Hacker News Reader

Comment by sombragris | Hacker News Reader

I really appreciate the apology and as they stated, its unconditional nature. Good.

However, I find something very problematic. This quote shows it:

"We have learned some important lessons about research with the open source community from this incident."

This is something I don't like. This is not something about "research with the open source community". If anything, they should have learned something about treating human beings as persons and not as involuntary guinea pigs. They should have learned something about not breaking anyone's (not only any open source community) good faith and trust, and respecting that.

They behaved like jerks and they still cannot see that.

View on HN

I think there is something to be applauded about people who genuinely apologize even though they can't see things from the other person's point of view.

They didn't decide to conduct this research on a whim. They had full approval of their university ethics board as well. They published a paper and had it peer reviewed without (as far as I know) anyone immediately calling for their heads.

They can't immediately turn heel face and believe their actions are wrong, always were wrong, and the wrongness should have been obvious to them.

Yet, despite this they recognize the hurt they've caused and are genuinely apologetic and will never do it again. Asking them to dismantle their world view in a week is a bit much, even criminals are given a few years of quiet contemplation before being asked to tell a parole board they have changed their hearts and minds.

That only tells me, that there's more garbage than just one individual.

If they lack knowledge of why it was bad, what will prevent them from doing another garbage study next time.

This incident, time, and reflection.

But their self-relfection, and I say basic ethics is severely lacking.

This study could have been done with consent, with limited bias, but they chose to go the idiot route.

This paper had multiple issues that they where aware of before the ban, original ban email indicates that complaint was made before to there's university, on twitter feed one of the researchers stated that IEEE received also complaint regarding ethics of the paper, way before ban.

They only sought approval from the ethics board after the fact IIRC

"If anything, they should have learned something about not treating human beings as persons and not as involuntary guinea pigs."

Perhaps the entire "tech" industry needs to learn that lesson. Non-technical end users should be entitled to that same level of trust as nerds. I can download free open source code, extract a tarball and build the software without worrying too much about scanning through all the files first for phone home/telemetry/OriginTrials nonsense.^1 However non-technical end users who use programs compiled for them by "tech" companies with ads and surveillance as their "business model" are not entitled to the same trust. I cannot think of any justification for the difference.

> Perhaps the entire "tech" industry needs to learn that lesson.

Audit studies are conducted all the time where researchers lie to people and waste their time.

> Factors Determining Callbacks to Job Applications by the Unemployed: An Audit Study

> We use an audit study approach to investigate how unemployment duration, age, and holding a low-level “interim” job affect the likelihood that experienced college- educated females applying for an administrative support job receive a callback from a potential employer. First, the results show no relationship between callback rates and the duration of unemployment. Second, workers age 50 and older are significantly less likely to receive a callback. Third, taking an interim job significantly reduces the likelihood of receiving a callback. Finally, employers who have higher callback rates respond less to observable differences across workers in determining whom to call back. We interpret these results in the context of a model of employer learning about applicant quality

http://www.econ.ucla.edu/tvwachter/papers/audit_study_Farber...

This is a very good point. I did not find anything objectionable about that experiment when I first read about it. And if the companies experimented upon had complained like the kernel maintainers did, I would have dismissed it as them covering up their bad process. This is actually making me consider that the submitters of the bad patches shouldn't be treated differently than the job application researchers.

Very good point. We seriously need to learn this lesson as you said.

Several parts read strangely to me

> we are very sorry that the method used in the “hypocrite commits” paper was inappropriate

This reads more as "sorry you were offended" than "It was inappropriate and we are sorry".

> As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches.

Bringing up why you did something in an apology is very shaky. Like in this case, it can sound more like justifying / excusing.

> Bringing up why you did something in an apology is very shaky. Like in this case, it can sound more like justifying / excusing.

Why is that a problem?

Answering myself: the apology feels more like a justification as to why they did, not an understanding of why they shouldn’t have.

