Hacker News Reader

Comment by HeyLaughingBoy | Hacker News Reader

At a previous job I was a developer on a medical instrument that used Windows to run the UI.

Before everyone gets all up in arms about it, Windows/Linux UI & database with external microcontrollers handling real-time control is a very common architectural choice for medical and industrial equipment. To the point where many Systems-on-Module (SoMs) come with a Linux-capable ARM processor and a separate, smaller processor for real-time, linked via shared memory.

Anyway, a customer called to report a weird bug that we couldn't resolve. After remoting into the instrument, we discovered that one of the lab technicians had attempted to install Excel on it. At some point the install must have failed, but it left a .dll behind that was causing a conflict with something in our code and keeping the UI from starting properly.

No, we did not learn anything from this incident...

View on HN

Isn't this what Embedded Windows was always for, like for use in medical equipment, ATMs, POS, PLC, oscilloscopes, etc? Basically stuff that's supposed to be fire-and-forget, run 24/7 and that the user shouldn't be able to tinker with.

And also what group policies were for, that can disable the user from installing any software?

Am I wrong to assume that the fuckup was on your end, for using the wrong tool and not configuring it properly?

Back in like early aughts I remember seeing an ATM in Rome that had evidently crashed and was sitting at a DOS prompt. I was much younger then, but I remember thinking it wasn't terribly surprising, but it was also a bit of a wizard of oz moment.

Memories now of what we were given at the hospital long ago: our obstetrics ward was using Philips OBTraceVue software. The original FDA-approved system required Philips to package the OS and hardware all together, so we were given a bunch of generic Compaq desktops to run their fetal heartrate monitoring on.

The biggest annoying complaint was "we want to run our EHR software on it!" but because of the FDA requirements, we weren't allowed to install anything on the box. Yet somehow providing AV could be OK in some cases, and in other cases installing Citrix? And then we'd somehow find out someone managed to install the EHR client onto it anyways and it became a big old mess to have to have Philips come send a tech out of their own to reimage a PC we couldn't "legally" service.

It was a big messy pain for a while back in the day. Was happy when we finally got to upgrade to the newer IntelliSpace software on our own PCs in the ward. (Also got to meet a support engineer that came out rocking an Agilent badge, so that was super cool on its own right of history...)

> somehow providing AV could be OK in some cases, and in other cases installing Citrix?

The only way this could possibly have passed FDA scrutiny would be if the original manufacturer had validated this particular system configuration and approved it.

There's probably tons of stuff like this going on all over the place, but it manages to say under the radar, so no one notices it. But with the FDA's increased scrutiny on cybersecurity it will eventually disappear.

> Am I wrong to assume that the fuckup was on your end, for using the wrong tool and not configuring it properly?

Not at all. I agree that it should have been locked down and only privileged accounts should be allowed software update. But the system auto-booted into an Administrator account so it really wasn't a surprise that eventually someone would do something stupid.

I will say that this was for Windows NT retail, not Windows NT Embedded. At that point, getting an NT Embedded license practically required sacrificing your firstborn child. It was only when Microsoft got to Win XP Embedded that the license didn't look like it was written by a team of lawyers who already knew that they were perpetually in Hell.

>But the system auto-booted into an Administrator account

Sounds like a major NT configuration mistake.

That wasn't a Therac-25 by any chance?

Sorry. Couple decades too late.

Reply on news.ycombinator.com