Hacker News Reader

Comment by Bilal_io | Hacker News Reader

According to some comments in Yesterday's thread Debian was also hit with something similar back in April.

Another comment in this thread quotes Crowdstrike's ToS which states that their software should not be used on critical systems.

I blame the hospital for its inability to operate with pen and paper in the event of a computer crash or a power outage.

View on HN

It's pretty difficult to operate a CT scanner with pen and paper, to name just one thing that fell over yesterday. CT scanners are life-critical.

Why any machine related to the operation of a CT scanner itself has to be connected to the internet? The problem is not "using technology" in general. The problem is internet connectivity being not correctly identified as a liability in designing our technology infrastructure systems.

From what I've seen when I've had CTs (I am not a medical professional and have no direct ties to their industry), the machine sends the images in real time to a technician in another room. Those images are then sent to an offsite service for review by a radiologist, then returned to the doctor to give you the results and they're uploaded to Epic where I can review them online at my leisure.

It's all on a network for a reason. If it's on a network, it has to comply with all regulations that govern the service.

Data transfer can happen after data acquisition through another machine that can be connected. If that machine is compromised alternative channels can be found. There is no fundamental reason in how the systems work that before that step anything has to be connected online. Having things online is actually a liability, as evidenced by the mere fact that software like crowdstrike should be installed with kernel access on them. Why instead of going that path, we do not just segregate networks to make them more resilient? The only reason I see is all these -aaS business models. Nothing that really relates to the real needs of people or the healthcare system itself. After the ransomware attacks, instead of reducing attack surface the direction was to actually increase liability and risk by having another point that things can fail. I do not think anybody really learnt from that anything imo.

Coulda woulda shoulda, of course. Money. That's why.

Reply on news.ycombinator.com