I'm a T1 diabetic, have worked on open source diabetes-tech (OpenAPS), and have used a number of different CGMs (though not this one specifically). This story... does not make very much sense.
CGMs (of any brand) are not, and have never been, reliable in the way that this story implies that people want them to be reliable. The physical biology of CGMs makes that sort of reliability infeasible. Where T1s are concerned, patient education has always included the need to check with fingerstick readings sometimes, and to be aware of mismatches between sensor readings and how you're feeling. If a brand of CGMs have an issue that sometimes causes false low readings, then fixing it if it's fixable is great, but that sort of thing was very much expected, and it doesn't seem reasonable to blame it for deaths. Moreover, there are two directions in which readings can be inaccurate (false low, false high) with very asymmetric risk profiles, and the report says that the errors were in the less-dangerous direction.
The FDA announcement doesn't say much about what the actual issue was, but given that it was linked to particular production batches, my bet is that it was a chemistry QC fail in one of the reagents used in the sensor wire. That's not something FOSS would be able to solve because it's not a software thing at all.
> CGMs (of any brand) are not, and have never been, reliable in the way that this story implies that people want them to be reliable
This has been my impression. I briefly used an Abbott Lingo to help me understand some health issues I was experiencing.
It's always been clear to me (including in the app and documentation) that CGMs are an extremely convenient tool as a first line - but struggle in extreme circumstances. And, let's be clear, if you would generally know if your body is in one of these extreme circumstances. You'd probably be feeling like shit.
That's not to mention the device in question, the Freestyle Libre, is (to my understanding) by far the most popular insulin-dependent diabetes CGM available.
This article is equivalent to calling the Boeing 737 unsafe because it's had the most Full Lost Events while completely ignoring it's flown 238.84M flights (which is basically more than the entire rest of the list combined).
That is odd. A too-low reading would result in less insulin and a high blood glucose, which can be extremely uncomfortable but is not immediately deadly.
If it had read too high, it could result in an insulin overdose, which can indeed bring coma followed by death in fairly short order.
Agreed. This story is clearly pushing an agenda to an extreme degree. They spent a lot of time linking to different things and past stories, but the claim of having killed seven people gets almost no coverage in the story. Can we at least get a source to where they’re getting that information?
>Such should be done only with great care, as a false low reading can harm and even kill the patient (who eats a high-sugar-content item while glucose in the blood is, in fact, not low).
I've been a type I diabetics for over 25 years and I don't quite understand this one. Low blood sugar is an immediate life or death situation, but high blood sugar killing people? Just how high was it and for how long?
As someone that has a CGM I still calibrate it by using a blood test every couple of days because the CGM sensors can wander on accuracy.
It depends on what the true blood sugar value was: if someone were already at the high end of normal and a 'brittle diabetic', you can end up in 'diabetic ketoacidosis' for T1DM individuals or—less likely—'hyperosmolar hyperglycemic state' generally.
Sorry to be crass, but this type of argument is exactly why non-experts shouldn't be talking about topics they aren't experts on. Admittedly, I am also NOT an expert here - but I am married to a doctor and have gleaned a thing or two to be comfortable communicating this very, very specific retort.
Your argument completely ignores the massive, massive qualifier of "if not treated".
Low blood sugar is an acute emergency. Diabetics can die very quickly from low blood sugar (well anyone can, it's just diabetics are more at risk).
High blood sugar becomes interesting because it's generally systematic, untreated high blood sugar that leads to issues. For someone using a CGM and at least attempting to manage their blood sugar, it _should_ be hard for them to actually hit the high blood sugar emergency state. This condition is largely unique to people who have uncontrolled diabetes and have long, extended times of extreme blood sugar.
Caveat Emptor: I myself am not a doctor. I love to learn from my wife. I'm confident enough to present an argument on an internet forum, but I'm certainly not confident or qualified enough to give you or anyone _actual_ medical advice.
You can die on the order of hours to days not of high blood sugar per se, but of the low insulin causing diabetic ketoacidosis parent comment mentions.
It would be odd for a faulty sensor to cause an otherwise bad day into dka and death though. The sensor would need to be wildly off for hours and the user to not notice. Insulin delivery would need to be paused or greatly reduced for many hours. There are additional therapies like SGLT-2 that could make this more likely but they usually aren’t used with T1D precisely because they break the normally very strong correlation between inadequate insulin levels (leading to dka) and high blood glucose.
Even though I can’t think of an easy way for a false low(s) to turn into lethal DKA, that doesn’t mean it didn’t happen. Abbott sells a lot of CGMs. It could have been a contributing factor to several deaths even if the fault would almost always not be a significant issue.
