• 0 Posts
  • 26 Comments
Joined 1 year ago
cake
Cake day: June 18th, 2023

help-circle


  • Medical devices are required to comply with 21 CFR 820 in the United States, which establishes quality management standards. This includes minimum standards for the software development lifecycle, including software verification and validation testing.

    In the EU, broadly equivalent standards include ISO 13485 and IEC 62304.

    If an OEM wants to do a software update, they at minimum need to perform and document a change impact analysis, verification testing, and regression testing. Bigger changes can involve a new FDA submission process.

    If you go around hacking new software features into your medical device, you are almost certainly not doing all of that stuff. That doesn’t mean that your software changes are low quality–maybe, maybe not. But it would be completely unfair to hold your device to the standard that the FDA holds them to–that medical devices in the United States are safe and effective treatments for diseases.

    This may be okay if you want to hack your own CPAP (usually a class II device) and never sell it to someone else. But I think we all need to acknowledge that there are some serious risks here.


  • The Linux software you can get as a regular user from your typical Linux distributions is absolutely not any more secure on average than your typical Windows software.

    I say this as someone who writes application programs on both systems.

    I think it’s really debatable whether the Linux kernel is really any more secure than the Windows NT kernel. Linux advocates have pushed the “many eyes, shallow bugs” line for a long time, but high profile lapses seem to really have put the lie to that.