<story><title>“They introduce kernel bugs on purpose”</title><url>https://lore.kernel.org/linux-nfs/YH+zwQgBBGUJdiVK@unreal/</url></story><parent_chain><item><author>duncaen</author><text>See page 9 of the already published paper:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;raw.githubusercontent.com&amp;#x2F;QiushiWu&amp;#x2F;qiushiwu.github.io&amp;#x2F;main&amp;#x2F;papers&amp;#x2F;OpenSourceInsecurity.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;raw.githubusercontent.com&amp;#x2F;QiushiWu&amp;#x2F;qiushiwu.github.i...&lt;/a&gt;&lt;p&gt;&amp;gt; We  send  the  emails  to  the  Linux  communityand  seek  their  feedback.  The  experiment  is  not  to  blame any maintainers but to reveal issues in the process. The IRB of  University  of  Minnesota  reviewed  the  procedures  of  the experiment and determined that this is not human research. We obtained a formal IRB-exempt letter. The experiment will not collect any personal data, individual behaviors, or personal opinions. It is limited to studying the patching process OSS communities follow, instead of individuals.</text></item><item><author>bluGill</author><text>If the IRB is any good the professor doesn&amp;#x27;t get that. Universities are publish or perish, and the IRB should force the withdrawal of all papers they submitted. This is might be enough to fire the professor with cause - including remove any tenure protection they might have - which means they get a bad reference.&lt;p&gt;I hope we hear from the IRB in about a year stating exactly what happened.  Real investigations of bad conduct should take time to complete correctly and I want them to do their job correctly so I&amp;#x27;ll give them that time.  (there is the possibility that these are good faith patches and someone in the linux community just hates this person - seems unlikely but until a proper independent investigation is done I&amp;#x27;ll leave that open.)</text></item><item><author>rzwitserloot</author><text>The professor gets exactly what they want here, no?&lt;p&gt;&amp;quot;We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time&amp;quot;.&lt;p&gt;That&amp;#x27;ll be a fun paper to write, no doubt.&lt;p&gt;Additional context:&lt;p&gt;* One of the committers of these faulty patches, Aditya Pakki, writes a reply taking offense at the &amp;#x27;slander&amp;#x27; and indicating that the commit was in good faith[1].&lt;p&gt;Greg KH then immediately calls bullshit on this, and then proceeds to ban the entire university from making commits [2].&lt;p&gt;The thread then gets down to business and starts coordinating revert patches for everything committed by University of Minnesota email addresses.&lt;p&gt;As was noted, this obviously has a bunch of collateral damage, but such drastic measures seem like a balanced response, considering that this university decided to _experiment_ on the kernel team and then lie about it when confronted (presumably, that lie is simply continuing their experiment of &amp;#x27;what would someone intentionally trying to add malicious code to the kernel do&amp;#x27;)?&lt;p&gt;* Abhi Shelat also chimes in with links to UMN&amp;#x27;s Institutional Review Board along with documentation on the UMN policies for ethical review. [3]&lt;p&gt;[1]: Message has since been deleted, so I&amp;#x27;m going by the content of it as quoted in Greg KH&amp;#x27;s followup, see footnote 2&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;YH%2FfM%2FTsbmcZzwnX@kroah.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;YH%2FfM%2FTsbmcZzwnX@kroah...&lt;/a&gt;&lt;p&gt;[3]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;3B9A54F7-6A61-4A34-9EAC-95332709BAE7@northeastern.edu&amp;#x2F;#t&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;3B9A54F7-6A61-4A34-9EAC-95...&lt;/a&gt;</text></item></parent_chain><comment><author>nkurz</author><text>&amp;gt; The IRB of University of Minnesota reviewed the procedures of the experiment and determined that this is not human research.&lt;p&gt;I&amp;#x27;m not sure how it affects things, but I think it&amp;#x27;s important to clarify that they did not obtain the IRB-exempt letter in advance of doing the research, but after the ethically questionable actions had already been taken:&lt;p&gt;&lt;i&gt;The IRB of UMN reviewed the study and determined that this is not human research (a formal IRB exempt letter was obtained).  Throughout the study, we honestly did not think this is human research, so we did not apply for an IRB approval in the beginning. ...  We would like to thank the people who suggested us to talk to IRB after seeing the paper abstract.&lt;/i&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www-users.cs.umn.edu&amp;#x2F;~kjlu&amp;#x2F;papers&amp;#x2F;clarifications-hc.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www-users.cs.umn.edu&amp;#x2F;~kjlu&amp;#x2F;papers&amp;#x2F;clarifications-hc....&lt;/a&gt;</text></comment>
