Hacker News Reader

Comment by jph | Hacker News Reader

Absolutely NOT because this could kill people.

If you truly have a pacemaker 0day, contact me (joelparkerhenderson) on most major service and I will connect you with my healthcare policy lawyer. She can rapidly open the doors to the vendors who have the risk.

View on HN

Do most medical device manufacturers carry insurance against lawsuits? If so, historically, how high has the bar been before the insurers pay out? If there is a strong relationship between a device manufacturer getting sued and an insurer losing money then this could be a great contact to try.

Yes, but more importantly, medical device makers have broad immunity when their devices go through the PMA process (the most stringent type of FDA approval). Basically, the argument is "hey, the FDA said it was safe".

Then this is where the pressure needs to be applied - at the certification process. It needs to be made a legal requirement to attain certification (if not already), and the certifiers need to follow best practices for vulnerability detection. And it needs to be an ongoing, open process.

Yes, the FDA certification should include something along the lines of "Manufacturer has an ongoing process to evaluate new vulnerabilities and push updates to affected individuals."

It does, at least for new approvals post ~2012. Doesn't help existing devices in the field though.

The question isn't whether it could kill people, but whether it would kill fewer people than not releasing the exploit.

(Though even if you were sure fewer people would die it would still be an ethical conundrum)

And how exactly does he determine whether that is the case?

Reply on news.ycombinator.com