Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was part of a human subject research study without my consent

christine.website

Post reply on HN
Print view View original

371–380 of 382 posts

Re: I was part of a human subject research study without my consent

#371

Post by josefx »

nr2x wrote: post #347
josefx wrote: post #211

Earlier quoted context omitted.

"Hard to get approved" my ass. The attacks on the Linux code review process with real harm code and zero safeguards against successfully hijacking a production kernel got approved and the review board even reaffirmed its decision when confronted about it, as far as I remember by claiming that the study wasn't focused medical issues. Did this study focus on medical issues? If not then at least one review board out the…

Because one IRB makes a bad decision doesn't mean, in general, deception studies are easy to get approved. Furthermore, this study used an "no human subjects" exemption to avoid a full review - which should not have happened. The Linux code attack study has also roundly criticized in the research community because it was such an abnormal failure of IRB.

> The Linux code attack study has also roundly criticized in the research community because it was such an abnormal failure of IRB.

So how is the board doing? Did its members face any consequences at all or are they still there ready to rubber stamp the next study with full approval and flimsy excuses?

Re: I was part of a human subject research study without my consent

#372

Post by xena »

Beldin wrote: post #362
xena wrote: post #295

Earlier quoted context omitted.

Really I have the nginx logs going to the disk so that I can have prometheus-nginx scrape them for referer patterns (it getting above a certain threshold for a given referer is how I know when my article got posted somewhere), status code rates and overall to make sure that the core functions of the site (such as the RSS feed) are working like I expect. I could probably change it to write the logs to a unix fifo inst…

Thanks! That's an informative reply. I was wondering whether not logging could be an option. That's now quite clear.

I just checked the logs and did some reverse IP lookups at random and it turns out nearly all the IP addresses I have are cloudflare IPs. So I don't even have IP addresses logged the way I thought I did! Yay me!

Re: I was part of a human subject research study without my consent

#373

Post by smsm42 »

dawnbreez wrote: post #323
master-lincoln wrote: post #294

Earlier quoted context omitted.

Why are you collecting personal information (IPs) of your readers though?

It's kind of hard not to log IPs when running a service over the internet. You kind of have to have their IP address in order to know where to send the info they want. Further, logging an IP address has also been necessary for security--to detect DoS and DDoS attacks, for instance, as both involve many repeated connections from the same IP (though you can offload that to a service now).

Why it is hard? The servers need to know the IP address, for sure, but they do not need to permanently record it. In fact, un-aggregated IP is probably not that useful for statistics either, I can be aggregated e.g. daily and then discarded.

You seem to be confusing temporarily holding information in the database (no matter whether in-memory or on persistent media) for operational purposes (be it networking or threat detection) and permanent storage of the same information way beyond the time it ceased to be useful for the purposes above.

Re: I was part of a human subject research study without my consent

#374

Post by dawnbreez »

bborud wrote: post #341
dawnbreez wrote: post #332

Earlier quoted context omitted.

> how would people have reacted if this had been limited to large corporations you do not like? Those large corporations we do not like have lawyers on retainer specifically to deal with this situation (probably by suing the pants off of whoever sent the email). It is acceptable to react differently when the victim is defenseless. That is why we would have a different reaction to a large corporation being struck by t…

So you are making the argument that one should apply different rules to different people depending on how much money they have. Well, no way that could go wrong. Interesting how you also make the tortured argument that privacy laws create victims.

I am making the argument that a company that already has lawyers on retainer for this occasion is not suffering the same harm that someone who does not have a lawyer on retainer does. Similarly, someone who can't afford a lawyer at all is disproportionately likely to be harmed compared to a company that has competent legal staff.

Also, "privacy laws create victims" is--to use your own phrase--a very tortured version of what's going on here. The people affected by this study were threatened with legal action. That is what they are victims of. Regardless of what law was used as an excuse, threatening someone with frivolous legal action is as bad as threatening someone with SWATting.

Re: I was part of a human subject research study without my consent

#375

Post by dawnbreez »

smsm42 wrote: post #358
kstrauser wrote: post #348

Earlier quoted context omitted.

I wrote the blog post from yesterday’s HN story, and that last paragraph is what worried me. I know I’m not a business, and I don’t make money from my project, and believe I’m not subject to the CCPA because of that. I dread the idea of having to prove that in court, though, and how expensive it might be to (hopefully!) prove I’m not liable for even accidentally violating it. There’s a reason patent trolls, copyright…

Patents and copyrights aren't limited to businesses, you can be in copyright or patent violation even if you're a private person - in fact, I'd assume vast majority of copyright violations now are performed by private people without profit motive. That particular law however is clearly written to target specific businesses and exclude private persons.