I’m bound to get type 2 some day. So I learned quite a bit about diabetes now. And low sugar is very bad. So a false low sugar tells the patient to eat sweet things. A high sugar causes lots of damage, but I have never heard of it causing death. Usually something gets amputated first. This finding was strange.
Let’s remember this writer is someone who has diabetes and an axe to grind. This is not news. This is a rant.
That seemed odd to me as well (also diabetic). When I'm not being responsible, I can ride out a BG of 300-400 for hours and mostly I'm just lethargic.
That said, my mother in law, who had worse diabetes than me, went without her pump during mine and her daughter's wedding (a bit of vanity about the pump showing through her dress). She was at 600+, and started feeling pretty ill that evening.
I depend on a pump and CGM (currently that's a Dexcom G7 and Omnipod, but I've used other brands as well).
I like the technology, but you have to 1) know your own body and 2) verify if you are uncertain about the readings. Every time I've switched devices I've interacted with diabetes educators, and they pretty much always tell me to always be prepared to verify manually (with an old-school finger stick and test strips).
Additionally, it's not always the fault of the technology, but often where meatspace and technology interface. When you insert a CGM, there's always a risk of the canula not going into the skin correctly. (usually it's a spring-loaded insertion tool and shoot a needle into your skin quickly, but it can mess up if the amount of pressure applied is wrong etc)
In such a case, the sensor that measures your blood will often, where you can't see, sit on top of the skin. This results in insanely low readings. That happens to me a few times a year (I swap out the sensor every 10 days), and you have to listen to how your body feels relative to the readings, and replace the sensor if necessary.
"... wrongful death lawsuits are typically the only way to hold these companies accountable. Yet, there are very few people who have not agreed Abbott's toxic terms of their proprietary companion application ..."
I (a non-diabetic interested in athletic performance) use an Abbott CGM sporadically and I have absolutely not agreed to any terms of service nor any other agreement of any kind - legal or otherwise.
I bought a purpose-specific, old model iphone from "Back Market" with no SIM card, very briefly allowed it wifi access long enough to download the "Lingo" app, then set the phone to airplane mode. Dedicated, throwaway email and AppleID.
It has never left airplane mode and it works perfectly. Pairing subsequent sensors does not require taking it out of airplane mode.
Further, I have no legal relationship nor have I made any agreement of any kind with Abbott.
I highly recommend that any user of these devices do the same.
In most cases you can’t use the device without agreeing to the terms of service right?
For example a service I use a lot recently changed their terms of service - there was no way to keep using the service without agreeing.
Might be different for devices or services that don’t need internet to function; but even for those you have some “activation” step nowadays that forces you to agree before “unlocking”
Part of the benefit of CGM’s is you can automatically load your readings to your doctor. I have a T1 child, so when I call with a problem I can get quick answers.
Related, Abbot previously had problems with their freestyle lite test strips. There were lawsuits, fines and most insurance dropped them from their covered diabetic suppliers.
> Who agreed to that ToS ? Abby McAbbott ? With no phone number ? A throwaway email address ?
I don’t think this matters in the way you think it does. If they can demonstrate that you have to click through the ToS to use the device and app, then the burden would be on you to show that you did not accept the ToS to use the device. But therein lies the catch: If you found a way to circumvent their setup process, you wouldn’t be using the device as designed or intended.
> If you found a way to circumvent their setup process, you wouldn’t be using the device as designed or intended.
Liability in civil court is not as simple as you posit. Severability and judge discretion are but 2 ways that immediately can invalidate this line of argument. The cause of actual damages are almost always scrutinized, meaning the company would have to prove that the legal agreement could somehow have prevented the damage. Courtrooms are often mischaracterized as following robotic rules and precedence to ill-effect, as if there aren't people in the courtroom using good judgement. This is largely because those cases are the ones most publicized, not because it's the norm.
That’s orthogonal to the comment I’m responding to. The parent commenter was claiming that because they left a device in airplane mode when they accepted the ToS, it doesn’t count. Like it’s a loophole that allows one to accept it but not have it count.
The actual terms of the ToS will always be evaluated in court. You can’t, however, go into court and argue that the ToS doesn’t apply because you put a fake name into the app and left it in airplane mode.
You also wouldn’t get anywhere if you bought their device but used it with your own reverse engineered app or something, as the app is considered part of the product.
"If they can demonstrate that you have to click through the ToS to use the device and app ..."
There's nothing to demonstrate. We will have no interactions.
My parent implied (probably correctly) that their ToS is toxic. I am pointing out that there is no reason for you to enter into that ToS.
