6 ms·

This apology fails from the 5th word: "We sincerely apologize for any harm..." While there are other requirements, a sincere apology cannot in any way enterta

This apology fails from the 5th word: "We sincerely apologize for any harm..." While there are other requirements, a sincere apology cannot in any way entertain doubt about the fact that there WAS harm. Truly acknowledging the harm done is foundational to a real apology, and most of us (myself included) end up sneaking in weasel words or phrases like this. Psychologically, its nice for the apologizer, since it allows one to think "i'm being good by apologizing, but maybe I didn't do anything bad after all?". But from the apologizee standpoint, these phrases are often devastating and can make it clear that the apologizer has no real recognition or care of what happened. Personally I've worked pretty hard to try to remove these sorts of phrases from my apologies. It's not easy. It makes you feel much more vulnerable and you really have to let whatever you did sit with you in a very uncomfortable way. But it's worth it.

audiometry 5y ago
Oh yeah, the "mistakes were made" passive-voice non-apology apoplogy. zzzz
jack9 5y ago
> a sincere apology cannot in any way entertain doubt about the fact that there WAS harm Someone will always be apologizing wrong for some. Some interpretation of what harm there was, is not necessarily the same as my interpretation. There are too many ways to construe what harm there was or may have been according to others to satisfy everyone addressed. This is an efficient wording that doesn't explicitly satisfy your (and many people's) specific issues out of "the community", which illustrates the point.
- MattGaiser 5y ago
  "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." I understand doubting the sincerity of the authors, but this argument hinges here on them saying "any" instead of "all" and they are often used interchangeably in casual conversation.
  - scott_w 5y ago
    This isn’t casual conversation. This letter should be a full, formal apology.
cookiengineer 5y ago
The issue I have with the letter (not being involved at all and just following) is that it feels like an apology of the bully at school that took your lunch money, and the parents found out. Honestly, for all we know this letter could be meaningless. A real good actor would also reveal the other commits in order to have a full disclosure. Trust isn't based on promises, trust is based on past actions. Therefore they should be treated as such, as their actions are evidence for being a potentially malicious actor. I'm still convinced Greg did the right thing here, as it's better to be safe than sorry in this case due to the sheer scale of an attack vector that the actors might have introduced. Even if other commits of good actors at the same University are now treated with more attention to their code, I think they are a casualty that was predictable in the moment the ethics commitee signed off the paper's research procedure.
neatze 5y ago
In researcher's shoes, I would retract paper from IEEE, only then send open latter. Because they did not do this, does not looks like there's open letter is sincere, I am sure researcher's aware that there where multiple complaints regarding there's paper before ban. The least they could have done is acknowledge such failures in open letter.
craftinator 5y ago
> end up sneaking in weasel words or phrases like this. Honestly, based on the way they handled their "research" in the first place, sneaking weasel words into an open apology letter is entirely par for the course...
cdrini 5y ago
This interpretation looks flawed. You discredit the entire message based on a single word--a very general word whose meaning you pinned to a definition which results in the most negative interpretation--and you also ignore the fact that they explicitly state the damage it caused in the same paragraph. To clarify: I'm not arguing this is a good or bad apology; just that the justification provided here looks flawed. Human speech isn't a programming language; it's not well defined and it's more than the sum of its parts. One can't derive conclusions about a text by analyzing a tiny subset out of context.
- mbauman 5y ago
  Strong disagree. You should always apologize for _what you did_ not the _effects_ of what you did. Lead with and more strongly emphasize your actions and how they were inappropriate.
- deleted 5y ago
  [deleted]
- plussed_reader 5y ago
  If this was a transcript of a spoken apology I might be of your train of thought, but this was a composed letter looked over by (ostensibly) multiple folks. The wording was a choice.
  - cdrini 5y ago
    Strongly agree with your sentiment; any premeditated/composed message is held to a higher standard (and rightfully so). I'm not arguing that one shouldn't analyze the wording, but that the analysis here is flawed (for the reasons I stated).
- kfarr 5y ago
  I would argue at this point in collective awareness of public communications, using a form of "sorry if I did any harm" regardless of specific words used is an explicit decision by the writer to not accept full culpability. I agree with original comment, when you see a weasel apology introduction, reading the rest is of little value.
