5 ms·

This is probably because they don't mean the apology, they were forced to write it by their administrators. And to be honest, I kind of agree with them. I don'

by darawk 5y ago

This is probably because they don't mean the apology, they were forced to write it by their administrators. And to be honest, I kind of agree with them. I don't really see what they did here as particularly bad. They demonstrated a very serious vulnerability in the linux kernel development process. I guess the harm they caused was wasting maintainers time, a bit? But what we all got out of it is the knowledge that real bad actors could easily have done this too. It's odd to me that people are focusing on like, the etiquette here when such an important vulnerability was demonstrated.

doomrobo 5y ago
They performed an experiment on human subjects without informed consent.
- darawk 5y ago
  Sure, but so does every website that AB tests a landing page. Consent is only relevant when there is some risk to the subject (or something they value, like privacy, etc).
  - thayne 5y ago
    What about the risk to the reputation of anyone who approves these patches? Or of intentinally buggy patches making it into the wild and being exploited?
    - darawk 5y ago
      > What about the risk to the reputation of anyone who approves these patches? This is a risk, but it's exposing vulnerabilities is always preferable to leaving them in place. > Or of intentinally buggy patches making it into the wild and being exploited? There was no real risk of this. They specifically did not allow it to make its way into real releases. If they had allowed it into actual releases, I would have a serious problem with that.
      - varajelle 5y ago
        There is also the risk that a third party sees the patch on a mailing list, and merges it to his internal branch because it looks like it is fixing one of his problem. But I'd argue it is his own fault to use unsupported patches.
  - doomrobo 5y ago
    > Consent is only relevant when there is some risk to the subject Says who? I don't think that's true according to IRB standards in the US. Nor is it true for websites who A/B test according to the GDPR
    - darawk 5y ago
      > Says who? Me and common sense. I don't believe consent is relevant when there is no risk of harm to the subject. IRBs and the GDPR are overly aggressive on this point, probably as a reaction to real and important violations of privacy. But the idea that A/B testing the color of your CTA button on a landing page requires informed consent is absurd.
      - doomrobo 5y ago
        There's lots of systemically horrible things that can happen if you're not careful about what you allow. If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report https://en.wikipedia.org/wiki/Belmont_Report https://en.wikipedia.org/wiki/Belmont_Report
        darawk 5y ago
        > There's lots of systemically horrible things that can happen if you're not careful about what you allow. Of course there are. But what specifically are the harms that are going to be caused by either this research or a landing page A/B test without a click through pop up? The existence of theoretical harms for broad categories of potential research does not have a whole lot of bearing on these specific lines of research. > If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report I read it. It was interesting, but I don't think it's particularly relevant here. The only prong of its test that would be relevant to this experiment is "respect for persons". The idea that somehow not revealing the bug or the experiment was intrinsically harmful as a violation of a person's moral autonomy. I don't buy that line of reasoning, and I can't really think of any valid consequentialist justification for it, and the report itself does not attempt to justify it either, as far as I can tell.
- cdrini 5y ago
  This is the part I'm personally most interested in. Research generally has pretty strict ethical regulations about consent. I'm wondering if this would qualify as a violation of any of their university's or the conference's rules.
- sriram_malhar 5y ago
  That's how security is tested. TSA undergoes undercover testing. https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-operation-us-airports/story?id=51022188 https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-...
  - doomrobo 5y ago
    TSA agents are informed that there are tests as part of their job. See this comment for another example of informed consent in security testing https://news.ycombinator.com/item?id=26929797 https://news.ycombinator.com/item?id=26929797
trombonechamp 5y ago
The purpose of the research was to publicly announce that that the research subjects (who did not consent to being studied) messed up. The research consisted of submitting patches specially crafted to make sure the (non-consenting) subjects did indeed mess up.
- darawk 5y ago
  Ya, I get that. But the point was to demonstrate that the project was vulnerable to this kind of attack - which it was. That's an extremely important finding.
bonzini 5y ago
What is the serious vulnerability? That sometimes bugs slip through?
- fighterpilot 5y ago
  How extremely easy it is for a nation state or other malicious actor to intentionally introduce bugs.
  - bonzini 5y ago
    Was there ever any doubt?
    - deleted 5y ago
      [deleted]
    - fighterpilot 5y ago
      Perhaps not, but was it on people's radar as much as it is as a consequence of this event?
deleted 5y ago
[deleted]
jdsully 5y ago
Their biggest crime seems to be they just aren't great developers. If you look at the patches they presented which to their knowledge were correct you'd see they couldn't have done anything useful. Because of their earlier work this was taken as intentional malice, but if they had been submitting great work it wouldn't be an issue.

