22 ms·

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whil

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

AdamJacobMuller 6y ago
This statement rings true because it is the wordsmith'd version of exactly what the department head probably said when he first heard, which probably went something like "what the f*k did you do, who the f*k thought this was a good idea, and who the f*k told you you could do this?"
- DannyBee 6y ago
  Yeah, i thought the same thing. This is basically someone yelling in an office put through a diplomacy filter, which is what you would expect happened.
- mike_d 6y ago
  I'm pretty sure the biggest program at UMN is Social Sciences. Conducting research experiments on unwitting subjects (the kernel maintainers) is a huge ethics violation. I can only imagine the other department heads screaming at the head of the, relatively speaking, small CS department.
  - mumblemumble 6y ago
    When I was in grad school for a branch of social sciences, we had a whole class on how to conduct research experiments on unwitting subjects. It's something that social scientists do all the time. (Tangentially, it's something that computer people do even more often, and probably with fewer ethics controls. A/B testing, for one prominent example.) But it's typically only allowed when it's clear that the risk of harm to the participants is pretty much negligible. Which is clearly not the case here. As others have said, it's probably the case that the reason this got past the IRB is not because the research was clandestine, but because the team lied about how it might affect people. And probably also, I'm guessing, the IRB had their guard down because they weren't expecting that particular department to be conducting social science field experiments.
mewse-hn 6y ago
I also think it's a good response but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt. The way their statement stands they can investigate themselves and determine they did nothing wrong, we'll have to see what they say down the road.
- belval 6y ago
  Perhaps I am naive but I think the apology should come after the internal investigation. It is more likely that you just have an administrator that became aware of the issue, they won't make an apology until they understand what happened.
- kenjackson 6y ago
  They could investigate and determine that they did nothing wrong, but they aren't the final arbiter of justice. This is not like the police investigating themselves. The OSS community can come to a different conclusion and still punish them. The job of UMN is to get the facts first, and then determine actions. If the OSS community (and others) feel like the actions don't match the facts (or if they feel the facts don't match what actually happened) they can apply their own set of actions.
- IncRnd 6y ago
  I doubt an apology would increase liability in this case, since the actions already occurred and are forensically visible.
- tw04 6y ago
  >but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt. I think an apology before they've had a chance to review everything that occurred would be rather empty, don't you? "I'm sorry you're upset"? I far prefer what they've stated they're going to do which is stop the activity they know about immediately, and to review how we got to this point. If, on the off chance, the professor was being honest about ensuring they weren't wasting anyone's time, and ensuring no bad code made it into the kernel, then the situation becomes a bit more murky. They'd need to go through all of the associated emails both public and internal to validate that. If on the other hand this is in fact a duck, I would expect them to both to issue a meaningful apology at that point, as well as lay out the steps they've taken to ensure it doesn't happen again (which they've indicated is their plan). And hopefully restore the trust of the OSS community.
IncRnd 6y ago
There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
- deleted 6y ago
  [deleted]
- MattGaiser 6y ago
  I would argue that first requires investigation. They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.
  - IncRnd 6y ago
    > I would argue that first requires investigation. Why do you think that enough of an investigation hasn't been performed in order to understand culpability? Thay already know what happened and want to learn why it was approved. That was what their comment said. Take a look at the actual PDF from the researchers, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" [1] [1] https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
    - alexeldeib 6y ago
      The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....
Zarathust 6y ago
If they really care about being banned, they'll have no choice but to follow thorough
- simlevesque 6y ago
  Yeah and that's some heavy shade on a university. They'll lose good students if this is not fixed.
  - munk-a 6y ago
    I don't think that's the case (due to how fame works) and I don't even think it's particularly productive to bring up that point. Their actions should be rectified since they did wrong - not out of fear of a punishment. When we bring only a specific punishment in as a consequence then the question of how to respond can be shifted over to a "which is worse" proposition which means that the punishment needs to be properly proportioned. At any rate - I doubt admissions would be appreciably impacted even if they handled this incident extremely poorly - some potential grad students might look elsewhere while most would likely be ignorant of the whole incident.
    - bluGill 6y ago
      There are enough of us here that have heard about this as to make a UMN degree worth less because we will trash a resume with that name on it.
