A university got itself banned from the Linux kernel (2021) • Hacker News Board

Re: A university got itself banned from the Linux kernel (2021)

#71

Post by remexre » Wed, Jan 14, 2026, 6:52 PM UTC

jovial_cavalier wrote: post #69

AlotOfReading wrote: post #25

Earlier quoted context omitted.

1) How did they hit stable then? [0] 2) Yes, emails absolutely need IRB sign-off too. If you email a bunch of people asking for their health info or doing a survey, the IRB would smack you for unapproved human research without consent. Consent was obviously not given here. [0] https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3N...

1) They did not hit stable. GKH is referring, in this email, to a legitimate attempt to contribute from a student at UMN. Whether or not this student was part of the hypocrite commits study, I don't know. But it's not a hypocrite commit, just a normal buggy commit. You can tell, because it's from a umn.edu email address, which they did not use for hypocrite commits. 2) I don't actually care about the internal policie…

The point of an IRB is to act as an outside reviewer of _ethics_. IRBs aren't some checklist thing admin put in to protect the University's reputation, they exist as a direct reaction to huge amounts of unethical human experimentation occurring last century.

Re: A university got itself banned from the Linux kernel (2021)

#72

Post by wtallis » Wed, Jan 14, 2026, 7:10 PM UTC

jovial_cavalier wrote: post #70

wtallis wrote: post #22

Earlier quoted context omitted.

> I don't think it's unethical to send someone an email that has bad code in it. It's unethical because of the bits you left out: sending code you know is bad, and doing so under false pretenses. Whether or not you think this rises to the level of requiring IRB approval, surely you must be able to understand that wasting people's time like this is going to be viewed negatively by almost anyone. Some people might be w…

See another comment I made in this thread about GKH's response - the UMN group submitted a handful of small patches as part of this study, and "wasted" probably a handful of man hours or at worst a few man days of maintainer time. I don't really consider it a waste because evidence that critical open source infrastructure doesn't bother to run static analysis before merging code from randos is actually useful informa…

> evidence that critical open source infrastructure doesn't bother to run static analysis before merging code from randos is actually useful information that the public deserves to have.

It's totally possible to obtain evidence of that without being an asshole to kernel maintainers. Which is the kind of thing that an ethics review conducted before the experiment could have pointed out. If the goal of the experiment was merely to demonstrate the lack of routine static analysis capable of catching such vulnerabilities, then the experiment's design was not justified and the experiment was needlessly harmful to non-consenting participants.

Re: A university got itself banned from the Linux kernel (2021)

#73

Post by mastermage » Thu, Jan 15, 2026, 9:15 AM UTC

aucisson_masque wrote: post #60

> If a sufficiently motivated, unscrupulous person can put themselves into a trusted position of updating critical software, there’s honestly little that can be done to stop them,” says White, the security researcher. That says a lot about Linux kernel safety.

thats literally like 90% of anything. This is open source, code maintained in large swaths by volunteers. Obviously there is not extensive background checks that are being done, the amount of resources that would require is not something the Linux Foundation probably has.

Re: A university got itself banned from the Linux kernel (2021)

#74

Post by jovial_cavalier » Thu, Jan 15, 2026, 9:23 PM UTC

remexre wrote: post #71

jovial_cavalier wrote: post #69

Earlier quoted context omitted.

1) They did not hit stable. GKH is referring, in this email, to a legitimate attempt to contribute from a student at UMN. Whether or not this student was part of the hypocrite commits study, I don't know. But it's not a hypocrite commit, just a normal buggy commit. You can tell, because it's from a umn.edu email address, which they did not use for hypocrite commits. 2) I don't actually care about the internal policie…

The point of an IRB is to act as an outside reviewer of _ethics_. IRBs aren't some checklist thing admin put in to protect the University's reputation, they exist as a direct reaction to huge amounts of unethical human experimentation occurring last century.

The point of an IRB is to stop you from nonconsentually sterilizing people. As long as the system stops that from happening, I don't care about the paperwork. It's not my concern.

The "ethical" issues with this study do not rise to the level that I care, so the only objection is that they didn't get the IRB to rubber stamp it beforehand, which I also don't care about.