| ▲ | arjie 13 hours ago | |||||||||||||||||||||||||||||||||||||
Oh I misunderstood the sections in the article about the umn.edu email stuff. My mistake. The actual course of events: 1. Prof and students make fake identities 2. They submit these secret vulns to Greg KH and friends 3. Some of these patches are accepted 4. They intervene at this point and reveal that the patches are malicious 5. The patches are then not merged 6. This news comes out and Greg KH applies big negative trust score to umn.edu 7. Some other student submits a buggy patch to Greg KH 8. Greg KH assumes that it is more research like this 9. Student calls it slander 10. Greg KH institutes policy for his tree that all umn.edu patches should be auto-rejected and begins reverts for all patches submitted in the past by such emails To be honest, I can't imagine any other such outcome could have occurred. No one likes being cheated out of work that they did, especially when a lot of it is volunteer work. But I was wrong to say the research was useless. It does demonstrate that identities without provenance can get malicious code into the kernel. Perhaps what we really need is a Social Credit Score for OSS ;) | ||||||||||||||||||||||||||||||||||||||
| ▲ | caycep 12 hours ago | parent | next [-] | |||||||||||||||||||||||||||||||||||||
Actually, I think #7 is one of the same students working for the professor. So GKH is correct in assuming it's more of the same. Research can be non-useless but also unethical at the same time... | ||||||||||||||||||||||||||||||||||||||
| ▲ | yjftsjthsd-h 12 hours ago | parent | prev | next [-] | |||||||||||||||||||||||||||||||||||||
> 3. Some of these patches are accepted > 4. They intervene at this point and reveal that the patches are malicious > 5. The patches are then not merged It's not clear to me that they revealed anything, just that they did fix the problems: > In their paper, Lu and Wu claimed that none of their bugs had actually made it to the Linux kernel — in all of their test cases, they’d eventually pulled their bad patches and provided real ones. Kroah-Hartman, of the Linux Foundation, contests this — he told The Verge that one patch from the study did make it into repositories, though he notes it didn’t end up causing any harm. (I'm only working from this article, though, so feel free to correct me) | ||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||
| ▲ | jovial_cavalier 12 hours ago | parent | prev [-] | |||||||||||||||||||||||||||||||||||||
>No one likes being cheated out of work that they did, especially when a lot of it is volunteer work. You know what would really be wasteful of volunteer hours? Instituting a policy whereby the community has to trawl through 20 years of commits from umn.edu addresses and manually review them for vulnerabilities even though you have no reasonable expectation that such commits are likely to contain malicious code and you're actually just butthurt. (they found nothing after weeks of doing this btw) | ||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||