<story><title>“They introduce kernel bugs on purpose”</title><url>https://lore.kernel.org/linux-nfs/YH+zwQgBBGUJdiVK@unreal/</url></story><parent_chain><item><author>duncaen</author><text>See page 9 of the already published paper:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;raw.githubusercontent.com&amp;#x2F;QiushiWu&amp;#x2F;qiushiwu.github.io&amp;#x2F;main&amp;#x2F;papers&amp;#x2F;OpenSourceInsecurity.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;raw.githubusercontent.com&amp;#x2F;QiushiWu&amp;#x2F;qiushiwu.github.i...&lt;/a&gt;&lt;p&gt;&amp;gt; We  send  the  emails  to  the  Linux  communityand  seek  their  feedback.  The  experiment  is  not  to  blame any maintainers but to reveal issues in the process. The IRB of  University  of  Minnesota  reviewed  the  procedures  of  the experiment and determined that this is not human research. We obtained a formal IRB-exempt letter. The experiment will not collect any personal data, individual behaviors, or personal opinions. It is limited to studying the patching process OSS communities follow, instead of individuals.</text></item><item><author>bluGill</author><text>If the IRB is any good the professor doesn&amp;#x27;t get that. Universities are publish or perish, and the IRB should force the withdrawal of all papers they submitted. This is might be enough to fire the professor with cause - including remove any tenure protection they might have - which means they get a bad reference.&lt;p&gt;I hope we hear from the IRB in about a year stating exactly what happened.  Real investigations of bad conduct should take time to complete correctly and I want them to do their job correctly so I&amp;#x27;ll give them that time.  (there is the possibility that these are good faith patches and someone in the linux community just hates this person - seems unlikely but until a proper independent investigation is done I&amp;#x27;ll leave that open.)</text></item><item><author>rzwitserloot</author><text>The professor gets exactly what they want here, no?&lt;p&gt;&amp;quot;We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time&amp;quot;.&lt;p&gt;That&amp;#x27;ll be a fun paper to write, no doubt.&lt;p&gt;Additional context:&lt;p&gt;* One of the committers of these faulty patches, Aditya Pakki, writes a reply taking offense at the &amp;#x27;slander&amp;#x27; and indicating that the commit was in good faith[1].&lt;p&gt;Greg KH then immediately calls bullshit on this, and then proceeds to ban the entire university from making commits [2].&lt;p&gt;The thread then gets down to business and starts coordinating revert patches for everything committed by University of Minnesota email addresses.&lt;p&gt;As was noted, this obviously has a bunch of collateral damage, but such drastic measures seem like a balanced response, considering that this university decided to _experiment_ on the kernel team and then lie about it when confronted (presumably, that lie is simply continuing their experiment of &amp;#x27;what would someone intentionally trying to add malicious code to the kernel do&amp;#x27;)?&lt;p&gt;* Abhi Shelat also chimes in with links to UMN&amp;#x27;s Institutional Review Board along with documentation on the UMN policies for ethical review. [3]&lt;p&gt;[1]: Message has since been deleted, so I&amp;#x27;m going by the content of it as quoted in Greg KH&amp;#x27;s followup, see footnote 2&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;YH%2FfM%2FTsbmcZzwnX@kroah.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;YH%2FfM%2FTsbmcZzwnX@kroah...&lt;/a&gt;&lt;p&gt;[3]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;3B9A54F7-6A61-4A34-9EAC-95332709BAE7@northeastern.edu&amp;#x2F;#t&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;lore.kernel.org&amp;#x2F;linux-nfs&amp;#x2F;3B9A54F7-6A61-4A34-9EAC-95...&lt;/a&gt;</text></item></parent_chain><comment><author>volta83</author><text>&amp;gt; We  send  the  emails  to  the  Linux  communityand  seek  their  feedback.&lt;p&gt;That&amp;#x27;s not really what they did.&lt;p&gt;They sent the patches, the patches where either merged or rejected.&lt;p&gt;And they never let anybody knew that they had introduced security vulnerabilities on the kernel on purpose until they got caught and people started reverting all the patches from their university and banned the whole university.</text></comment>