Linux and the limits of responsible research
Summary
LWN documents the conflict over deliberately problematic patches from Minnesota and researchers' responsibility towards production communities. The conflict escalated in April 2021. The University of Minnesota later apologised.
Ideas
- Researchers submitted patches to study maintainers' reactions experimentally.
- Some changes contained deliberately faulty patterns.
- Kernel maintainers temporarily stopped contributions from the university involved.
- Earlier changes were reviewed again for possible damage.
Insights
- People in open projects are not unwitting test subjects.
- Deception uses up the trust that makes technical collaboration possible in the first place.
- Research ethics also apply to publicly accessible development processes.
Facts
- Greg Kroah-Hartman announced a review of earlier contributions.
Recommendations
- Obtain informed consent before experiments on real maintenance processes.
- Clearly separate security research from production patch queues.
References
Links to the original source and the Web Archive open in a new tab.