7 ms·

Twenty years ago, this incident would have been met with a "Your scientists were so preoccupied with whether or not they could, they didn't stop to think if the

Twenty years ago, this incident would have been met with a "Your scientists were so preoccupied with whether or not they could, they didn't stop to think if they should." A decade back, "play stupid games, win stupid prizes" would have won out. Now, I think The Kids would say "Fuck around and find out" (this is often accompanied by a stencil of an open-mouthed alligator). No matter the form of the reaction, I am still left wondering at the proportions of disregard, hubris, naivete, and perhaps sheer lack of consideration of consequences that went into this whole affair. For the life of me I simply cannot imagine anyone patting me on the back and saying, "Good show on that paper, old boy! Smartly done!" Was there nobody in the whole group who had reservations? Were any expressed or were they simply hidden away? I am sincerely curious as to how it managed to get to this point.

defaultname 6y ago
I'll be the odd one out and say that I see nothing wrong with their study. There are much more skillful, much better resourced actors who can do what the UMN did much more discretely. I mean, the UMN flaws were egregious and blatantly obvious. They should have been met with ridicule at first glance. If they aren't (and they weren't), there are problems that need to be addressed. But there's a torch mob about this -- a very misled, and I would say foolish torch mob -- and as a result comments like mine will invariably be moderated down to invisible. I guess if we just brigade against some junior researchers it'll help defend the kernel from actually malicious actors...
- floatingatoll 6y ago
  If UMN’s ethics review(s) has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. The outrage, and the core ethical violation, centers around intentionally wasting the time of others for selfish benefit without appropriate review and consent.
  - zajio1am 6y ago
    > If UMN’s ethics board has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. I do not think that would help. This was done on public mailing list and deceptive behavior was also against third parties (other reviewers). I do not think Linus/Greg can give consent to that.
    - floatingatoll 6y ago
      Within the scope of the project, Linus and Greg absolutely could deem this acceptable on a project basis. Individual contributors might then leave the project once this comes to light, but if the project owners say “We need you to submit an 8 hour video of paint drying with every commit”, that’s their right to do so, and if they say “We chose to allow researchers to waste hours of your collective project time for a experiment”, that’s their right to do as well. If they want to guide the project down seemingly-unproductive paths because they truly think it’s worth it, then they will.
      - pvg 6y ago
        The difference is one of these gives you the opportunity to consent or opt out of the wasting of your time, the other ones doesn't. You aren't describing ethically equivalent things.
        floatingatoll 6y ago
        With an experiment of this nature, it is not always possible to get universal consent-or-refusal, due to the nature of the experiment. If you're doing an experiment with footpaths and you want to close specific paths to see how people's behavior changes, you do need to seek permission from the owner of the footpaths, and you do need to perform some sort of ethics review to ensure you aren't creating severe mobility issues for those being experimented upon, but you would never be expected to seek permission from each person traveling those footpaths to waste up to a minute of their time by closing the footpath they intended to traverse. Whether or not that time waste is acceptable is ultimately the decision of the owner/operator of the footpaths, not of the individuals using it. So, then, it is similar with a 'secret experiment upon unwitting people' and the Linux project. The owner/operators are Linus and Greg, and as the experiment cannot be pre-announced without tainting the outcomes, they are the ultimate "go or no-go" decision makers — just as the owner/operator of the footpaths would, too, have a right to refuse an experiment upon their participants. The individual Linux contributors who participate in the Linux project have no implicit authority whatsoever in any such consideration, and would not be offered opt-in or opt-out consent prior to it being performed. If the good of the project requires pentesting the processes that contributors operate, the project has every right to do so; it's for the good of the project, and contributors' time spent will have been net valuable even if the specific contributions are felt to have been "discarded" or if the contributors feel that their time was "wasted". This lack of individual authority in many respects is not comfortable or appealing for open source contributors to consider, but it's critical for us to confront it and learn lessons from it. We do not perfect authority over how open source projects use our contributions, whether in time, money, or code. Some percentage of our contributions will always end up being discarded or wasted, and sometimes that will be upsetting to contributors. These are real aspects of project participation regardless of whether secret experiments are approved by the project owners/operators or not. I hope that this event helps us develop better empathy for large projects, such as Linux or other operating systems, when they make decisions that benefit the project rather than contributors.
- rideontime 6y ago
  What a rhetorical power move it is to preemptively decry "torch mobs" for having your comment disapproved of. You might also consider the possibility that you'll get downvoted for suggesting that "ridicule" is an appropriate response in a code review.
  - defaultname 6y ago
    Maybe you haven't been paying attention, but the "torch mobs" have been pretty active as this situation has unfolded. There is nothing "preemptive" about it. The zeitgeist is pretty obvious. As to the "ridicule", putting aside the out of place attempt to moral high ground about a rhetorical turn of phrase, yes their commits were so egregiously flawed that ridicule was the only response.
- ampdepolymerase 6y ago
  When a state level attacker carries out a successful attack via the kernel, then the developer community will hide behind shocked_pikachu.jpeg and call for more social engineering and red team training for the Linux foundation. Until then, people are happy being complacent and any attempt to change the status quo will be met with hostility.
- kortilla 6y ago
  Your comment will be downmodded because you mentioned it in advance and you haven’t actually stated why you think it was fine to abuse the open source maintainers other than “someone else can do it”. “I beat my kids so some weirdo on the street doesn’t!”
- balozi 6y ago
  Their particular problem in this case is that they are researchers at a reputable university. They are not supposed to be caught doing this, ever. Poorly supervised students coupled to disinterested faculty advisors is the recipe for this sort of non-sense.
