Breaking News: Telstra to launch first 4G Windows phone

ZDNet / Open Source / Story

Cyborg lawyer demands software source

By on January 20th, 2012 
Submit

Lawyer Karen Sandler's heart condition means she needs a pacemaker-defibrillator to avoid sudden death, so she has one simple question: what software does it run?

Karen Sandler
(Credit: Linux.conf.au)

Yet it turns out that it's impossible for her to see and understand the technology that's being installed into her own body and upon which her life depends. Regulatory authorities don't see or review the software either.

She simply has to trust that the vendor is telling the truth and doing things right.

In this third of four daily podcasts from Linux.conf.au 2012 (LCA) in Ballarat, you'll hear Sandler discuss the real-world implications of this very personal software story.

How do we know the software works as advertised? How do we know it's secure? And what will happen if something goes wrong and the vendor tries to cover up the flaws, or if the vendor just goes bankrupt and the software stops being maintained?

Sandler also discusses legal cases where the prosecution's evidence was unreliable because it relied on software that turned out to be flawed — yet another practical reason to demand the source.

You'll also hear part two of our look at FreedomBox, a project to create a platform for privacy-enhancing social networks. Following on from yesterday's episode, FreedomBox Foundation board member and developer Bdale Garbee gives us a status update on the project's software stack.

There's also a conversation with Mary Gardiner and Valerie Aurora about the Ada Initiative, a project to increase the participation of women in open technology and culture. Also, Linux kernel developer "Rusty" Russell and geek-advocate Pia Waugh explain why the Ada Initiative and other work won Mary Gardiner this year's Rusty Wrench award for services to the Australian Linux community.

Running time: 42 minutes, 45 seconds

"Metal Free Software Song 2: This Time It's Personal" by Jono Bacon is based on the original "Free Software Song" by Richard Stallman, used under a Creative Commons Attribution ShareAlike licence.

Talkback

There are times OSS community borderline stupidity when it comes to promoting their religion.

How do you know if a pacemaker works as advertised ? Really???

I am generally happy with people giving away source. I'm am also happy with people who do not want to. It is their right.

But when the community comes out with something like this - a pacemaker story, you really begin to wonder if they have lost the plot.

Which reminds me, sometimes when the source is made available - the "community" doesn't want it or has little interest in it. Just look around many source code repositories. Projects are dead and haven't been touched simply due to lack of interest.

It's not imported if you open source it or not. What is important is what you do with it. In this case - pace makers save lives. They are designed to work and work well for years. (I have a friend who has one.)

fred9999fred9999 January 20th, 2012
Report offensive content Reply (+14) (-23)

I don't think you really understand the article or her point... I don't think she wants it open sourced so that she can tinker with it or so the open source community can create a fork or something...

It's about audibility of the code, to ensure it does not contain errors in the code or security flaws, and so people can understand how it works. A drug cannot be sold or prescribed by doctors unless it is well documented and has passed a through review process, why should the software that runs a pace maker be any different?

In short, before you go shooting off your mouth at people check that you understand what you are talking about first.

NeddyONeddyO January 20th, 2012
Report offensive content Reply (+22) (-4)

Sorry NeddyO, I understand the point of the article and her point, but I still agree with Fred9999. If she, or anyone else, does not like that the manufacturer will not let her see the software, then she can go find another pacemaker. Its a choice. If you can do better, then feel free and you can share your whatever information you want. The device is only "being installed into her own body" because she agreed to it. Its called free will. I applaud those who chose to open up their proprietary devices, but to suggest in any way that she has some right to have it opened is foolish. The only somewhat legitimate argument is that it may require more regulatory oversight. But, even then, the public doesn't get to see what is inside the box.

craig0craig0 January 22nd, 2012
Report offensive content Reply (+2) (-8)

You may feel free to disagree but I for one am glad there are no "backyard" pacemakers yet. And I am glad no one is seriously entertaining this foolishness. The world is just waiting to see how pacemakers work! Really.

fred9999fred9999 January 22nd, 2012
Report offensive content Reply (+2) (0)

I had a similar issue with a Japanese customer wanting an RCA for an issue. Turns out the JNI fibre-channel card (firmware+solaris device driver) had an issue, but we couldnt specify exactly what. They demanded the source code and code reviews to determine the actual error, before they could trust the product again.

