4 ms·

Well, apparently they needed the bad publicity and "overreaction" to actually do that. The fact that they didn't communicate _clearly_ with the kernel about ex

by gnud 5y ago

Well, apparently they needed the bad publicity and "overreaction" to actually do that. The fact that they didn't communicate _clearly_ with the kernel about exactly which patches this was about at the time when they announced their paper is extremely icky, and makes my sympathy for later misunderstandings/misinformation very limited.

Foxboron 5y ago
The entire incident has been disappointing. The researchers conducting the research thinking this was a good idea, the IRB review process at the UMN, IEEE accepting the IRB exception after ethical concerns where raised, and the overreaction from gregkh on the LKML. Hopefully there is a silver lining and we see better research collaboration between the kernel devs and researchers going forward. IEEE has a job to do around all of this going forward.
- inetknght 5y ago
  > the overreaction from gregkh on the LKML I don't think it was an overreaction. I think it was a very valid reaction.
  - Foxboron 5y ago
    There are a few issues with blaming someone for sending known malicious patches which just causes confusion and is outright wrong. Brad Spengler is a... character, but I do agree with him that greg started out on this wrong. (He also goes a bit further with his criticism that I don't agree with). However yes, review of the patches was proper but all this could have been done with less unfounded accusations from gregs side.
    - neatze 5y ago
      Can you provide specifics what do you mean exactly by unfounded accusations ? Really curious who makes unfunded accusations ...
      - Foxboron 5y ago
        https://lore.kernel.org/linux-nfs/YH5%2Fi7OvsjSmqADv@kroah.com/ https://lore.kernel.org/linux-nfs/YH5%2Fi7OvsjSmqADv@kroah.c... And the resulting conversations between Aditya Pakki and Greg. Aditya was never part of the hypocrite commit research, accusing them for this is just bad.
        shadowgovt 5y ago
        That's the problem with bad-faith action by an institution... It casts a shadow on the actions of all the other agents of the institution. Greg's concerns proved to be overblown, but at the time they were raised he had reason to believe them valid.
        HarryHirsch 5y ago
        The "hypocrite commit" project was using the kernel developers to further Kangjie Lu's career goals. Aditya was using the kernel developers' time to further his research project, his static analyzer. There's no material difference.
        gnud 5y ago
        That's easy to say now. At the time, UMC had not "debriefed" the kernel maintainers they lied to in the "hypocrite commits". And then Pakki didn't mention that these new patches were generated by a tool, and submitted a bunch of "nonsense" patches with no explanation. What reason did GKH have to trust anyone associated with the "hypocrite commits" at that point? (ps. don't think you deserve all the downvotes here...)
        Foxboron 5y ago
        I said the same thing then. The pre-print was public at that point and I had been following it since December, sharing thesis adviser doesn't make you associated with research conducted months prior. Yes, they are bad patches and the research is also questionable. But this is not bad faith nor malicious.
    - fartcannon 5y ago
      From the outside, Greg appears to behave like a saint through this enitre process. The university, professors and students involved in this calamity have demonatrated precisely why software developers really need to be bound by ethics.
    - fartcannon 5y ago
      Are you Aditya? You write quite a bit like them. Do you want to take a moment and explain how your broken static anylizer isn't involved?
      - Foxboron 5y ago
        Please google me. You'll quickly learn I'm a 26 year old Norwegian FOSS maintainer named "Morten Linderud". Or, y'know. Click on the profile.
        fartcannon 5y ago
        Passionate! I like it, Morten. It's rare. I did click your profile, but this is a post about deception. Trust no one.
  - nitrogen 5y ago
    The sort of reaction an emperor has upon finding their shiny new clothes don't actually exist. It's bad the tailors sold fake clothes, but it's also bad the emperor and co. didn't notice sooner. Here we saw the emperor go on a full war path against the entire place of origin of a couple of misguided individuals. Not a proportionate response.
    - simlevesque 5y ago
      Institutional Review Board dropped the ball and failed at their job. Which reflects on the institution. It's not just about individuals.
      - saalweachter 5y ago
        Eh, maybe, but at the same time, I kind of got the feeling that the researchers were treating the IRB as one more layer of security to get around. The IRB is a gatekeeper, yes, but it is also a resource. You should be working with the IRB to make sure everything you are doing is above the board, because ultimately, if you do something unethical or harmful to individuals or society, that's still on you, even if you got your plan stamped by the IRB. You shouldn't have an antagonistic relationship where you use the vague and technically accurate but misleading descriptions of your research an an attempt to get a "get out of consequences free" card.
        webmaven 5y ago
        > Eh, maybe, but at the same time, I kind of got the feeling that the researchers were treating the IRB as one more layer of security to get around. Which suggests an entirely new line of inquiry: testing IRB procedures to see whether unethical proposals will be approved if described in misleading terms. While we're at it, we should check to see whether proposals ostensibly from people who are not faculty or students, or who perhaps don't even exist, are ever approved. Regardless of the results, we can conclude that having to sign a statement promising to never do unethical research before submitting a proposal, and insisting on identity verification before proposals are reviewed, will lower the chances of unethical research proposals slipping through.

