“They introduce kernel bugs on purpose” • Hacker News Board

Re: “They introduce kernel bugs on purpose”

#521

Post by karsinkk » Wed, Apr 21, 2021, 3:35 PM UTC

Here's a clarification from the Researchers over at UMN[1].

They claim that none of the Bogus patches were merged to the Stable code line :

>Once any maintainer of the community responds to the email,indicating “looks good”,we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all the three cases, maintainers explicitly acknowledged and confirmed to not move forward with the incorrect patches. This way, we ensure that the incorrect patches will not be adopted or committed into the Git tree of Linux.

I haven't been able to find out what the 3 patches which the reference are, but the discussions on Greg's UMN Revert patch [2] does indicate that some of the fixes have indeed been merged to Stable and are actually Bogus.

[1] : https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

[2] : https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

Re: “They introduce kernel bugs on purpose”

#522

Post by mihaaly » Wed, Apr 21, 2021, 3:35 PM UTC

beshrkayali wrote: post #335

This seems like a pretty scummy way to do "research". I mean I understand that people in academia are becoming increasingly disconnected from the real world, but wow this is low. It's not that they're doing this, I'm sure they're not the first to think of this (for research or malicious reasons), but having the gall to brag about it is a new low.

I believe this is violating research ethics hard, very hard. Reminds me if someone was aiming at researching childs' mental development through the study of inflicting mental damages. The subjects and the likely damages are not similar but the approach and mentality are inconveniently so.

Re: “They introduce kernel bugs on purpose”

#523

Post by bluGill » Wed, Apr 21, 2021, 3:36 PM UTC

aritmo wrote: post #385

duxup wrote: post #360

I don't like this university ban approach. Universities are places with lots of different students, professors, and different people with different ideas, and inevitably people who make bad choices. Universities don't often act with a single purpose or intent. That's what makes them interesting. Prone to failure and bad ideas, but also new ideas that you can't do at corporate HQ because you've got a CEO breathing dow…

A university-wide ban helps in converting the issue into an internal issue of that university. The university officials will have to figure out what went wrong and rectify.

Probably not because nobody else at the university is affected, and probably won't be for a dozen more years when someone else happens to get interested in something. Even in CS there are a ton of legitimate projects to work on, so a ban on just one common one isn't going to be noticed without more attention.

Note that I suspect enough people have gotten notice by the press now.

Re: “They introduce kernel bugs on purpose”

#524

Post by knz_ » Wed, Apr 21, 2021, 3:36 PM UTC

The bad actors here should be expelled and deported. The nationalities involved make it clear this is likely a backfired foreign intelligence operation and not just 'research'.

They were almost certainly expecting an obvious bad patch to be reverted while trying to sneak by a less obvious one.

Re: “They introduce kernel bugs on purpose”

#525

Post by Luker88 » Wed, Apr 21, 2021, 3:36 PM UTC

The discussion points link to the github of the research

https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...

It has yet to be published (due next month)

How about opening few bug reports to correctly report the final response of the community and the actual impact?

Not asking to harass them: if anyone should do it, it would be the kernel devs, and I'm not one of them

Re: “They introduce kernel bugs on purpose”

#526

Post by Ar-Curunir » Wed, Apr 21, 2021, 3:37 PM UTC

arkh wrote: post #342

> I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts. Maybe not being nice is part of the immune system of open source.

Instead of not being nice, maybe Linux should adopt some sort of CI and testing infrastructure.

Re: “They introduce kernel bugs on purpose”

#527

Post by [deleted] » Wed, Apr 21, 2021, 3:37 PM UTC

ltfish wrote: post #413

Some clarifications since they are unclear in the original report. - Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&P 2021 paper. - According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kerne…

[deleted]

Re: “They introduce kernel bugs on purpose”

#528

Post by xtorol » Wed, Apr 21, 2021, 3:37 PM UTC

duxup wrote: post #360

I don't like this university ban approach. Universities are places with lots of different students, professors, and different people with different ideas, and inevitably people who make bad choices. Universities don't often act with a single purpose or intent. That's what makes them interesting. Prone to failure and bad ideas, but also new ideas that you can't do at corporate HQ because you've got a CEO breathing dow…

Agree that universities don't (and shouldn't) act with a single purpose or intent, but they need to have institutional controls in place that prevent really bad ideas from negatively affecting the surrounding community. Those seem to be lacking in this case, and in their absence I think the kernel maintainers' actions are entirely justified.

Re: “They introduce kernel bugs on purpose”

#529

Post by oraged » Wed, Apr 21, 2021, 3:37 PM UTC

HelloNurse wrote: post #491

They seem to be teaching social engineering. Using a young, possibly foreign student as a front is a classy touch.

The author of the patches, Aditya Pakki, is a second year PHD student as per his website https://adityapakki.github.io/about/

He himself is to blame for submitting these kind of patches and claiming innocence. If a person as old as him can't figure out what's ethical and what's not, then that person deserves what comes out of actions like these.

Re: “They introduce kernel bugs on purpose”

#530

Post by impalallama » Wed, Apr 21, 2021, 3:38 PM UTC

gruez wrote: post #393

angry_octet wrote: post #384

Research without ethics is research without value. Unbelievable that this could have passed ethics review, so I'd bet it was never reviewed. Big black eye for University of Minnesota. Imagine if you are another doctoral student is CS/EE and this tool has ruined your ability to participate in Linux.

> Research without ethics is research without value. didn't we learn a lot from nazi/japanese experiments from ww2?

By in large no. The Nazi experiments were based on faulty race science and were indistinguishable from brutal torture and what remains is either useless or impossible to reproduce for ethical reasons.