thanhhaimai 5y ago
"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html I think it's both unfair and non-constructive to pick apart a apology letter based on one word like that. Let's assume good faith, especially when the writer's English might not be their first language (based on their name).
- akersten 5y ago
  We are talking about deliberate security vulnerabilities in the Linux kernel, a piece of critical infrastructure. Frankly, this is not the place to assume good faith.
  - varajelle 5y ago
    But they did not introduce security vulnerabilities as there prevented the bad patches from being merged
    - Karunamon 5y ago
      Those measures were insufficient, as according to the developers, a number of the bogus patches were merged and had to be reverted.
      - varajelle 5y ago
        I think the kernel maintainer reverted all the patches coming from that university, regardless if they were bogus or not.
      - rincebrain 5y ago
        Sort of? The "hypocrite commits", according to the researchers' own paper, originated from "random Gmail addresses", and the researchers continue to claim none of those got merged (though since they haven't told us what they were, ...) The additional claim is that some of the commits not covered by their "hypocrite commits" (and thus, submitted from their UMN addresses) contained security bugs, deliberate or not, and the loss of trust in the researchers is sufficient to justify reverting all of their commits until they can be reviewed.
darawk 5y ago
This is probably because they don't mean the apology, they were forced to write it by their administrators. And to be honest, I kind of agree with them. I don't really see what they did here as particularly bad. They demonstrated a very serious vulnerability in the linux kernel development process. I guess the harm they caused was wasting maintainers time, a bit? But what we all got out of it is the knowledge that real bad actors could easily have done this too. It's odd to me that people are focusing on like, the etiquette here when such an important vulnerability was demonstrated.
- doomrobo 5y ago
  They performed an experiment on human subjects without informed consent.
  - darawk 5y ago
    Sure, but so does every website that AB tests a landing page. Consent is only relevant when there is some risk to the subject (or something they value, like privacy, etc).
    - thayne 5y ago
      What about the risk to the reputation of anyone who approves these patches? Or of intentinally buggy patches making it into the wild and being exploited?
      - darawk 5y ago
        > What about the risk to the reputation of anyone who approves these patches? This is a risk, but it's exposing vulnerabilities is always preferable to leaving them in place. > Or of intentinally buggy patches making it into the wild and being exploited? There was no real risk of this. They specifically did not allow it to make its way into real releases. If they had allowed it into actual releases, I would have a serious problem with that.
        5y ago
koonsolo 5y ago
Exactly my feeling too when I read this apology. For me, it reads like this "With the best intentions, we were helping you. Unfortunately, you are too stupid to not realise this. We are sorry that we hurt your feelings, but please let us continue in helping you." When you get such an apology, best thing is to avoid such people. Because it's clear they do not understand where they went wrong. They should have either apologized with "we made a very big mistake that had a negative impact, it did more harm than good". Or they should have argued with real evidence on how they improve the Linux kernel, like refer to real exploits that they fixed. This is just a "we're sorry that you don't realize we are helping you"
nl 5y ago
In some variations of English any can mean the same as all in some cases where you are uncertain you know every possible harm. Indeed: "The Court held that "the word 'any' is to be considered all-inclusive" https://www.michbar.org/file/generalinfo/plainenglish/pdfs/91_oct.pdf https://www.michbar.org/file/generalinfo/plainenglish/pdfs/9...
gorgoiler 5y ago
That fifth word is a mistake and the apology certainly has flaws, but you are being extreme. A more substantial criticism is that blending we’re sorry with excuses and mitigating explanations is what makes it lose impact. But really, they acknowledge the harm they did and they said sorry and I hope you give them some credit for doing so.
Hnrobert42 5y ago
Your critique seems more about waffle words in apologies and less about this specific apology. While they do waffle in that sentence, on the whole, their apology seems pretty sincere. They acknowledge their error and the harms they perceive they caused. As a linux user, I am inclined to accept.
scotty79 5y ago
Wait. 'Any' can mean 'none at all' in this context?
egberts1 5y ago
I too bristled at the word “any” for an apology. I would have listed the specific harms in a concise manner instead. Maybe save that word “any” for the end, maybe and only as a future tense of profusely avoidance of future harm.

