Intentionally buggy commits for fame

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 0:49 UTC (Thu) by flussence (guest, #85566)
Parent article: Intentionally buggy commits for fame—and papers

They claim their IRB acked this, whereas I've seen other people pointing out they only sought that approval after they got caught, which isn't proper protocol at all, and if that's the case the not only was it clearly forced through in a turnaround of mere hours.

In either case it means their IRB is rotten too. Making an example of the entire organisation seems fair to me.

to post comments

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 4:39 UTC (Thu) by anonymous_commenter (guest, #117657) [Link] (2 responses)

I agree, any human experiment must goes through an IRB first and any competent IRB would have said no after virtually grilling the responsible peoples' posterior (from the paper writer to whoever had knowledge and vetted it up the chain) through such a machine and handing them back :)

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 14:18 UTC (Thu) by tamiko (subscriber, #115350) [Link]

Something doesn't entirely compute here.

As someone who has to deal with IRB approval in the past:

You need IRB approval for literally everything that involves human beings in some form (which is the case here). For example, I had to write a 30 page document for an IRB approval to do a 2 page anonymous questionaire at the end of a software course.

Also, I would be highly surprised if the Minnesota IRB did not require "informed consent", i.e., a statement summarizing impact and consequences for potential participants and that has to be signed by participants before research can be conducted.

Institutional IRBs had been created specifically to ensure that "informed consent" is given in some form before any research is conducted...

Experimentation on humans without their consent is unacceptable

Posted Apr 22, 2021 15:31 UTC (Thu) by david.a.wheeler (subscriber, #72896) [Link]

I agree, any experiment on humans must go through an IRB, and in almost *all* cases you have to have consent from the humans being experimented on.

In this case, the researchers didn't send their proposal to their IRB before doing the experiment - which is *already* a huge problem. IRBs are supposed to protect humans from experiments, how can that possibly work if the experiments happen first??? Their IRB then approved doing these experiments on humans without their consent, which is beyond the pale. GregKH specifically called the researchers out on this: "Our community does not appreciate being experimented on". Saying the word "process" does not suddenly change the rules or eliminate the humans; humans were fundamentally involved in the Linux kernel review process. If using the word "process" eliminated IRBs, then every medical experiment would suddenly investigate "metabolic processes" instead :-). I had to go through detailed IRBs just for surveys and interviews; this failure of oversight is a black mark on the whole university.

I think these researchers clearly acted unethically, and since they didn't ask for prior consent, they may have attacked other systems no matter what they say. I used the following shell command to search for potentially-concerning commits in git in one of my projects, other projects may want to do the same:

git shortlog --summary --numbered --email | grep -E '(wu000273|kjlu|@umn.edu)'

*All* OSS projects should review proposed changes for potential security issues, and harden their software & supply chain against attacks. I also welcome research to make that better!

But we don’t need researchers who perform attacks on production systems without authorization, or researchers who perform attacks on developers without their consent. Research is great, but you need to get permission from those you're attacking first.

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 10:45 UTC (Thu) by bpearlmutter (subscriber, #14693) [Link] (3 responses)

Having worked with them, I have to say that IRBs are utterly inappropriate for software or software security. It's far outside their area of competence, and their rules do not make sense in that domain.

Let me give an example. A PhD student is implementing a new text editor with some interesting features. They decide since usability testing involves human beings, it is human subjects research and subject to IRB approval, and the IRB agrees. So, what happens next?

- The grad student isn't allowed to use the editor (cannot use self as experimental subject).

- Key bindings must pass relevant health-and-safety regulations.

- Their officemate has the same PI, also cannot be use it (has interest in result).

- Anyone trying it has to fill out five pages of paperwork (consent form) that lists risks like injuring wrist from repetitive stress injuries, paging through material might cause screen to flash light-and-dark which could trigger photosensitive epilepsy.

- Data retention policy must be on file, including plans for security, access, withdrawl of consent, external data control officer, audits for compliance.

- Statistical analysis must be pre-specified.