  - cycomanic 6y ago
    Actually the supervisor was directly involved in this. I think it's much more the high pressure publish or perish culture, possibly coupled with the pressures of tenure-track hiring (I'm not entirely sure if the supervisor was already tenured).
- zajio1am 6y ago
  > I'll be the odd one out and say that I see nothing wrong with their study. There are much more skillful, much better resourced actors who can do what the UMN did much more discretely. Puting these patches under false pretense is deceptive behavior to other people, that is problematic regardless of whether the intent is malicious or just doing research.
- drknownuffin 6y ago
  I agree strongly. People demanding this be pursued in criminal court are seriously getting bent out of shape. "We can mob these people because they're super in the wrong and also utterly helpless to defend themselves against my righteous fury," is ridiculous. They made an ethical blunder, but this wasn't Tuskegee 2.0.
- simion314 6y ago
  Seems more ethical and positive experiment to have the students to work with historical data, you can find a metric on how easy it is to slip a bug into the kernel, maybe they could identify problematic trends like time of day/year when bugs can slip in, or time before a release. Do we really need someone to prove that a malicious backdoor can be added? since real bugs happen then it is clear that the system is not perfect, Imagine this would be allowed, then all contributions would need to be checked not for the regular kind of problems but for all those stealthy tricks, so instead of working on the kernel you would need to attempt to find on how each commit is truing to trick you , or maybe this is fine on it's own but is part of a bigger plan.
- dang 6y ago
  > and as a result comments like mine will invariably be moderated down to invisible. Please don't downvote-bait or superciliously posture like that. It degrades discussion noticeably and breaks the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. Note the second-last one. Also this one: "Please don't sneer, including at the rest of the community." Also this one: "Don't be snarky."
  - abnry 6y ago
    Okay, but he gets a comment from you and avoids a faded out comment. If his comment was simply faded out, you would not have replied. Frankly, you need to recognize that there is a mob mentality on this topic and that legitimate comments are getting downvoted.
    - dang 6y ago
      The way to respond to a mob mentality is to respectfully supply correct information and patiently make correct arguments. That may not work, mobs being what they are, but the solution is not to lash out in frustration, call names and fulminate. That's worse in every respect: it inflames the mob, damages the commons, and gives readers even more reason to reject whatever truth you're advocating (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=truth%20discredit%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...). Discrediting your minority view while at the same time damaging the community we all depend on is self-defeating behavior. The only reason we do it is because it's extremely frustrating to feel outnumbered by people who hold a wrong view (or one we feel is wrong). We all need to find ways to process that frustration in ourselves, before we can't stand it anymore and get propelled into the comments to seek relief. The relief of venting is short-lived and soon comes back worse, in the classic way that addicts need a higher dose the next time. I don't mean to pick on you or mumblemumble personally. We're all addicts in this sense, and it's in all our interests to find a better way. This experience of frustration is extremely common, as we all know—the internet being, to a first approximation, wrong about everything.
      - 6y ago
- dsr_ 6y ago
  You completely ignore the issue of consent. The UMN has placed itself on the same level as those miscreants, because they screwed up in several different ways. Finally, maturity is, in large part, knowing the difference between having a capability and exercising it. As an institution, the UMN has revealed itself to be immature. What they do about it now determines how they will be treated in future.
- ric2b 6y ago
  They acted just like actual malicious actors by not letting anyone know or asking for consent on their experiment. Try robbing a bank and then claiming you were just testing their security and it was just for research, see how well that works out.
sp332 6y ago
And it's not too rare, either. Tests of "supply chain attacks" have actually uploaded sample packages to package repos like NPM and PyPI, and the professional researchers collected bug bounties. Meanwhile the volunteer repo admins often take the blame and have to clean up all the fake packages too. https://arstechnica.com/information-technology/2021/02/supply-chain-attack-that-fooled-apple-and-microsoft-is-attracting-copycats/ https://arstechnica.com/information-technology/2021/02/suppl...
- angry_octet 6y ago
  The difference is that the bug bounties are being collected from an endorsed bug bounty program. Fake and malicious packages jam public collections regularly, and are not part of white hat research. It's a trash fire which seemingly only gets better with exploits forcing people to change.
  - sp332 6y ago
    The bug bounties are from companies who use the repos, not the repos themselves.
kodah 6y ago
> Was there nobody in the whole group who had reservations? I've seen very well-intentioned people do very stupid, seemingly callous, etc things that would make anyone who didn't know them question their quality as a human being. My answer to these kinds of situations has been to remedy it and move on quickly. The more you dwell, the more possibilities and random connections pop in your head, and the easier it is to believe everybody is just a selfish, evil, etc person; which is far from the truth if you've chosen to live life a little.
tomc1985 6y ago
The academic ivory tower is real. I have seen tenured professors with tenuous grips on the reality outside of academia. Something like this kernel affair seems pretty plausible to me
senderista 6y ago
Wonder if anyone involved was on the tenure track. If so I assume they can kiss tenure goodbye.
- azhenley 6y ago
  It looks like the lead faculty is likely going up for tenure in a year or two.
itronitron 6y ago
>> Was there nobody in the whole group who had reservations? Based on my experience (not at UMN), reservations expressed by juniors are dismissed and the seniors keep their reservations to themselves, lest they also be dismissed.
dylan604 6y ago
There are plenty of examples of the entire decision tree being tone deaf from the real world not just in academia. Often times, this turns out to be because the group involved is not very diverse so the group "experience" is not as wide. How many times has something with a double meaning been used in marketing where the world gasps and asks "was there not one person involved of ____ race/sex/age/etc?"

