Intentionally buggy commits for fame

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 4:39 UTC (Thu) by anonymous_commenter (guest, #117657)
In reply to: Intentionally buggy commits for fame—and papers by flussence
Parent article: Intentionally buggy commits for fame—and papers

I agree, any human experiment must goes through an IRB first and any competent IRB would have said no after virtually grilling the responsible peoples' posterior (from the paper writer to whoever had knowledge and vetted it up the chain) through such a machine and handing them back :)

to post comments

Intentionally buggy commits for fame—and papers

Posted Apr 22, 2021 14:18 UTC (Thu) by tamiko (subscriber, #115350) [Link]

Something doesn't entirely compute here.

As someone who has to deal with IRB approval in the past:

You need IRB approval for literally everything that involves human beings in some form (which is the case here). For example, I had to write a 30 page document for an IRB approval to do a 2 page anonymous questionaire at the end of a software course.

Also, I would be highly surprised if the Minnesota IRB did not require "informed consent", i.e., a statement summarizing impact and consequences for potential participants and that has to be signed by participants before research can be conducted.

Institutional IRBs had been created specifically to ensure that "informed consent" is given in some form before any research is conducted...

Experimentation on humans without their consent is unacceptable

Posted Apr 22, 2021 15:31 UTC (Thu) by david.a.wheeler (subscriber, #72896) [Link]

I agree, any experiment on humans must go through an IRB, and in almost *all* cases you have to have consent from the humans being experimented on.

In this case, the researchers didn't send their proposal to their IRB before doing the experiment - which is *already* a huge problem. IRBs are supposed to protect humans from experiments, how can that possibly work if the experiments happen first??? Their IRB then approved doing these experiments on humans without their consent, which is beyond the pale. GregKH specifically called the researchers out on this: "Our community does not appreciate being experimented on". Saying the word "process" does not suddenly change the rules or eliminate the humans; humans were fundamentally involved in the Linux kernel review process. If using the word "process" eliminated IRBs, then every medical experiment would suddenly investigate "metabolic processes" instead :-). I had to go through detailed IRBs just for surveys and interviews; this failure of oversight is a black mark on the whole university.

I think these researchers clearly acted unethically, and since they didn't ask for prior consent, they may have attacked other systems no matter what they say. I used the following shell command to search for potentially-concerning commits in git in one of my projects, other projects may want to do the same:

git shortlog --summary --numbered --email | grep -E '(wu000273|kjlu|@umn.edu)'

*All* OSS projects should review proposed changes for potential security issues, and harden their software & supply chain against attacks. I also welcome research to make that better!

But we don’t need researchers who perform attacks on production systems without authorization, or researchers who perform attacks on developers without their consent. Research is great, but you need to get permission from those you're attacking first.