Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UMN CS&E Statement on Linux Kernel Research

cse.umn.edu

Post reply on HN
Print view View original

111–120 of 332 posts

Re: UMN CS&E Statement on Linux Kernel Research

#111

Post by balozi »

aspaceman wrote: post #84
Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

They also didn't just throw the group under the bus and try and wash their hands clean - good move.

Academia runs on egos and reputations. You can be sure the the fallout is coming.

Re: UMN CS&E Statement on Linux Kernel Research

#112

Post by ransElectronics »

The researchers, the researcher's bosses and pretty much every person in command at UMN had to sign off on this being an acceptable method of conducting research. This shows such an extreme lack of good faith or judgement on their part that I do not believe UMN could, or should ever be forgiven. Their actions show nothing but criminally bad faith taking place, all the way up to the top. The only rational response from the Kernel team is to revert all code submitted by any member of UMN and to permanently blacklist every person who has ever attended UMN or worked at UMN for any reason or any length of time.

The only way I could see this getting forgiven is if every party that could have cancelled the project is forcibly removed from holding any position of employment or enrollment at UMN, going all the way up to the head owners and managers of the entire university.

Re: UMN CS&E Statement on Linux Kernel Research

#113

Post by ellisv »

zxspectrum1982 wrote: post #91
alexeldeib wrote: post #53

Earlier quoted context omitted.

The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

From my reading of the threads in the kernel mailing lists, it seems the IRB thought "is it bioscience with experimentation on live animals? No? Then it's all fine".

I participated in IRB for a UMN campus and that’s pretty much how these things worked back then.

Re: UMN CS&E Statement on Linux Kernel Research

#114

Post by _rpd »

alexeldeib wrote: post #53
IncRnd wrote: post #42

Earlier quoted context omitted.

> I would argue that first requires investigation. Why do you think that enough of an investigation hasn't been performed in order to understand culpability? Thay already know what happened and want to learn why it was approved. That was what their comment said. Take a look at the actual PDF from the researchers , "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Comm…

The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

I think they misrepresented the project so that it would be classified as “not human research”. It’s unclear whether the misrepresentation was intentional (to obtain the exemption) or unintentional (they were genuinely unaware of the human impact).

Re: UMN CS&E Statement on Linux Kernel Research

#115

Post by zenir »

detaro wrote: post #9

I found these statements by the associate department head interesting: https://twitter.com/lorenterveen/status/1384955467051454466 > I do work in Social Computing, and this situation is directly analogous to a number of incidents on Wikipedia quite awhile ago that led to that community and researchers reaching an understanding on research methods that are and are not acceptable. and https://twitter.com/lorenterveen/s…

Basically now they can do a meta study on how the review process of IRB has flaws. As shown, if you intentionally try to bypass the IRB, apparently you can. It's even reproducible.

Re: UMN CS&E Statement on Linux Kernel Research

#116

Post by seoaeu »

zxspectrum1982 wrote: post #91
alexeldeib wrote: post #53

Earlier quoted context omitted.

The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

From my reading of the threads in the kernel mailing lists, it seems the IRB thought "is it bioscience with experimentation on live animals? No? Then it's all fine".

Yeah, especially considering that the IRB said the research was out of scope (specifically that it was not "human subject research") rather than indicating that it was ethical. Kind of like the distinction between a court not having jurisdiction and a court declaring you didn't break any laws.

Re: UMN CS&E Statement on Linux Kernel Research

#117

Post by Causality1 »

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

I disagree. There's not a single word of apology in it.

Re: UMN CS&E Statement on Linux Kernel Research

#118

Post by tytso »

a-dub wrote: post #80
a-dub wrote: post #72

Earlier quoted context omitted.

that helps a bit with regards to understanding why people are so upset about this. but honestly, it seems like valuable research to me. it's unfortunate that it took some time away from busy kernel developers, and it's unfortunate that it ultimately makes the project look worse... ...but isn't that supposed to be part of the promise behind open source? it wouldn't surprise me if i learned that management of private o…

i think the discussion should not be around banning them as known bad actors, but instead should be around how to detect bad actors or better introduce safety and security into the project. i'll tell you one thing, it has shaken my trust in the oss kernel development model as it operates today, and honestly that seems like maybe a good thing? how many companies are literally printing money with the linux kernel? can'…

No development model is protected from malicious actors, and this is not unique to OSS. Could the Ministry of State Security sponsor a student to study at the US, and then after graduate, that student gets a job at Microsoft, and then introduces vulnerabilities in Windows? In theory all patches should get code reviews, but could someone get a bug past code reivew? Sure!

You can try to detect it before it happens, but very often you won't catch it until after it's landed in the source code repository, and some cases, it'll actually make it out to customers before you notice.

It's true for proprietary code; it'st true for open source code; it's true for x.509 CA certificates[1]. We should still do the best job that we can, if for no other reason that there are plenty of zero-days which are introduced by human error, never mind by malicious actors.

[1] https://www.thesslstore.com/blog/final-warning-last-chance-t...

Re: UMN CS&E Statement on Linux Kernel Research

#119

Post by seoaeu »

notyourday wrote: post #49
IncRnd wrote: post #14

Earlier quoted context omitted.

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.gi…

They have just learned about the details of the research conducted: > Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel. I'm going to say that the odds are that the faculty member in question is not going to be a faculty member anymo…

Firing faculty is oddly difficult, but I do expect they'll take at least some actions
Post reply on HN