5 ms·

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the

by IncRnd 6y ago

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...

deleted 6y ago
[deleted]
MattGaiser 6y ago
I would argue that first requires investigation. They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.
- IncRnd 6y ago
  > I would argue that first requires investigation. Why do you think that enough of an investigation hasn't been performed in order to understand culpability? Thay already know what happened and want to learn why it was approved. That was what their comment said. Take a look at the actual PDF from the researchers, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" [1] [1] https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
  - alexeldeib 6y ago
    The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....
    - IncRnd 6y ago
      Yes, but that doesn't have bearing on my comment that was being referenced, that they didn't say what had happened was wrong. Here is Ken Thompson's apropos paper from 1984. [0] [0] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
      - alexeldeib 6y ago
        Sure. I was answering your question: > Why do you think that enough of an investigation hasn't been performed in order to understand culpability?
    - colechristensen 6y ago
      Honestly I’m guessing this kind of situation didn’t match any existing policy for the review board and a few people made a bad call. We need to make sure to be supportive of people making mistakes and learning from them instead of raising pitchforks for every misstep. Failure is never completely avoidable and responding properly to failure is way more important than never failing.
    - zxspectrum1982 6y ago
      From my reading of the threads in the kernel mailing lists, it seems the IRB thought "is it bioscience with experimentation on live animals? No? Then it's all fine".
      - ellisv 6y ago
        I participated in IRB for a UMN campus and that’s pretty much how these things worked back then.
      - seoaeu 6y ago
        Yeah, especially considering that the IRB said the research was out of scope (specifically that it was not "human subject research") rather than indicating that it was ethical. Kind of like the distinction between a court not having jurisdiction and a court declaring you didn't break any laws.
  - MattGaiser 6y ago
    > We will investigate the research method and the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, if needed. The "if needed" tells me they aren't sure what if anything is wrong yet. It would surprise me if they have done that much of an investigation in the few hours since they might have learned about this beyond scheduling meetings with involved parties and compiling relevant documents in a folder. I think they are at the point of having a bunch of angry emails and a few news articles from certain publications. I don't blame them wanting a bit more than that before saying anything.
epage 6y ago
I'm up for "wait and see". From an administrative perspective, removed from what is happening, I can see investigating first before admitting fault. I'd much rather people understanding why they were wrong, even if it takes some time.
hn8788 6y ago
They shouldn't have. This appears to be a pretty clear cut case, but made up outrage-bait has made it to the top of HN before. Investigating claims is the correct thing to do.
- ethbr0 6y ago
  Exactly. If someone apologizes to me, and I know that they have no way of knowing if they're guilty or not, what's that apology worth?
bronson 6y ago
It’s too early for that. I expect their followup will have details on failures but first they need to figure out exactly what happened. That will take some time and effort. At least now they’re burning UMN time and not kernel maintainer time.
Isthatablackgsd 6y ago
The department heads just learn of what is happening. They cannot say "we didn't do anything wrong!!!" without investigation because it will make the university in a very negative light (it is a serious ramifications). They need to get all the facts and knowing how it happens and who is responsible for this. So this way they can make a concise action and they will make a proper statement. They are taking "investigation first and comment after" cautiously and seriously.
- balozi 6y ago
  It's worth remembering that this was a repeat offense. They failed to respond to the first complaint.
  - detaro 6y ago
    It's a bit unclear who complained to whom about this - and I'd expect looking into this to be part of the review. i.e. I could easily see "some people reached out to IRB concerned about lack of its involvement, IRB talked to researcher and went through process, came to result for whatever reasons" happening and not being something that is reported up the chain, because it was "resolved".
notyourday 6y ago
They have just learned about the details of the research conducted: > Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel. I'm going to say that the odds are that the faculty member in question is not going to be a faculty member anymore especially if the ban remains in place as the said faculty member probably at best fibbed the leadership before about his research.
- seoaeu 6y ago
  Firing faculty is oddly difficult, but I do expect they'll take at least some actions
  - notyourday 6y ago
    He is an adjunct that just trashed university's reputation. I'm sure it would even fall into firing for cause
    - seoaeu 6y ago
      Missed the adjunct part... I'm with you on this one.
      - alisonkisk 6y ago
        He's not an adjunct. https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/
    - alisonkisk 6y ago
      He's not an adjunct. https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/ Adjuncts don't have Ph.D students.
      - notyourday 6y ago
xibalba 6y ago
This is what innocent until proven guilty looks like. I, for one, agree with the approach. I don't want to live in a world where people are fired and projects shutdown on the basis of allegations alone.
- IncRnd 6y ago
  Don't jump to conclusions, and say I am guilty of something that I didn't write. I never said to fire people and shutdown projects based upon allegations alone. You may not have read the article for this comment page, but they admit that the action took place. The researchers, themselves, elsewhere admitted it took place.
  - xibalba 6y ago
    Pardon me. I did not mean to imply you were calling for anything. And I agree, the facts look pretty damning. Nevertheless, I fully support a slow, deliberate, and comprehensive evaluation by any authority when evaluating serious accusations. Further, I strongly believe in presumptive innocence, regardless of initial impressions. Btw, I'm not suggesting you don't believe in any of the above.

by IncRnd 6y ago

deleted 6y ago

[deleted]

MattGaiser 6y ago

I would argue that first requires investigation. They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.

