> The last line is "We will report our findings back to the community as soon as practical." It should be followed by "and we will provide an update in no more than 30 days".

I don't really think this is a worthwhile distinction. Personally, it comes off as trying to nanny a process that involves the Linux kernel maintainers and UMN Admins. There's a ban on UMN, probably until they show they can head off ethical issues. The public doesn't need to be sitting around demanding an update in 30 days or less. They'll act when they have confidence in their facts and the outcome, and the Linux community will undoubtedly act in kind.

I disagree. The associate department head named in the statement linked it on Twitter, immediately following up his comments with

> I very much welcome feedback from the participants who brought this to our attention: that's why I tagged @gregkh . Obviously, we would appreciate any guidance as to how we can get the Univ. of Minnesota contribution ban lifted.

This is pretty clearly one of their main interests in moving fast here. https://twitter.com/lorenterveen/status/1384954220705722369

What's your interest in "fast" here?

I don't understand the question. By fast I mean that they had a statement up on the website within 24 hours and the associate head of the department is already pinging members of the kernel team on Twitter to ask how they can get unbanned. That's moving very quickly by academic standards.

> At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more.

They need to act to get the ban rescinded, they can't just ignore this issue away.

> They need to act to get the ban rescinded, they can't just ignore this issue away.

I doubt that - in the other thread, someone noted that the last non-hostile kernel contribution from @umn.edu was in 2014. I don't think they are champing at the bit to get legit kernel contributions merged - or at least haven't in the past 7 years. At this point, it is purely a reputation/PR problem with little urgency - the ban is not blocking anyone's work at the university (except for the suspended research project)

The real urgency is they need to protect their reputation. So long as they do a proper investigation and take proper action they can spin this as a rouge professor and be forgiven. We as a community should give them time to investigate and figure out how to handle and prevent this, and then if done correctly forgive them. If they make this statement and then there is no action within a year, then we should assume this is a token attempt to sweep things under the rug and continue with more bans.

For now I'll accept their apology, but if there is no action in the future I'll retract that.

bluGill says: "...rouge professor? "

It's a common misspelling, and I find it particularly grating (that, and "tounge" *shivers*). However, I've been getting better at reflexively requesting corrections as I also have some words I constantly misspell.

Well ya know you have to find out the details to make a decision, no? Snap decisions are almost always wrong until you know the facts, no just one side, but all sides. This is the same shit that happens in the 24/7 newscycle "now now now"

I agree, that's why in this case (as I say in my post) I believe they'll follow through.

As the pressure is already on them to rectify the situation, there's no need to for an artificial deadline. It adds nothing, but could delay their announcement or force them to publish an incomplete response.

"and we admit that a full accounting for these actions is necessary before our ban is rescinded" is a valid (albeit even less common) form of making sure that they are held accountable. Nonetheless, it is important that the accused admits it.

The common case today is that admitting you are due to account for your actions is the same as admitting that you are at fault. I have been denied jobs because I have admitted that to being accountable for my decisions, whereas I got the distinct impression had I simply not accounted for them they wouldn't have cared.

It is a good PR statement, but it doesn't touch on any of the Linux Kernel community's concerns. It makes no committment to working with the community or, like you said provide any kind of explicit time frame.

Instead, the statement is there to prevent journalists from putting "UWN puts the entire internet at risk" on their front page. Instead, it frames the incident into a boring "Students offended the Linux Kernel community while trying to help out by doing security research, we will investigate" story.

Well put. It’s taken me the last hour to realise that it really is refreshingly transparent.

To me, it’s like the distinction between offence caused and actually showing some genuine reflection as to why there might be offence caused. This statement, to me, is firmly in the former camp.

This statement is in the former camp, stating that they do not have enough data yet to be able to be in the latter camp. They're stating that they'll be working toward it. It's a statement that they needed to put out asap before being able to state affirmatively what actually happened, since that can take time.

This sort of incident is difficult to set expectations for reporting back.

I expect UMN to move swiftly on this but it’s a large university and may move more slowly than we’d like.

That's why you promise an update, not a resolution.

> explicit time frame

This seems incompatible with the pace of academia, as I have experienced it.

Academics tend to be able to find their calendars when money or prestige is involved.

This is the second one.

They need not promise to have results in a particular time frame, but they should commit to giving an update by a particular date, even if that update is just, "We've made progress investigating this incident, but we are not yet ready to report our findings. We will give our next update no later than $DATE."

I have also seen many times a university happy to throw a student or even a faculty member under the bus, and in this case it seems extremely clear that they were running an unethical sociological experiment that was probably not reviewed by the IRB there. That's grounds for the university very rapidly turning on you.

Violating IRB ethics is a very serious issue, and has timelines in place once a complaint is filed. I expect that this statement was intended to be fast, short, and direct because of the time sensitivity.

They’ve explicitly said before that this was reviewed by the IRB and cleared by them as not being an experiment with human subjects

Which means either they mislead the IRB, or the IRB also needs reform. That investigation should take a while either way to figure out how that is possible.

My experience with anything that involves other faculty (at worse, tenured faculty) is that it will get done some time between later and never. With prioritization slipping the further you venture from your home department.

And this is by definition a matter that will involve a lot of parties. At minimum, as everyone in the chain tries to ensure their ass is covered and how it's not really their fault, because it wasn't really their job to say no to this.

While I disagree with you in this specific instance (because I think it'd be hard for them to be so specific this early on), I think you've made a very good point about building trust in the face of handling things.

Educational instutions don't generally do that. In many cases, they can't.

Kind of like how Mozilla will open-source Pocket any day now, just like they promised in 2017...

What on earth has that got to with any of this?

It's an example of an organization making a promise to take action to respond to feedback from the community, not providing a time frame, and then just never doing it.

For the sake of discussion, I'll grant the example, but the fact that org A acts in bad faith has no bearing on whether org B acts in bad faith.

If Mozilla had ties to UMN CS&E you might have had a (tenuous) point, but...

Plus, this has come out in the last 48hrs or so? And you're somehow saying that's comparable to 3 years? Sure, if they haven't issued a further statement in 1 month, 3 months, etc. then you might be justified.