“They introduce kernel bugs on purpose” • Hacker News Board

Re: “They introduce kernel bugs on purpose”

#451

Post by joosters » Wed, Apr 21, 2021, 3:12 PM UTC

kop316 wrote: post #226

rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

Hearing how you phrased it reminds me of a study that showed how parachutes do not in fact save lives (the study was more to show the consequences of extrapolating data, so the result should not be taken seriously): https://www.bmj.com/content/363/bmj.k5094

The original referenced paper is also very good: http://elucidation.free.fr/parachuteBMJ.pdf (can't find a better formatted link, sorry)

Conclusions: As with many interventions intended to prevent ill health, the effectiveness of parachutes has not been subjected to rigorous evaluation by using randomised controlled trials.Advocates of evidence based medicine have criticised the adoption of interventions evaluated by using only observational data. We think that everyone might benefit if the most radical protagonists of evidence based medicine organised and participated in a double blind, randomised, placebo controlled, crossover trial of the parachute.

With the footnote: Contributors: GCSS had the original idea. JPP tried to talk him out of it. JPP did the first literature search but GCSS lost it. GCSS drafted the manuscript but JPP deleted all the best jokes. GCSS is the guarantor, and JPP says it serves him right

Re: “They introduce kernel bugs on purpose”

#452

Post by LegitShady » Wed, Apr 21, 2021, 3:13 PM UTC

farisjarrah wrote: post #337

LegitShady wrote: post #313

They should be reported to the authorities for attempting to introduce security vulnerabilities into software intentionally. This is not ok.

What these researchers did was clearly and obviously wrong, but is it actually illegal?

It should be reported anyways. This might be only some small part of the malfeasance they're getting up to.

Re: “They introduce kernel bugs on purpose”

#453

Post by fefe23 » Wed, Apr 21, 2021, 3:13 PM UTC

Reminds me of the Tuskegee Symphilis Study.

Sure we infected you with Syphilis without asking for permission first, but we did it for science!

Re: “They introduce kernel bugs on purpose”

#454

Post by Forgeties79 » Wed, Apr 21, 2021, 3:13 PM UTC

pas wrote: post #389

rubyn00bie wrote: post #321

This is supremely fucked up and I’d say is borderline criminal. It’s really lucky asshole researchers like this haven’t caused a bug that cost billions of dollars, or killed someone, because eventually shit like this will... and holy shit will “it was just research” do nothing to save them.

How come there's no ethical review for research that interacts with people? (I mean it's there in medicine and psychology, and probably for many economics experiments too.) edit: oh, it seems they got an exemption, because it's software research - https://news.ycombinator.com/item?id=26890084 :|

I can’t imagine it will stay that way forever. As more and more critical tools and infrastructure go digital, allowing people to just whack away at them or introduce malicious/bad code in the name of research is just going to be way too big of a liability.

Re: “They introduce kernel bugs on purpose”

#455

Post by timdorr » Wed, Apr 21, 2021, 3:14 PM UTC

ltfish wrote: post #413

Some clarifications since they are unclear in the original report. - Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&P 2021 paper. - According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kerne…

Aditya's advisor [1] is one of the co-authors of the paper. He at least knew about this work and was very likely involved with it.

[1] https://adityapakki.github.io/assets/files/aditya_cv.pdf

Re: “They introduce kernel bugs on purpose”

#456

Post by bluGill » Wed, Apr 21, 2021, 3:14 PM UTC

gruez wrote: post #393

angry_octet wrote: post #384

Research without ethics is research without value. Unbelievable that this could have passed ethics review, so I'd bet it was never reviewed. Big black eye for University of Minnesota. Imagine if you are another doctoral student is CS/EE and this tool has ruined your ability to participate in Linux.

> Research without ethics is research without value. didn't we learn a lot from nazi/japanese experiments from ww2?

We did. Often we wish they could have got more decimal points in a measurement, or had known how to check for some factor. Despite all the gains and potential breakthroughs lost nobody is willing to repeat them or anything like them. I know just enough medically people given 2 weeks to live who were still around 10 years latter that I can't think of any situation where I'd make an exception.

Though what a lot is is also open to question. Much of what we learned isn't that useful to real world problems. However some has been important.

Re: “They introduce kernel bugs on purpose”

#457

Post by Quarrelsome » Wed, Apr 21, 2021, 3:14 PM UTC

Quarrelsome wrote: post #23

This is ridiculously unethical research. Despite the positive underlying reasons treating someone as a lab rat (in this case maintainers reviewing PRs) feels almost sociopathic.

how do I deserve -4 for this?

Re: “They introduce kernel bugs on purpose”

#458

Post by rflrob » Wed, Apr 21, 2021, 3:15 PM UTC

ltfish wrote: post #413

Some clarifications since they are unclear in the original report. - Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&P 2021 paper. - According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kerne…

But Kanjie Lu, Pakki’s advisor, was one of the authors. The claim that “ You, and your group, have publicly admitted to sending known-buggy patches” may not be totally accurate (or it might be—Pakki could be on other papers I’m not aware of), but it’s not totally inaccurate either. Most academic work is variations on a theme, so it’s reasonable to be suspect of things from Lu’s group.

Re: “They introduce kernel bugs on purpose”

#459

Post by tsujp » Wed, Apr 21, 2021, 3:15 PM UTC

This is categorically unethical behaviour. Attempting to get malicious code into an open source project that powers a large set of the worlds infrastructure — or even a small project — should be punished in my view. Actors are known, its been stated by the actors as intentional.

I think the Linux Foundation should make an example of this.

Re: “They introduce kernel bugs on purpose”

#460

Post by admax88q » Wed, Apr 21, 2021, 3:15 PM UTC

colechristensen wrote: post #361

arkh wrote: post #342

> I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts. Maybe not being nice is part of the immune system of open source.

I think so. With a large project I think a realist attitude that raises to the level of mean when there’s bullshit around is somewhat necessary to prevent decay. If not you get cluttered up with bad code and people there for the experience. Like how stackoverflow is lost to rule zealots there for the game not for the purpose. Something big and important should be intimidating and isn’t a public service babysitter...

I'm not sure why you think you have to be mean to avoid bad code. Being nice doesn't mean accepting any and all contributions. It just means not being a jerk or _overly_ harsh when rejecting.