5 ms·

> is not a situation created by the group of researchers. As far as I got from various threads on the issue the university has been involved in at least two m

by josefx 6y ago

> is not a situation created by the group of researchers. As far as I got from various threads on the issue the university has been involved in at least two major time wasters: * Breaking the trust model and forcing the maintainers to revert all already accepted patches on suspicion alone * Running a primitive static code analysis tool that got overeager with correcting impossible bugs and not marking the generated patches as such. > Proactively punish the whole UMN does nothing to address the real issue here. Proactive? The universities review board signed off on that mess, there is nothing proactive about banning a group of bad actors after the fact.

SiempreViernes 6y ago
Proactive probable refers to also banning the 6700 staff, along with the 46000 students, that are not part of the research project from ever contributing.
- monocasa 6y ago
  That staff and student body is governed by the same ethics board that allowed this to happen.
  - cycomanic 6y ago
    Facebook experimented on people (some might have even been kernel programmers), but Facebook programmers are still contributing to the kernel. Let's not even talk about all the other organisations who have done some pretty unethical things, I mean lots of corporations who have or still are violating the GPL (on Kernel code even) are allowed to continue to contribute to the kernel.
    - monocasa 6y ago
      They didn't experiment on the kernel process itself. And it would be counterproductive to set up the incentives so that people who aren't contributing in the first place can't.
    - pabs3 6y ago
      Do you have any examples of companies that are both still GPL violating and still contributing to Linux mainline?
  - seoaeu 6y ago
    Why is that a problem? Most kernel contributors aren't governed by any ethics board at all!
    - josefx 6y ago
      They probably work for some company and can you imagine the shit storm if it ever came out that Microsofts board of directors signed off on a Microsoft dev. actively submitting vulnerabilities into the Linux kernel?
      - seoaeu 6y ago
        An IRB and a board of directors aren't remotely similar. UMN actually does have a board of trustees but they've had literally nothing to do with this incident. The senior administration (and the CS&E department prior to the mailing list blowup) never even knew that this research was happening.
- zopa 6y ago
  Realistically, if a UMN student submits a patch from their personal, non-.edu email address, will anyone notice or care?
staticassertion 6y ago
> * Running a primitive static code analysis tool that got overeager with correcting impossible bugs and not marking the generated patches as such. This is not a major time waster. It happens constantly - students everywhere are doing this, and the patches are accepted constantly. Further, while Greg classified the entirety of the analyzers findings as being useless, he was incorrect.[0] > The universities review board signed off on that mess, there is nothing proactive about banning a group of bad actors after the fact. In terms of the researchers submitting malicious patches it was done without edu addresses, which means that banning them solves nothing. [0] https://lore.kernel.org/lkml/b43fc2b0-b3cf-15ab-7d3c-25c1f2a3e658@canonical.com/ https://lore.kernel.org/lkml/b43fc2b0-b3cf-15ab-7d3c-25c1f2a... In fact, most of the fixes fit into the bucket of "potentially useful".
- spacechild1 6y ago
  > students everywhere are doing this Which somehow makes it ok? The Linux team told UMN not to run experiments on the kernel anymore, and then a student comes along and does it again. Given his association with Kangjie Lu, he should have known better.
seoaeu 6y ago
> Breaking the trust model and forcing the maintainers to revert all already accepted patches on suspicion alone The kernel developers chose to do that out of a combination of spite and excessive caution. The actual malicious patches didn't even come from UMN email addresses. > Proactive? The universities review board signed off on that mess, there is nothing proactive about banning a group of bad actors after the fact. Why does everyone keep repeating this? The IRB declared that it wasn't human subject research. Tons of other IRBs would have done the same because they all use a standardized definition that hasn't been updated for interactions with online communities.
- josefx 6y ago
  > Tons of other IRBs would have done the same because they all use a standardized definition that hasn't been updated for interactions with online communities. I can imagine a paper from the 1940s showing how they checked the security precautions of baby food manufacturers by having a factory worker under their control randomly lace the produced baby food with arsenic to see if the manipulated batches got caught by an "abstract process" before they could enter general distribution. Yeah, nothing that went wrong in this case can be excused by "but the internets!!!".
  - seoaeu 6y ago
    In another part of the thread, a commenter linked the response from the department which pointed out that the definition of human subject research and even IRBs themselves are governed by federal statute. A bunch did go wrong in this case, but the actions of the IRB weren't one of them. They were acting exactly as directed by the law. The fault lies with the researchers who conducted the experiment, and perhaps broadly with the academic community for not establishing guidelines for ethical oversight of non-human subject research.
    - josefx 6y ago
      The definition of human subject is literally "a human a researcher collects information on", as far as I can find the law doesn't even try to over complicate that point. Claiming that researching the Linux review process does not involve human subjects seems to be willfully ignorant.

