• 0 Posts
  • 410 Comments
Joined 1 year ago
cake
Cake day: June 18th, 2023

help-circle







  • Medical devices are required to comply with 21 CFR 820 in the United States, which establishes quality management standards. This includes minimum standards for the software development lifecycle, including software verification and validation testing.

    In the EU, broadly equivalent standards include ISO 13485 and IEC 62304.

    If an OEM wants to do a software update, they at minimum need to perform and document a change impact analysis, verification testing, and regression testing. Bigger changes can involve a new FDA submission process.

    If you go around hacking new software features into your medical device, you are almost certainly not doing all of that stuff. That doesn’t mean that your software changes are low quality–maybe, maybe not. But it would be completely unfair to hold your device to the standard that the FDA holds them to–that medical devices in the United States are safe and effective treatments for diseases.

    This may be okay if you want to hack your own CPAP (usually a class II device) and never sell it to someone else. But I think we all need to acknowledge that there are some serious risks here.


  • The Linux software you can get as a regular user from your typical Linux distributions is absolutely not any more secure on average than your typical Windows software.

    I say this as someone who writes application programs on both systems.

    I think it’s really debatable whether the Linux kernel is really any more secure than the Windows NT kernel. Linux advocates have pushed the “many eyes, shallow bugs” line for a long time, but high profile lapses seem to really have put the lie to that.








  • Another aspect to this is that Android is Linux, but it is not GNU / Linux. This is true both in the literal sense of not using GNU coreutils or glibc, and also in the broader sense.

    What I mean by the “broader” sense:

    • no X or Wayland
    • GTK or Qt support is something an application has to bring with them.
    • filesystem is substantially reorganized
    • users and system permissions setup substantially differently

    To the application programmer Android / Linux looks like a completely different ball game.


  • Israel has already been fighting a war with Hezbollah that Hezbollah declared. These attacks were fairly specifically targeted at Hezbollah’s military equipment. They have been arguably successful at disrupting Hezbollah’s communications, and likely command and control systems. That by itself is a valid military objective.

    To the extent that these attacks directly hurt Hezbollah personnel, and to the extent that they damaged Hezbollah’s morale: those too are valid military objectives.

    So “war crime” gets thrown around here quite a bit just because there are high civilian casualties. The facts are twofold: Civilian casualties have always been a part of warfare; and there is no specific number or proportion that makes some act into a war crime. That’s just not how these kinds of laws are written.

    I have not yet seen a strong argument for a specific war crime rooted in a specific basis in international law. A lot of people bring up protocols 1 and 2 to the Geneva conventions, but Israel and the US have not ratified those.

    There are other conventions that regulate weapons of war, but I’m pretty sure none of them are going to address pager bombs directly. An argument there would have to be at least somewhat creative.