7 ms·

If UMN’s ethics review(s) has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. The outrage, and the c

If UMN’s ethics review(s) has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. The outrage, and the core ethical violation, centers around intentionally wasting the time of others for selfish benefit without appropriate review and consent.

zajio1am 6y ago
> If UMN’s ethics board has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. I do not think that would help. This was done on public mailing list and deceptive behavior was also against third parties (other reviewers). I do not think Linus/Greg can give consent to that.
- floatingatoll 6y ago
  Within the scope of the project, Linus and Greg absolutely could deem this acceptable on a project basis. Individual contributors might then leave the project once this comes to light, but if the project owners say “We need you to submit an 8 hour video of paint drying with every commit”, that’s their right to do so, and if they say “We chose to allow researchers to waste hours of your collective project time for a experiment”, that’s their right to do as well. If they want to guide the project down seemingly-unproductive paths because they truly think it’s worth it, then they will.
  - pvg 6y ago
    The difference is one of these gives you the opportunity to consent or opt out of the wasting of your time, the other ones doesn't. You aren't describing ethically equivalent things.
    - floatingatoll 6y ago
      With an experiment of this nature, it is not always possible to get universal consent-or-refusal, due to the nature of the experiment. If you're doing an experiment with footpaths and you want to close specific paths to see how people's behavior changes, you do need to seek permission from the owner of the footpaths, and you do need to perform some sort of ethics review to ensure you aren't creating severe mobility issues for those being experimented upon, but you would never be expected to seek permission from each person traveling those footpaths to waste up to a minute of their time by closing the footpath they intended to traverse. Whether or not that time waste is acceptable is ultimately the decision of the owner/operator of the footpaths, not of the individuals using it. So, then, it is similar with a 'secret experiment upon unwitting people' and the Linux project. The owner/operators are Linus and Greg, and as the experiment cannot be pre-announced without tainting the outcomes, they are the ultimate "go or no-go" decision makers — just as the owner/operator of the footpaths would, too, have a right to refuse an experiment upon their participants. The individual Linux contributors who participate in the Linux project have no implicit authority whatsoever in any such consideration, and would not be offered opt-in or opt-out consent prior to it being performed. If the good of the project requires pentesting the processes that contributors operate, the project has every right to do so; it's for the good of the project, and contributors' time spent will have been net valuable even if the specific contributions are felt to have been "discarded" or if the contributors feel that their time was "wasted". This lack of individual authority in many respects is not comfortable or appealing for open source contributors to consider, but it's critical for us to confront it and learn lessons from it. We do not perfect authority over how open source projects use our contributions, whether in time, money, or code. Some percentage of our contributions will always end up being discarded or wasted, and sometimes that will be upsetting to contributors. These are real aspects of project participation regardless of whether secret experiments are approved by the project owners/operators or not. I hope that this event helps us develop better empathy for large projects, such as Linux or other operating systems, when they make decisions that benefit the project rather than contributors.
      - pvg 6y ago
        With an experiment of this nature, I think the thing I'm objecting to is that this is a valid or meaningful 'experiment'. Placing there, to me, is already inaccurate framing.
- operator-name 6y ago
  In a previous thread a user suggested the following: Get consent from the project leaders and announce publicly their intentions and a time window of a few months. Then randomly submit the patches as originally outlined. Although this would not prove as strong of a result, it is far more ethical and similarly effective. Companies use this kind of method all the time.
temp8964 6y ago
Wouldn't Linus/Greg be heavily criticized for such cooperation then? The nature of this experiment prohibits it from total consent with the process been experimented on.
- phnofive 6y ago
  They likely wouldn’t have cooperated with study, but advised that there is no point to it as there is no mechanism to catch the behavior they described. It sort of like asking “What if we volunteered for the parks department and slipped a load of salt into the fertilizer?” - of course bad actors can find new ways to circumvent security.
  - floatingatoll 6y ago
    "We found out that we have no process for confirming that we're applying the correct fertilizer to the soil in question, and accidentally salted the earth of a small patch of flowers during the test. While not ideal, the damage is small and contained and repairs are underway."
