← Back to context

Comment by macspoofing

4 years ago

Linux maintainers should log a complaint with the University's ethics board. You can't just experiment on people without consent.

18 comments

macspoofing

Reply
hn8788  4 years ago

One of the other emails in the chain says they already did.

> This is not ok, it is wasting our time, and we will have to report this, AGAIN, to your university...

walrus01  4 years ago

I have a theory that while the university's ethics board may have people on it who are familiar with the myriad of issues surrounding, for instance, biomedical research, they have nobody on it with even the most cursory knowledge of open source software development. And nobody who has even the faintest idea of how critically important the Linux kernel is to global infrastructure.

  • bluGill  4 years ago

    They should also have people on it who are familiar with psychology research. The issues with this research the types of things psychology research should find.

kevincox  4 years ago

I agree. They are attempting to put security vulnerabilities into a security-critical piece of software that is used by billions of people. This is clearly unethical and unacceptable.

smnrchrds  4 years ago

According to duncaen, the researchers had gotten the green light from the ethics board before conducting the experiment.

https://news.ycombinator.com/item?id=26888978

  • formerly_proven  4 years ago

    IRB makes a decision based on the study protocol/design, so if you intentionally mislead / make wrong statements there, IRB approval doesn't really mean anything.

    • ajarmst  4 years ago

      It means they either lied to the IRB or the IRB is absolutely incompetent. Possibly actionably so. I've sat on an IRB. This experiment would have been punted on initial review. It wouldn't even have made the agenda for discussion and vote.

  • rurban  4 years ago

    Because they lied to them. They promised not to do any actual harm. But they did

Frost1x  4 years ago

I always find the dichotomy we have regarding human subject experimentation interesting in the US. We essentially have two ecosystems of human subjects as to what is allowed and isn't: public and privately funded. The contrast is a bit stark.

We have public funded rules (typically derived or pressured by availability of federal or state monies/resources) which are quite strict, have ethics and IRB boards, cover even behavioral studies like this where no direct physical harm is induced but still manipulates peoples' behaviors. This is the type of experiment you're referring to where you can't experiment on people without their consent (and by the way, I agree with this opinion).

Meanwhile, we have private funded research which has a far looser set of constraints and falls into everyday regulations. You can't really physically harm someone or inject syphilis in them (Tuskegee experiments) which makes sense, but when we start talking about human subjects in terms of data, privacy of data, or behavioral manipulation most regulation goes out the window.

These people likely could be reprimanded, even fired, and scarlet lettered making their career going forward more difficult (maybe not so much in this specific case because it's really not that harmful) but enough to screw them over financially and potentially in terms of career growth.

Meanwhile, some massive business could do this with their own funding and not bat an eye. Facebook could do this (I don't know why they would) but they could. Facebook is a prime example of largely unregulated human subject experimentation though. Social networks are a hotbed for data, interactions, and setting up experimentation. It's not just Facebook though (they're an obvious easy target), it's slews of businesses collecting data and manipulating it around consumers: marketing/advertising, product design/UX focusing on 'engagement', and all sorts of stuff. Every industry does this and that sort of human subject experimentation is accepted because $money$. Meanwhile, researchers from public funding sources are crucified for similar behaviors.

I'm not defending this sort of human subject experimentation, it's ethically questionable, wrong, and should involve punishment. I am however continually disgusted by the double standard we have. If we as a society really think this sort of experimentation on human subjects or human subject data is so awful, why do we allow it to occur under private capital and leave it largely unregulated?

s_dev  4 years ago

I'm not sure it is experimenting people without consent. Though it's certainly shitty and opportunitstic of UoM to do this.

Linux Bug fixes are open to the public. The experiment isn't on people but on bugs. I would be like filing different customer support complaints to change the behavior of a company -- you're not experimenting on people but the process of how that company interfaces with the public.

I see no wrong here including the Linux maintainers banning submissions from UoM which is completely justified as time wasting.