Are you suggesting that I, an anonymous piggyback user of their service, would blow up my anonymity (and all of the protections and peace of mind that it affords) by attempting to reestablish some form of legal contact ?
No. It's easy come, easy go and that's just fine with me.
> There's nothing to demonstrate. We will have no interactions.
Ok? Then it doesn’t matter if you accept or not.
The ToS doesn’t come into play unless there’s legal action. If you’re never going to enter into legal action with the company then it doesn’t matter if you accept the ToS or not.
Doesn't really work that way. If you want to sue Abbot, then you have to reveal yourself. At which point, it will be clear that you were in fact using the product and did in fact agree to the ToS. If you never sue Abbot, then sure. But then it doesn't matter.
Just imagine how different the world would be if this wasn't allowed and any time a ToS was pushed out like this the user had the option to offer a counter ToS and the company must have a human look it over and agree/disagree within a set period of time.
> I bought a purpose-specific, old model iphone from "Back Market" with no SIM card, very briefly allowed it wifi access long enough to download the "Lingo" app, then set the phone to airplane mode. Dedicated, throwaway email and AppleID.
None of this actually matters if you went through the steps to use the app. The app is designed such that you agree to the terms before you can use it.
You can use all the throwaway emails, devices, VPNs, and other tricks in the world, but unless you can reliably demonstrate to a court that you were utilizing the app in a way that didn’t involve accepting any terms of service then they could simply demonstrate that it’s part of their app flow.
Even using tricks to utilize the device outside of the app wouldn’t help, because they could simply demonstrate that you weren’t using it as designed or intended.
> I highly recommend that any user of these devices do the same.
No thank you. I have to wear these devices 24/7 to keep me alive, and it was a huge quality of life improvement when I was able to control them all from my phone. I see literally no benefit to doing what you suggest.
Our almost 5 year old has had T1D for two years. We ended up going the way of a controlled lower carb diet for our entire family. Other than the greatly increased cost to eat this way, it has been transformative for diabetes management of our son, the amount of sleep we get, and the lessened risk of aggressive lows.
We've managed to keep our sons A1C in the 6-7% window after we changed our diet to be heavily carb controlled.
Non-diabetic who's interested in bio-feedback here. The GI graph is indeed dramatic[1].
Equally dramatic, in my experience, is the effect of exercise in modulating glucose spikes. It quickly became apparent that if I walked or worked out at the gym within 30mins of a meal, dGlucose/dt and subsequently max glucose would be dramatically reduced. Eventually, I got into the habit of planning exercise post high-GI meals as a way eliminate spikes.
It was an effective weightloss strategy for me as opposed to strictly a glucose regulation method and a positive experience as a whole as I got to develop an intuitive understanding of a physiological process I had only a theoretical understanding of before.
1. It would have been nice to see a labeled abscissa[2][x-axis].
Tidepool is a non-profit focused on diabetes. Among other things, they are working on an algorithm (loop) that does insulin dosing: https://www.tidepool.org/tidepool-loop
If one wants to separate the hardware (insulin pump, CGM) from the algorithm that controls them, seems like Tidepool is one org to talk to.
"Globally, Abbott has received reports of 736 severe adverse events (57 in the U.S.) and seven deaths (none in the U.S.) potentially associated with this issue."[1]
Thanks. That’s very different than the headline claim that the issue killed 7 patients. The “associated with” is a broad term in cases like this that means the device may have been used at the time, not that the bug specifically caused the death.
FWIW CVS did sent out a letter via USPS (I use their mail order service) about the recall and the risk. I'm not sure what the "undisclosed bug" refers to.
Can anyone find the link to the document that claims 7 patients died as a result of these false low glucose readings? It’s strange that this article would go to great lengths to include footnotes and sources for various things except for the core of their claim.
On one hand, this is a very, very bad bug. On the other, the article is almost of hit job to try to prove FOSS would have solved this issue. There are also a lot of completely factually incorrect statements and wild assumptions.
If my understanding is correct, the device in question, the Freestyle Libre 3, is the most popular continuous glucose monitor (GCM) in production. And, one of only a few approved GCMs available. By the very nature of being an extremely popular device that helps manage a chronic, high effort disease (diabetes management is a massive, massive mental drain) - you're going to have failures.
Not to mention, I've always been under the impression that GCMs have some faults and IF the device reports do not match your expectations, you should confirm with an alternative method (like a finger prick) or seek emergency medical attention (which should have been sought in these extreme circumstances, anyways).