Eventually JNI gave us the source code for the fibre-channel driver + firmware. It was useless, no-one had the time or inclination to dedicate weeks/months of their lives to understand the software/firmware operation or how it implemented fibre channel.

How would one detect an error? By visual code inspection?

I noticed access to source code seems to be a panacea for all, but in reality only the dedicated few are willing to sit down and do the hard work to understand the source.

raist40raist40 January 20th, 2012
Report offensive content Reply (+4) (-4)

Exactly my point. Which is what NeddyO doesn't get. Who looks at at the code ? Who has time ? The only thing it accomplishes is probably some knock off Chinese pacemakers available in the grey market.

Besides, are we implying that something AS IMPORTANT as a pacemaker doesn't get reviewed ? In all these years pacemakers been in existence - have we had ONE pacemaker with faulty software ?

I think this is the exact problem with OS zealots that they keep barking up the wrong tree these days. Pure stupidity I say.

fred9999fred9999 January 20th, 2012
Report offensive content Reply (+1) (-11)

fred9999: would you consider the potential for a third party to remotely deliver an electric shock to your heart to be "faulty software"? http://www.nytimes.com/2008/03/12/business/12heart-web.html

bodbod January 21st, 2012
Report offensive content Reply (+13) (0)

Would you consider the billions of R&D dollars invested to ensure medical devices like this work as prescribed and approval of the certifications bodies. That's right boys and girls - devices like this ( and most medicines and drugs) are tested independently by authorities to ensure that they work as prescribed.

What does the OS community require next ? The chemical compound in Viagra ?

fred9999fred9999 January 23rd, 2012
Report offensive content Reply (+1) (-2)

as DESCRIBED, also all FDA approved drugs must list active ingredients and show a number of testing trials and effects. that's not always the case, took them awhile to figure out how aspirin worked but they showed you the compound. i'm surprised u can work a computer fred, your ranting in these comments has no bases or merit.

johnnyd2johnnyd2 January 24th, 2012
Report offensive content Reply (+1) (0)

> Besides, are we implying that something AS IMPORTANT as a pacemaker doesn't get reviewed ?

Yes. The full keynote presentation had her explaining that the approval board in the USA basically lets the manufacturer test their own product; she also explains that it's already malfunctioned once. Other issues include some models (not hers) having unencrypted wireless control available at a good distance (feet+).

She also attempted (unsuccesfully) for quite some time to get different manufacturers to reveal more information about their devices.

See the full keynote here - http://www.youtube.com/watch?v=5XDTQLa3NjE

mibusmibus January 23rd, 2012
Report offensive content Reply (+1) (0)

you must never have been to defcon... they crash pacemakers for breakfast. i'm not kidding.

http://hackaday.com/2008/08/09/defcon-16-pacemaker-b-gone/

johnnyd2johnnyd2 January 24th, 2012
Report offensive content Reply (0) (0)

wow you guys really hate this woman for wanting to understand or have a feeling of control or comfort for the thing that controls her life.

johnnydjohnnyd January 22nd, 2012
Report offensive content Reply (+12) (-5)

So manufacturers are obligated to every lawyer on earth with OCD ? Yes, I can see that being their core business. How about we ask Apple how their products work ?

fred9999fred9999 January 22nd, 2012
Report offensive content Reply (+1) (-5)

if apple makes a pacemaker, and has a contract with hospitals to use that pacemaker, then u are hit by a car and need one, you will ask for the source code too just to make sure someone running nmap locally doesn't find a "bug". this is an extreme example... but not to far off. simple request, if their hardware works then
the software source shouldn't be a big deal

johnnyd2johnnyd2 January 24th, 2012
Report offensive content Reply (0) (0)

So why does the manufacturer not just explain how the software was created and validated? What do they have to lose? Just like with voting machines, there exists a public interest to know how these machines work. I doubt the software for this product is half as complicated as the above commenters think.

elfWyattelfWyatt January 22nd, 2012
Report offensive content Reply (+4) (-2)

If you have ever heard of the software failure cases involving the Therac 25, you would be worried about software testing too. She is not asking for open sourcing the software. She is asking to validate the software. If you have software static analysis tools, like cppcheck, Coverity or the many other types of tools, you have a good starting point to find just the basic flaws. Not all software developers and test plans are created equal. If you're motivated with your life, you would be willing to make sure that the software is tested to work correctly too.

