“They introduce kernel bugs on purpose” • Hacker News Board

Re: “They introduce kernel bugs on purpose”

#311

Post by ret2plt » Wed, Apr 21, 2021, 2:31 PM UTC

kstenerud wrote: post #3

kdbg wrote: post #2

I don't think there have been any recent comments from anyone at U.Mn. So, back when the original research (happened last year) the following clarification was offered by Qiushi Wu and Kangjie Lu which atleast paints their research in somewhat better light: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... That said the current incident seems to have gone beyond the limits of that one and is a new incid…

From their explanation: (3). We send the incorrect minor patches to the Linux community through email to seek their feedback. (4). Once any maintainer of the community responds to the email, indicating “looks good”, we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all the three…

> You do not experiment on people without their consent. This is in fact the very FIRST point of the Nuremberg code:

> 1. The voluntary consent of the human subject is absolutely essential.

The Nuremberg code is explicitly about medical research, so it doesn't apply here. More generally, I think that the magnitude of the intervention is also relevant, and that an absolutist demand for informed consent in all - including the most trivial - cases is quite silly.

Now, in this specific case I would agree that wasting people's time is an intervention that's big enough to warrant some scrutiny, but the black-and-white way of some people to phrase this really irks me.

PS: I think people in these kinds of debate tend to talk past one another, so let me try to illustrate where I'm coming from with an experiment I came across recently:

To study how the amount of tips waiters get changes in various circumstances, some psychologists conducted an experiment where the waiter would randomly either give the guests some chocolate with the bill, or not (control condition)[0] This is, of course, perfectly innocuous, but an absolutist claim about research ethics ("You do not experiment on people without their consent.") would make research like this impossible without any benefit.

[0] https://onlinelibrary.wiley.com/doi/epdf/10.1111/j.1559-1816...

Re: “They introduce kernel bugs on purpose”

#312

Post by WrtCdEvrydy » Wed, Apr 21, 2021, 2:32 PM UTC

incrudible wrote: post #301

WrtCdEvrydy wrote: post #291

I just want you to know that this is extremely unethical to create a paper where you attempt to discredit others by just using your university's reputation to try to create vulnerabilities on purpose. I back your decision and fuck these people. I will additionally be sending a strongly worded email to this person, their advisor and their whoever's in charge of this joke of a computer science school. Sometimes I wish…

I completely disagree with this framing. A real malicious actor is going to be planted in some reputable institution, creating errors that look like honest mistakes. How do you test if the process catches such vulnerabilities? You do it the just the way that these researchers did. Yes, it creates extra homework for some people with certain responsibilities, that doesn't mean it's unethical. Don't shoot the messenger.

> A real malicious actor

They introduced a real vulnerability in a codebase that lowers world-wide cybersecurity used by billions so they could jerk themselves off over a research paper.

They are a real malicious actor and I hope they hit by the CFAA.

Re: “They introduce kernel bugs on purpose”

#313

Post by LegitShady » Wed, Apr 21, 2021, 2:32 PM UTC

They should be reported to the authorities for attempting to introduce security vulnerabilities into software intentionally. This is not ok.

Re: “They introduce kernel bugs on purpose”

#314

Post by motohagiography » Wed, Apr 21, 2021, 2:33 PM UTC

This isn't friendly pen-testing in a community, this is an attack on critical infrastructure using a university as cover. The foundation should sue the responsible profs personally and seek criminal prosecution. I remember a bunch of U.S. contractors said they did the same thing to one of the openbsd vpn library projects about 15 years ago as well.

What this professor is proving out is that open source and (likely, other) high trust networks cannot survive really mendacious participants, but perhaps by mistake, he's showing how important it is to make very harsh and public examples of said actors and their mendacity.

I wonder if some of these or other bug contributors have also complained that the culture of the project governance is too aggressive, that project leads can create an unsafe environment, and discourage people from contributing? If counter-intelligence prosecutors pull on this thread, I have no doubt it will lead to unravelling a much broader effort.

