious reasons. Still, nothing is done about it.

monocasa 5y ago
I used to be terrified of that as well, until meeting many former medical device engineers in the Denver area who got out for moral reasons. However shit you think the community code is, the official code is probably worse. Like kills people and hide behind lawyers already worse. It's not uncommon for these engineers to have a 'if I am incapacitated, do not hook me up to these devices' card in their wallet like you'd normally see for alllergies for products they've worked on.
- disabled 5y ago
  Just FYI, the European Union made such projects illegal as of 26 May 2021. See Medical Devices Regulation (MDR) EU 2017/745: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0745 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... Also, these projects were designed on purpose to circumvent or in some cases break the law, which is the wrong approach to medical device design. It's dangerous and designs kill, as you know. See this stipulation (and control/command + f = "commercial" in paper): 27) ‘making available on the market’ means any supply of a device, other than an investigational device, for distribution, consumption or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge; Also: 46) ‘investigational device’ means a device that is assessed in a clinical investigation Also: 1) ‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: — diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease, Also: (19) It is necessary to clarify that software in its own right, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device. The qualification of software, either as a device or an accessory, is independent of the software's location or the type of interconnection between the software and a device.
  - netr0ute 5y ago
    Sad, Big Pharma strikes again.
    - OJFord 5y ago
      Did people start sentences with 'Sad' like this before Trump's presidency? I don't know if it's a (an American) colloquialism I simply hadn't noticed prior to that, or a more personal quirk that caught on? I don't mean to single out you specifically, I keep noticing it now.
      - netr0ute 5y ago
        Trump is more associated with "SAD!" but with how many sad privacy/freedom violations there are nowadays, it could be because of that.
      - meowster 5y ago
        Yes, it's been used that way in American venacular for at least several decades.
        OJFord 5y ago
        Thanks, it was an honest question, something I've noticed a few times and wondered about. I was going to say (did type) that I can't think of another word that's used in the same sort of declaratory way - but actually, as I wrote, it occurred to me that 'funny' is too. 'Funny, I just never noticed it with 'sad' until a few years ago.'
      - OneLeggedCat 5y ago
        It became a lot more common around 2015.
      - dTal 5y ago
        Let me put it this way. How linguistically innovative do you think Trump is?
  - 5y ago
- mattrj 5y ago
  Fascinating. Want to know another secret about code quality? Custom software for banks generally sucks as well. That's your money it's messing with. am: "Let's try it in production" pm: We are going to need you to write a script to put everything back where it was.
  - deleted 5y ago
    [deleted]
- rcxdude 5y ago
  Yeah, I think the nature of the medical device development process is that with competent engineers and managers it makes it possible to develop a safe device. It does not make it guaranteed to be safe regardless of the competency of the organisation.
mypalmike 5y ago
Openaps is a shining example of why open source medical device control is effective and necessary. Talk to the developers. Talk to the users. For every fear that "something bad is bound to happen" there are dozens of stories where bad things actually did happen because these tools did not exist. The key to safety is that hardware itself a) shows the real state of things and b) has safety mechanisms in place such that even the most malignant control software would be no worse than poorly timed manual dosing.
- rcxdude 5y ago
  It's pretty crazy. One thing that people don't realise about type 1 diabetes is that your effectiveness at blood sugar regulation basically translates into years of lifespan: the damaging effects of high blood sugar are cumulative and complications are inevitable, you can only hope to delay them as long as possible (low blood sugar is more immediately life threatening). Insulin pumps were already a huge step change in the level of regulation you could achieve, and openaps is yet another level again, which you can't get anywhere else. I don't fault anyone who uses or develops it, even in the face of the risks or legal penalties.
e2le 5y ago
I doubt it's much worse than trusting your life to proprietary code written behind closed doors. Something bad usually happens every now and again. Of course, those insulin pumps are running insecure firmware allowing for adjustments to be made remotely by an sbc (Raspberry Pi) where the OpenAPS software lives and takes measurements from a GCM. Without the insecure remote interface on those insulin pumps, OpenAPS might not exist. I'm not sure it's moral to attack such a project built and maintained by diabetics who simply want to provide for themselves a better quality of life.
- disabled 5y ago
  > Of course, those insulin pumps are running insecure firmware allowing for adjustments to be made remotely by an sbc (Raspberry Pi) where the OpenAPS software lives and takes measurements from a GCM. Without the insecure remote interface on those insulin pumps, OpenAPS might not exist. This is the issue here, with a cyber to physical attack, which is bound to happen at some point, with some medical device, and this project is a huge target for something like that. This project was specifically mentioned in the book "Click Here to Kill Everybody" by renowned cybersecurity expert Bruce Schriener, too. OpenAPS was also designed to circumvent government laws, and is not-as-legal as the creators portray it to be. For example, one of the main "advocates" calls OpenAPS an "off-label qualification" for use (in the USA), when in order for that to apply, the specific device intended to be used must be FDA approved. As you know, OpenAPS cannot be FDA approved at this point of time. This individual also illegally markets unapproved medical devices across the United States, Europe, Australia, and New Zealand, plus online, with various gatherings for it. If you look at the specific laws of those lands, it is pretty clear cut what is going on is illegal. Plus, the new EU Medical Devices Regulation applies now. Yes, it is illegal. I am astonished that this individual has not gotten in trouble with the FDA yet.
rascul 5y ago
> The code is hosted on GitHub, and is against Microsoft's Terms and Conditions, for obvious reasons. Still, nothing is done about it. What are the obvious reasons?

