4 ms·

An IRB did in fact approve the research as part of the peer review publication process. > Nothing a few 100% watertight patches as distraction and maybe cooper

An IRB did in fact approve the research as part of the peer review publication process. > Nothing a few 100% watertight patches as distraction and maybe cooperation from some maintainers couldn't fix to a reasonable degree. Either way that doesn't justify the experiment. The extent to which a bad actor can use patching of bugs to introduce subtle vulnerabilities is actually valuable knowledge. We only know this even happened because it was disclosed by the researchers. Make no mistake any person or organization who wants to do this will have zero qualms about doing it.

bluGill 6y ago
This was already a known risk. The gains from quantifying how bad the risk are is far outweighed by the fact that they introduced a new risk.
- deleted 6y ago
  [deleted]
teraflop 6y ago
> An IRB did in fact approve the research as part of the peer review publication process. The IRB did not approve the research, it declared that it was "exempt". That's essentially a determination that the research poses absolutely no risk of harm to anyone and does not require a detailed review, which seems like a very questionable decision to me. One of the things that's worth investigating is whether the researchers were honest in describing their experiment to the IRB. Also, it's been alleged that the IRB exemption was only sought after the research was conducted and the paper was submitted for publication. If true, that seems to imply that they lied on their NSF grant application, because the principal investigator would have had to certify that either the research did not involve human subjects or that they had already applied for IRB approval/exemption.
- fluidcruft 6y ago
  Why is it a questionable decision? I do not see the risk it poses. Literally anyone including organizations far more well funded and vested than UMN are likely submitting hypocrite patches. At its worst, this research is merely substituting one existing bug with a new bug. And yeah, approval was sought after the research was conducted. Which itself will result in corrective action (very likely: training in human subjects research).

bluGill 6y ago

This was already a known risk. The gains from quantifying how bad the risk are is far outweighed by the fact that they introduced a new risk.

deleted 6y ago
[deleted]

teraflop 6y ago

> An IRB did in fact approve the research as part of the peer review publication process. The IRB did not approve the research, it declared that it was "exempt". That's essentially a determination that the research poses absolutely no risk of harm to anyone and does not require a detailed review, which seems like a very questionable decision to me. One of the things that's worth investigating is whether the researchers were honest in describing their experiment to the IRB. Also, it's been alleged that the IRB exemption was only sought after the research was conducted and the paper was submitted for publication. If true, that seems to imply that they lied on their NSF grant application, because the principal investigator would have had to certify that either the research did not involve human subjects or that they had already applied for IRB approval/exemption.

fluidcruft 6y ago
Why is it a questionable decision? I do not see the risk it poses. Literally anyone including organizations far more well funded and vested than UMN are likely submitting hypocrite patches. At its worst, this research is merely substituting one existing bug with a new bug. And yeah, approval was sought after the research was conducted. Which itself will result in corrective action (very likely: training in human subjects research).