    - lazyasciiart 6y ago
      "The Parks Department responded by saying well duh, we could have told you that there was no such process, and then you would have avoided killing the flowers and wasting our time by making us check on everywhere else you were allowed to apply fertilizer".
- floatingatoll 6y ago
  No one’s discussing that, and I think that’s the most valuable question of all. Was this experiment so worthwhile that it ought to have been approved? Or was the experiment itself so irrelevant that ethical compliance or not, it shouldn’t have needed doing? Is random testing of gatekeepers an appropriate process in Linux development?
  - cycomanic 6y ago
dekhn 6y ago
There is no such thing as UMN ethics board, although they do have an ethics office: https://integrity.umn.edu/ethics https://integrity.umn.edu/ethics. I don't think they get individually involved in specific studies unless there's been some sort of compliance violation. It's also questionable whether the IRB should have considered this human subjects research and not given them an exemption. It's also questionable whether, if the IRB had done that, the IRB would have stopped the study or asked for revisions to the study design (they would if they were paying close enough attention). Professors at universities are typically given large amounts of freedom to conduct studies without heavy prior approval, it's a tradeoff.
- shadowgovt 6y ago
  And it's a trade-off that the Linux maintainers have now justifiably called them to task on for making the trade-off in a way that pushed the cost onto external parties.
  - hinkley 6y ago
    As the top level stated, "fuck around and find out."
- floatingatoll 6y ago
  Okay, “UMN’s ethics review(s)” encompasses whatever the exact ethical review process(es) are. Updated.
  - dekhn 6y ago
    ethics is mostly self-regulated; when you apply for grants, the University ensures you're not proposing to do anything illegal (risk protection for the U), but subsequently doesn't actively monitor most researchers to ensure they are being ethical. Same for publications. In those cases, the response is entirely reactive, doing investigations and actions after the problem hits the press.
tmotwu 6y ago
> If UMN’s ethics board has approved this experiment in cooperation with Linus/Greg No, informed consent must be with all participants and maintainers reviewing the patches. Why does Linus/Greg get to decide that for others?
- floatingatoll 6y ago
  That is not as cut and dried a decision as you frame it to be. California emissions testing for vehicles includes licensed smog test stations and a process where undercover inspectors bring cars that are in violation to those stations. If the smog test station is incompetent, they will be cited and perhaps stripped of their operating license. If another state decided that they’d like to start performing random tests upon their network of smog test stations, without any retaliation to those stations, then it would not be a violation of ethics for that state to send undercover cars through the stations. It would be unethical to punish those who fail undercover tests, unless the state had announced that random undercover testing was beginning and that punishments would be applied for failures. The researchers were not attempting to modify the behavior of the participants, nor did they seem to be interested in naming and shaming specific maintainers, so it’s not as simple as “anyone who comes into contact with the experiment must be fully informed”.
  - iudqnolq 6y ago
    A professor is not a government. Also, all governments will use uncover officers without warning first.
    - floatingatoll 6y ago
      The analogy is from California to Linus/Greg, not UMN.
  - quickthrowman 6y ago
    California controls the licenses for smog test stations. I would imagine there’s a clause in the contract that says “California, at any time, may do random undercover inspections of the smog testing facility to ensure compliance” which the owner of the licensed smog station would be aware of. Do you see how that differs from an academic randomly experimenting on an open source project with no notice or warning? Retail store owners/managers contract out “mystery shoppers” to test compliance with retail store policy and procedure. This example is also nothing like the UMN experimenting on Linux, since there’s a contract and both parties are aware. A similar example to the UMN/Linux situation would be an academic doctor deciding to randomly test blood donor screening by sending in HIV positive people to lie about their status in order to donate tainted blood and only telling the Red Cross or whoever after the blood has been donated.
presentation 6y ago
Somehow I feel that wasting some developer time in a situation where informing all the parties involved would have probably undermined the research itself, is a lot less of a ethical breach than full blown coerced human experimentation with permanent effects on those people's lives, which this research is being compared to. The outrage on HN about this experiment has been mind-boggling to me, how sacred people hold keeping the Linux kernel and its maintainers' time pristine. And ultimately it seems that the research was useful, given the blast radius it produced.
- DreamScatter 6y ago
  Time wasted is a permanent effect that cannot be recovered, so your argument falls apart.