defaultname 6y ago

I'll be the odd one out and say that I see nothing wrong with their study. There are much more skillful, much better resourced actors who can do what the UMN did much more discretely. I mean, the UMN flaws were egregious and blatantly obvious. They should have been met with ridicule at first glance. If they aren't (and they weren't), there are problems that need to be addressed. But there's a torch mob about this -- a very misled, and I would say foolish torch mob -- and as a result comments like mine will invariably be moderated down to invisible. I guess if we just brigade against some junior researchers it'll help defend the kernel from actually malicious actors...

floatingatoll 6y ago
If UMN’s ethics review(s) has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. The outrage, and the core ethical violation, centers around intentionally wasting the time of others for selfish benefit without appropriate review and consent.
- zajio1am 6y ago
  > If UMN’s ethics board has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. I do not think that would help. This was done on public mailing list and deceptive behavior was also against third parties (other reviewers). I do not think Linus/Greg can give consent to that.
  - floatingatoll 6y ago
    Within the scope of the project, Linus and Greg absolutely could deem this acceptable on a project basis. Individual contributors might then leave the project once this comes to light, but if the project owners say “We need you to submit an 8 hour video of paint drying with every commit”, that’s their right to do so, and if they say “We chose to allow researchers to waste hours of your collective project time for a experiment”, that’s their right to do as well. If they want to guide the project down seemingly-unproductive paths because they truly think it’s worth it, then they will.
    - pvg 6y ago
      The difference is one of these gives you the opportunity to consent or opt out of the wasting of your time, the other ones doesn't. You aren't describing ethically equivalent things.
      - floatingatoll 6y ago
        With an experiment of this nature, it is not always possible to get universal consent-or-refusal, due to the nature of the experiment. If you're doing an experiment with footpaths and you want to close specific paths to see how people's behavior changes, you do need to seek permission from the owner of the footpaths, and you do need to perform some sort of ethics review to ensure you aren't creating severe mobility issues for those being experimented upon, but you would never be expected to seek permission from each person traveling those footpaths to waste up to a minute of their time by closing the footpath they intended to traverse. Whether or not that time waste is acceptable is ultimately the decision of the owner/operator of the footpaths, not of the individuals using it. So, then, it is similar with a 'secret experiment upon unwitting people' and the Linux project. The owner/operators are Linus and Greg, and as the experiment cannot be pre-announced without tainting the outcomes, they are the ultimate "go or no-go" decision makers — just as the owner/operator of the footpaths would, too, have a right to refuse an experiment upon their participants. The individual Linux contributors who participate in the Linux project have no implicit authority whatsoever in any such consideration, and would not be offered opt-in or opt-out consent prior to it being performed. If the good of the project requires pentesting the processes that contributors operate, the project has every right to do so; it's for the good of the project, and contributors' time spent will have been net valuable even if the specific contributions are felt to have been "discarded" or if the contributors feel that their time was "wasted". This lack of individual authority in many respects is not comfortable or appealing for open source contributors to consider, but it's critical for us to confront it and learn lessons from it. We do not perfect authority over how open source projects use our contributions, whether in time, money, or code. Some percentage of our contributions will always end up being discarded or wasted, and sometimes that will be upsetting to contributors. These are real aspects of project participation regardless of whether secret experiments are approved by the project owners/operators or not. I hope that this event helps us develop better empathy for large projects, such as Linux or other operating systems, when they make decisions that benefit the project rather than contributors.
rideontime 6y ago
What a rhetorical power move it is to preemptively decry "torch mobs" for having your comment disapproved of. You might also consider the possibility that you'll get downvoted for suggesting that "ridicule" is an appropriate response in a code review.
- defaultname 6y ago
  Maybe you haven't been paying attention, but the "torch mobs" have been pretty active as this situation has unfolded. There is nothing "preemptive" about it. The zeitgeist is pretty obvious. As to the "ridicule", putting aside the out of place attempt to moral high ground about a rhetorical turn of phrase, yes their commits were so egregiously flawed that ridicule was the only response.
ampdepolymerase 6y ago
