>but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt.

I think an apology before they've had a chance to review everything that occurred would be rather empty, don't you? "I'm sorry you're upset"?

I far prefer what they've stated they're going to do which is stop the activity they know about immediately, and to review how we got to this point.

If, on the off chance, the professor was being honest about ensuring they weren't wasting anyone's time, and ensuring no bad code made it into the kernel, then the situation becomes a bit more murky. They'd need to go through all of the associated emails both public and internal to validate that.

If on the other hand this is in fact a duck, I would expect them to both to issue a meaningful apology at that point, as well as lay out the steps they've taken to ensure it doesn't happen again (which they've indicated is their plan). And hopefully restore the trust of the OSS community.

Maybe it's because I'm both Canadian and a tech manager but I've never worried about over apologizing if it's genuine. Same goes for saying thank you.

Perhaps I am naive but I think the apology should come after the internal investigation.

It is more likely that you just have an administrator that became aware of the issue, they won't make an apology until they understand what happened.

They could investigate and determine that they did nothing wrong, but they aren't the final arbiter of justice. This is not like the police investigating themselves. The OSS community can come to a different conclusion and still punish them.

The job of UMN is to get the facts first, and then determine actions. If the OSS community (and others) feel like the actions don't match the facts (or if they feel the facts don't match what actually happened) they can apply their own set of actions.

Apologies are overrated. Are these leaders actually sorry for something they likely weren’t aware of before today? Doubtful. Who are they apologizing to? The public?

When the issue has gotten actual attention an apology to the kernel mailing list might be appropriate, but as someone who has been apologized to many times it all just becomes meaningless, who cares if you say you’re sorry. I care what you’ll do about it.

Immediate knee-jerk apologies are usually worthless because the person apologizing usually has no idea what's going on and can't make a reasoned statement. They're just trying to do damage control.

The best apologies are the ones that are done after some reflection, not under duress, and not purely for reputation.

I doubt an apology would increase liability in this case, since the actions already occurred and are forensically visible.