-----
Here's the thing for me. FOSS essentially assumes that the user is going to be willing to understand the underlying details to know when FOSS fucks up. Yes, when FOSS fucks up. That's simply not realistic for any consumer product. If your argument for FOSS relies on users being able to read raw data and interpret things that are only learned by education, that's not a consumer grade solution.
Anecdotally, I used use Abbott's Lingo CGM a few months ago to help get me more data on a health issue I was having. I would never, ever, in my wildest dreams have trusted FOSS to get this right. There's simply too much money/effort/rigor involved in getting these biomedical devices correct to believe that the FOSS community could simply create a better product without actually doing any trials or studies. Not to mention, the recommended app (Juggluco) has a terrible UI. This just isn't going anywhere.
To be clear, this is a deadly bug and Abbott should be held accountable - but claiming the solution is some untested, untrailed, terrible UX is not the answer.
In the context of FOSS adherents in general, the belief is that a rising tide lifts all boats: that the work of one dedicated open source hobbyist auditing CGM code for flaws would benefit all CGM users one way or another, if I apply that general principle here as a specific example. However, the characteristic of shoddy UX is loosely correlated with how much the developer(s) choose to (and can afford to) spend developing their work, not with whether the work is open or closed source. The exact balance shifts over time based on cultural-economic shifts in both developer capability (“what’s a folder? does left-click mean I have to use my left hand?”) and in free time energy (“I did so many hours at work to afford rent/food next week that I have no energy left to care about PRs”).
In any case, I agree that the post falls quite flat at being effective advocacy here; to me, not because it clamors for “terrible UX”, but because it fails to make a case that the author’s desired FOSS outcome holds any value at all for those who don’t know or care about source code. It’s certainly a horror story but I’m quite inured to horror as a sales tactic, and that’s where it drops the ball.
> The FDA reports that Freestyle injured over 700 people and killed seven people with this bug. Spcifically, the bug caused the device to falsely report an extremely low glucose level. Advanced stage diabetics use low reading information to inform them that they may have too much insulin currently. The usual remedy is to eat something sugary to raise glucose in the blood. Such should be done only with great care, as a false low reading can harm and even kill the patient (who eats a high-sugar-content item while glucose in the blood is, in fact, not low)
I bet almost everyone with a device with that bug was injured more or less, because high blood sugar is a silent damager of many organs resulting in cumulative damage without overt short term symptoms of injury. For example, slow damage to eyesight, kidneys and nerves in the feet.
So my wife has a CGM and is stuck with a fancy pump that is supposed to "automatically" coordinate with her sensor to deliver or reduce insulin when it detects her numbers are too high/low.
I've always been suspicious of the yahoos writing the software that controls these kinds of devices being a security guy and all.
But I also would love to participate in, contribute to or help in any way with reverse engineering, open sourcing, or in some other way making it so that my wife's life isn't dependent upon the quality of software developed by the lowest bidder they could outsource it to.
If anyone knows how I could help please let me know who to reach out to.
Android APS, and xDrip. Getting watches to allow ble connection for CGMs is a great RE opportunity. It is really hard to have stable bluetooth connections.
I worked at medtronic in the early 2000's (early paradigm pumps) and were evaluating wireless protocols and security... at the time we determined it was impossible to secure, once the FDA approved another device maker that did have connectivity there was a scramble to catch up. (this was palmos/pocketpc era).
It was fun work but I always remembered how insanely detailed the code was, 8bit low power microcontrollers (some 16bit) but really really really tight C code.
Then the demand for remote control happened and that really crapped the bed.
https://www.medtronic.com/en-us/e/product-security/security-...
The amazing developer Scott Hanselman built on a PalmOS app to store readings and if I recall correctly wore 2 pumps with fast/slow insulin... he had a cybernetic pancreas in the mid-2000's.
I'm a T1 diabetic, have worked on open source diabetes-tech (OpenAPS), and have used a number of different CGMs (though not this one specifically). This story... does not make very much sense.
CGMs (of any brand) are not, and have never been, reliable in the way that this story implies that people want them to be reliable. The physical biology of CGMs makes that sort of reliability infeasible. Where T1s are concerned, patient education has always included the need to check with fingerstick readings sometimes, and to be aware of mismatches between sensor readings and how you're feeling. If a brand of CGMs have an issue that sometimes causes false low readings, then fixing it if it's fixable is great, but that sort of thing was very much expected, and it doesn't seem reasonable to blame it for deaths. Moreover, there are two directions in which readings can be inaccurate (false low, false high) with very asymmetric risk profiles, and the report says that the errors were in the less-dangerous direction.