One of the biggest issues with the Digital Millennium Copyright Act is that it was never designed for a world where Siivagunner[1] exists. On a fundamental level, it was built on the assumption that everyone involved can litigate--which means that the widespread ability to edit, remix, and review things has created some unfortunate exploits and exposed serious oversights in how the DMCA functions.

[1]https://youtu.be/rEcOzjg7vBU

Re: I was part of a human subject research study without my consent

#376

Post by dawnbreez »

smsm42 wrote: post #373
dawnbreez wrote: post #323

Earlier quoted context omitted.

It's kind of hard not to log IPs when running a service over the internet. You kind of have to have their IP address in order to know where to send the info they want. Further, logging an IP address has also been necessary for security--to detect DoS and DDoS attacks, for instance, as both involve many repeated connections from the same IP (though you can offload that to a service now).

Why it is hard? The servers need to know the IP address, for sure, but they do not need to permanently record it. In fact, un-aggregated IP is probably not that useful for statistics either, I can be aggregated e.g. daily and then discarded. You seem to be confusing temporarily holding information in the database (no matter whether in-memory or on persistent media) for operational purposes (be it networking or threat…

As I understand it, from a legal standpoint, storing it for operational purposes is equivalent to storing it for any other purpose.

Also, even if you only store the information for 24 hours--how many users are on Hackernews in a given hour? How many of them click through the top links? Certainly enough that some sites have crashed under the load, which makes me think that the number is higher than 50K. Congrats, you're now storing 50K IPs, despite having an automated system to delete them in a day.

(I don't even wanna think about the headache it'd cause if you got dragged to court over this. I don't know how many judges will understand that you delete the list every 24 hours to avoid being liable for storing it, not to get rid of evidence.)

Re: I was part of a human subject research study without my consent

#377

Post by dawnbreez »

dr_dshiv wrote: post #352
dawnbreez wrote: post #337

Earlier quoted context omitted.

The example you gave is not relevant. The researchers in this study are already directly contacting everyone they need consent from, and if an individual declines, the rest of the sample can still be studied (unlike in a classroom setting, where everyone's physically in the same room and it's impossible to study any of them in isolation). Further, the study would still have worked if the researchers had simply asked…

I’m not defending their study and I feel like you are trying to argue “sides” rather than trying to understand my point about nuance.

I'm primarily concerned with the study, since A) that's the topic at hand, B) it involves technology and privacy, which I care about, and C) people keep comparing this to pentesting, just like last time, and I also care about security research.

I apologize for assuming that you were defending the study; I figured that was the topic of conversation, after all.

If there is nuance, but it does not apply to this situation, then it is worth saying that this nuance does not apply to this situation--so that I'm less likely to misinterpret what you're saying.

Re: I was part of a human subject research study without my consent

#378

Post by mrtranscendence »

ChrisMarshallNY wrote: post #281
dc7yduejjrn wrote: post #173

Earlier quoted context omitted.

This is just FUD. I've yet to meet a lawyer who won't do a cursory evaluation of your case for free. It's in their interest to know if you're bringing them an easy win.

> I've yet to meet a lawyer who won't do a cursory evaluation of your case for free. You don't get out much, do you? I've known tons of lawyers that won't look at their watch and tell you the time, unless they get a tenner from it. To be fair, they are used to folks trying to extract highly valuable services from them, for free, so it's sort of a defense mechanism. I have (and have had) many friends that are lawyers.…

I guess it depends on the lawyer. Not long ago I was shocked when a lawyer (not somebody we know, just a random phone book lawyer) stayed on a call with my girlfriend for a half hour talking about her father's estate and charged nothing for it.

Re: I was part of a human subject research study without my consent

#379

Post by mbesto »

watwut wrote: post #182
dcow wrote: post #161

Earlier quoted context omitted.

It really depends on your ethical framework doesn't it? People lie all the time for good reasons. Are those actions unethical? Further, I am struggling to see who was harmed here or how there was any ill intent. On top of that, the results of this study seem like they would be enlightening. It seems like society should want this experiment to be able to take place. Certainly a western liberal understanding of ethics…

The formal ethics of research on humans requires informed consent of participants. You can take framework of sales or management where lie is just being smart, but it is not applicable here.

> The formal ethics of research on humans requires informed consent of participants.

How do you explain research on placebos then?

Re: I was part of a human subject research study without my consent

#380

Post by hattmall »

colejohnson66 wrote: post #318
hattmall wrote: post #30

Earlier quoted context omitted.

Because she is extremely easily stressed out

I presume you’ve never been stressed out about anything?

Well of course I have, but not anything so closely resembling a spam email. If an email, allegedly from a person in Russia, asking about a law in California with regard to your small personal blog creates a measurable level of stress then what happens in an actually stressful event like say having a flat tire on the highway or having a credit card stolen.
Post reply on HN