4 ms·

I really appreciate the apology and as they stated, its unconditional nature. Good. However, I find something very problematic. This quote shows it: "We have

I really appreciate the apology and as they stated, its unconditional nature. Good. However, I find something very problematic. This quote shows it: "We have learned some important lessons about research with the open source community from this incident." This is something I don't like. This is not something about "research with the open source community". If anything, they should have learned something about treating human beings as persons and not as involuntary guinea pigs. They should have learned something about not breaking anyone's (not only any open source community) good faith and trust, and respecting that. They behaved like jerks and they still cannot see that.

at_a_remove 5y ago
Going further, "with" seems like the wrong preposition. "On" seems more accurate.
- neltnerb 5y ago
  It would make sense if they were talking about mice, in which case "on" is still more accurate but "with" is probably correctly assumed to be equivalent. Research with humans involves them being on the author list...
- ENOTTY 5y ago
  The professor is not a native English speaker. I’d cut him some slack in minor issues with his word choice.
dylan604 5y ago
>They behaved like jerks and they still cannot see that. They just come off as disconnected academics. Samething with the experiments with algorithms from Facebook. They are so wrapped up in what they are doing, they no longer see the "users" as human beings. There are some times this is almost required to survive like being an ER doctor. If you lose that many people, it could be debilitating unless you were able to disconnect. That's far and away much different than these robots.
true_religion 5y ago
I think there is something to be applauded about people who genuinely apologize even though they can't see things from the other person's point of view. They didn't decide to conduct this research on a whim. They had full approval of their university ethics board as well. They published a paper and had it peer reviewed without (as far as I know) anyone immediately calling for their heads. They can't immediately turn heel face and believe their actions are wrong, always were wrong, and the wrongness should have been obvious to them. Yet, despite this they recognize the hurt they've caused and are genuinely apologetic and will never do it again. Asking them to dismantle their world view in a week is a bit much, even criminals are given a few years of quiet contemplation before being asked to tell a parole board they have changed their hearts and minds.
- Ygg2 5y ago
  That only tells me, that there's more garbage than just one individual. If they lack knowledge of why it was bad, what will prevent them from doing another garbage study next time.
  - burnished 5y ago
    This incident, time, and reflection.
    - Ygg2 5y ago
      But their self-relfection, and I say basic ethics is severely lacking. This study could have been done with consent, with limited bias, but they chose to go the idiot route.
- pxc 5y ago
  They only sought approval from the ethics board after the fact IIRC
- neatze 5y ago
  This paper had multiple issues that they where aware of before the ban, original ban email indicates that complaint was made before to there's university, on twitter feed one of the researchers stated that IEEE received also complaint regarding ethics of the paper, way before ban.
temp8964 5y ago
Is it now not P.C. to discuss what they revealed? Or "nothing" has been revealed? Are we not allowed to discuss the possibility of someone hacked an university email address and then submit a patch?
- burnished 5y ago
  You're being too coy. What do you think was revealed?
epage 5y ago
Several parts read strangely to me > we are very sorry that the method used in the “hypocrite commits” paper was inappropriate This reads more as "sorry you were offended" than "It was inappropriate and we are sorry". > As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches. Bringing up why you did something in an apology is very shaky. Like in this case, it can sound more like justifying / excusing.
- enw 5y ago
  > Bringing up why you did something in an apology is very shaky. Like in this case, it can sound more like justifying / excusing. Why is that a problem?
  - enw 5y ago
    Answering myself: the apology feels more like a justification as to why they did, not an understanding of why they shouldn’t have.
    - craftinator 5y ago
      > the apology feels more like a justification Which I'm guessing is why they made it an open letter. This isn't about acknowledging their misdeeds and trying to fix their relationship with the OS community, this is them trying to sneak in spin and justifications to a public announcement to cover their collective asses, to put forth a false narrative that shows their actions in a better light than they acted in.
neatze 5y ago
Additionally, would be right thing to do with there's apology email to also state that they retracted "hypocrite commit” paper from IEEE ? After all before a ban, there where complaint(s) made regarding this paper, by other researchers and community members.
1vuio0pswjnm7 5y ago
"If anything, they should have learned something about not treating human beings as persons and not as involuntary guinea pigs." Perhaps the entire "tech" industry needs to learn that lesson. Non-technical end users should be entitled to that same level of trust as nerds. I can download free open source code, extract a tarball and build the software without worrying too much about scanning through all the files first for phone home/telemetry/OriginTrials nonsense.^1 However non-technical end users who use programs compiled for them by "tech" companies with ads and surveillance as their "business model" are not entitled to the same trust. I cannot think of any justification for the difference.
- sombragris 5y ago
  Very good point. We seriously need to learn this lesson as you said.
- barry-cotter 5y ago
  > Perhaps the entire "tech" industry needs to learn that lesson. Audit studies are conducted all the time where researchers lie to people and waste their time. > Factors Determining Callbacks to Job Applications by the Unemployed: An Audit Study > We use an audit study approach to investigate how unemployment duration, age, and holding a low-level “interim” job affect the likelihood that experienced college- educated females applying for an administrative support job receive a callback from a potential employer. First, the results show no relationship between callback rates and the duration of unemployment. Second, workers age 50 and older are significantly less likely to receive a callback. Third, taking an interim job significantly reduces the likelihood of receiving a callback. Finally, employers who have higher callback rates respond less to observable differences across workers in determining whom to call back. We interpret these results in the context of a model of employer learning about applicant quality http://www.econ.ucla.edu/tvwachter/papers/audit_study_FarberSilvermanVonWachter.pdf http://www.econ.ucla.edu/tvwachter/papers/audit_study_Farber...
  - shard 5y ago
    This is a very good point. I did not find anything objectionable about that experiment when I first read about it. And if the companies experimented upon had complained like the kernel maintainers did, I would have dismissed it as them covering up their bad process. This is actually making me consider that the submitters of the bad patches shouldn't be treated differently than the job application researchers.
bawolff 5y ago
Imagine if instead they did this research with the closed source community. You know, get hired under false pretenses, sneak some vulns into some commercial product, write a paper about how easy it was. Pretty sure if they tried that they would be in jail right now.
- lrvick 5y ago
  There are literally companies you can hire that will go this far pentesting your company and the employees involved are not in on it. How else do you prove your process can stop real infiltrators by state actors?
  - bawolff 5y ago
    So? The difference is consent (in your case of the owners of the company). There are many crimes in the world that are only crimes if you do it without consent. > How else do you prove your process can stop real infiltrators by state actors? One of the common security controls against infiltration by foreign nation states is espionage being a capital offense. Well obviously not appropriate, i think that its pretty obvious that these researchers would have not succeded if they faced the electric chair like a spy would. So i don't think the comparison is apt.
    - lrvick 5y ago
      So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? If you have approval from one person in an org of 100,000 is this still okay? It has to be, because getting explicit consent from every person in the org at that size would be untenable, and make them artificially extra vigilant during a potential audit window. Well now scale this to open source. The typical web project has 2k+ random nodejs libs in their dependency tree. These are all separate orgs/individuals. Real world bad actors are backdooring these projects constantly. I specialize in this area of research. If every white hat has to get permission from exponentially large dependency chains, they will never even come close to being able to compete with black hats here finding the weak links of the chain. The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate.
maweki 5y ago
I also found the apology lacking in that they did not specifically acknowledge that they were indeed experimenting on people.
cblconfederate 5y ago
This falls under behavioral research. I believe psychologists have solved the problem of how to research that is both blind and in line with ethical standards. All they had to do was ask one.