The FDA announcement doesn't say much about what the actual issue was, but given that it was linked to particular production batches, my bet is that it was a chemistry QC fail in one of the reagents used in the sensor wire. That's not something FOSS would be able to solve because it's not a software thing at all.
> CGMs (of any brand) are not, and have never been, reliable in the way that this story implies that people want them to be reliable
This has been my impression. I briefly used an Abbott Lingo to help me understand some health issues I was experiencing.
It's always been clear to me (including in the app and documentation) that CGMs are an extremely convenient tool as a first line - but struggle in extreme circumstances. And, let's be clear, if you would generally know if your body is in one of these extreme circumstances. You'd probably be feeling like shit.
That's not to mention the device in question, the Freestyle Libre, is (to my understanding) by far the most popular insulin-dependent diabetes CGM available.
This article is equivalent to calling the Boeing 737 unsafe because it's had the most Full Lost Events while completely ignoring it's flown 238.84M flights (which is basically more than the entire rest of the list combined).
That is odd. A too-low reading would result in less insulin and a high blood glucose, which can be extremely uncomfortable but is not immediately deadly.
If it had read too high, it could result in an insulin overdose, which can indeed bring coma followed by death in fairly short order.
> This story... does not make very much sense
Agreed. This story is clearly pushing an agenda to an extreme degree. They spent a lot of time linking to different things and past stories, but the claim of having killed seven people gets almost no coverage in the story. Can we at least get a source to where they’re getting that information?
>Such should be done only with great care, as a false low reading can harm and even kill the patient (who eats a high-sugar-content item while glucose in the blood is, in fact, not low).
I've been a type I diabetics for over 25 years and I don't quite understand this one. Low blood sugar is an immediate life or death situation, but high blood sugar killing people? Just how high was it and for how long?
As someone that has a CGM I still calibrate it by using a blood test every couple of days because the CGM sensors can wander on accuracy.
It depends on what the true blood sugar value was: if someone were already at the high end of normal and a 'brittle diabetic', you can end up in 'diabetic ketoacidosis' for T1DM individuals or—less likely—'hyperosmolar hyperglycemic state' generally.
See https://www.mayoclinic.org/diseases-conditions/hyperglycemia... for a discussion of both (in Emergency conditions)
Sorry to be crass, but this type of argument is exactly why non-experts shouldn't be talking about topics they aren't experts on. Admittedly, I am also NOT an expert here - but I am married to a doctor and have gleaned a thing or two to be comfortable communicating this very, very specific retort.
Your argument completely ignores the massive, massive qualifier of "if not treated".
Low blood sugar is an acute emergency. Diabetics can die very quickly from low blood sugar (well anyone can, it's just diabetics are more at risk).
High blood sugar becomes interesting because it's generally systematic, untreated high blood sugar that leads to issues. For someone using a CGM and at least attempting to manage their blood sugar, it _should_ be hard for them to actually hit the high blood sugar emergency state. This condition is largely unique to people who have uncontrolled diabetes and have long, extended times of extreme blood sugar.
Caveat Emptor: I myself am not a doctor. I love to learn from my wife. I'm confident enough to present an argument on an internet forum, but I'm certainly not confident or qualified enough to give you or anyone _actual_ medical advice.
You can die on the order of hours to days not of high blood sugar per se, but of the low insulin causing diabetic ketoacidosis parent comment mentions.
It would be odd for a faulty sensor to cause an otherwise bad day into dka and death though. The sensor would need to be wildly off for hours and the user to not notice. Insulin delivery would need to be paused or greatly reduced for many hours. There are additional therapies like SGLT-2 that could make this more likely but they usually aren’t used with T1D precisely because they break the normally very strong correlation between inadequate insulin levels (leading to dka) and high blood glucose.
Even though I can’t think of an easy way for a false low(s) to turn into lethal DKA, that doesn’t mean it didn’t happen. Abbott sells a lot of CGMs. It could have been a contributing factor to several deaths even if the fault would almost always not be a significant issue.
I’m bound to get type 2 some day. So I learned quite a bit about diabetes now. And low sugar is very bad. So a false low sugar tells the patient to eat sweet things. A high sugar causes lots of damage, but I have never heard of it causing death. Usually something gets amputated first. This finding was strange.
Let’s remember this writer is someone who has diabetes and an axe to grind. This is not news. This is a rant.
That seemed odd to me as well (also diabetic). When I'm not being responsible, I can ride out a BG of 300-400 for hours and mostly I'm just lethargic.
That said, my mother in law, who had worse diabetes than me, went without her pump during mine and her daughter's wedding (a bit of vanity about the pump showing through her dress). She was at 600+, and started feeling pretty ill that evening.
