3 ms·
Publicly disclosing the patches would actually harm the reputation of any maintainer who accepted them and expose them to harassment and potential employment is
by fluidcruft 6y ago
Publicly disclosing the patches would actually harm the reputation of any maintainer who accepted them and expose them to harassment and potential employment issues, so I strongly suspect an IRB would not allow it. It's entirely possible to fix bugs and educate without disclosing that the bugs were deliberate or part of the research.
- zymhan 6y agoYou're skipping the part where the IRB would have to approve injecting vulnerabilities into a public software project, a process which involves obfuscating and lying to humans.
- fluidcruft 6y agoRight, but according to what's said about the study design, they (1) fixed an existing bug (2) introduced a new bug, and if maintainers didn't notice the new bug, (3) followed up with a patch removing the new bug Overall there's benefit in that an existing bug is removed and no introduced bugs persist. I don't see why IRB would be likely to object to this.