4 ms·

They performed an experiment on human subjects without informed consent.

darawk 5y ago
Sure, but so does every website that AB tests a landing page. Consent is only relevant when there is some risk to the subject (or something they value, like privacy, etc).
- thayne 5y ago
  What about the risk to the reputation of anyone who approves these patches? Or of intentinally buggy patches making it into the wild and being exploited?
  - darawk 5y ago
    > What about the risk to the reputation of anyone who approves these patches? This is a risk, but it's exposing vulnerabilities is always preferable to leaving them in place. > Or of intentinally buggy patches making it into the wild and being exploited? There was no real risk of this. They specifically did not allow it to make its way into real releases. If they had allowed it into actual releases, I would have a serious problem with that.
    - varajelle 5y ago
      There is also the risk that a third party sees the patch on a mailing list, and merges it to his internal branch because it looks like it is fixing one of his problem. But I'd argue it is his own fault to use unsupported patches.
- doomrobo 5y ago
  > Consent is only relevant when there is some risk to the subject Says who? I don't think that's true according to IRB standards in the US. Nor is it true for websites who A/B test according to the GDPR
  - darawk 5y ago
    > Says who? Me and common sense. I don't believe consent is relevant when there is no risk of harm to the subject. IRBs and the GDPR are overly aggressive on this point, probably as a reaction to real and important violations of privacy. But the idea that A/B testing the color of your CTA button on a landing page requires informed consent is absurd.
    - doomrobo 5y ago
      There's lots of systemically horrible things that can happen if you're not careful about what you allow. If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report https://en.wikipedia.org/wiki/Belmont_Report https://en.wikipedia.org/wiki/Belmont_Report
      - darawk 5y ago
        > There's lots of systemically horrible things that can happen if you're not careful about what you allow. Of course there are. But what specifically are the harms that are going to be caused by either this research or a landing page A/B test without a click through pop up? The existence of theoretical harms for broad categories of potential research does not have a whole lot of bearing on these specific lines of research. > If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report I read it. It was interesting, but I don't think it's particularly relevant here. The only prong of its test that would be relevant to this experiment is "respect for persons". The idea that somehow not revealing the bug or the experiment was intrinsically harmful as a violation of a person's moral autonomy. I don't buy that line of reasoning, and I can't really think of any valid consequentialist justification for it, and the report itself does not attempt to justify it either, as far as I can tell.
        ryandrake 5y ago
        If I sit across the street from your house in a van and observe your life, noting down the times you come and go, and logging what I can see through your window, and then using that data to market things to you, would you agree that you'd rather be able to provide and withdraw consent for this activity? No harm done to you.
cdrini 5y ago
This is the part I'm personally most interested in. Research generally has pretty strict ethical regulations about consent. I'm wondering if this would qualify as a violation of any of their university's or the conference's rules.
sriram_malhar 5y ago
That's how security is tested. TSA undergoes undercover testing. https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-operation-us-airports/story?id=51022188 https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-...
- doomrobo 5y ago
  TSA agents are informed that there are tests as part of their job. See this comment for another example of informed consent in security testing https://news.ycombinator.com/item?id=26929797 https://news.ycombinator.com/item?id=26929797

Sure, but so does every website that AB tests a landing page. Consent is only relevant when there is some risk to the subject (or something they value, like privacy, etc).

thayne 5y ago
What about the risk to the reputation of anyone who approves these patches? Or of intentinally buggy patches making it into the wild and being exploited?
- darawk 5y ago
  > What about the risk to the reputation of anyone who approves these patches? This is a risk, but it's exposing vulnerabilities is always preferable to leaving them in place. > Or of intentinally buggy patches making it into the wild and being exploited? There was no real risk of this. They specifically did not allow it to make its way into real releases. If they had allowed it into actual releases, I would have a serious problem with that.
  - varajelle 5y ago
    There is also the risk that a third party sees the patch on a mailing list, and merges it to his internal branch because it looks like it is fixing one of his problem. But I'd argue it is his own fault to use unsupported patches.
doomrobo 5y ago
> Consent is only relevant when there is some risk to the subject Says who? I don't think that's true according to IRB standards in the US. Nor is it true for websites who A/B test according to the GDPR
- darawk 5y ago
  > Says who? Me and common sense. I don't believe consent is relevant when there is no risk of harm to the subject. IRBs and the GDPR are overly aggressive on this point, probably as a reaction to real and important violations of privacy. But the idea that A/B testing the color of your CTA button on a landing page requires informed consent is absurd.
  - doomrobo 5y ago
    There's lots of systemically horrible things that can happen if you're not careful about what you allow. If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report https://en.wikipedia.org/wiki/Belmont_Report https://en.wikipedia.org/wiki/Belmont_Report
    - darawk 5y ago
      > There's lots of systemically horrible things that can happen if you're not careful about what you allow. Of course there are. But what specifically are the harms that are going to be caused by either this research or a landing page A/B test without a click through pop up? The existence of theoretical harms for broad categories of potential research does not have a whole lot of bearing on these specific lines of research. > If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report I read it. It was interesting, but I don't think it's particularly relevant here. The only prong of its test that would be relevant to this experiment is "respect for persons". The idea that somehow not revealing the bug or the experiment was intrinsically harmful as a violation of a person's moral autonomy. I don't buy that line of reasoning, and I can't really think of any valid consequentialist justification for it, and the report itself does not attempt to justify it either, as far as I can tell.
      - ryandrake 5y ago
        If I sit across the street from your house in a van and observe your life, noting down the times you come and go, and logging what I can see through your window, and then using that data to market things to you, would you agree that you'd rather be able to provide and withdraw consent for this activity? No harm done to you.

cdrini 5y ago

This is the part I'm personally most interested in. Research generally has pretty strict ethical regulations about consent. I'm wondering if this would qualify as a violation of any of their university's or the conference's rules.

sriram_malhar 5y ago

That's how security is tested. TSA undergoes undercover testing. https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-operation-us-airports/story?id=51022188 https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-...

doomrobo 5y ago
TSA agents are informed that there are tests as part of their job. See this comment for another example of informed consent in security testing https://news.ycombinator.com/item?id=26929797 https://news.ycombinator.com/item?id=26929797