I depend on a pump and CGM (currently that's a Dexcom G7 and Omnipod, but I've used other brands as well).
I like the technology, but you have to 1) know your own body and 2) verify if you are uncertain about the readings. Every time I've switched devices I've interacted with diabetes educators, and they pretty much always tell me to always be prepared to verify manually (with an old-school finger stick and test strips).
Additionally, it's not always the fault of the technology, but often where meatspace and technology interface. When you insert a CGM, there's always a risk of the canula not going into the skin correctly. (usually it's a spring-loaded insertion tool and shoot a needle into your skin quickly, but it can mess up if the amount of pressure applied is wrong etc) In such a case, the sensor that measures your blood will often, where you can't see, sit on top of the skin. This results in insanely low readings. That happens to me a few times a year (I swap out the sensor every 10 days), and you have to listen to how your body feels relative to the readings, and replace the sensor if necessary.
"... wrongful death lawsuits are typically the only way to hold these companies accountable. Yet, there are very few people who have not agreed Abbott's toxic terms of their proprietary companion application ..."
I (a non-diabetic interested in athletic performance) use an Abbott CGM sporadically and I have absolutely not agreed to any terms of service nor any other agreement of any kind - legal or otherwise.
I bought a purpose-specific, old model iphone from "Back Market" with no SIM card, very briefly allowed it wifi access long enough to download the "Lingo" app, then set the phone to airplane mode. Dedicated, throwaway email and AppleID.
It has never left airplane mode and it works perfectly. Pairing subsequent sensors does not require taking it out of airplane mode.
Further, I have no legal relationship nor have I made any agreement of any kind with Abbott.
I highly recommend that any user of these devices do the same.
In most cases you can’t use the device without agreeing to the terms of service right?
For example a service I use a lot recently changed their terms of service - there was no way to keep using the service without agreeing.
Might be different for devices or services that don’t need internet to function; but even for those you have some “activation” step nowadays that forces you to agree before “unlocking”
"In most cases you can’t use the device without agreeing to the terms of service right?"
Yeah ?
Who agreed to that ToS ? Abby McAbbott ? With no phone number ? A throwaway email address ?
As I said: I have not entered into any agreements of any kind with Abbott. You should not either.
Part of the benefit of CGM’s is you can automatically load your readings to your doctor. I have a T1 child, so when I call with a problem I can get quick answers.
Related, Abbot previously had problems with their freestyle lite test strips. There were lawsuits, fines and most insurance dropped them from their covered diabetic suppliers.
> Who agreed to that ToS ? Abby McAbbott ? With no phone number ? A throwaway email address ?
I don’t think this matters in the way you think it does. If they can demonstrate that you have to click through the ToS to use the device and app, then the burden would be on you to show that you did not accept the ToS to use the device. But therein lies the catch: If you found a way to circumvent their setup process, you wouldn’t be using the device as designed or intended.
> If you found a way to circumvent their setup process, you wouldn’t be using the device as designed or intended.
Liability in civil court is not as simple as you posit. Severability and judge discretion are but 2 ways that immediately can invalidate this line of argument. The cause of actual damages are almost always scrutinized, meaning the company would have to prove that the legal agreement could somehow have prevented the damage. Courtrooms are often mischaracterized as following robotic rules and precedence to ill-effect, as if there aren't people in the courtroom using good judgement. This is largely because those cases are the ones most publicized, not because it's the norm.
That’s orthogonal to the comment I’m responding to. The parent commenter was claiming that because they left a device in airplane mode when they accepted the ToS, it doesn’t count. Like it’s a loophole that allows one to accept it but not have it count.
The actual terms of the ToS will always be evaluated in court. You can’t, however, go into court and argue that the ToS doesn’t apply because you put a fake name into the app and left it in airplane mode.
You also wouldn’t get anywhere if you bought their device but used it with your own reverse engineered app or something, as the app is considered part of the product.
"If they can demonstrate that you have to click through the ToS to use the device and app ..."
There's nothing to demonstrate. We will have no interactions.
My parent implied (probably correctly) that their ToS is toxic. I am pointing out that there is no reason for you to enter into that ToS.
Are you suggesting that I, an anonymous piggyback user of their service, would blow up my anonymity (and all of the protections and peace of mind that it affords) by attempting to reestablish some form of legal contact ?
No. It's easy come, easy go and that's just fine with me.
> There's nothing to demonstrate. We will have no interactions.
Ok? Then it doesn’t matter if you accept or not.
The ToS doesn’t come into play unless there’s legal action. If you’re never going to enter into legal action with the company then it doesn’t matter if you accept the ToS or not.
I think we agree with one another.