InspectorGadget345InspectorGadget345 January 22nd, 2012
Report offensive content Reply (+6) (0)

I do not want her (or anyone else) to have the source code to my ICD/pacemaker so some psychopath can write code to hack into it and control my heart! Ignorance is security here!

These devices sustain life not control it. It is voluntary! You do not have to have it installed.

Her fear, education as a lawyer, and short sightedness puts the rest of us at risk!

LucidLucid January 22nd, 2012
Report offensive content Reply (+2) (-8)

Just curious, how many of the people who gave a thumbs down to this post actually have one implanted? Or is this a philosophical argument for with no personal risk in it for you?

LucidLucid January 23rd, 2012
Report offensive content Reply (0) (0)

Linus' Law: http://en.wikipedia.org/wiki/Linus'_Law

Also the video of the keynote can be found here:
http://www.youtube.com/watch?v=5XDTQLa3NjE&list=PL98382D6677F8E2D4&index=1&feature=plpp_video

jheskethjhesketh January 22nd, 2012
Report offensive content Reply (+3) (0)

1) When talking about a device whose purpose is to sustain ones life, one has the right to know its provenance even if they cannot personally understand it. This isn't "some OCD lawyer."

2) The "just trust the authorities" argument lacks logical or moral standing of any sort. Move along folks, trust us completely, pay no attention to the man behind the curtain, nothing to see here.... except your own flatline. Had a friend who saw her own flatline...

3) The easiest exploits to abuse are the ones that are common knowledge to the blackhat crowd, and a guarded secret to everyone else.

4) Do you check the eggs at the store before you buy the carton? There are testing procedures in place. Laser-guided quality control mechanisms created by millions of dollars in engineering to make sure you never get a cracked one. That's why you just toss it in the basket on faith, because machines and humans are both flawless, guaranteeing you'll never purchase a cracked egg.

5) It's a little late for her to simply put her pacemaker back on the shelf and start shopping for a new one.

iuviusiuvius January 23rd, 2012
Report offensive content Reply (+1) (0)

Medical software undergoes rigorous review (within the company) with life-support software following a strict design-first, code-second, test-last process. Each of these steps is reviewed in depth with independant groups, with reviewers providing a signature that they have done as required. The devices then get tested on real patients in clinical trials as the ultimate verification. All the design and test documentation is provided to the FDA, however the code is not. If any of the submitted documentation is falsified and a problem occurs in the field triggering an investigation, there will be serious legal ramifications and the developers, tester and reviewers all know this. Within this environment the scope for error is minimal, and the quality is way higher than anything I have seen produced by any FOSS group.

BigJohnSBigJohnS January 30th, 2012
Report offensive content Reply (0) (0)
Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment

Terms of Service - As a ZDNet registrant, and by using this service, you indicate that you agree to our Terms and Conditions and have read and understand our Privacy Policy.

Resource Centre Useful content from our premier sponsors

ZDNet Australia Live

BYOD: What the people think http://t.co/syY7RSyR via @zite

Twitter to track users through widgets: Twitter has given details about tracking users across the internet, and ... http://t.co/Er6izMDp

@superjon_11 just be weary that's what causes them to explode http://t.co/6XSePS0j

SAP eyes cloud super network with Ariba buy
http://t.co/F7NtV2Ju

SA Health's journey to e-health http://t.co/tHAhRy9c

Govt CIO praises budget's $1bn IT investment: Despite a tighter 2012-13 Federal Budget, the government's chief i... http://t.co/sRO5U7C0

Bit more meat to this Global SI #salesforce announcement than earlier ones, still don't think they get it though! http://t.co/Eb386WFF

NSW Govt appoints Silicon Valley office head to represent Aussie tech. Is this useful or a good direction? http://t.co/icIl6GOq

#ABC #Bitcoin Miner tackled in minutes #ITSecurity #law http://t.co/ptOPKpOI

#NSW Govt announces shopfront in Silicon Valley http://t.co/oUEMM9zY #gov2au”. MT: @allisonhornery @johnW3LLS #gov2au

SA Health's journey to #ehealth – structural reform, workforce restructure & infrastructure
http://t.co/TTno9Td9 /via @zdnetaustralia

Goods Shopping Location Discount Of Japan's Largest Abroad Train Brands. Coach Escape Shelter 89% Off.We Entertain Jammed Items Such As A...

