Hacker News Reader

Comment by doomrobo | Hacker News Reader

They performed an experiment on human subjects without informed consent.

Sure, but so does every website that AB tests a landing page. Consent is only relevant when there is some risk to the subject (or something they value, like privacy, etc).

What about the risk to the reputation of anyone who approves these patches? Or of intentinally buggy patches making it into the wild and being exploited?

> What about the risk to the reputation of anyone who approves these patches?

This is a risk, but it's exposing vulnerabilities is always preferable to leaving them in place.

> Or of intentinally buggy patches making it into the wild and being exploited?

There was no real risk of this. They specifically did not allow it to make its way into real releases.

If they had allowed it into actual releases, I would have a serious problem with that.

There is also the risk that a third party sees the patch on a mailing list, and merges it to his internal branch because it looks like it is fixing one of his problem.

But I'd argue it is his own fault to use unsupported patches.

> Consent is only relevant when there is some risk to the subject

Says who? I don't think that's true according to IRB standards in the US. Nor is it true for websites who A/B test according to the GDPR

> Says who?

Me and common sense. I don't believe consent is relevant when there is no risk of harm to the subject. IRBs and the GDPR are overly aggressive on this point, probably as a reaction to real and important violations of privacy. But the idea that A/B testing the color of your CTA button on a landing page requires informed consent is absurd.

There's lots of systemically horrible things that can happen if you're not careful about what you allow. If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report

https://en.wikipedia.org/wiki/Belmont_Report

> There's lots of systemically horrible things that can happen if you're not careful about what you allow.

Of course there are. But what specifically are the harms that are going to be caused by either this research or a landing page A/B test without a click through pop up? The existence of theoretical harms for broad categories of potential research does not have a whole lot of bearing on these specific lines of research.

> If you're interested why these ethical principles exist in the United States, I suggest you at least skim the Belmont Report

I read it. It was interesting, but I don't think it's particularly relevant here. The only prong of its test that would be relevant to this experiment is "respect for persons". The idea that somehow not revealing the bug or the experiment was intrinsically harmful as a violation of a person's moral autonomy.

I don't buy that line of reasoning, and I can't really think of any valid consequentialist justification for it, and the report itself does not attempt to justify it either, as far as I can tell.

If I sit across the street from your house in a van and observe your life, noting down the times you come and go, and logging what I can see through your window, and then using that data to market things to you, would you agree that you'd rather be able to provide and withdraw consent for this activity? No harm done to you.

I think it's reasonable to consider invasion of privacy a harm on its own. There was no invasion of privacy in this example.

> But the idea that A/B testing the color of your CTA button on a landing page requires informed consent is absurd.

A/B testing on major platforms is much more sophisticated than that[1].

It's a crucial practice for advertisers and marketing teams that dives deep into researching the psychological response towards images, text and dozens of other variables. Human subjects are acting as lab rats in order to extract some data points to drive the next test and campaign.

So, yes, it should definitely require informed consent and opting in.

[1]: https://www.bbc.com/news/technology-28051930

> A/B testing on major platforms is much more sophisticated than that[1].

On some it is, and some it isn't.

> It's a crucial practice for advertisers and marketing teams that dives deep into researching the psychological response towards images, text and dozens of other variables. Human subjects are acting as lab rats in order to extract some data points to drive the next test and campaign.

This is just a long and emotionally laden way of saying "changing images and text to see which works best".

> So, yes, it should definitely require informed consent and opting in.

Guess we're just going to have to agree to disagree then. I don't see any reason whatsoever to think that this practice is harmful to the subjects being experimented on.

At worst, it's harmful to society in general because it incentivizes consumerism and potentially self destructive behavior. But that is completely orthogonal to the issue of informed consent. If you got perfectly informed consent from 10,000 people to tease out the perfect pitch text, and then deployed it against the rest of the population, the effect would be exactly the same, whether or not you got consent.

If anything they wasted time and energy of project maintainers. This alone should be enough to see the behavior is inexcusable.

Ya, they wasted a bit of their time. That wasn't very nice. But it's hardly the great crime it's being made out to be, and what they did was a huge public service. It's impossible to over-state the importance of linux kernel security.

You don't get to decide what you think is important and then burden others pushing it. If you think testing security in random attack way is important tell the people who run the project. They are the ones qualified to make the calls.

It's just a scammy move at best. To me it's borderline criminal to sabotage a project like that.

This is the part I'm personally most interested in. Research generally has pretty strict ethical regulations about consent. I'm wondering if this would qualify as a violation of any of their university's or the conference's rules.

That's how security is tested. TSA undergoes undercover testing.

https://abcnews.go.com/US/tsa-fails-tests-latest-undercover-...

TSA agents are informed that there are tests as part of their job. See this comment for another example of informed consent in security testing

https://news.ycombinator.com/item?id=26929797

Reply on news.ycombinator.com