Comment by MaxBarraclough

> I guess it'd involve much more work, and could've yielded zero results - after all, I don't think there are any documented examples when a vulnerability was proven to have been introduced on purpose.

In line with UncleMeat's comment, I'm not convinced it's of any consequence that the security flaw was introduced deliberately, rather than by accident.

> scientists don't chase around the world looking for people or objects that, by chance, already did the things they're testing for

That doesn't sound like a fair description of what's happening here.

There are two things at play. Firstly, an analysis of the survival function [0] associated with security vulnerabilities in the kernel. Secondly, the ability of malicious developers to deliberately introduce new vulnerabilities. (The technical specifics detailed in the paper are not relevant to our discussion.)

I'm not convinced that this unethical study demonstrates anything of interest on either point. We already know that security vulnerabilities make their way into the kernel. We already know that malicious actors can write code with intentional vulnerabilities, and that it's possible to conceal these vulnerabilities quite effectively.

> Honestly, I wouldn't object to that experiment either. It wouldn't do much harm (little additional vandalism doesn't matter on the margin, the base rate is already absurd), and could yield some social good.

That's like saying It's ok to deface library books, provided it's a large library, and provided other people are also defacing them.

Also, it would not yield a social good. As I already said, it's possible to study Wikipedia's ability to repair vandalism, without committing vandalism. This isn't hypothetical, it's something various researchers have done. [0][1]

> Part of the reason to have public research institutions is to allow researchers to do things that would be considered bad if done by random individual.

It isn't. Universities have ethics boards. They are held to a higher ethical standard, not a lower one.

> Running research like this against them makes sense

No one is contesting that Wikipedia is worthy of study.

[0] https://en.wikipedia.org/wiki/Wikipedia:Wikipedia_Signpost/2...

[1] https://en.wikipedia.org/wiki/Wikipedia:Counter-Vandalism_Un...