Live data from Hacker News

A university got itself banned from the Linux kernel (2021)

theverge.com

31–40 of 74 posts

Re: A university got itself banned from the Linux kernel (2021)

#31

Woah, the thing that leapt out at me, as a professor, is that they somehow got an exemption from the UMN institutional review board. Uh, how?? It's clearly human subjects research under the conventional federal definition[1] and obviously posed a meaningful risk of harm, in addition to being conducted deceptively. Someone has to have massively been asleep at the wheel at that IRB. [1] https://grants.nih.gov/policy-an…

Maybe you're over-estimating how much universities actually care about ethics and IRB.

I reported my advisor to university admin for gross safety violations, attempting to collect data on human subjects without any IRB oversight at all, falsifying data, and falsifying financial records. He brought his undergrad class into the lab one day and said we should collect data on them, (low hanging fruit!) with machinery that had just started working a few days prior, we hadn't even begun developing basic safety features for it, we hadn't even discussed design of experiments or requesting IRB approval for experiments. We (grad students) cornered the professor as a group and told him that was wildly unacceptable, and he tried it multiple more times before we reported him to university admin. Admin ignored it completely. In the next year, we also reported him for falsifying data in journal papers and falsifying financial records related to research grants. And, oh yeah, assigning Chinese nationals to work on DoD-funded work that explicitly required US citizens and lying to the DoD about it. University completely ignored that too. And then he got tenure. I was in a Top-10-US grad program. So in my experience, as long as the endowment is growing, university admin doesn't care about much else.

Re: A university got itself banned from the Linux kernel (2021)

#32
post #11

Earlier quoted context omitted.

Oh I misunderstood the sections in the article about the umn.edu email stuff. My mistake. The actual course of events: 1. Prof and students make fake identities 2. They submit these secret vulns to Greg KH and friends 3. Some of these patches are accepted 4. They intervene at this point and reveal that the patches are malicious 5. The patches are then not merged 6. This news comes out and Greg KH applies big negative…

>No one likes being cheated out of work that they did, especially when a lot of it is volunteer work. You know what would really be wasteful of volunteer hours? Instituting a policy whereby the community has to trawl through 20 years of commits from umn.edu addresses and manually review them for vulnerabilities even though you have no reasonable expectation that such commits are likely to contain malicious code and y…

But what if the next paper is about then about the bad patch they put in 15 years ago and it still hasn't been noticed? UMN has created a situation that now calls into question everything that has contributed by UMN in showing bad-faith in retroactively approving Lu's actions.

Re: A university got itself banned from the Linux kernel (2021)

#33
post #28

Earlier quoted context omitted.

> 3. Some of these patches are accepted > 4. They intervene at this point and reveal that the patches are malicious > 5. The patches are then not merged It's not clear to me that they revealed anything, just that they did fix the problems: > In their paper, Lu and Wu claimed that none of their bugs had actually made it to the Linux kernel — in all of their test cases, they’d eventually pulled their bad patches and pr…

You know there's a lot of he-said she-said here. The truth is that I was repeating there what they claimed in the paper which is that they intervened prior to merge to mainline.

My point was that (the article claims that) they didn't "reveal that the patches are malicious" at that point. Revert yes, reveal no.

Re: A university got itself banned from the Linux kernel (2021)

#34

Woah, the thing that leapt out at me, as a professor, is that they somehow got an exemption from the UMN institutional review board. Uh, how?? It's clearly human subjects research under the conventional federal definition[1] and obviously posed a meaningful risk of harm, in addition to being conducted deceptively. Someone has to have massively been asleep at the wheel at that IRB. [1] https://grants.nih.gov/policy-an…

I've also had to deal with the IRB a lot as a professor. The retroactive application is extremely weird (although maybe better than nothing?).

This seems like one of those situations that would usually require regular review to err on the side of caution if nothing else. It's worth pointing out there are exceptions though:

https://grants.nih.gov/sites/default/files/exempt-human-subj...

Generally those exceptions fall into "publicly observable behavior", which I guess I could see this falling into?

It's ethically unjustified how the whole thing actually happened but I guess I can see an IRB coming to an exemption decision. I would probably disagree with that decision but I could see how it would happen.

In some weird legalistic sense I can also see an IRB exempting it because the study already happened and they couldn't do anything about it. It's such a weird thing to do and IRBs do weird things sometimes.

Re: A university got itself banned from the Linux kernel (2021)

#35
post #11

Earlier quoted context omitted.

Oh I misunderstood the sections in the article about the umn.edu email stuff. My mistake. The actual course of events: 1. Prof and students make fake identities 2. They submit these secret vulns to Greg KH and friends 3. Some of these patches are accepted 4. They intervene at this point and reveal that the patches are malicious 5. The patches are then not merged 6. This news comes out and Greg KH applies big negative…

>No one likes being cheated out of work that they did, especially when a lot of it is volunteer work. You know what would really be wasteful of volunteer hours? Instituting a policy whereby the community has to trawl through 20 years of commits from umn.edu addresses and manually review them for vulnerabilities even though you have no reasonable expectation that such commits are likely to contain malicious code and y…

> even though you have no reasonable expectation that such commits are likely to contain malicious code and you're actually just butthurt

Other than the tiny bit where that's not true. An institution just demonstrated that they are willing to submit malicious code, and don't feel any need to tell you that they did so (even after the fact). It's perfectly reasonable to ask if they've done this before.

Re: A university got itself banned from the Linux kernel (2021)

#37
post #28

Earlier quoted context omitted.

You know there's a lot of he-said she-said here. The truth is that I was repeating there what they claimed in the paper which is that they intervened prior to merge to mainline.

My point was that (the article claims that) they didn't "reveal that the patches are malicious" at that point. Revert yes, reveal no.

Man, what a mess.

Re: A university got itself banned from the Linux kernel (2021)

#39

Woah, the thing that leapt out at me, as a professor, is that they somehow got an exemption from the UMN institutional review board. Uh, how?? It's clearly human subjects research under the conventional federal definition[1] and obviously posed a meaningful risk of harm, in addition to being conducted deceptively. Someone has to have massively been asleep at the wheel at that IRB. [1] https://grants.nih.gov/policy-an…

This is retroactive ass covering by the UMN IRB.

Re: A university got itself banned from the Linux kernel (2021)

#40
post #27

>Then, there’s the dicier issue of whether an experiment like this amounts to human experimentation. It doesn’t, according to the University of Minnesota’s Institutional Review Board. Lu and Wu applied for approval in response to the outcry, and they were granted a formal letter of exemption. I had to apply for exemptions often in grad school. You must do so before performing the research -- it is not ethical to wait…

I was honestly surprised the University of Minnesota didn’t part ways with the teacher and students who performed this bullshit research.

This level of malfeasance strikes me as something akin to plagiarism for a professional writer.

Post reply on HN