- Study must be pre-registered with appropriate bodies.

And a computer game? A wearable computer? Just imagine!

IRB problems

Posted Apr 22, 2021 15:52 UTC (Thu) by david.a.wheeler (subscriber, #72896) [Link]

I completely disagree. IRBs are (necessarily) bureaucratic, but the rules work well enough in general.

Sure, a particular IRB can misapply the rules governing it, such as the ridiculous examples you list. But the solution is to work with the IRB (or its oversight) to fix them. You need to have people on the IRB who understand the domain, but nothing prevents that either.

I imagine IRBs could be improved, or replaced with something better. But the issue here is that we have researchers that experimented on humans without their consent. You don't need to be a rocket scientist to realize that such experiments are generally *not* acceptable.

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 23:26 UTC (Thu) by anonymous_commenter (guest, #117657) [Link]

Where I worked (cognitive science), there has been computer based testing of subjects (both typical and atypical) which involved computer scientist teaming up with psych or neuroscientist to implement those computer based test and in those cases, yes, IRB approval was sought out which was a normal process (more for psych or neuro peoples) but in any cases, IRBs in most major research university do get exposure to the computer science side of it.

Here, I see two faults:

1-: not seeking IRB approval first.

2-: either (yes, I can play devil's advocate), the IRB rubberstamped the study after the fact or else, the paper author lied about seeking IRB approval. Please take my concern with a grain of salt and no more than that; I'm just fresh out of an exam which took me 5 hours 45 minutes and I have to deliver 2 terms paperwork for next Monday 11:59pm, one of which isn't started yet. Otherwise, I would investigate.

Intentionally buggy commits for fame—and papers

Posted Apr 25, 2021 2:03 UTC (Sun) by anonymous_commenter (guest, #117657) [Link]

Now that I have more time (paperwork shipped), please (Jon Corbet if you moderate comments and bpearlmutter) let me address each individual points:

The grad student isn't allowed to use the editor (cannot use self as experimental subject). also Their officemate has the same PI, also cannot be use it (has interest in result).

Bias in the result. Yes, I agree that one these two winners of the 2005 Nobel prize (www.nobelprize.org/prizes/medicine/2005/summary/) infected himself with H. Pilori to validate his result but for one exception, there are a metric ton of examples not to follow. It's like N95 and N99 masks now despite mass vaccination against COVID-19. some, not vaccinated peoples refuse to wear masks.

Key bindings must pass relevant health-and-safety regulations.

Health and security at work, not only universities are subjects to these law, so does every other workplaces in most countries. The laws (including workplace health and security) are implemented after the facts because someone suffered.

Anyone trying it has to fill out five pages of paperwork (consent form) that lists risks like injuring wrist from repetitive stress injuries, paging through material might cause screen to flash light-and-dark which could trigger photosensitive epilepsy.

Ever had a vaccine? read the package insert. I agree that's lawyeresque writing about the common (sore arm not because of the vaccine but rather the method of application...read syringe administered by a human) and not so common (Guillain Barré syndrome and death which range from 1 in a few million to one in a billion). Same laws or lawyeresque CYA.

Data retention policy must be on file, including plans for security, access, withdrawl of consent, external data control officer, audits for compliance.

How many years are you required to keep your taxes paperwork on hand before being allowed to destroy them? Here (canucksland), it's 7 years and I can ask for the last 10 years of my taxes to be recalculated. Now human research, more so because it involve human, not just financial data.

Statistical analysis must be pre-specified. Study must be pre-registered with appropriate bodies.

Yes to both, it's part the Geneva convention after the nazi experiments done by Dr Mengeles. Remember, the law upon which IRB are subjected to are after the facts and among the factual evidence base are the nazi experiments. There's also the various charter of human rights.

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 13:53 UTC (Thu) by nix (subscriber, #2304) [Link]

> I've seen other people pointing out they only sought that approval after they got caught

Whaaat?! OK that should be a huge strike against these people. Good grief!