3 ms·

(2021) Discussion at the time (3025 points, 1954 comments) https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670

• jovial_cavalier 10mo ago
  The authors were 100% in the right, and GKH was 100% in the wrong. It's very amusing to go back and read all of the commenters calling for the paper authors to face criminal prosecution. The fact is that they provided a valuable service and exposed a genuine issue with kernel development policies. Their work reflected poorly on kernel maintainers, and so those maintainers threw a hissy fit and brigaded the community against them. Also, banning umn.edu email addresses didn't even make sense since the hypocrite commits were all from gmail addresses.
  • yjftsjthsd-h 10mo ago
    > Also, banning umn.edu email addresses didn't even make sense since the hypocrite commits were all from gmail addresses. The blanket ban was kicked off by another incident after the hypocrite commit incident.
  • caycep 10mo ago
    I mean...there is a whole discussion about the questionable ethics of the research methods in the verge article. And human subjects and issues-of-consent questions aside, they are also messing with a mission critical system (linux kernel), and apparently left crappy code in there for all the maintainers to go back and weed out.
    • jovial_cavalier 10mo ago
      1) once hypocrite commits were accepted, the authors would immediately retract them 2) I don't think it's unethical to send someone an email that has bad code in it. You shouldn't need an IRB to send emails.
      • wtallis 10mo ago
        > I don't think it's unethical to send someone an email that has bad code in it. It's unethical because of the bits you left out: sending code you know is bad, and doing so under false pretenses. Whether or not you think this rises to the level of requiring IRB approval, surely you must be able to understand that wasting people's time like this is going to be viewed negatively by almost anyone. Some people might be willing to accept that doing this harm is worth it for the greater cause of the research, but that doesn't erase the harm done.
        • mmooss 10mo ago
          Bad code is wasting time; investigating the security of Linux code approval is a good use of time.
        • jovial_cavalier 10mo ago
          See another comment I made in this thread about GKH's response - the UMN group submitted a handful of small patches as part of this study, and "wasted" probably a handful of man hours or at worst a few man days of maintainer time. I don't really consider it a waste because evidence that critical open source infrastructure doesn't bother to run static analysis before merging code from randos is actually useful information that the public deserves to have. GKH's response was to waste man weeks or man months of maintainer time persecuting every last commit that happened to come from umn.edu, despite having zero reason to believe these commits were more suspect than any other institution's commits.
          • wtallis 10mo ago
            > evidence that critical open source infrastructure doesn't bother to run static analysis before merging code from randos is actually useful information that the public deserves to have. It's totally possible to obtain evidence of that without being an asshole to kernel maintainers. Which is the kind of thing that an ethics review conducted before the experiment could have pointed out. If the goal of the experiment was merely to demonstrate the lack of routine static analysis capable of catching such vulnerabilities, then the experiment's design was not justified and the experiment was needlessly harmful to non-consenting participants.
• alphager 10mo ago
  Fun fact: one of the researchers removed any reference to this from their publications page: https://www-users.cse.umn.edu/~kjlu/ https://www-users.cse.umn.edu/~kjlu/
• gweinberg 10mo ago
  Yeah, given that it's been 5 years I would think there would be some followup.