Re: “They introduce kernel bugs on purpose”

#315

Post by xibalba » Wed, Apr 21, 2021, 2:33 PM UTC

treesknees wrote: post #277

The full title is "Linux bans University of Minnesota for sending buggy patches in the name of research" and it seems to justify the ban. It's not as though these students were just bad programmers, they were intentionally introducing bugs, performing unethical experimentation on volunteers and members of another organization without their consent. Unfortunately even if the latest submissions were sent with good inte…

From the looks of the dialogue, it was all of the above with the addition of lying about what they were up to when confronted. I would think all of this constitutes a serious violation of any real university's research ethics standards.

Re: “They introduce kernel bugs on purpose”

#316

Post by robrtsql » Wed, Apr 21, 2021, 2:33 PM UTC

Very embarrassed to see my alma mater in the news today. I was hoping these were just some grad students going rogue but it even looks like the IRB allowed this 'research' to happen.

Re: “They introduce kernel bugs on purpose”

#317

Post by andrewzah » Wed, Apr 21, 2021, 2:33 PM UTC

incrudible wrote: post #301

WrtCdEvrydy wrote: post #291

I just want you to know that this is extremely unethical to create a paper where you attempt to discredit others by just using your university's reputation to try to create vulnerabilities on purpose. I back your decision and fuck these people. I will additionally be sending a strongly worded email to this person, their advisor and their whoever's in charge of this joke of a computer science school. Sometimes I wish…

I completely disagree with this framing. A real malicious actor is going to be planted in some reputable institution, creating errors that look like honest mistakes. How do you test if the process catches such vulnerabilities? You do it the just the way that these researchers did. Yes, it creates extra homework for some people with certain responsibilities, that doesn't mean it's unethical. Don't shoot the messenger.

No. There are processes to do such sorts of penetration testing. Randomly sending buggy commits or commits with security vulns to "test the process" is extremely unethical. The linux kernel team are not lab rats.

Re: “They introduce kernel bugs on purpose”

#318

Post by LegitShady » Wed, Apr 21, 2021, 2:33 PM UTC

kleiba wrote: post #286

How is such a ban going to be effective? The "researchers" could easily continue their experiments using different credentials, right?

Their whole department/university just got officially banned. If they attempt to circumvent that, the authorities would probably be involved due to fraud.

Re: “They introduce kernel bugs on purpose”

#319

Post by lbarrow » Wed, Apr 21, 2021, 2:35 PM UTC

thaeli wrote: post #299

random5634 wrote: post #284

How does something like this get through IRB - I always felt IRB was over the top - and then they approve something like this? UMN looks pretty shoddy - the response from the researcher saying these were automated by a tool looks like a potential lie.

They obtained an "IRB-exempt letter" because their IRB found that this was not human research. It's quite likely that the IRB made this finding based on a misrepresentation of the research during that initial stage; once they had an exemption letter the IRB wouldn't be looking any closer.

My understanding is that it's pretty common for CS departments to get IRB exemption even when human participants are tangentially involved in studies.

Re: “They introduce kernel bugs on purpose”

#320

Post by xroche » Wed, Apr 21, 2021, 2:35 PM UTC

treesknees wrote: post #277

The full title is "Linux bans University of Minnesota for sending buggy patches in the name of research" and it seems to justify the ban. It's not as though these students were just bad programmers, they were intentionally introducing bugs, performing unethical experimentation on volunteers and members of another organization without their consent. Unfortunately even if the latest submissions were sent with good inte…

The full titre should actually be "Linux bans University of Minnesota for sending buggy patches in the name of research and thinking they can add insult to injury by playing the victims"

> I respectfully ask you to cease and desist from making wild accusations that are bordering on slander.

> These patches were sent as part of a new static analyzer that I wrote and it's sensitivity is obviously not great. I sent patches on the hopes to get feedback. We are not experts in the linux kernel and repeatedly making these statements is disgusting to hear.

> Obviously, it is a wrong step but your preconceived biases are so strong that you make allegations without merit nor give us any benefit of doubt. I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts.

This idiot should be banned from the University, not from the linux kernel.