5 hours ago by befeffofs on Reservoir blogs: Fan fakes Tarantino diary

1963年ナイキの創業者フィル・ナイトが訪日、オニツカ（現アシックス）の経営陣を訪問。 最新の機能性や斬新なデザインによって、常に新しいもの求める若者たちの心を掴んできたナイキスニーカー。今回はエアジョーダンやエアマックスなど、ナイキスニーカーの歴史に欠かせない名品から今...

5 hours ago by Speerbprayexy on Reservoir blogs: Fan fakes Tarantino diary

5 hours ago by Ideoforie on Reservoir blogs: Fan fakes Tarantino diary

Ferragamo Shoes Is Distinguished Brand.Ferragamo Is So Baby Valuation Broaden, It Is Secure To Shopping Outlet Online Stores.Ferragamo Ba...

5 hours ago by axollaCrake on Reservoir blogs: Fan fakes Tarantino diary

We Are Specialty Fit out Miu Miu Handbags, Miu Miu Purse, Miu Miu Sunglasses And So On. Miu Miu Sale Online Big Reduction With No Trade O...

5 hours ago by MoxboowsVix on Reservoir blogs: Fan fakes Tarantino diary

Pay off Trainer Wallet&Coach Pocket In Our Coach Store With Sad Sacrifice And Finish Quality, Save 80% Off. Cheap Carriage Overnight bag ...

5 hours ago by Fefinfani on Reservoir blogs: Fan fakes Tarantino diary

クリスチャン ルブタンは靴職人としてのスピリットが強いことで有名で、インタヴューでは下記のように語っています。Christian Louboutin「私は女性に、私の作る靴をファッションとは別の領域のにある、美の対象としてみてほしい。靴というものはアクセサリーではなく、その...

5 hours ago by ganitaickexia on Reservoir blogs: Fan fakes Tarantino diary

Celine luggage,Celine carrier bag,pocketbook Celine,CELINE Celine is synonymous with trait and fastidiousness prevalent since founding in...

5 hours ago by unulseDralola on Reservoir blogs: Fan fakes Tarantino diary

From moi @zdnetaustralia: where are all the ICT jobs: http://t.co/p3e1Y26r via

SAP buys its way into the cloud party: Will it work?: Will SAP and Oracle's rollup strategy for cloud players wo... http://t.co/nPjHXHtH

6 hours ago by Elundaninulge on Reservoir blogs: Fan fakes Tarantino diary

RT @dataPlumbers: Combining @Ariba's network & @SAP's applications - "SAP eyes cloud super network with Ariba buy" http://t.co/jeMWEKpB

Gee zdnet gets this wrong, not often either. Heard of html5 @zdnetaustralia? http://t.co/TksSIP31 read comment 1

BYOD: What the people think http://t.co/iqfwr2R5 via @zite

Medicare Locals get $50m for e-health http://t.co/0Prqy7Q3 via @zdnetaustralia #fb #in

Normally would expect better from zdnet. I call BS. It appears that if you look at their decision it is about using HTML5 to develop thei...

6 hours ago by butterflyeffecs on Android fragmentation steers Vic Health

oBoDwZrOrsjUq //www.2012chanelbagsforsale.com]chanel handbags gWbyPIERM niLqoOE //www.2012chanelbagsforsale.com]chanel outlet hBaJhfpEu...