      - munk-a 6y ago
        I certainly wouldn't do so - this looks like it was a research topic by one professor and one grad student... So nearly no one with a degree from UMN was involved with this. Even the specific grad student was college aged at the time and we all did stupid stuff when we were young. I think this only really rubs off on the professor since they clearly should've known better. Honestly I think the biggest blow to the university will be when it comes to hiring CS professors - those are the only folks likely to do the due diligence on this topic or be passively aware of it.
aspaceman 6y ago
They also didn't just throw the group under the bus and try and wash their hands clean - good move.
- balozi 6y ago
  Academia runs on egos and reputations. You can be sure the the fallout is coming.
agf 6y ago
It is a good statement, and I believe they'll follow through, but it's missing something important that is often missing from otherwise professional communication. The last line is "We will report our findings back to the community as soon as practical." It should be followed by "and we will provide an update in no more than 30 days". Without any explicit time frame, holding them publicly accountable becomes trickier. At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more. Note that the companies that do ongoing incident updates on status sites best all do this -- "We will provide an update by 10:30pm PST".
- boomboomsubban 6y ago
  > At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more. They need to act to get the ban rescinded, they can't just ignore this issue away.
  - agf 6y ago
    I agree, that's why in this case (as I say in my post) I believe they'll follow through.
    - boomboomsubban 6y ago
      As the pressure is already on them to rectify the situation, there's no need to for an artificial deadline. It adds nothing, but could delay their announcement or force them to publish an incomplete response.
    - GauntletWizard 6y ago
      "and we admit that a full accounting for these actions is necessary before our ban is rescinded" is a valid (albeit even less common) form of making sure that they are held accountable. Nonetheless, it is important that the accused admits it. The common case today is that admitting you are due to account for your actions is the same as admitting that you are at fault. I have been denied jobs because I have admitted that to being accountable for my decisions, whereas I got the distinct impression had I simply not accounted for them they wouldn't have cared.
Causality1 6y ago
I disagree. There's not a single word of apology in it.
- xiphias2 6y ago
  They don't have to, it's the ,,redearcher'' who has to apologize. The University has to do exactly what they have done and follow up, to keep their reputation.
  - melenaboija 6y ago
    They have to investigate and also apologize accordingly in the name of the university. Saying the researcher is the only responsible of a work that is managed by the university (with things such as probably funds and for sure resources) is just wrong.
- burnished 6y ago
  Too early. The shit storm is less than a day old. You wouldn't accept an insincere apology right? So we shouldn't demand an apology before a sincere one could possibly be issued.
spfzero 6y ago
I agree, and given that they have only just started to look into it, I think it shows an appropriate amount of concern and urgency. They'll at least want to talk to the researchers and get their point of view, before committing any further. This is about the best you could expect at this point, they'll want to proceed methodically.
mariksolo 6y ago
It doesn't take much to write a single paragraph, though. I think the quality of their response will become much more clear later.
- elliekelly 6y ago
  Have you ever drafted a public response for an issue receiving a lot of attention on social media when you don’t know the whole story but, from what little you do know, things aren’t looking great for the entity you represent? You vastly underestimate how much effort and attention was put into writing that “single paragraph” because I promise you it sure does take much.
dleslie 6y ago
Is it? Their ethics committee approved the research, and yet I see no acknowledgement of their responsibility.
- macintux 6y ago
  The story just broke. We don’t know what the IRB saw, we don’t know what they said. Throwing anyone under the bus before there any time to even start asking questions is not what any smart administration should do.
  - dleslie 6y ago
    We know that they approved the research.
    - remarkEon 6y ago
      I think it’s more accurate to say that “we know that they approved something. Whether or not that something turns out to be exactly that this professor and his student did here is I gather a different question.
      - tytso 6y ago
        The "hypocrite commit" preprint/abstract was a controversy which broke late last year. Prof. Lu at that point published an FAQ stating that he didn't think it was Human Subject Research (HSR) and got a post hoc review from the UMN IRB giving him a free pass, agreeing that attempting to con humans is apparently not HSR by their lights. This is three month old news at this point, and is quite well established. What triggered the ban now is another set of suspicious commits was sent by a graduate student in the same research group.
        remarkEon 6y ago
        Thanks, I didn't know that background (shame on me for not reading through all the history I guess). Odd decisions appear to have been made here by all parties. Though I was born in Iowa, I grew up in Minnesota and have a lot of friends who went there (Twin Cities campus, mostly). Definitely not "Minnesota Nice".