I'm simply trying to reiterate - as often as possible - that you do not need to tie your personal identity to products and services like this.
Merry Christmas!
Doesn't really work that way. If you want to sue Abbot, then you have to reveal yourself. At which point, it will be clear that you were in fact using the product and did in fact agree to the ToS. If you never sue Abbot, then sure. But then it doesn't matter.
Just imagine how different the world would be if this wasn't allowed and any time a ToS was pushed out like this the user had the option to offer a counter ToS and the company must have a human look it over and agree/disagree within a set period of time.
You know, Kind of like a real contract.
> the option to offer a counter ToS and the company must have a human look it over and agree/disagree within a set period of time.
You technically do have this option. You can send your own terms to a company’s legal team.
The answer will always be no. A law enforcing them to respond in a certain period of time won’t change that. Always no.
It is never cost effective to have lawyers review individual contracts for relatively cheap devices.
> I bought a purpose-specific, old model iphone from "Back Market" with no SIM card, very briefly allowed it wifi access long enough to download the "Lingo" app, then set the phone to airplane mode. Dedicated, throwaway email and AppleID.
None of this actually matters if you went through the steps to use the app. The app is designed such that you agree to the terms before you can use it.
You can use all the throwaway emails, devices, VPNs, and other tricks in the world, but unless you can reliably demonstrate to a court that you were utilizing the app in a way that didn’t involve accepting any terms of service then they could simply demonstrate that it’s part of their app flow.
Even using tricks to utilize the device outside of the app wouldn’t help, because they could simply demonstrate that you weren’t using it as designed or intended.
> I highly recommend that any user of these devices do the same.
No thank you. I have to wear these devices 24/7 to keep me alive, and it was a huge quality of life improvement when I was able to control them all from my phone. I see literally no benefit to doing what you suggest.
I found this video interesting on understanding what type 1 diabetic management looks like:
https://www.youtube.com/watch?v=uHaYPEDGaro
Beth McNally & Amy Rush - 'TCR in Practice: Navigating Insulin for Protein & Fat in Type 1 Diabetes'
At the end of the video there is some strategies described with automatic pumps.
And the graph a t=174 is kind of eye opening:
https://youtu.be/uHaYPEDGaro?t=174
Our almost 5 year old has had T1D for two years. We ended up going the way of a controlled lower carb diet for our entire family. Other than the greatly increased cost to eat this way, it has been transformative for diabetes management of our son, the amount of sleep we get, and the lessened risk of aggressive lows.
We've managed to keep our sons A1C in the 6-7% window after we changed our diet to be heavily carb controlled.
Non-diabetic who's interested in bio-feedback here. The GI graph is indeed dramatic[1].
Equally dramatic, in my experience, is the effect of exercise in modulating glucose spikes. It quickly became apparent that if I walked or worked out at the gym within 30mins of a meal, dGlucose/dt and subsequently max glucose would be dramatically reduced. Eventually, I got into the habit of planning exercise post high-GI meals as a way eliminate spikes.
It was an effective weightloss strategy for me as opposed to strictly a glucose regulation method and a positive experience as a whole as I got to develop an intuitive understanding of a physiological process I had only a theoretical understanding of before.
1. It would have been nice to see a labeled abscissa[2][x-axis].
2. https://en.wikipedia.org/wiki/Abscissa_and_ordinate
Tidepool is a non-profit focused on diabetes. Among other things, they are working on an algorithm (loop) that does insulin dosing: https://www.tidepool.org/tidepool-loop
If one wants to separate the hardware (insulin pump, CGM) from the algorithm that controls them, seems like Tidepool is one org to talk to.
"Globally, Abbott has received reports of 736 severe adverse events (57 in the U.S.) and seven deaths (none in the U.S.) potentially associated with this issue."[1]
[1] https://abbott.mediaroom.com/press-releases?item=124718
Thanks. That’s very different than the headline claim that the issue killed 7 patients. The “associated with” is a broad term in cases like this that means the device may have been used at the time, not that the bug specifically caused the death.
FWIW CVS did sent out a letter via USPS (I use their mail order service) about the recall and the risk. I'm not sure what the "undisclosed bug" refers to.
Can anyone find the link to the document that claims 7 patients died as a result of these false low glucose readings? It’s strange that this article would go to great lengths to include footnotes and sources for various things except for the core of their claim.
It appears to be in the fourth paragraph.
https://www.fda.gov/medical-devices/medical-device-recalls-a...
> As of November 14, 2025, Abbott has reported 736 serious injuries, and seven deaths associated with this issue.
I don't know how to feel about this article.
