6 ms·

I do think the IRB got this one wrong, but I am not surprised that they got it wrong. From my experience with an IRB, they were most worried about researchers

I do think the IRB got this one wrong, but I am not surprised that they got it wrong. From my experience with an IRB, they were most worried about researchers doing another Tuskegee experiment or a Stanford prison experiment. The question they were interested in was something like “are you going to torture/abuse/harm people directly?” The people on the board have likely never thought about the issue of introducing a (possibly important) vulnerability into software which is widely used. That also has the potential for harm, but doesn’t look obvious to the IRB in the way that deliberately infecting someone with syphilis would. Getting an exempt determination for this research would likely have been extremely easy at any IRB at any university in the country. Applications from CS departments are probably less than 1% of what they do (that figure is a guess so if anyone knows better please correct it!).

fluidcruft 5y ago
The research plan is said to include reversing the hypocrite patch. So basically you're replacing one existing bug (if the researchers could find it, anyone else could) with an obscure bug (that at least initially only the researchers are aware of) and then only if the obscure bug slips through the maintainers, then later the obscure bug is also purged. So even if the IRB understands what's going on, I think there's a reasonable beneficence case.
Fomite 5y ago
In my experience, what an IRB is worried about varies wildly by IRB. My graduate university was very careful, to the point of frustration (I had a four email back-and-forth with them about a project with no human subjects). The institution I did a postdoc with on the other hand was fairly lax and hands off. Current institution is somewhere in the middle.
- huitzitziltzin 5y ago
  True in my experience. A four email back and forth about a project w/ no human subjects is a pain. I had several months of back and forth about simply using data on events which had happened 15 years earlier. (I made (what felt like to me like) appeals to metaphysics to argue that it was very unlikely my using this data could retroactively harm people in the study.) I would be surprised if there are IRBs which get a lot of action from CS departments, and more surprised if they have members who can make a qualified evaluation of the costs and benefits of this research. I'm also not convinced that it was a bad idea. This was extremely poorly executed, but illustrates an important (though maybe obvious) point: this method for introducing vulnerabilities would work. A better way to handle it, IMO, would have been to involve someone at the very top in the Linux organization, to say "hey we are going to do this to see if it works - are you ok with that?" and then as soon as it works once, or on some defined, very small number of times, stop immediately and tell everyone what you did.

fluidcruft 5y ago

The research plan is said to include reversing the hypocrite patch. So basically you're replacing one existing bug (if the researchers could find it, anyone else could) with an obscure bug (that at least initially only the researchers are aware of) and then only if the obscure bug slips through the maintainers, then later the obscure bug is also purged. So even if the IRB understands what's going on, I think there's a reasonable beneficence case.

Fomite 5y ago

In my experience, what an IRB is worried about varies wildly by IRB. My graduate university was very careful, to the point of frustration (I had a four email back-and-forth with them about a project with no human subjects). The institution I did a postdoc with on the other hand was fairly lax and hands off. Current institution is somewhere in the middle.

huitzitziltzin 5y ago
True in my experience. A four email back and forth about a project w/ no human subjects is a pain. I had several months of back and forth about simply using data on events which had happened 15 years earlier. (I made (what felt like to me like) appeals to metaphysics to argue that it was very unlikely my using this data could retroactively harm people in the study.) I would be surprised if there are IRBs which get a lot of action from CS departments, and more surprised if they have members who can make a qualified evaluation of the costs and benefits of this research. I'm also not convinced that it was a bad idea. This was extremely poorly executed, but illustrates an important (though maybe obvious) point: this method for introducing vulnerabilities would work. A better way to handle it, IMO, would have been to involve someone at the very top in the Linux organization, to say "hey we are going to do this to see if it works - are you ok with that?" and then as soon as it works once, or on some defined, very small number of times, stop immediately and tell everyone what you did.