4 ms·

> 3) Getting the consent of the people behind the process would invalidate the results. This has not been a valid excuse since the 1950s. Scientists are not al

> 3) Getting the consent of the people behind the process would invalidate the results. This has not been a valid excuse since the 1950s. Scientists are not allowed to ignore basic ethics because they want to discover something. Deliberately introducing bugs into any open source project is plainly unethical; doing so in the Linux kernel is borderline malicious.

bezout 6y ago
We should ban A/B testing then. Google didn’t tell me they were using me to understand which link color is more profitable for them. There are experiments and experiments. Apart from the fact that they provided the fix right away, they didn’t do anyone harm. And, by the way, it’s their job. Maintainers must approve patches after they ensured that the patch is fine. It’s okay to do mistakes, but don’t tell me “you’re wasting my time” after I showed you that maybe there’s something wrong with the process. If anything, you should thank me and review the process. If your excuse is “you knew the patch was vulnerable”, then how are you going to defend the project from bad actors?
- wccrawford 6y ago
  Actually, I think participants in an A/B test should be informed of it. I think people should be informed when market research is being done on them. For situations where they are already invested in the situation, it should be optional. For other situations, such as new customer acquisition, the person would have the option of simply leaving the site to avoid it. But either way, they should be informed.
- corty 6y ago
  > they didn’t do anyone harm. Several of the patches are claimed to have landed in stable. Also, distributions and others (like the grsecurity people) pick up lkml patches that are not included in stable but might have security benefits. So even just publishing such a patch is harmful. Also, fixes were only provided to the maintainers privately as it seems, and unsuccessfully. Or not at all. > If your excuse is “you knew the patch was vulnerable”, then how are you going to defend the project from bad actors? Exactly the same way as without that "research". If you try to pry open my car door, I'll drag you to the next police station. "I'm just researching the security of car doors" won't help you.
- account42 6y ago
  > We should ban A/B testing then. Google didn’t tell me they were using me to understand which link color is more profitable for them. Yes please.
- deleted 6y ago
  [deleted]
InsomniacL 6y ago
No bugs were introduced and they didn't intend to introduce any bugs. infact, they have resolved over 1000+ bugs in the linux kernel. >> https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... "We did not introduce or intend to introduce any bug or vulnerability in the Linux kernel. All the bug-introducing patches stayed only in the email exchanges, without being adopted or merged into any Linux branch, which was explicitly confirmed by maintainers. Therefore, the bug-introducing patches in the email did not even become a Git commit in any Linux branch. None of the Linux users would be affected. The following shows the specific procedure of the experiment"
- rincebrain 6y ago
  And now all their patches are getting reverted because nobody trusts them to have been made in good faith, so their list of resolved bugs goes to 0.
  - Avamander 6y ago
    It's indeed unfortunate what a few bruised egos will result in.
    - rincebrain 6y ago
      I don't think it's necessarily a bruised ego here - I think what upset him is that the paper was published a few months ago and yet, based on this patch, the author seems to still be attempting to submit deeply flawed patches to LKML, and complaining when people don't trust them to be innocent mistakes for some reason.
  - InsomniacL 6y ago
    so instead of fixing the issue they found of being able to introduce backdoors in to their code, they are going to rollback thousand + of other bug fixes. That's more of a story than what the researchers have done...
    - 6y ago

bezout 6y ago

We should ban A/B testing then. Google didn’t tell me they were using me to understand which link color is more profitable for them. There are experiments and experiments. Apart from the fact that they provided the fix right away, they didn’t do anyone harm. And, by the way, it’s their job. Maintainers must approve patches after they ensured that the patch is fine. It’s okay to do mistakes, but don’t tell me “you’re wasting my time” after I showed you that maybe there’s something wrong with the process. If anything, you should thank me and review the process. If your excuse is “you knew the patch was vulnerable”, then how are you going to defend the project from bad actors?

wccrawford 6y ago
Actually, I think participants in an A/B test should be informed of it. I think people should be informed when market research is being done on them. For situations where they are already invested in the situation, it should be optional. For other situations, such as new customer acquisition, the person would have the option of simply leaving the site to avoid it. But either way, they should be informed.
corty 6y ago
> they didn’t do anyone harm. Several of the patches are claimed to have landed in stable. Also, distributions and others (like the grsecurity people) pick up lkml patches that are not included in stable but might have security benefits. So even just publishing such a patch is harmful. Also, fixes were only provided to the maintainers privately as it seems, and unsuccessfully. Or not at all. > If your excuse is “you knew the patch was vulnerable”, then how are you going to defend the project from bad actors? Exactly the same way as without that "research". If you try to pry open my car door, I'll drag you to the next police station. "I'm just researching the security of car doors" won't help you.
account42 6y ago
> We should ban A/B testing then. Google didn’t tell me they were using me to understand which link color is more profitable for them. Yes please.
deleted 6y ago
[deleted]

InsomniacL 6y ago

No bugs were introduced and they didn't intend to introduce any bugs. infact, they have resolved over 1000+ bugs in the linux kernel. >> https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... "We did not introduce or intend to introduce any bug or vulnerability in the Linux kernel. All the bug-introducing patches stayed only in the email exchanges, without being adopted or merged into any Linux branch, which was explicitly confirmed by maintainers. Therefore, the bug-introducing patches in the email did not even become a Git commit in any Linux branch. None of the Linux users would be affected. The following shows the specific procedure of the experiment"

rincebrain 6y ago
And now all their patches are getting reverted because nobody trusts them to have been made in good faith, so their list of resolved bugs goes to 0.
- Avamander 6y ago
  It's indeed unfortunate what a few bruised egos will result in.
  - rincebrain 6y ago
    I don't think it's necessarily a bruised ego here - I think what upset him is that the paper was published a few months ago and yet, based on this patch, the author seems to still be attempting to submit deeply flawed patches to LKML, and complaining when people don't trust them to be innocent mistakes for some reason.
- InsomniacL 6y ago
  so instead of fixing the issue they found of being able to introduce backdoors in to their code, they are going to rollback thousand + of other bug fixes. That's more of a story than what the researchers have done...
  - 6y ago