If the university doesn't review research methodologies that directly impact others (I'm not talking about societal impact of the work down the line), then they should be considered bad-faith actors. This is the equivalent of punishing a university for not having an IRB for human experiments .

I assume individual members from UMN may still contribute without a UMN address. They just won't be given any special consideration (implicit or explicit) as belonging to a particular organization.

By that standard, basically no university meets your threshold. (in other places the IRB might have decided differently, but also that's not extremely likely) Researchers are just not monitored that closely usually.

They'd already complained to UMN about the research, and nothing was done about it. It wasn't just the IRB that allowed it to continue.

What do you mean continued it. The research of submitting buggy patches had ended already (they even had a draft paper). The whole row started because one of the researchers submitted a patches from a (not very good apparently) in progress static analysis tool. The bad quality of the patch led to GKH accusing the submitter that they are continuing. As the article states this was not the case.

Is that the case? I hadn't seen anything conclusive that that actually had happened? (some people said the contacted the IRB, but presumably that was part of what triggered the IRB to look at it)

But looking into this and clearly documenting it is part of what UMN needs to do.

In the most recent email chain where they banned UMN, GKH said that they were going to have to complain to the university again. From what I understand, the IRB review was initiated by the researchers themselves after receiving backlash from the original paper.

But researchers don't operate within a vacuum, research is a social effort. The faculty member and the graduate student who dreamt up this line of research have discussed it with others and they all thought it was a splendid idea.

>By that standard, basically no university meets your threshold.

The question then, is what to do about this much larger scale problem, not to simply assert the premise is wrong.

Agree or disagree with whether it should have been done but blaming UMN was a social tactic to embarass the University so that UMN would apply pressure to the researcher and deal with them.

> social tactic

This, but not derisively. Note that the university's IRB granted an exception for this behavior, and neither UMN nor the department responded with consideration for the concerns raised by the kernel team until after they banned the whole domain.

The social tactic could have been changed from "we will revert all recent patches originating from UMN" to "we are forced to review all recent patches originating from UMN, and to enforce stricter scrutiny of UMN patches going forward." Second is more honest and also applies social pressure.

That sounds like a good first warning. But they persisted even after Greg KH complained to UMN and told them to stop. A more severe punishment for a second offense is needed, IMO.

The second option also doesn't result in any big negatives for UMN associated personnel because the kernel devs take on all the work of enforcing stricter scrutiny.

> It never made any sense to blame UMN in general for an action taken by arguably only a single department

UMN is ultimately responsible for the actions of the people under their organization. This include oversight and dealing with the actions of those people when they have crossed lines.

Agreed, and I'm stunned this is even in question.

> It's not really surprising a bunch of academic-types were too far removed from open source etiquette

Umm, there's etiquette in academia too you know... even FOSS etiquette in academia.

And that fact highlights the mistakes made here.

A fellow researcher intentionally pushing bad data into a colleague's study as some kind of penetration test on the colleague's scientific methodology would be justifiably seen as betrayal, and a possibly bad faith betrayal at that since research grants are a finite resource.

The researchers in the story appear to have failed to extrapolate that sort of collegial courtesy to the open source community maintaining Linux.

The researchers in this story acted unethically - as academics. I'm saying it's not the culture difference.