> the apology feels more like a justification

Which I'm guessing is why they made it an open letter. This isn't about acknowledging their misdeeds and trying to fix their relationship with the OS community, this is them trying to sneak in spin and justifications to a public announcement to cover their collective asses, to put forth a false narrative that shows their actions in a better light than they acted in.

>They behaved like jerks and they still cannot see that.

They just come off as disconnected academics. Samething with the experiments with algorithms from Facebook. They are so wrapped up in what they are doing, they no longer see the "users" as human beings. There are some times this is almost required to survive like being an ER doctor. If you lose that many people, it could be debilitating unless you were able to disconnect. That's far and away much different than these robots.

Imagine if instead they did this research with the closed source community. You know, get hired under false pretenses, sneak some vulns into some commercial product, write a paper about how easy it was. Pretty sure if they tried that they would be in jail right now.

There are literally companies you can hire that will go this far pentesting your company and the employees involved are not in on it.

How else do you prove your process can stop real infiltrators by state actors?

So? The difference is consent (in your case of the owners of the company).

There are many crimes in the world that are only crimes if you do it without consent.

> How else do you prove your process can stop real infiltrators by state actors?

One of the common security controls against infiltration by foreign nation states is espionage being a capital offense. Well obviously not appropriate, i think that its pretty obvious that these researchers would have not succeded if they faced the electric chair like a spy would. So i don't think the comparison is apt.

So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick?

If you have approval from one person in an org of 100,000 is this still okay?

It has to be, because getting explicit consent from every person in the org at that size would be untenable, and make them artificially extra vigilant during a potential audit window.

Well now scale this to open source. The typical web project has 2k+ random nodejs libs in their dependency tree. These are all separate orgs/individuals.

Real world bad actors are backdooring these projects constantly. I specialize in this area of research.

If every white hat has to get permission from exponentially large dependency chains, they will never even come close to being able to compete with black hats here finding the weak links of the chain.

The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate.

> So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick?

You have to get consent from someone who has legal authority to give it to you.

> If every white hat has to get permission from exponentially large dependency chains

They don't. They just have to get permission from someone in authority. Different open source projects have different governance structures. Sometimes that is a single person.

> The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate.

If you are hacking someone elses system without their consent (not to mention for your own personal gain), you are a blackhat. By definition. Pretending to be a researcher doesn't change that.

> you can hire

there lies the difference, duh.

And what about the hundreds of NPM dependencies in VS Code no one reviews?

Or the the thousands of brew packages that are blindly merged unsigned by 800 people with access?

Who pays to give a white hat as much freedom to find supply chain attack vectors here? Who gets consent from every random student whose code, if compromised, would compromise every major company?

We have created a massive mess, and I don't know that we will be able to hire enough researchers to fix it.

We are going to need unpaid volunteers, and a lot of them.

holy moving the goalpost batman, slow down.

> We are going to need unpaid volunteers, and a lot of them.

that's absolutely orthogonal to the question at hand, it's not a matter of paid or unpaid, neither being volunteer or not: it's a matter of consent.

if you don't sought consent beforehand either via a contract relationship or a sponsored bug hunt program or the likes, you're a racketeer, not a white hat, and you should (and will) be treated as such.

Going further, "with" seems like the wrong preposition. "On" seems more accurate.

The professor is not a native English speaker. I’d cut him some slack in minor issues with his word choice.

It would make sense if they were talking about mice, in which case "on" is still more accurate but "with" is probably correctly assumed to be equivalent. Research with humans involves them being on the author list...

Additionally, would be right thing to do with there's apology email to also state that they retracted "hypocrite commit” paper from IEEE ?

After all before a ban, there where complaint(s) made regarding this paper, by other researchers and community members.

This falls under behavioral research. I believe psychologists have solved the problem of how to research that is both blind and in line with ethical standards. All they had to do was ask one.

I also found the apology lacking in that they did not specifically acknowledge that they were indeed experimenting on people.

Is it now not P.C. to discuss what they revealed? Or "nothing" has been revealed?

Are we not allowed to discuss the possibility of someone hacked an university email address and then submit a patch?

You're being too coy. What do you think was revealed?

Reply on news.ycombinator.com