by josefx 6y ago

SiempreViernes 6y ago

Proactive probable refers to also banning the 6700 staff, along with the 46000 students, that are not part of the research project from ever contributing.

monocasa 6y ago
That staff and student body is governed by the same ethics board that allowed this to happen.
- cycomanic 6y ago
  Facebook experimented on people (some might have even been kernel programmers), but Facebook programmers are still contributing to the kernel. Let's not even talk about all the other organisations who have done some pretty unethical things, I mean lots of corporations who have or still are violating the GPL (on Kernel code even) are allowed to continue to contribute to the kernel.
  - monocasa 6y ago
    They didn't experiment on the kernel process itself. And it would be counterproductive to set up the incentives so that people who aren't contributing in the first place can't.
  - pabs3 6y ago
    Do you have any examples of companies that are both still GPL violating and still contributing to Linux mainline?
- seoaeu 6y ago
  Why is that a problem? Most kernel contributors aren't governed by any ethics board at all!
  - josefx 6y ago
    They probably work for some company and can you imagine the shit storm if it ever came out that Microsofts board of directors signed off on a Microsoft dev. actively submitting vulnerabilities into the Linux kernel?
    - seoaeu 6y ago
      An IRB and a board of directors aren't remotely similar. UMN actually does have a board of trustees but they've had literally nothing to do with this incident. The senior administration (and the CS&E department prior to the mailing list blowup) never even knew that this research was happening.
zopa 6y ago
Realistically, if a UMN student submits a patch from their personal, non-.edu email address, will anyone notice or care?

staticassertion 6y ago

> * Running a primitive static code analysis tool that got overeager with correcting impossible bugs and not marking the generated patches as such. This is not a major time waster. It happens constantly - students everywhere are doing this, and the patches are accepted constantly. Further, while Greg classified the entirety of the analyzers findings as being useless, he was incorrect.[0] > The universities review board signed off on that mess, there is nothing proactive about banning a group of bad actors after the fact. In terms of the researchers submitting malicious patches it was done without edu addresses, which means that banning them solves nothing. [0] https://lore.kernel.org/lkml/b43fc2b0-b3cf-15ab-7d3c-25c1f2a3e658@canonical.com/ https://lore.kernel.org/lkml/b43fc2b0-b3cf-15ab-7d3c-25c1f2a... In fact, most of the fixes fit into the bucket of "potentially useful".

spacechild1 6y ago
> students everywhere are doing this Which somehow makes it ok? The Linux team told UMN not to run experiments on the kernel anymore, and then a student comes along and does it again. Given his association with Kangjie Lu, he should have known better.

seoaeu 6y ago

> Breaking the trust model and forcing the maintainers to revert all already accepted patches on suspicion alone The kernel developers chose to do that out of a combination of spite and excessive caution. The actual malicious patches didn't even come from UMN email addresses. > Proactive? The universities review board signed off on that mess, there is nothing proactive about banning a group of bad actors after the fact. Why does everyone keep repeating this? The IRB declared that it wasn't human subject research. Tons of other IRBs would have done the same because they all use a standardized definition that hasn't been updated for interactions with online communities.

josefx 6y ago
> Tons of other IRBs would have done the same because they all use a standardized definition that hasn't been updated for interactions with online communities. I can imagine a paper from the 1940s showing how they checked the security precautions of baby food manufacturers by having a factory worker under their control randomly lace the produced baby food with arsenic to see if the manipulated batches got caught by an "abstract process" before they could enter general distribution. Yeah, nothing that went wrong in this case can be excused by "but the internets!!!".
- seoaeu 6y ago
  In another part of the thread, a commenter linked the response from the department which pointed out that the definition of human subject research and even IRBs themselves are governed by federal statute. A bunch did go wrong in this case, but the actions of the IRB weren't one of them. They were acting exactly as directed by the law. The fault lies with the researchers who conducted the experiment, and perhaps broadly with the academic community for not establishing guidelines for ethical oversight of non-human subject research.
  - josefx 6y ago
    The definition of human subject is literally "a human a researcher collects information on", as far as I can find the law doesn't even try to over complicate that point. Claiming that researching the Linux review process does not involve human subjects seems to be willfully ignorant.