at_a_remove 5y ago

Going further, "with" seems like the wrong preposition. "On" seems more accurate.

neltnerb 5y ago
It would make sense if they were talking about mice, in which case "on" is still more accurate but "with" is probably correctly assumed to be equivalent. Research with humans involves them being on the author list...
ENOTTY 5y ago
The professor is not a native English speaker. I’d cut him some slack in minor issues with his word choice.

dylan604 5y ago

>They behaved like jerks and they still cannot see that. They just come off as disconnected academics. Samething with the experiments with algorithms from Facebook. They are so wrapped up in what they are doing, they no longer see the "users" as human beings. There are some times this is almost required to survive like being an ER doctor. If you lose that many people, it could be debilitating unless you were able to disconnect. That's far and away much different than these robots.

true_religion 5y ago

I think there is something to be applauded about people who genuinely apologize even though they can't see things from the other person's point of view. They didn't decide to conduct this research on a whim. They had full approval of their university ethics board as well. They published a paper and had it peer reviewed without (as far as I know) anyone immediately calling for their heads. They can't immediately turn heel face and believe their actions are wrong, always were wrong, and the wrongness should have been obvious to them. Yet, despite this they recognize the hurt they've caused and are genuinely apologetic and will never do it again. Asking them to dismantle their world view in a week is a bit much, even criminals are given a few years of quiet contemplation before being asked to tell a parole board they have changed their hearts and minds.