zajio1am 6y ago

> If UMN’s ethics board has approved this experiment in cooperation with Linus/Greg, there would not be anything to be outraged about. I do not think that would help. This was done on public mailing list and deceptive behavior was also against third parties (other reviewers). I do not think Linus/Greg can give consent to that.

floatingatoll 6y ago
Within the scope of the project, Linus and Greg absolutely could deem this acceptable on a project basis. Individual contributors might then leave the project once this comes to light, but if the project owners say “We need you to submit an 8 hour video of paint drying with every commit”, that’s their right to do so, and if they say “We chose to allow researchers to waste hours of your collective project time for a experiment”, that’s their right to do as well. If they want to guide the project down seemingly-unproductive paths because they truly think it’s worth it, then they will.
- pvg 6y ago
  The difference is one of these gives you the opportunity to consent or opt out of the wasting of your time, the other ones doesn't. You aren't describing ethically equivalent things.
  - floatingatoll 6y ago
    With an experiment of this nature, it is not always possible to get universal consent-or-refusal, due to the nature of the experiment. If you're doing an experiment with footpaths and you want to close specific paths to see how people's behavior changes, you do need to seek permission from the owner of the footpaths, and you do need to perform some sort of ethics review to ensure you aren't creating severe mobility issues for those being experimented upon, but you would never be expected to seek permission from each person traveling those footpaths to waste up to a minute of their time by closing the footpath they intended to traverse. Whether or not that time waste is acceptable is ultimately the decision of the owner/operator of the footpaths, not of the individuals using it. So, then, it is similar with a 'secret experiment upon unwitting people' and the Linux project. The owner/operators are Linus and Greg, and as the experiment cannot be pre-announced without tainting the outcomes, they are the ultimate "go or no-go" decision makers — just as the owner/operator of the footpaths would, too, have a right to refuse an experiment upon their participants. The individual Linux contributors who participate in the Linux project have no implicit authority whatsoever in any such consideration, and would not be offered opt-in or opt-out consent prior to it being performed. If the good of the project requires pentesting the processes that contributors operate, the project has every right to do so; it's for the good of the project, and contributors' time spent will have been net valuable even if the specific contributions are felt to have been "discarded" or if the contributors feel that their time was "wasted". This lack of individual authority in many respects is not comfortable or appealing for open source contributors to consider, but it's critical for us to confront it and learn lessons from it. We do not perfect authority over how open source projects use our contributions, whether in time, money, or code. Some percentage of our contributions will always end up being discarded or wasted, and sometimes that will be upsetting to contributors. These are real aspects of project participation regardless of whether secret experiments are approved by the project owners/operators or not. I hope that this event helps us develop better empathy for large projects, such as Linux or other operating systems, when they make decisions that benefit the project rather than contributors.
    - pvg 6y ago
      With an experiment of this nature, I think the thing I'm objecting to is that this is a valid or meaningful 'experiment'. Placing there, to me, is already inaccurate framing.
operator-name 6y ago
In a previous thread a user suggested the following: Get consent from the project leaders and announce publicly their intentions and a time window of a few months. Then randomly submit the patches as originally outlined. Although this would not prove as strong of a result, it is far more ethical and similarly effective. Companies use this kind of method all the time.

temp8964 6y ago

Wouldn't Linus/Greg be heavily criticized for such cooperation then? The nature of this experiment prohibits it from total consent with the process been experimented on.

phnofive 6y ago
They likely wouldn’t have cooperated with study, but advised that there is no point to it as there is no mechanism to catch the behavior they described. It sort of like asking “What if we volunteered for the parks department and slipped a load of salt into the fertilizer?” - of course bad actors can find new ways to circumvent security.
- floatingatoll 6y ago
  "We found out that we have no process for confirming that we're applying the correct fertilizer to the soil in question, and accidentally salted the earth of a small patch of flowers during the test. While not ideal, the damage is small and contained and repairs are underway."
  - lazyasciiart 6y ago
    "The Parks Department responded by saying well duh, we could have told you that there was no such process, and then you would have avoided killing the flowers and wasting our time by making us check on everywhere else you were allowed to apply fertilizer".
floatingatoll 6y ago
No one’s discussing that, and I think that’s the most valuable question of all. Was this experiment so worthwhile that it ought to have been approved? Or was the experiment itself so irrelevant that ethical compliance or not, it shouldn’t have needed doing? Is random testing of gatekeepers an appropriate process in Linux development?
- cycomanic 6y ago