by gnud 5y ago

Foxboron 5y ago

The entire incident has been disappointing. The researchers conducting the research thinking this was a good idea, the IRB review process at the UMN, IEEE accepting the IRB exception after ethical concerns where raised, and the overreaction from gregkh on the LKML. Hopefully there is a silver lining and we see better research collaboration between the kernel devs and researchers going forward. IEEE has a job to do around all of this going forward.

inetknght 5y ago
> the overreaction from gregkh on the LKML I don't think it was an overreaction. I think it was a very valid reaction.
- Foxboron 5y ago
  There are a few issues with blaming someone for sending known malicious patches which just causes confusion and is outright wrong. Brad Spengler is a... character, but I do agree with him that greg started out on this wrong. (He also goes a bit further with his criticism that I don't agree with). However yes, review of the patches was proper but all this could have been done with less unfounded accusations from gregs side.
  - neatze 5y ago
    Can you provide specifics what do you mean exactly by unfounded accusations ? Really curious who makes unfunded accusations ...
    - Foxboron 5y ago
      https://lore.kernel.org/linux-nfs/YH5%2Fi7OvsjSmqADv@kroah.com/ https://lore.kernel.org/linux-nfs/YH5%2Fi7OvsjSmqADv@kroah.c... And the resulting conversations between Aditya Pakki and Greg. Aditya was never part of the hypocrite commit research, accusing them for this is just bad.
      - shadowgovt 5y ago
        That's the problem with bad-faith action by an institution... It casts a shadow on the actions of all the other agents of the institution. Greg's concerns proved to be overblown, but at the time they were raised he had reason to believe them valid.
      - HarryHirsch 5y ago
        The "hypocrite commit" project was using the kernel developers to further Kangjie Lu's career goals. Aditya was using the kernel developers' time to further his research project, his static analyzer. There's no material difference.
      - gnud 5y ago
        That's easy to say now. At the time, UMC had not "debriefed" the kernel maintainers they lied to in the "hypocrite commits". And then Pakki didn't mention that these new patches were generated by a tool, and submitted a bunch of "nonsense" patches with no explanation. What reason did GKH have to trust anyone associated with the "hypocrite commits" at that point? (ps. don't think you deserve all the downvotes here...)
        Foxboron 5y ago
        I said the same thing then. The pre-print was public at that point and I had been following it since December, sharing thesis adviser doesn't make you associated with research conducted months prior. Yes, they are bad patches and the research is also questionable. But this is not bad faith nor malicious.
  - fartcannon 5y ago
    From the outside, Greg appears to behave like a saint through this enitre process. The university, professors and students involved in this calamity have demonatrated precisely why software developers really need to be bound by ethics.
  - fartcannon 5y ago
    Are you Aditya? You write quite a bit like them. Do you want to take a moment and explain how your broken static anylizer isn't involved?
    - Foxboron 5y ago
      Please google me. You'll quickly learn I'm a 26 year old Norwegian FOSS maintainer named "Morten Linderud". Or, y'know. Click on the profile.
      - fartcannon 5y ago
        Passionate! I like it, Morten. It's rare. I did click your profile, but this is a post about deception. Trust no one.
- nitrogen 5y ago
  The sort of reaction an emperor has upon finding their shiny new clothes don't actually exist. It's bad the tailors sold fake clothes, but it's also bad the emperor and co. didn't notice sooner. Here we saw the emperor go on a full war path against the entire place of origin of a couple of misguided individuals. Not a proportionate response.
  - simlevesque 5y ago
    Institutional Review Board dropped the ball and failed at their job. Which reflects on the institution. It's not just about individuals.
    - saalweachter 5y ago
      Eh, maybe, but at the same time, I kind of got the feeling that the researchers were treating the IRB as one more layer of security to get around. The IRB is a gatekeeper, yes, but it is also a resource. You should be working with the IRB to make sure everything you are doing is above the board, because ultimately, if you do something unethical or harmful to individuals or society, that's still on you, even if you got your plan stamped by the IRB. You shouldn't have an antagonistic relationship where you use the vague and technically accurate but misleading descriptions of your research an an attempt to get a "get out of consequences free" card.
      - webmaven 5y ago
        > Eh, maybe, but at the same time, I kind of got the feeling that the researchers were treating the IRB as one more layer of security to get around. Which suggests an entirely new line of inquiry: testing IRB procedures to see whether unethical proposals will be approved if described in misleading terms. While we're at it, we should check to see whether proposals ostensibly from people who are not faculty or students, or who perhaps don't even exist, are ever approved. Regardless of the results, we can conclude that having to sign a statement promising to never do unethical research before submitting a proposal, and insisting on identity verification before proposals are reviewed, will lower the chances of unethical research proposals slipping through.