On one hand, this is a very, very bad bug. On the other, the article is almost of hit job to try to prove FOSS would have solved this issue. There are also a lot of completely factually incorrect statements and wild assumptions.
If my understanding is correct, the device in question, the Freestyle Libre 3, is the most popular continuous glucose monitor (GCM) in production. And, one of only a few approved GCMs available. By the very nature of being an extremely popular device that helps manage a chronic, high effort disease (diabetes management is a massive, massive mental drain) - you're going to have failures.
Not to mention, I've always been under the impression that GCMs have some faults and IF the device reports do not match your expectations, you should confirm with an alternative method (like a finger prick) or seek emergency medical attention (which should have been sought in these extreme circumstances, anyways).
-----
Here's the thing for me. FOSS essentially assumes that the user is going to be willing to understand the underlying details to know when FOSS fucks up. Yes, when FOSS fucks up. That's simply not realistic for any consumer product. If your argument for FOSS relies on users being able to read raw data and interpret things that are only learned by education, that's not a consumer grade solution.
Anecdotally, I used use Abbott's Lingo CGM a few months ago to help get me more data on a health issue I was having. I would never, ever, in my wildest dreams have trusted FOSS to get this right. There's simply too much money/effort/rigor involved in getting these biomedical devices correct to believe that the FOSS community could simply create a better product without actually doing any trials or studies. Not to mention, the recommended app (Juggluco) has a terrible UI. This just isn't going anywhere.
To be clear, this is a deadly bug and Abbott should be held accountable - but claiming the solution is some untested, untrailed, terrible UX is not the answer.
In the context of FOSS adherents in general, the belief is that a rising tide lifts all boats: that the work of one dedicated open source hobbyist auditing CGM code for flaws would benefit all CGM users one way or another, if I apply that general principle here as a specific example. However, the characteristic of shoddy UX is loosely correlated with how much the developer(s) choose to (and can afford to) spend developing their work, not with whether the work is open or closed source. The exact balance shifts over time based on cultural-economic shifts in both developer capability (“what’s a folder? does left-click mean I have to use my left hand?”) and in free time energy (“I did so many hours at work to afford rent/food next week that I have no energy left to care about PRs”).
In any case, I agree that the post falls quite flat at being effective advocacy here; to me, not because it clamors for “terrible UX”, but because it fails to make a case that the author’s desired FOSS outcome holds any value at all for those who don’t know or care about source code. It’s certainly a horror story but I’m quite inured to horror as a sales tactic, and that’s where it drops the ball.
> The FDA reports that Freestyle injured over 700 people and killed seven people with this bug. Spcifically, the bug caused the device to falsely report an extremely low glucose level. Advanced stage diabetics use low reading information to inform them that they may have too much insulin currently. The usual remedy is to eat something sugary to raise glucose in the blood. Such should be done only with great care, as a false low reading can harm and even kill the patient (who eats a high-sugar-content item while glucose in the blood is, in fact, not low)
I bet almost everyone with a device with that bug was injured more or less, because high blood sugar is a silent damager of many organs resulting in cumulative damage without overt short term symptoms of injury. For example, slow damage to eyesight, kidneys and nerves in the feet.
So my wife has a CGM and is stuck with a fancy pump that is supposed to "automatically" coordinate with her sensor to deliver or reduce insulin when it detects her numbers are too high/low.
I've always been suspicious of the yahoos writing the software that controls these kinds of devices being a security guy and all.
But I also would love to participate in, contribute to or help in any way with reverse engineering, open sourcing, or in some other way making it so that my wife's life isn't dependent upon the quality of software developed by the lowest bidder they could outsource it to.
If anyone knows how I could help please let me know who to reach out to.
There is an open source project using older pumps and somewhat older CGMs (Dexcom G6 and prior)
https://openaps.org/
Android APS, and xDrip. Getting watches to allow ble connection for CGMs is a great RE opportunity. It is really hard to have stable bluetooth connections.
I worked at medtronic in the early 2000's (early paradigm pumps) and were evaluating wireless protocols and security... at the time we determined it was impossible to secure, once the FDA approved another device maker that did have connectivity there was a scramble to catch up. (this was palmos/pocketpc era). It was fun work but I always remembered how insanely detailed the code was, 8bit low power microcontrollers (some 16bit) but really really really tight C code. Then the demand for remote control happened and that really crapped the bed. https://www.medtronic.com/en-us/e/product-security/security-...
The amazing developer Scott Hanselman built on a PalmOS app to store readings and if I recall correctly wore 2 pumps with fast/slow insulin... he had a cybernetic pancreas in the mid-2000's.