dekhn 6y ago

There is no such thing as UMN ethics board, although they do have an ethics office: https://integrity.umn.edu/ethics https://integrity.umn.edu/ethics. I don't think they get individually involved in specific studies unless there's been some sort of compliance violation. It's also questionable whether the IRB should have considered this human subjects research and not given them an exemption. It's also questionable whether, if the IRB had done that, the IRB would have stopped the study or asked for revisions to the study design (they would if they were paying close enough attention). Professors at universities are typically given large amounts of freedom to conduct studies without heavy prior approval, it's a tradeoff.

shadowgovt 6y ago
And it's a trade-off that the Linux maintainers have now justifiably called them to task on for making the trade-off in a way that pushed the cost onto external parties.
- hinkley 6y ago
  As the top level stated, "fuck around and find out."
floatingatoll 6y ago
Okay, “UMN’s ethics review(s)” encompasses whatever the exact ethical review process(es) are. Updated.
- dekhn 6y ago
  ethics is mostly self-regulated; when you apply for grants, the University ensures you're not proposing to do anything illegal (risk protection for the U), but subsequently doesn't actively monitor most researchers to ensure they are being ethical. Same for publications. In those cases, the response is entirely reactive, doing investigations and actions after the problem hits the press.

tmotwu 6y ago

> If UMN’s ethics board has approved this experiment in cooperation with Linus/Greg No, informed consent must be with all participants and maintainers reviewing the patches. Why does Linus/Greg get to decide that for others?

floatingatoll 6y ago
That is not as cut and dried a decision as you frame it to be. California emissions testing for vehicles includes licensed smog test stations and a process where undercover inspectors bring cars that are in violation to those stations. If the smog test station is incompetent, they will be cited and perhaps stripped of their operating license. If another state decided that they’d like to start performing random tests upon their network of smog test stations, without any retaliation to those stations, then it would not be a violation of ethics for that state to send undercover cars through the stations. It would be unethical to punish those who fail undercover tests, unless the state had announced that random undercover testing was beginning and that punishments would be applied for failures. The researchers were not attempting to modify the behavior of the participants, nor did they seem to be interested in naming and shaming specific maintainers, so it’s not as simple as “anyone who comes into contact with the experiment must be fully informed”.
- iudqnolq 6y ago
  A professor is not a government. Also, all governments will use uncover officers without warning first.
  - floatingatoll 6y ago
    The analogy is from California to Linus/Greg, not UMN.
- quickthrowman 6y ago
  California controls the licenses for smog test stations. I would imagine there’s a clause in the contract that says “California, at any time, may do random undercover inspections of the smog testing facility to ensure compliance” which the owner of the licensed smog station would be aware of. Do you see how that differs from an academic randomly experimenting on an open source project with no notice or warning? Retail store owners/managers contract out “mystery shoppers” to test compliance with retail store policy and procedure. This example is also nothing like the UMN experimenting on Linux, since there’s a contract and both parties are aware. A similar example to the UMN/Linux situation would be an academic doctor deciding to randomly test blood donor screening by sending in HIV positive people to lie about their status in order to donate tainted blood and only telling the Red Cross or whoever after the blood has been donated.

presentation 6y ago

Somehow I feel that wasting some developer time in a situation where informing all the parties involved would have probably undermined the research itself, is a lot less of a ethical breach than full blown coerced human experimentation with permanent effects on those people's lives, which this research is being compared to. The outrage on HN about this experiment has been mind-boggling to me, how sacred people hold keeping the Linux kernel and its maintainers' time pristine. And ultimately it seems that the research was useful, given the blast radius it produced.

DreamScatter 6y ago
Time wasted is a permanent effect that cannot be recovered, so your argument falls apart.