2 ms·

Though I disagree with the research in general, if you did want to research "hypocrite commits" in an actual OSS setting, there isn't really any other way to do

Though I disagree with the research in general, if you did want to research "hypocrite commits" in an actual OSS setting, there isn't really any other way to do it other than actually introducing bugs per their proposal. That being said, I think it would've made more sense for them to have created some dummy complex project for a class and have say 80% of the class introduce "good code", 10% of the class review all code and 10% of the class introduce these "hypocrite" commits. That way you could do similar research without having to potentially break legit code in use. I say this since the crux of what they're trying to discover is: 1. In OSS anyone can commit. 2. Though people are incentivized to reject bad code, complexities of modern projects make 100% rejection of bad code unlikely, if not impossible. 3. Malicious actors can take advantage of (1) and (2) to introduce code that does both good and bad things such that an objective of theirs is met (presumably putting in a back-door).

not2b 6y ago
No, there's an ethical way to do it. You get the permission of the top people in the project you want to test (in this case, that would be Linus and Greg K-H), but the more junior maintainers aren't informed. You then see which bad changes are caught and which aren't, but you have a backstop to prevent malicious code from actually getting into a release. And even then, you leave it to the people in charge of the project to decide whether they think this would be a worthwhile test or a waste of time. To do otherwise is completely unethical experimentation on unwilling human subjects, plus a risk that if you "succeed" (in sneaking something by) you have harmed the public.
- deleted 6y ago
  [deleted]
cortesoft 6y ago
'Red team' exercises happen ethically all the time. You get permission from people in charge (of either a project or a company), you agree on the ground rules, and then you do the exercise. They don't have to tell everyone in the group, but you have to tell certain key people and get their buy in.
- ska 6y ago
  There's no good reason this couldn't have been done here, though not all OSS projects are set up in a way to make this easy.
deleted 6y ago
[deleted]

not2b 6y ago

No, there's an ethical way to do it. You get the permission of the top people in the project you want to test (in this case, that would be Linus and Greg K-H), but the more junior maintainers aren't informed. You then see which bad changes are caught and which aren't, but you have a backstop to prevent malicious code from actually getting into a release. And even then, you leave it to the people in charge of the project to decide whether they think this would be a worthwhile test or a waste of time. To do otherwise is completely unethical experimentation on unwilling human subjects, plus a risk that if you "succeed" (in sneaking something by) you have harmed the public.

deleted 6y ago
[deleted]

cortesoft 6y ago

'Red team' exercises happen ethically all the time. You get permission from people in charge (of either a project or a company), you agree on the ground rules, and then you do the exercise. They don't have to tell everyone in the group, but you have to tell certain key people and get their buy in.

ska 6y ago
There's no good reason this couldn't have been done here, though not all OSS projects are set up in a way to make this easy.

deleted 6y ago

[deleted]