AdamJacobMuller 6y ago

This statement rings true because it is the wordsmith'd version of exactly what the department head probably said when he first heard, which probably went something like "what the f*k did you do, who the f*k thought this was a good idea, and who the f*k told you you could do this?"

DannyBee 6y ago
Yeah, i thought the same thing. This is basically someone yelling in an office put through a diplomacy filter, which is what you would expect happened.
mike_d 6y ago
I'm pretty sure the biggest program at UMN is Social Sciences. Conducting research experiments on unwitting subjects (the kernel maintainers) is a huge ethics violation. I can only imagine the other department heads screaming at the head of the, relatively speaking, small CS department.
- mumblemumble 6y ago
  When I was in grad school for a branch of social sciences, we had a whole class on how to conduct research experiments on unwitting subjects. It's something that social scientists do all the time. (Tangentially, it's something that computer people do even more often, and probably with fewer ethics controls. A/B testing, for one prominent example.) But it's typically only allowed when it's clear that the risk of harm to the participants is pretty much negligible. Which is clearly not the case here. As others have said, it's probably the case that the reason this got past the IRB is not because the research was clandestine, but because the team lied about how it might affect people. And probably also, I'm guessing, the IRB had their guard down because they weren't expecting that particular department to be conducting social science field experiments.

mewse-hn 6y ago

I also think it's a good response but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt. The way their statement stands they can investigate themselves and determine they did nothing wrong, we'll have to see what they say down the road.

belval 6y ago
Perhaps I am naive but I think the apology should come after the internal investigation. It is more likely that you just have an administrator that became aware of the issue, they won't make an apology until they understand what happened.
kenjackson 6y ago
They could investigate and determine that they did nothing wrong, but they aren't the final arbiter of justice. This is not like the police investigating themselves. The OSS community can come to a different conclusion and still punish them. The job of UMN is to get the facts first, and then determine actions. If the OSS community (and others) feel like the actions don't match the facts (or if they feel the facts don't match what actually happened) they can apply their own set of actions.
IncRnd 6y ago
I doubt an apology would increase liability in this case, since the actions already occurred and are forensically visible.
tw04 6y ago
>but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt. I think an apology before they've had a chance to review everything that occurred would be rather empty, don't you? "I'm sorry you're upset"? I far prefer what they've stated they're going to do which is stop the activity they know about immediately, and to review how we got to this point. If, on the off chance, the professor was being honest about ensuring they weren't wasting anyone's time, and ensuring no bad code made it into the kernel, then the situation becomes a bit more murky. They'd need to go through all of the associated emails both public and internal to validate that. If on the other hand this is in fact a duck, I would expect them to both to issue a meaningful apology at that point, as well as lay out the steps they've taken to ensure it doesn't happen again (which they've indicated is their plan). And hopefully restore the trust of the OSS community.

IncRnd 6y ago

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...

deleted 6y ago
[deleted]
MattGaiser 6y ago
I would argue that first requires investigation. They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.
- IncRnd 6y ago
  > I would argue that first requires investigation. Why do you think that enough of an investigation hasn't been performed in order to understand culpability? Thay already know what happened and want to learn why it was approved. That was what their comment said. Take a look at the actual PDF from the researchers, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" [1] [1] https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
  - alexeldeib 6y ago
    The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

Zarathust 6y ago

If they really care about being banned, they'll have no choice but to follow thorough

simlevesque 6y ago
Yeah and that's some heavy shade on a university. They'll lose good students if this is not fixed.
- munk-a 6y ago
  I don't think that's the case (due to how fame works) and I don't even think it's particularly productive to bring up that point. Their actions should be rectified since they did wrong - not out of fear of a punishment. When we bring only a specific punishment in as a consequence then the question of how to respond can be shifted over to a "which is worse" proposition which means that the punishment needs to be properly proportioned. At any rate - I doubt admissions would be appreciably impacted even if they handled this incident extremely poorly - some potential grad students might look elsewhere while most would likely be ignorant of the whole incident.
  - bluGill 6y ago
    There are enough of us here that have heard about this as to make a UMN degree worth less because we will trash a resume with that name on it.
    - munk-a 6y ago
      I certainly wouldn't do so - this looks like it was a research topic by one professor and one grad student... So nearly no one with a degree from UMN was involved with this. Even the specific grad student was college aged at the time and we all did stupid stuff when we were young. I think this only really rubs off on the professor since they clearly should've known better. Honestly I think the biggest blow to the university will be when it comes to hiring CS professors - those are the only folks likely to do the due diligence on this topic or be passively aware of it.

