On Wed, Apr 21, 2021 at 11:58:08AM +0000, Shelat, Abhi wrote: > Academic research should NOT waste the time of a community. > > If you believe this behavior deserves an escalation, you can contact > the Institutional Review Board (irb@xxxxxxx) at UMN to investigate > whether this behavior was harmful; in particular, whether the research > activity had an appropriate IRB review, and what safeguards prevent > repeats in other communities. For what it's worth, they do address security, IRB, and maintainer-time questions in "Ethical Considerations", starting on p. 8: https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf (Summary: in that experiment, they claim actual fixes were sent before the original (incorrect) patches had a chance to be committed; that their IRB reviewed the plan and determined it was not human research; and that patches were all small and (after correction) fixed real (if minor) bugs.) This effort doesn't appear to be following similar protocols, if Leon Romanvosky and Aditya Pakki are correct that security holes have already reached stable. Also, I still don't understand the explanation of the original SUNRPC patch. I don't know much about static analyzers, but it really doesn't look like the kind of mistake I'd expect one to make. --b.