audiometry 5y ago

Oh yeah, the "mistakes were made" passive-voice non-apology apoplogy. zzzz

jack9 5y ago

> a sincere apology cannot in any way entertain doubt about the fact that there WAS harm Someone will always be apologizing wrong for some. Some interpretation of what harm there was, is not necessarily the same as my interpretation. There are too many ways to construe what harm there was or may have been according to others to satisfy everyone addressed. This is an efficient wording that doesn't explicitly satisfy your (and many people's) specific issues out of "the community", which illustrates the point.

MattGaiser 5y ago
"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." I understand doubting the sincerity of the authors, but this argument hinges here on them saying "any" instead of "all" and they are often used interchangeably in casual conversation.
- scott_w 5y ago
  This isn’t casual conversation. This letter should be a full, formal apology.

cookiengineer 5y ago

The issue I have with the letter (not being involved at all and just following) is that it feels like an apology of the bully at school that took your lunch money, and the parents found out. Honestly, for all we know this letter could be meaningless. A real good actor would also reveal the other commits in order to have a full disclosure. Trust isn't based on promises, trust is based on past actions. Therefore they should be treated as such, as their actions are evidence for being a potentially malicious actor. I'm still convinced Greg did the right thing here, as it's better to be safe than sorry in this case due to the sheer scale of an attack vector that the actors might have introduced. Even if other commits of good actors at the same University are now treated with more attention to their code, I think they are a casualty that was predictable in the moment the ethics commitee signed off the paper's research procedure.

neatze 5y ago

In researcher's shoes, I would retract paper from IEEE, only then send open latter. Because they did not do this, does not looks like there's open letter is sincere, I am sure researcher's aware that there where multiple complaints regarding there's paper before ban. The least they could have done is acknowledge such failures in open letter.

craftinator 5y ago

> end up sneaking in weasel words or phrases like this. Honestly, based on the way they handled their "research" in the first place, sneaking weasel words into an open apology letter is entirely par for the course...

cdrini 5y ago

This interpretation looks flawed. You discredit the entire message based on a single word--a very general word whose meaning you pinned to a definition which results in the most negative interpretation--and you also ignore the fact that they explicitly state the damage it caused in the same paragraph. To clarify: I'm not arguing this is a good or bad apology; just that the justification provided here looks flawed. Human speech isn't a programming language; it's not well defined and it's more than the sum of its parts. One can't derive conclusions about a text by analyzing a tiny subset out of context.

mbauman 5y ago
Strong disagree. You should always apologize for _what you did_ not the _effects_ of what you did. Lead with and more strongly emphasize your actions and how they were inappropriate.
deleted 5y ago
[deleted]
plussed_reader 5y ago
If this was a transcript of a spoken apology I might be of your train of thought, but this was a composed letter looked over by (ostensibly) multiple folks. The wording was a choice.
- cdrini 5y ago
  Strongly agree with your sentiment; any premeditated/composed message is held to a higher standard (and rightfully so). I'm not arguing that one shouldn't analyze the wording, but that the analysis here is flawed (for the reasons I stated).
kfarr 5y ago
I would argue at this point in collective awareness of public communications, using a form of "sorry if I did any harm" regardless of specific words used is an explicit decision by the writer to not accept full culpability. I agree with original comment, when you see a weasel apology introduction, reading the rest is of little value.

thanhhaimai 5y ago

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html I think it's both unfair and non-constructive to pick apart a apology letter based on one word like that. Let's assume good faith, especially when the writer's English might not be their first language (based on their name).

