Hacker News Reader

Comment by IncRnd | Hacker News Reader

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1]

[1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...

View on HN

The department heads just learn of what is happening. They cannot say "we didn't do anything wrong!!!" without investigation because it will make the university in a very negative light (it is a serious ramifications). They need to get all the facts and knowing how it happens and who is responsible for this. So this way they can make a concise action and they will make a proper statement. They are taking "investigation first and comment after" cautiously and seriously.

It's worth remembering that this was a repeat offense. They failed to respond to the first complaint.

It's a bit unclear who complained to whom about this - and I'd expect looking into this to be part of the review. i.e. I could easily see "some people reached out to IRB concerned about lack of its involvement, IRB talked to researcher and went through process, came to result for whatever reasons" happening and not being something that is reported up the chain, because it was "resolved".

I'm up for "wait and see". From an administrative perspective, removed from what is happening, I can see investigating first before admitting fault. I'd much rather people understanding why they were wrong, even if it takes some time.

They shouldn't have. This appears to be a pretty clear cut case, but made up outrage-bait has made it to the top of HN before. Investigating claims is the correct thing to do.

Exactly. If someone apologizes to me, and I know that they have no way of knowing if they're guilty or not, what's that apology worth?

I would argue that first requires investigation.

They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.

> I would argue that first requires investigation.

Why do you think that enough of an investigation hasn't been performed in order to understand culpability?

Thay already know what happened and want to learn why it was approved. That was what their comment said.

Take a look at the actual PDF from the researchers, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" [1]

[1] https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...

The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work?

0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

Honestly I’m guessing this kind of situation didn’t match any existing policy for the review board and a few people made a bad call.

We need to make sure to be supportive of people making mistakes and learning from them instead of raising pitchforks for every misstep. Failure is never completely avoidable and responding properly to failure is way more important than never failing.

From my reading of the threads in the kernel mailing lists, it seems the IRB thought "is it bioscience with experimentation on live animals? No? Then it's all fine".

Yeah, especially considering that the IRB said the research was out of scope (specifically that it was not "human subject research") rather than indicating that it was ethical. Kind of like the distinction between a court not having jurisdiction and a court declaring you didn't break any laws.

I participated in IRB for a UMN campus and that’s pretty much how these things worked back then.

I think they misrepresented the project so that it would be classified as “not human research”. It’s unclear whether the misrepresentation was intentional (to obtain the exemption) or unintentional (they were genuinely unaware of the human impact).

Yes, but that doesn't have bearing on my comment that was being referenced, that they didn't say what had happened was wrong.

Here is Ken Thompson's apropos paper from 1984. [0]

[0] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Sure. I was answering your question:

> Why do you think that enough of an investigation hasn't been performed in order to understand culpability?

> We will investigate the research method and the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, if needed.

The "if needed" tells me they aren't sure what if anything is wrong yet. It would surprise me if they have done that much of an investigation in the few hours since they might have learned about this beyond scheduling meetings with involved parties and compiling relevant documents in a folder.

I think they are at the point of having a bunch of angry emails and a few news articles from certain publications. I don't blame them wanting a bit more than that before saying anything.

This is what innocent until proven guilty looks like. I, for one, agree with the approach. I don't want to live in a world where people are fired and projects shutdown on the basis of allegations alone.

Don't jump to conclusions, and say I am guilty of something that I didn't write. I never said to fire people and shutdown projects based upon allegations alone. You may not have read the article for this comment page, but they admit that the action took place. The researchers, themselves, elsewhere admitted it took place.

Pardon me. I did not mean to imply you were calling for anything. And I agree, the facts look pretty damning. Nevertheless, I fully support a slow, deliberate, and comprehensive evaluation by any authority when evaluating serious accusations. Further, I strongly believe in presumptive innocence, regardless of initial impressions.

Btw, I'm not suggesting you don't believe in any of the above.

It’s too early for that. I expect their followup will have details on failures but first they need to figure out exactly what happened. That will take some time and effort.

At least now they’re burning UMN time and not kernel maintainer time.

They have just learned about the details of the research conducted:

> Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel.

I'm going to say that the odds are that the faculty member in question is not going to be a faculty member anymore especially if the ban remains in place as the said faculty member probably at best fibbed the leadership before about his research.

Firing faculty is oddly difficult, but I do expect they'll take at least some actions

He is an adjunct that just trashed university's reputation. I'm sure it would even fall into firing for cause

He's not an adjunct.

https://www-users.cs.umn.edu/~kjlu/

Adjuncts don't have Ph.D students.

He is not tenured and until he is he is basically an adjunct.

No, that's not how this works. Tenure track faculty have way more job security

Missed the adjunct part... I'm with you on this one.

He's not an adjunct.

https://www-users.cs.umn.edu/~kjlu/

Reply on news.ycombinator.com