Ygg2 5y ago
That only tells me, that there's more garbage than just one individual. If they lack knowledge of why it was bad, what will prevent them from doing another garbage study next time.
- burnished 5y ago
  This incident, time, and reflection.
  - Ygg2 5y ago
    But their self-relfection, and I say basic ethics is severely lacking. This study could have been done with consent, with limited bias, but they chose to go the idiot route.
pxc 5y ago
They only sought approval from the ethics board after the fact IIRC
neatze 5y ago
This paper had multiple issues that they where aware of before the ban, original ban email indicates that complaint was made before to there's university, on twitter feed one of the researchers stated that IEEE received also complaint regarding ethics of the paper, way before ban.

temp8964 5y ago

Is it now not P.C. to discuss what they revealed? Or "nothing" has been revealed? Are we not allowed to discuss the possibility of someone hacked an university email address and then submit a patch?

burnished 5y ago
You're being too coy. What do you think was revealed?

epage 5y ago

Several parts read strangely to me > we are very sorry that the method used in the “hypocrite commits” paper was inappropriate This reads more as "sorry you were offended" than "It was inappropriate and we are sorry". > As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches. Bringing up why you did something in an apology is very shaky. Like in this case, it can sound more like justifying / excusing.

enw 5y ago
> Bringing up why you did something in an apology is very shaky. Like in this case, it can sound more like justifying / excusing. Why is that a problem?
- enw 5y ago
  Answering myself: the apology feels more like a justification as to why they did, not an understanding of why they shouldn’t have.
  - craftinator 5y ago
    > the apology feels more like a justification Which I'm guessing is why they made it an open letter. This isn't about acknowledging their misdeeds and trying to fix their relationship with the OS community, this is them trying to sneak in spin and justifications to a public announcement to cover their collective asses, to put forth a false narrative that shows their actions in a better light than they acted in.

neatze 5y ago

Additionally, would be right thing to do with there's apology email to also state that they retracted "hypocrite commit” paper from IEEE ? After all before a ban, there where complaint(s) made regarding this paper, by other researchers and community members.

1vuio0pswjnm7 5y ago

"If anything, they should have learned something about not treating human beings as persons and not as involuntary guinea pigs." Perhaps the entire "tech" industry needs to learn that lesson. Non-technical end users should be entitled to that same level of trust as nerds. I can download free open source code, extract a tarball and build the software without worrying too much about scanning through all the files first for phone home/telemetry/OriginTrials nonsense.^1 However non-technical end users who use programs compiled for them by "tech" companies with ads and surveillance as their "business model" are not entitled to the same trust. I cannot think of any justification for the difference.

sombragris 5y ago
Very good point. We seriously need to learn this lesson as you said.
barry-cotter 5y ago
> Perhaps the entire "tech" industry needs to learn that lesson. Audit studies are conducted all the time where researchers lie to people and waste their time. > Factors Determining Callbacks to Job Applications by the Unemployed: An Audit Study > We use an audit study approach to investigate how unemployment duration, age, and holding a low-level “interim” job affect the likelihood that experienced college- educated females applying for an administrative support job receive a callback from a potential employer. First, the results show no relationship between callback rates and the duration of unemployment. Second, workers age 50 and older are significantly less likely to receive a callback. Third, taking an interim job significantly reduces the likelihood of receiving a callback. Finally, employers who have higher callback rates respond less to observable differences across workers in determining whom to call back. We interpret these results in the context of a model of employer learning about applicant quality http://www.econ.ucla.edu/tvwachter/papers/audit_study_FarberSilvermanVonWachter.pdf http://www.econ.ucla.edu/tvwachter/papers/audit_study_Farber...
- shard 5y ago
  This is a very good point. I did not find anything objectionable about that experiment when I first read about it. And if the companies experimented upon had complained like the kernel maintainers did, I would have dismissed it as them covering up their bad process. This is actually making me consider that the submitters of the bad patches shouldn't be treated differently than the job application researchers.

bawolff 5y ago

Imagine if instead they did this research with the closed source community. You know, get hired under false pretenses, sneak some vulns into some commercial product, write a paper about how easy it was. Pretty sure if they tried that they would be in jail right now.

lrvick 5y ago
There are literally companies you can hire that will go this far pentesting your company and the employees involved are not in on it. How else do you prove your process can stop real infiltrators by state actors?
- bawolff 5y ago
  So? The difference is consent (in your case of the owners of the company). There are many crimes in the world that are only crimes if you do it without consent. > How else do you prove your process can stop real infiltrators by state actors? One of the common security controls against infiltration by foreign nation states is espionage being a capital offense. Well obviously not appropriate, i think that its pretty obvious that these researchers would have not succeded if they faced the electric chair like a spy would. So i don't think the comparison is apt.
  - lrvick 5y ago
    So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? If you have approval from one person in an org of 100,000 is this still okay? It has to be, because getting explicit consent from every person in the org at that size would be untenable, and make them artificially extra vigilant during a potential audit window. Well now scale this to open source. The typical web project has 2k+ random nodejs libs in their dependency tree. These are all separate orgs/individuals. Real world bad actors are backdooring these projects constantly. I specialize in this area of research. If every white hat has to get permission from exponentially large dependency chains, they will never even come close to being able to compete with black hats here finding the weak links of the chain. The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate.

maweki 5y ago

I also found the apology lacking in that they did not specifically acknowledge that they were indeed experimenting on people.

cblconfederate 5y ago

This falls under behavioral research. I believe psychologists have solved the problem of how to research that is both blind and in line with ethical standards. All they had to do was ask one.