4 ms·

I can't comprehend how that kind of bug even happens. Not that insulin pumps should have any bugs, but it doesn't even sound like an integer overflow or use af

I can't comprehend how that kind of bug even happens. Not that insulin pumps should have any bugs, but it doesn't even sound like an integer overflow or use after free which is "understandable". Are they doing some kind of scuffed string parsing?

ajdude 3y ago
They probably wrote the controller in JavaScript
- pavel_lishin 3y ago
  At my first job out of college, we were hired to create a point-of-sale system. We wrote it in Javascript, being unaware of how Javascript treats numbers. (Like a rented mule.) After the first few days, the client reached out and told us that the end-of-day numbers were sometimes off by a few cents - tax totals, things like that. After a few weeks, they'd be off by significantly more. Easily the most embarrassing incident of my career, even worse than when I accidentally left a `console.log("FUCK");` in production code as a debugging tool, or when we wrote some code to generate random four-letter codes that would spew out the occasional profanity.
  - freedomben 3y ago
    We had a similar issue with random four-letter codes. The simplest and easiest solution was to remove vowels from the pool of candidates. Consonant only codes are much harder to generate real words.
    - Maxion 3y ago
      FCK!
      - freedomben 3y ago
        That's only 3 letters! FXCK was probably the closest we got with that change
        Freak_NL 3y ago
        NGGR and CVNT might not sit well in some countries either.
- selimthegrim 3y ago
  I once worked on software that interfaced with Omnipods just to read and display its data and it was an unholy assemblage of Java applets, Pascal, and out of date C#. (The software that is, I think the Omnipod DLL was just C)
- mmis1000 3y ago
  It's probably caused by a shitty spec instead of bug. Some PM insists that you must sanitize the user input 'when' user inputs. And '.' alone isn't a proper number. Which led you to this. No. You should NEVER change user input when user action is not finished yet. That's a giant UX hazard.
freedomben 3y ago
With low level devices, I have been amazed at how many hackish things are done by people who don't have sufficient experience developing such things. I would not be surprised to find out that they are parsing or storing the value without the leading decimal, and depending on code in some other place to prepend the leading decimal, and there be a corner case or something that misses this, and no safety checks or even sanity checks.
- pixl97 3y ago
  In the t.slim they have a maximum dose in time range setting on the device. I don't use the app for it, so I don't know if the phone app could override that setting. If I remember right that is triggered while pumping so if you hit the limit in the middle of dose administration it will stop.
eternityforest 3y ago
People think it's a race condition. Not knowing anything about this or having seen the UI, I would guess it's something really dumb. Like maybe every number is sent as it's own Bluetooth packet, but then when you hit enter, that's when the point gets appended. Because of some other insanity that needed this as a workaround, like, I don't know, maybe it starts out already showing a dot, and the numbers you type go after that, and for some reason they ....and then the Bluetooth stack reorders the enter key and the dot? Or, maybe the command is sent with the decimal at the end, I'm a packet with other stuff, and the packet length can vary based on the other stuff, and the calculation is wrong. Or it's even more like Therac, and they have two modes, a 10x and 1x mode, maybe because there's some hardware interlock on the 10x, but they both interpret the value differently and use different units , and there's some bug in selection logic?

ajdude 3y ago

They probably wrote the controller in JavaScript

pavel_lishin 3y ago
At my first job out of college, we were hired to create a point-of-sale system. We wrote it in Javascript, being unaware of how Javascript treats numbers. (Like a rented mule.) After the first few days, the client reached out and told us that the end-of-day numbers were sometimes off by a few cents - tax totals, things like that. After a few weeks, they'd be off by significantly more. Easily the most embarrassing incident of my career, even worse than when I accidentally left a `console.log("FUCK");` in production code as a debugging tool, or when we wrote some code to generate random four-letter codes that would spew out the occasional profanity.
- freedomben 3y ago
  We had a similar issue with random four-letter codes. The simplest and easiest solution was to remove vowels from the pool of candidates. Consonant only codes are much harder to generate real words.
  - Maxion 3y ago
    FCK!
    - freedomben 3y ago
      That's only 3 letters! FXCK was probably the closest we got with that change
      - Freak_NL 3y ago
        NGGR and CVNT might not sit well in some countries either.
selimthegrim 3y ago
I once worked on software that interfaced with Omnipods just to read and display its data and it was an unholy assemblage of Java applets, Pascal, and out of date C#. (The software that is, I think the Omnipod DLL was just C)
mmis1000 3y ago
It's probably caused by a shitty spec instead of bug. Some PM insists that you must sanitize the user input 'when' user inputs. And '.' alone isn't a proper number. Which led you to this. No. You should NEVER change user input when user action is not finished yet. That's a giant UX hazard.

freedomben 3y ago

With low level devices, I have been amazed at how many hackish things are done by people who don't have sufficient experience developing such things. I would not be surprised to find out that they are parsing or storing the value without the leading decimal, and depending on code in some other place to prepend the leading decimal, and there be a corner case or something that misses this, and no safety checks or even sanity checks.

pixl97 3y ago
In the t.slim they have a maximum dose in time range setting on the device. I don't use the app for it, so I don't know if the phone app could override that setting. If I remember right that is triggered while pumping so if you hit the limit in the middle of dose administration it will stop.

eternityforest 3y ago

People think it's a race condition. Not knowing anything about this or having seen the UI, I would guess it's something really dumb. Like maybe every number is sent as it's own Bluetooth packet, but then when you hit enter, that's when the point gets appended. Because of some other insanity that needed this as a workaround, like, I don't know, maybe it starts out already showing a dot, and the numbers you type go after that, and for some reason they ....and then the Bluetooth stack reorders the enter key and the dot? Or, maybe the command is sent with the decimal at the end, I'm a packet with other stuff, and the packet length can vary based on the other stuff, and the calculation is wrong. Or it's even more like Therac, and they have two modes, a 10x and 1x mode, maybe because there's some hardware interlock on the 10x, but they both interpret the value differently and use different units , and there's some bug in selection logic?