When a state level attacker carries out a successful attack via the kernel, then the developer community will hide behind shocked_pikachu.jpeg and call for more social engineering and red team training for the Linux foundation. Until then, people are happy being complacent and any attempt to change the status quo will be met with hostility.
kortilla 6y ago
Your comment will be downmodded because you mentioned it in advance and you haven’t actually stated why you think it was fine to abuse the open source maintainers other than “someone else can do it”. “I beat my kids so some weirdo on the street doesn’t!”
balozi 6y ago
Their particular problem in this case is that they are researchers at a reputable university. They are not supposed to be caught doing this, ever. Poorly supervised students coupled to disinterested faculty advisors is the recipe for this sort of non-sense.
- cycomanic 6y ago
  Actually the supervisor was directly involved in this. I think it's much more the high pressure publish or perish culture, possibly coupled with the pressures of tenure-track hiring (I'm not entirely sure if the supervisor was already tenured).
zajio1am 6y ago
> I'll be the odd one out and say that I see nothing wrong with their study. There are much more skillful, much better resourced actors who can do what the UMN did much more discretely. Puting these patches under false pretense is deceptive behavior to other people, that is problematic regardless of whether the intent is malicious or just doing research.
drknownuffin 6y ago
I agree strongly. People demanding this be pursued in criminal court are seriously getting bent out of shape. "We can mob these people because they're super in the wrong and also utterly helpless to defend themselves against my righteous fury," is ridiculous. They made an ethical blunder, but this wasn't Tuskegee 2.0.
simion314 6y ago
Seems more ethical and positive experiment to have the students to work with historical data, you can find a metric on how easy it is to slip a bug into the kernel, maybe they could identify problematic trends like time of day/year when bugs can slip in, or time before a release. Do we really need someone to prove that a malicious backdoor can be added? since real bugs happen then it is clear that the system is not perfect, Imagine this would be allowed, then all contributions would need to be checked not for the regular kind of problems but for all those stealthy tricks, so instead of working on the kernel you would need to attempt to find on how each commit is truing to trick you , or maybe this is fine on it's own but is part of a bigger plan.
dang 6y ago
> and as a result comments like mine will invariably be moderated down to invisible. Please don't downvote-bait or superciliously posture like that. It degrades discussion noticeably and breaks the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. Note the second-last one. Also this one: "Please don't sneer, including at the rest of the community." Also this one: "Don't be snarky."
- abnry 6y ago
  Okay, but he gets a comment from you and avoids a faded out comment. If his comment was simply faded out, you would not have replied. Frankly, you need to recognize that there is a mob mentality on this topic and that legitimate comments are getting downvoted.
  - dang 6y ago
    The way to respond to a mob mentality is to respectfully supply correct information and patiently make correct arguments. That may not work, mobs being what they are, but the solution is not to lash out in frustration, call names and fulminate. That's worse in every respect: it inflames the mob, damages the commons, and gives readers even more reason to reject whatever truth you're advocating (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=truth%20discredit%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...). Discrediting your minority view while at the same time damaging the community we all depend on is self-defeating behavior. The only reason we do it is because it's extremely frustrating to feel outnumbered by people who hold a wrong view (or one we feel is wrong). We all need to find ways to process that frustration in ourselves, before we can't stand it anymore and get propelled into the comments to seek relief. The relief of venting is short-lived and soon comes back worse, in the classic way that addicts need a higher dose the next time. I don't mean to pick on you or mumblemumble personally. We're all addicts in this sense, and it's in all our interests to find a better way. This experience of frustration is extremely common, as we all know—the internet being, to a first approximation, wrong about everything.
    - 6y ago
dsr_ 6y ago
You completely ignore the issue of consent. The UMN has placed itself on the same level as those miscreants, because they screwed up in several different ways. Finally, maturity is, in large part, knowing the difference between having a capability and exercising it. As an institution, the UMN has revealed itself to be immature. What they do about it now determines how they will be treated in future.
ric2b 6y ago
They acted just like actual malicious actors by not letting anyone know or asking for consent on their experiment. Try robbing a bank and then claiming you were just testing their security and it was just for research, see how well that works out.

