Is an open-source pacemaker safer than closed-source?
Is an open-source pacemaker safer than closed-source?

        
        Richard Stallman recently collapsed; he’s OK.  But it did of course get attention in the programming world.For those not in the know, Richard - rms - is the leading light in the Free software movement (Free as in ownership, not free as in no-cost) and he really divides programmers into the camps - the minority who follow, the majority who admire without trying to understand, and the vocal minority dead against him.Now him collapsing raises an interesting question: if he needed a medical device that wasn’t running Free software, would he use it?He answered a similar question once:22. two_front_teeth: Suppose your doctor told you that you needed a medical procedure to survive but that the procedure would require inserting a device inside of your body which ran proprietary software. Would you be willing to have the procedure done to save your life?RMS: The only way I could justify this is if I began developing a free replacement for that very program. It is ok to use a nonfree program for the purpose of developing its free replacement. [source]The principle is really about Freedom; safety is just a sideline here.  But I wondered, would a Free-software device be any safer?  I think the answer is yes and here’s why:The manufacturer makes, say, a pacemaker and releases the software as open-source. Obviously at this exact point in time they release it we have a pacemaker as safe as if they hadn’t released the code too.the attackerNow that the code is public there’s a risk that the attacker can more easily find bugs in the device and attack users of it.Closed source devices have never stopped attackers before, even in medical implants (again and more); its security through obscurity.the bugsOf more concern is straightforward bugs in the software:From 1997 to 2003, at least 212 deaths resulted from defects in five different brands of defibrillators. [via]Update: this post prompted this comment on proggit:I recently had to review code running on an FDA approved class 2b device. It was terrifyingly bad and I discovered several easily triggered bugs from simply reading over the code. I think transparency should be absolutely required for medical systems.Acceptance testing, at least for class 2 devices, is very shallow. If the device I worked with is any indicator for the overall trend, I am terrified of having my life depend on proprietary code.And of course the infamous Therac-25 malfunctions.the defenseBut who else is interested in looking at that code and understanding it?  Users of the pacemaker who are also programmers, and the doctors who prescribe them.There are a lot of programmers who have pacemakers or have loved-ones with pacemakers.  They have a very real motivation to look at it.And there are plenty of doctors who are competent programmers and have the right mindset too.There might even be programming doctors who have pacemakers.I think that open-source pacemakers would quickly get valid improvements and bug fixes and stabilize.I think all users of pacemakers would benefit.
      
      
      

      
      
      

      

			

      
      
      
        
         
        
            

            
           
					
             Notes
             
randomlyhaphazard reblogged this from williamedwardscoder and added:                                                                                                                                                                                    
                                tl;dr YES                            
           
           

            
            
             ↓ click the "share" button below!
    	    
    	    
    	    
	    
        
      