akersten 5y ago
We are talking about deliberate security vulnerabilities in the Linux kernel, a piece of critical infrastructure. Frankly, this is not the place to assume good faith.
- varajelle 5y ago
  But they did not introduce security vulnerabilities as there prevented the bad patches from being merged
  - Karunamon 5y ago
    Those measures were insufficient, as according to the developers, a number of the bogus patches were merged and had to be reverted.
    - varajelle 5y ago
      I think the kernel maintainer reverted all the patches coming from that university, regardless if they were bogus or not.
    - rincebrain 5y ago
      Sort of? The "hypocrite commits", according to the researchers' own paper, originated from "random Gmail addresses", and the researchers continue to claim none of those got merged (though since they haven't told us what they were, ...) The additional claim is that some of the commits not covered by their "hypocrite commits" (and thus, submitted from their UMN addresses) contained security bugs, deliberate or not, and the loss of trust in the researchers is sufficient to justify reverting all of their commits until they can be reviewed.

darawk 5y ago

This is probably because they don't mean the apology, they were forced to write it by their administrators. And to be honest, I kind of agree with them. I don't really see what they did here as particularly bad. They demonstrated a very serious vulnerability in the linux kernel development process. I guess the harm they caused was wasting maintainers time, a bit? But what we all got out of it is the knowledge that real bad actors could easily have done this too. It's odd to me that people are focusing on like, the etiquette here when such an important vulnerability was demonstrated.

doomrobo 5y ago
They performed an experiment on human subjects without informed consent.
- darawk 5y ago
  Sure, but so does every website that AB tests a landing page. Consent is only relevant when there is some risk to the subject (or something they value, like privacy, etc).
  - thayne 5y ago
    What about the risk to the reputation of anyone who approves these patches? Or of intentinally buggy patches making it into the wild and being exploited?
    - darawk 5y ago
      > What about the risk to the reputation of anyone who approves these patches? This is a risk, but it's exposing vulnerabilities is always preferable to leaving them in place. > Or of intentinally buggy patches making it into the wild and being exploited? There was no real risk of this. They specifically did not allow it to make its way into real releases. If they had allowed it into actual releases, I would have a serious problem with that.
      - 5y ago

koonsolo 5y ago

Exactly my feeling too when I read this apology. For me, it reads like this "With the best intentions, we were helping you. Unfortunately, you are too stupid to not realise this. We are sorry that we hurt your feelings, but please let us continue in helping you." When you get such an apology, best thing is to avoid such people. Because it's clear they do not understand where they went wrong. They should have either apologized with "we made a very big mistake that had a negative impact, it did more harm than good". Or they should have argued with real evidence on how they improve the Linux kernel, like refer to real exploits that they fixed. This is just a "we're sorry that you don't realize we are helping you"

nl 5y ago

In some variations of English any can mean the same as all in some cases where you are uncertain you know every possible harm. Indeed: "The Court held that "the word 'any' is to be considered all-inclusive" https://www.michbar.org/file/generalinfo/plainenglish/pdfs/91_oct.pdf https://www.michbar.org/file/generalinfo/plainenglish/pdfs/9...

gorgoiler 5y ago

That fifth word is a mistake and the apology certainly has flaws, but you are being extreme. A more substantial criticism is that blending we’re sorry with excuses and mitigating explanations is what makes it lose impact. But really, they acknowledge the harm they did and they said sorry and I hope you give them some credit for doing so.

Hnrobert42 5y ago

Your critique seems more about waffle words in apologies and less about this specific apology. While they do waffle in that sentence, on the whole, their apology seems pretty sincere. They acknowledge their error and the harms they perceive they caused. As a linux user, I am inclined to accept.

scotty79 5y ago

Wait. 'Any' can mean 'none at all' in this context?

egberts1 5y ago

I too bristled at the word “any” for an apology. I would have listed the specific harms in a concise manner instead. Maybe save that word “any” for the end, maybe and only as a future tense of profusely avoidance of future harm.