[HarryHirsch]

Aditya decided to join a supervisor with questionable ethics who ran a very ill-conceived research project. He could have chosen someone else for his thesis or spoken up when the paper went for submission, or at least stepped aside from kernel development but instead decided to dig in. It's all very poor judgement on his part, in multiple instances. There's no need to normalize that behaviour, because it's not normal, at least not in the world I'd like to live in.

Recommended reading: All Hallows Eve by Charles Williams, a meditation on where stupidity and selfishness lead.

[dcow]

I don't necessarily disagree about how a student should handle an ethically grey situation. But that still doesn't justify treating other humans like shit.

And for the record I don’t think there is even level headed consensus formed yet on the whole paper thing. It’s arguably unethical, but it is also arguably simply inconsiderate. And it has certainly provided some degree of utility, although it’s unclear how much. I think most of the impressions have been molded by Greg’s response during the “kernel peeps are pissed” phase of the whole affair.

[HarryHirsch]

And for the record I don’t think there is even level headed consensus formed yet on the whole paper thing.

The paper has been withdrawn because consensus is clear: for experiments on human subjects informed consent is required in advance. The institution recognizes that much: "We acknowledge our responsibility to do this to prevent situations like this incident in the future."

[dcow]

It's also reactionary. There was social pressure and the threat of being perma-banned as an institution from contributing to the kernel. The decision was made under duress. It's not surprising it was withdrawn.

> for experiments on human subjects informed consent is required in advance

By such simple logic A/B testing is unethical. And that may be the case. Still, it's not exactly clear in this case where to draw the line and who/what the subject is.

There's a comment elsewhere in this thread that sums the situation up better than I can: https://news.ycombinator.com/item?id=26985631. I've read the paper and honestly I have a mixed impression. It certainly is respectful and doesn't come off as "we're going to be super malicious and mega waste everyone's time and fuck with the kernel maintainers for fun and science". It does not aim to experiment with humans in order to study how humans socially react to a breach of trust in a high trust collaboration. That was not their goal at all. Arguably, as laid out pretty explicitly in the paper, the experiment is not on human subjects but rather on a system of collaboration used primarily by open source projects. It happens that the system is operated by humans. Are you testing the humans, or stressing the system?

Is making crafted investments in the market for the sole purpose of studying the validity of a hypothetical model unethical? Is it research on humans because the market is a human endeavor operated by humans? These are genuine questions.

There are also different ethical frameworks. No harm was caused by this research. In fact, the only real harm to humans has been Greg berating a person (because of their proximity to past research and perceived sloppy patches) who offered legitimate patches some of which actually fixed bugs in the kernel. Clearly Greg didn't even take the time to understand the patches he just categorically dismissed them all because he had a bone to pick. Now the kernel is down a contributor who's contributions clearly have utility.

Back to the paper, even if it presents the obvious for people working on open source projects, it, like is the status quo in security research, is the working example of the exploit. In my experience people don't give a shit about perceived vulnerabilities until they become real vulnerabilities. As a kernel user, I actually value this research more than the alleged waste of time it may have caused for maintainers. I'm not the only one who feels this way. Sometimes to effect change you need to light a fire under somebody's ass.

So the paper is valuable to some subset of people. It provides utility. It did no harm to computer system or humans. You see what I'm getting at.. there are ethical frameworks under which this paper is clearly ethical (even if you concede it directly and explicitly aimed to experiment on humans, which I debate). Ideally the researchers would have asked Linus and Greg if they could perform the research on their project so they wouldn't feel out of the loop and attacked/culpable when the research was published. I do hope everyone's learned their lesson in that regard.

Anyway back to Greg, you're really moving the goal posts. We can agree 100% that the paper is unethical. The fact is simply irrelevant when considering whether it's right to piss on some student at UMN who presented valid albeit sloppy patches to the kernel in a gesture of good faith in order to try and improve the state of security. It's a breach of the kernel's own community guidelines, at the very least!

[staticassertion]

This is a ridiculous judgment from someone who has barely a glimpse into someone else's life. You've extrapolated, from a mere association that you know virtually nothing about, that Aditya must be both stupid and selfish.

[HarryHirsch]

From his posts to the mailing list it's clear that Greg was aware of the "hypocrite commit" paper and that there was some agreement in place with the University which must have stipulated "no more bogus patches". Professor Lu and everyone in his group were aware of the state of affairs. Then Aditya went and posted another bogus patch, the output of his static analyzer, to further his career, even though he should have known how that would be received. I regretfully stand by my assessment.

[staticassertion]

You're pulling all of this out of thin air.

> and that there was some agreement in place with the University which must have stipulated "no more bogus patches"

This is baseless.

> Then Aditya went and posted another bogus patch

Not bogus. Aditya's analyzer did in fact find plenty of bugs - do your research, this is confirmed by many other maintainers.

> to further his career, even though he should have known how that would be received

Why should he have known that? I would never expect to receive the kind of feedback given by Greg, followed by a total university ban, over a student submitting subpar commits. It's an insane overreaction.

[spacechild1]

> Not bogus. Aditya's analyzer did in fact find plenty of bugs

But the commit in question was bogus, and it looks like Aditya did not properly check the output of his tool. Maybe he did not send bogus patches on purpose, but the fact that he used the Linux kernel as a playground for testing his experimental static analysis tool (without disclosing it in the commits) is still problematic and he should be called out for that.

[HarryHirsch]

Greg wrote: "we will have to report this, AGAIN, to your university..."

There was behind-the-scenes talk that the student chose to ignore, it's impossible to interpret in any other way.

[dcow]

Here's another interpretation based on the facts we know today:

Greg was assuming these were patches coming from some new "hypocrite patch" project at UMN and "AGAIN" refers to the previous incident in Aug2020 regarding the paper. I don't think the student was ignoring anything. Greg categorically dismissed legitimate contributions to the kernel because of his rash perception that UMN was up to no good AGAIN. So that's why he referenced the previous event and said AGAIN.

In reality, this isn't some conspiracy where UMN was attempting to add hypocrite patches for a 2nd time. Greg was dead wrong in that regard. You need to read: https://www-users.cs.umn.edu/%7Ekjlu/papers/full-disclosure.....

[HarryHirsch]

In other words: Greg and all the other kernel maintainers were made unwilling participants in a research project (the "hypocrite patches") and then were made unwilling participants in another research project with the same advisor (the static analyzer which was of questionable utility).

So - no more free research support for the University of Minnesota. That's fair because the reviewers did not choose to spend time on the University of Minnesota's research output.