sp332 6y ago

And it's not too rare, either. Tests of "supply chain attacks" have actually uploaded sample packages to package repos like NPM and PyPI, and the professional researchers collected bug bounties. Meanwhile the volunteer repo admins often take the blame and have to clean up all the fake packages too. https://arstechnica.com/information-technology/2021/02/supply-chain-attack-that-fooled-apple-and-microsoft-is-attracting-copycats/ https://arstechnica.com/information-technology/2021/02/suppl...

angry_octet 6y ago
The difference is that the bug bounties are being collected from an endorsed bug bounty program. Fake and malicious packages jam public collections regularly, and are not part of white hat research. It's a trash fire which seemingly only gets better with exploits forcing people to change.
- sp332 6y ago
  The bug bounties are from companies who use the repos, not the repos themselves.

kodah 6y ago

> Was there nobody in the whole group who had reservations? I've seen very well-intentioned people do very stupid, seemingly callous, etc things that would make anyone who didn't know them question their quality as a human being. My answer to these kinds of situations has been to remedy it and move on quickly. The more you dwell, the more possibilities and random connections pop in your head, and the easier it is to believe everybody is just a selfish, evil, etc person; which is far from the truth if you've chosen to live life a little.

tomc1985 6y ago

The academic ivory tower is real. I have seen tenured professors with tenuous grips on the reality outside of academia. Something like this kernel affair seems pretty plausible to me

senderista 6y ago

Wonder if anyone involved was on the tenure track. If so I assume they can kiss tenure goodbye.

azhenley 6y ago
It looks like the lead faculty is likely going up for tenure in a year or two.

itronitron 6y ago

>> Was there nobody in the whole group who had reservations? Based on my experience (not at UMN), reservations expressed by juniors are dismissed and the seniors keep their reservations to themselves, lest they also be dismissed.

dylan604 6y ago

There are plenty of examples of the entire decision tree being tone deaf from the real world not just in academia. Often times, this turns out to be because the group involved is not very diverse so the group "experience" is not as wide. How many times has something with a double meaning been used in marketing where the world gasps and asks "was there not one person involved of ____ race/sex/age/etc?"