IncRnd 6y ago
> I would argue that first requires investigation. Why do you think that enough of an investigation hasn't been performed in order to understand culpability? Thay already know what happened and want to learn why it was approved. That was what their comment said. Take a look at the actual PDF from the researchers, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" [1] [1] https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
- alexeldeib 6y ago
  The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....
  - IncRnd 6y ago
    Yes, but that doesn't have bearing on my comment that was being referenced, that they didn't say what had happened was wrong. Here is Ken Thompson's apropos paper from 1984. [0] [0] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
    - alexeldeib 6y ago
      Sure. I was answering your question: > Why do you think that enough of an investigation hasn't been performed in order to understand culpability?
  - colechristensen 6y ago
    Honestly I’m guessing this kind of situation didn’t match any existing policy for the review board and a few people made a bad call. We need to make sure to be supportive of people making mistakes and learning from them instead of raising pitchforks for every misstep. Failure is never completely avoidable and responding properly to failure is way more important than never failing.
  - zxspectrum1982 6y ago
    From my reading of the threads in the kernel mailing lists, it seems the IRB thought "is it bioscience with experimentation on live animals? No? Then it's all fine".
    - ellisv 6y ago
      I participated in IRB for a UMN campus and that’s pretty much how these things worked back then.
    - seoaeu 6y ago
      Yeah, especially considering that the IRB said the research was out of scope (specifically that it was not "human subject research") rather than indicating that it was ethical. Kind of like the distinction between a court not having jurisdiction and a court declaring you didn't break any laws.
- MattGaiser 6y ago
  > We will investigate the research method and the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, if needed. The "if needed" tells me they aren't sure what if anything is wrong yet. It would surprise me if they have done that much of an investigation in the few hours since they might have learned about this beyond scheduling meetings with involved parties and compiling relevant documents in a folder. I think they are at the point of having a bunch of angry emails and a few news articles from certain publications. I don't blame them wanting a bit more than that before saying anything.

epage 6y ago

I'm up for "wait and see". From an administrative perspective, removed from what is happening, I can see investigating first before admitting fault. I'd much rather people understanding why they were wrong, even if it takes some time.

hn8788 6y ago

They shouldn't have. This appears to be a pretty clear cut case, but made up outrage-bait has made it to the top of HN before. Investigating claims is the correct thing to do.

ethbr0 6y ago
Exactly. If someone apologizes to me, and I know that they have no way of knowing if they're guilty or not, what's that apology worth?

bronson 6y ago

It’s too early for that. I expect their followup will have details on failures but first they need to figure out exactly what happened. That will take some time and effort. At least now they’re burning UMN time and not kernel maintainer time.

Isthatablackgsd 6y ago

The department heads just learn of what is happening. They cannot say "we didn't do anything wrong!!!" without investigation because it will make the university in a very negative light (it is a serious ramifications). They need to get all the facts and knowing how it happens and who is responsible for this. So this way they can make a concise action and they will make a proper statement. They are taking "investigation first and comment after" cautiously and seriously.

balozi 6y ago
It's worth remembering that this was a repeat offense. They failed to respond to the first complaint.
- detaro 6y ago
  It's a bit unclear who complained to whom about this - and I'd expect looking into this to be part of the review. i.e. I could easily see "some people reached out to IRB concerned about lack of its involvement, IRB talked to researcher and went through process, came to result for whatever reasons" happening and not being something that is reported up the chain, because it was "resolved".

notyourday 6y ago

They have just learned about the details of the research conducted: > Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel. I'm going to say that the odds are that the faculty member in question is not going to be a faculty member anymore especially if the ban remains in place as the said faculty member probably at best fibbed the leadership before about his research.

seoaeu 6y ago
Firing faculty is oddly difficult, but I do expect they'll take at least some actions
- notyourday 6y ago
  He is an adjunct that just trashed university's reputation. I'm sure it would even fall into firing for cause
  - seoaeu 6y ago
    Missed the adjunct part... I'm with you on this one.
    - alisonkisk 6y ago
      He's not an adjunct. https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/
  - alisonkisk 6y ago
    He's not an adjunct. https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/ Adjuncts don't have Ph.D students.
    - notyourday 6y ago

xibalba 6y ago

This is what innocent until proven guilty looks like. I, for one, agree with the approach. I don't want to live in a world where people are fired and projects shutdown on the basis of allegations alone.

IncRnd 6y ago
Don't jump to conclusions, and say I am guilty of something that I didn't write. I never said to fire people and shutdown projects based upon allegations alone. You may not have read the article for this comment page, but they admit that the action took place. The researchers, themselves, elsewhere admitted it took place.
- xibalba 6y ago
  Pardon me. I did not mean to imply you were calling for anything. And I agree, the facts look pretty damning. Nevertheless, I fully support a slow, deliberate, and comprehensive evaluation by any authority when evaluating serious accusations. Further, I strongly believe in presumptive innocence, regardless of initial impressions. Btw, I'm not suggesting you don't believe in any of the above.