monocasa 5y ago

I used to be terrified of that as well, until meeting many former medical device engineers in the Denver area who got out for moral reasons. However shit you think the community code is, the official code is probably worse. Like kills people and hide behind lawyers already worse. It's not uncommon for these engineers to have a 'if I am incapacitated, do not hook me up to these devices' card in their wallet like you'd normally see for alllergies for products they've worked on.

disabled 5y ago
Just FYI, the European Union made such projects illegal as of 26 May 2021. See Medical Devices Regulation (MDR) EU 2017/745: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0745 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... Also, these projects were designed on purpose to circumvent or in some cases break the law, which is the wrong approach to medical device design. It's dangerous and designs kill, as you know. See this stipulation (and control/command + f = "commercial" in paper): 27) ‘making available on the market’ means any supply of a device, other than an investigational device, for distribution, consumption or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge; Also: 46) ‘investigational device’ means a device that is assessed in a clinical investigation Also: 1) ‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: — diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease, Also: (19) It is necessary to clarify that software in its own right, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device. The qualification of software, either as a device or an accessory, is independent of the software's location or the type of interconnection between the software and a device.
- netr0ute 5y ago
  Sad, Big Pharma strikes again.
  - OJFord 5y ago
    Did people start sentences with 'Sad' like this before Trump's presidency? I don't know if it's a (an American) colloquialism I simply hadn't noticed prior to that, or a more personal quirk that caught on? I don't mean to single out you specifically, I keep noticing it now.
    - netr0ute 5y ago
      Trump is more associated with "SAD!" but with how many sad privacy/freedom violations there are nowadays, it could be because of that.
    - meowster 5y ago
      Yes, it's been used that way in American venacular for at least several decades.
      - OJFord 5y ago
        Thanks, it was an honest question, something I've noticed a few times and wondered about. I was going to say (did type) that I can't think of another word that's used in the same sort of declaratory way - but actually, as I wrote, it occurred to me that 'funny' is too. 'Funny, I just never noticed it with 'sad' until a few years ago.'
    - OneLeggedCat 5y ago
      It became a lot more common around 2015.
    - dTal 5y ago
      Let me put it this way. How linguistically innovative do you think Trump is?
- 5y ago
mattrj 5y ago
Fascinating. Want to know another secret about code quality? Custom software for banks generally sucks as well. That's your money it's messing with. am: "Let's try it in production" pm: We are going to need you to write a script to put everything back where it was.
- deleted 5y ago
  [deleted]
rcxdude 5y ago
Yeah, I think the nature of the medical device development process is that with competent engineers and managers it makes it possible to develop a safe device. It does not make it guaranteed to be safe regardless of the competency of the organisation.

mypalmike 5y ago

Openaps is a shining example of why open source medical device control is effective and necessary. Talk to the developers. Talk to the users. For every fear that "something bad is bound to happen" there are dozens of stories where bad things actually did happen because these tools did not exist. The key to safety is that hardware itself a) shows the real state of things and b) has safety mechanisms in place such that even the most malignant control software would be no worse than poorly timed manual dosing.

rcxdude 5y ago
It's pretty crazy. One thing that people don't realise about type 1 diabetes is that your effectiveness at blood sugar regulation basically translates into years of lifespan: the damaging effects of high blood sugar are cumulative and complications are inevitable, you can only hope to delay them as long as possible (low blood sugar is more immediately life threatening). Insulin pumps were already a huge step change in the level of regulation you could achieve, and openaps is yet another level again, which you can't get anywhere else. I don't fault anyone who uses or develops it, even in the face of the risks or legal penalties.

e2le 5y ago

I doubt it's much worse than trusting your life to proprietary code written behind closed doors. Something bad usually happens every now and again. Of course, those insulin pumps are running insecure firmware allowing for adjustments to be made remotely by an sbc (Raspberry Pi) where the OpenAPS software lives and takes measurements from a GCM. Without the insecure remote interface on those insulin pumps, OpenAPS might not exist. I'm not sure it's moral to attack such a project built and maintained by diabetics who simply want to provide for themselves a better quality of life.

disabled 5y ago
> Of course, those insulin pumps are running insecure firmware allowing for adjustments to be made remotely by an sbc (Raspberry Pi) where the OpenAPS software lives and takes measurements from a GCM. Without the insecure remote interface on those insulin pumps, OpenAPS might not exist. This is the issue here, with a cyber to physical attack, which is bound to happen at some point, with some medical device, and this project is a huge target for something like that. This project was specifically mentioned in the book "Click Here to Kill Everybody" by renowned cybersecurity expert Bruce Schriener, too. OpenAPS was also designed to circumvent government laws, and is not-as-legal as the creators portray it to be. For example, one of the main "advocates" calls OpenAPS an "off-label qualification" for use (in the USA), when in order for that to apply, the specific device intended to be used must be FDA approved. As you know, OpenAPS cannot be FDA approved at this point of time. This individual also illegally markets unapproved medical devices across the United States, Europe, Australia, and New Zealand, plus online, with various gatherings for it. If you look at the specific laws of those lands, it is pretty clear cut what is going on is illegal. Plus, the new EU Medical Devices Regulation applies now. Yes, it is illegal. I am astonished that this individual has not gotten in trouble with the FDA yet.

rascul 5y ago

> The code is hosted on GitHub, and is against Microsoft's Terms and Conditions, for obvious reasons. Still, nothing is done about it. What are the obvious reasons?