by darawk 5y ago

doomrobo 5y ago

They performed an experiment on human subjects without informed consent.

darawk 5y ago
Sure, but so does every website that AB tests a landing page. Consent is only relevant when there is some risk to the subject (or something they value, like privacy, etc).
- thayne 5y ago
  What about the risk to the reputation of anyone who approves these patches? Or of intentinally buggy patches making it into the wild and being exploited?
  - darawk 5y ago
    > What about the risk to the reputation of anyone who approves these patches? This is a risk, but it's exposing vulnerabilities is always preferable to leaving them in place. > Or of intentinally buggy patches making it into the wild and being exploited? There was no real risk of this. They specifically did not allow it to make its way into real releases. If they had allowed it into actual releases, I would have a serious problem with that.
    - varajelle 5y ago
      There is also the risk that a third party sees the patch on a mailing list, and merges it to his internal branch because it looks like it is fixing one of his problem. But I'd argue it is his own fault to use unsupported patches.
- doomrobo 5y ago
  > Consent is only relevant when there is some risk to the subject Says who? I don't think that's true according to IRB standards in the US. Nor is it true for websites who A/B test according to the GDPR
  - darawk 5y ago
    > Says who? Me and common sense. I don't believe consent is relevant when there is no risk of harm to the subject. IRBs and the GDPR are overly aggressive on this point, probably as a reaction to real and important violations of privacy. But the idea that A/B testing the color of your CTA button on a landing page requires informed consent is absurd.
    - doomrobo 5y ago
      There's lots of systemically horrible things that can happen if you're not careful about what you allow. If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report https://en.wikipedia.org/wiki/Belmont_Report https://en.wikipedia.org/wiki/Belmont_Report
      - darawk 5y ago
        > There's lots of systemically horrible things that can happen if you're not careful about what you allow. Of course there are. But what specifically are the harms that are going to be caused by either this research or a landing page A/B test without a click through pop up? The existence of theoretical harms for broad categories of potential research does not have a whole lot of bearing on these specific lines of research. > If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report I read it. It was interesting, but I don't think it's particularly relevant here. The only prong of its test that would be relevant to this experiment is "respect for persons". The idea that somehow not revealing the bug or the experiment was intrinsically harmful as a violation of a person's moral autonomy. I don't buy that line of reasoning, and I can't really think of any valid consequentialist justification for it, and the report itself does not attempt to justify it either, as far as I can tell.
cdrini 5y ago
This is the part I'm personally most interested in. Research generally has pretty strict ethical regulations about consent. I'm wondering if this would qualify as a violation of any of their university's or the conference's rules.
sriram_malhar 5y ago
That's how security is tested. TSA undergoes undercover testing. https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-operation-us-airports/story?id=51022188 https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-...
- doomrobo 5y ago
  TSA agents are informed that there are tests as part of their job. See this comment for another example of informed consent in security testing https://news.ycombinator.com/item?id=26929797 https://news.ycombinator.com/item?id=26929797

trombonechamp 5y ago

The purpose of the research was to publicly announce that that the research subjects (who did not consent to being studied) messed up. The research consisted of submitting patches specially crafted to make sure the (non-consenting) subjects did indeed mess up.

darawk 5y ago
Ya, I get that. But the point was to demonstrate that the project was vulnerable to this kind of attack - which it was. That's an extremely important finding.

bonzini 5y ago

What is the serious vulnerability? That sometimes bugs slip through?

fighterpilot 5y ago
How extremely easy it is for a nation state or other malicious actor to intentionally introduce bugs.
- bonzini 5y ago
  Was there ever any doubt?
  - deleted 5y ago
    [deleted]
  - fighterpilot 5y ago
    Perhaps not, but was it on people's radar as much as it is as a consequence of this event?

deleted 5y ago

[deleted]

jdsully 5y ago

Their biggest crime seems to be they just aren't great developers. If you look at the patches they presented which to their knowledge were correct you'd see they couldn't have done anything useful. Because of their earlier work this was taken as intentional malice, but if they had been submitting great work it wouldn't be an issue.