6 hours ago by khngmspwbzm on Deakin Uni opts for Cisco Unified Computing

RT @zdnetaustralia: South Australia's e-health journey is a tough one, but it first required a good foundation. http://t.co/ha4HV3y3 ^ML

RT @zdnetaustralia: Google has joined in on the chorus of organisations warning users about DNSChanger infections http://t.co/ysaIHiuG ^ML

SA Health's journey to e-health http://t.co/tsbfDYHd

“@jufemaiz : Ausgrid is trialling tech that allows the grid to report back on what might be wrong. http://t.co/ezB8ksXa ^ML” is this you?

RT @maverickwoman: Yammer gets into gamification with Badgeville: http://t.co/faPDDVYr #gamification RT @mobilelearning #yam

Chrome beats Internet Explorer in global Web browser race http://t.co/E2YsEvbO

SA Health's journey to e-health: Implementing e-health services for an entire state is a daunting task, but, as ... http://t.co/93FJNlE6

SA Health's journey to e-health http://t.co/3iMSd3nN

SA Health's journey to e-health: Implementing e-health services for an entire state is a daunting task, but, as ... http://t.co/Zl9T7kQL

SA Health's journey to e-health - ZDNet Australia http://t.co/lI1N44kB #ehealth

RT @zdnetaustralia: Google has joined in on the chorus of organisations warning users about DNSChanger infections http://t.co/ysaIHiuG ^ML

South Australia's e-health journey is a tough one, but it first required a good foundation. http://t.co/ha4HV3y3 ^ML

Hotel Wi-Fi investigation - http://t.co/luJqmD1T

Listened to a guy from SA Health chat about how to consolidate IT from 70 hospitals today. Snazzy stuff. http://t.co/IZxhpu5X

Govt CIO praises budget's $1bn IT investment http://t.co/HXx2LFDf via @zdnetaustralia

by http://t.co/vmlLt4bh: SA Health's journey to e-health: Implementing e-health services for an entire state is a... http://t.co/NVrBd9c5

Facebook investor to sue Nasdaq over alleged bungled orders: http://t.co/XGRsNzA4 ^LH

Combining @Ariba's network & @SAP's applications - "SAP eyes cloud super network with Ariba buy" http://t.co/jeMWEKpB

Akku Asus A32-K72 Original,Kompatibler Ersatz akku für Li-ion Asus A32-K72 Original Laptop Akkus Asus A32-K72 Original，A32-K72 Original...

8 hours ago by akkuakku on HP Compaq 6730b

It is great to see the NSW government taking this step, however there's plenty of home-grown talent loeaving or being rediverted due to l...

8 hours ago by Aceyducey on NSW Govt appoints Silicon Valley champion

But this is the thing. There are still plenty of good-quality graduates whose skills can raise seasoned professional eyebrows... if they ...

10 hours ago by techkid on Skills shortage: companies being too picky?

I wouldn't have called Vista cheesy. Its GUI was pretty slick (and indeed handed on to Windows 7). It was, however, poorly implemented, h...

10 hours ago by techkid on Microsoft admits Vista was 'cheesy'

Thanks Nelson, it should be right now.

-Michael.

10 hours ago by Mukimu on Ausgrid network to talk back to operators

I guess the mouse was a necessary evil at the time. I mean, yes, keyboard shortcuts in the right hands are faster than any mouse action (...

11 hours ago by techkid on Microsoft admits Vista was 'cheesy'

fyi google may always lie

11 hours ago by rt luvs youh on Google shows we're killing our language

they probaly always lie about in4mation bout people

11 hours ago by rt luvs youh on Google shows we're killing our language

$6.7million, now we know the price to the tax payer of a government IT project clean up. You've got to ask the question don't you: why o...

12 hours ago by Takenforgranted on Vic scraps HealthSMART system

This story has been voted 10 times in the last 24 hours!

1 day ago, CeBIT 2012 opens: photos

This story has been voted 15 times in the last 24 hours!

1 day ago, Lenovo ThinkPad 3G tablet (32GB)

Facebook Activity

Keep up with ZDNet Australia

LinkedinLinkedin Join our network

RSS FeedsRSS Feeds Subscribe now

NewslettersNewsletters Subscribe today

AlertAlertsSubscribe now

ZDNet Events Calendar

ZDNet Events Calendar

Plan Comparison

Prev Next
Loading...
Deals powered by WhistleOut

Sponsored resources