4 ms·

> Breaking the trust model and forcing the maintainers to revert all already accepted patches on suspicion alone The kernel developers chose to do that out of

by seoaeu 6y ago

> Breaking the trust model and forcing the maintainers to revert all already accepted patches on suspicion alone The kernel developers chose to do that out of a combination of spite and excessive caution. The actual malicious patches didn't even come from UMN email addresses. > Proactive? The universities review board signed off on that mess, there is nothing proactive about banning a group of bad actors after the fact. Why does everyone keep repeating this? The IRB declared that it wasn't human subject research. Tons of other IRBs would have done the same because they all use a standardized definition that hasn't been updated for interactions with online communities.

josefx 6y ago
> Tons of other IRBs would have done the same because they all use a standardized definition that hasn't been updated for interactions with online communities. I can imagine a paper from the 1940s showing how they checked the security precautions of baby food manufacturers by having a factory worker under their control randomly lace the produced baby food with arsenic to see if the manipulated batches got caught by an "abstract process" before they could enter general distribution. Yeah, nothing that went wrong in this case can be excused by "but the internets!!!".
- seoaeu 6y ago
  In another part of the thread, a commenter linked the response from the department which pointed out that the definition of human subject research and even IRBs themselves are governed by federal statute. A bunch did go wrong in this case, but the actions of the IRB weren't one of them. They were acting exactly as directed by the law. The fault lies with the researchers who conducted the experiment, and perhaps broadly with the academic community for not establishing guidelines for ethical oversight of non-human subject research.
  - josefx 6y ago
    The definition of human subject is literally "a human a researcher collects information on", as far as I can find the law doesn't even try to over complicate that point. Claiming that researching the Linux review process does not involve human subjects seems to be willfully ignorant.
    - seoaeu 6y ago
      The letter [0] explains it better than I could: > Crucially, an essential requirement for research to be considered as “human subjects research” (and thus within the purview of the IRB) is that it involves collecting information about human subjects themselves, such as age, blood pressure, or related. No such information was sought or collected here. [...] Importantly, even if one believed the study did involve human research subjects (perhaps due to the interactions and the incidental collection of email addresses), the study would clearly be exempt from IRB oversight pursuant to 45 CFR 46.104(D). [0] https://drive.google.com/file/d/1z3Nm2bfR4tH1nOGBpuOmLyoJVEiO9cUq/view https://drive.google.com/file/d/1z3Nm2bfR4tH1nOGBpuOmLyoJVEi...
      - josefx 6y ago
        > such as age, blood pressure, or related So they try to cite the law, giving the relevant section, but the law contains a generic "information or biospecimens" instead of restricting itself to the clearly medical subset they provide. It would be better if they actually cited a source or the exact paragraph that results in their interpretation, because I can't find it. Even worse they give 46.104(D) as reason why it would be excluded anyway. That is literally the list of all possible reasons something could be excluded. Which of the reasons listed do they refer to?

by seoaeu 6y ago

josefx 6y ago

> Tons of other IRBs would have done the same because they all use a standardized definition that hasn't been updated for interactions with online communities. I can imagine a paper from the 1940s showing how they checked the security precautions of baby food manufacturers by having a factory worker under their control randomly lace the produced baby food with arsenic to see if the manipulated batches got caught by an "abstract process" before they could enter general distribution. Yeah, nothing that went wrong in this case can be excused by "but the internets!!!".

seoaeu 6y ago
In another part of the thread, a commenter linked the response from the department which pointed out that the definition of human subject research and even IRBs themselves are governed by federal statute. A bunch did go wrong in this case, but the actions of the IRB weren't one of them. They were acting exactly as directed by the law. The fault lies with the researchers who conducted the experiment, and perhaps broadly with the academic community for not establishing guidelines for ethical oversight of non-human subject research.
- josefx 6y ago
  The definition of human subject is literally "a human a researcher collects information on", as far as I can find the law doesn't even try to over complicate that point. Claiming that researching the Linux review process does not involve human subjects seems to be willfully ignorant.
  - seoaeu 6y ago
    The letter [0] explains it better than I could: > Crucially, an essential requirement for research to be considered as “human subjects research” (and thus within the purview of the IRB) is that it involves collecting information about human subjects themselves, such as age, blood pressure, or related. No such information was sought or collected here. [...] Importantly, even if one believed the study did involve human research subjects (perhaps due to the interactions and the incidental collection of email addresses), the study would clearly be exempt from IRB oversight pursuant to 45 CFR 46.104(D). [0] https://drive.google.com/file/d/1z3Nm2bfR4tH1nOGBpuOmLyoJVEiO9cUq/view https://drive.google.com/file/d/1z3Nm2bfR4tH1nOGBpuOmLyoJVEi...
    - josefx 6y ago
      > such as age, blood pressure, or related So they try to cite the law, giving the relevant section, but the law contains a generic "information or biospecimens" instead of restricting itself to the clearly medical subset they provide. It would be better if they actually cited a source or the exact paragraph that results in their interpretation, because I can't find it. Even worse they give 46.104(D) as reason why it would be excluded anyway. That is literally the list of all possible reasons something could be excluded. Which of the reasons listed do they refer to?