aspaceman 6y ago

They also didn't just throw the group under the bus and try and wash their hands clean - good move.

balozi 6y ago
Academia runs on egos and reputations. You can be sure the the fallout is coming.

agf 6y ago

It is a good statement, and I believe they'll follow through, but it's missing something important that is often missing from otherwise professional communication. The last line is "We will report our findings back to the community as soon as practical." It should be followed by "and we will provide an update in no more than 30 days". Without any explicit time frame, holding them publicly accountable becomes trickier. At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more. Note that the companies that do ongoing incident updates on status sites best all do this -- "We will provide an update by 10:30pm PST".

boomboomsubban 6y ago
> At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more. They need to act to get the ban rescinded, they can't just ignore this issue away.
- agf 6y ago
  I agree, that's why in this case (as I say in my post) I believe they'll follow through.
  - boomboomsubban 6y ago
    As the pressure is already on them to rectify the situation, there's no need to for an artificial deadline. It adds nothing, but could delay their announcement or force them to publish an incomplete response.
  - GauntletWizard 6y ago
    "and we admit that a full accounting for these actions is necessary before our ban is rescinded" is a valid (albeit even less common) form of making sure that they are held accountable. Nonetheless, it is important that the accused admits it. The common case today is that admitting you are due to account for your actions is the same as admitting that you are at fault. I have been denied jobs because I have admitted that to being accountable for my decisions, whereas I got the distinct impression had I simply not accounted for them they wouldn't have cared.

Causality1 6y ago

I disagree. There's not a single word of apology in it.

xiphias2 6y ago
They don't have to, it's the ,,redearcher'' who has to apologize. The University has to do exactly what they have done and follow up, to keep their reputation.
- melenaboija 6y ago
  They have to investigate and also apologize accordingly in the name of the university. Saying the researcher is the only responsible of a work that is managed by the university (with things such as probably funds and for sure resources) is just wrong.
burnished 6y ago
Too early. The shit storm is less than a day old. You wouldn't accept an insincere apology right? So we shouldn't demand an apology before a sincere one could possibly be issued.

spfzero 6y ago

I agree, and given that they have only just started to look into it, I think it shows an appropriate amount of concern and urgency. They'll at least want to talk to the researchers and get their point of view, before committing any further. This is about the best you could expect at this point, they'll want to proceed methodically.

mariksolo 6y ago

It doesn't take much to write a single paragraph, though. I think the quality of their response will become much more clear later.

elliekelly 6y ago
Have you ever drafted a public response for an issue receiving a lot of attention on social media when you don’t know the whole story but, from what little you do know, things aren’t looking great for the entity you represent? You vastly underestimate how much effort and attention was put into writing that “single paragraph” because I promise you it sure does take much.

dleslie 6y ago

Is it? Their ethics committee approved the research, and yet I see no acknowledgement of their responsibility.

macintux 6y ago
The story just broke. We don’t know what the IRB saw, we don’t know what they said. Throwing anyone under the bus before there any time to even start asking questions is not what any smart administration should do.
- dleslie 6y ago
  We know that they approved the research.
  - remarkEon 6y ago
    I think it’s more accurate to say that “we know that they approved something. Whether or not that something turns out to be exactly that this professor and his student did here is I gather a different question.
    - tytso 6y ago
      The "hypocrite commit" preprint/abstract was a controversy which broke late last year. Prof. Lu at that point published an FAQ stating that he didn't think it was Human Subject Research (HSR) and got a post hoc review from the UMN IRB giving him a free pass, agreeing that attempting to con humans is apparently not HSR by their lights. This is three month old news at this point, and is quite well established. What triggered the ban now is another set of suspicious commits was sent by a graduate student in the same research group.
      - remarkEon 6y ago
        Thanks, I didn't know that background (shame on me for not reading through all the history I guess). Odd decisions appear to have been made here by all parties. Though I was born in Iowa, I grew up in Minnesota and have a lot of friends who went there (Twin Cities campus, mostly). Definitely not "Minnesota Nice".