Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“They introduce kernel bugs on purpose”

lore.kernel.org

Post reply on HN
Print view View original

531–540 of 1001 posts

Re: “They introduce kernel bugs on purpose”

#531

Post by rrss »

forgotpwd16 wrote: post #479

Not wanting to play the devil's advocate here but though scummy, they still successfully introduced vulnerabilities to the kernel. Suppose the paper hadn't been released or an adversary had done it. How long they'll be lingering around if they're ever removed? The paper makes a case that FOSS projects shouldn't merely trust authority for security (neither the ones submitting or the ones reviewing) but utilize tools t…

> utilize tools to find potential vulnerabilities for every commit.

The paper doesn't actually have concrete suggestions for tools, just hand-waving about "use static analysis tools, better than the ones you already use" and "use fuzzers, better than those that already exist."

The work was a stunt to draw attention to the problem of malicious committers. In that regard, it was perhaps successful. The authors' first recommendation is for the kernel community to increase accountability and liability for malicious committers, and GregKH is doing a fantastic job at that by holding umn.edu accountable.

Re: “They introduce kernel bugs on purpose”

#533

Post by closeparen »

This is a community that thinks it’s gross negligence if something with a real name on it fails to be airgapped.

Social shame and reputation damage may be useful defense mechanisms in general, but in a hacker culture where the right to make up arbitrarily many secret identities is a moral imperative, people who burn their identities can just get new ones. Banning or shaming is not going to work against someone with actual malicious intent.

Re: “They introduce kernel bugs on purpose”

#534

Post by sigstoat »

endisneigh wrote: post #478

Though I disagree with the research in general, if you did want to research "hypocrite commits" in an actual OSS setting, there isn't really any other way to do it other than actually introducing bugs per their proposal. That being said, I think it would've made more sense for them to have created some dummy complex project for a class and have say 80% of the class introduce "good code", 10% of the class review all c…

> Though I disagree with the research in general, if you did want to research "hypocrite commits" in an actual OSS setting, there isn't really any other way to do it other than actually introducing bugs per their proposal.

they could've done the much harder work of studying all of the incoming patches looking for bugs, and then just not reporting their findings until the kernel team accepts the patch.

the kernel has a steady stream of incoming patches, and surely a number of bugs in them to work with.

yeah it would've cost more, but would've also generated significant value for the kernel.

Re: “They introduce kernel bugs on purpose”

#536

Post by notdang »

karsinkk wrote: post #521

Here's a clarification from the Researchers over at UMN[1]. They claim that none of the Bogus patches were merged to the Stable code line : >Once any maintainer of the community responds to the email,indicating “looks good”,we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all t…

The main issue here is that it wastes the time of the reviewers and they did not address it in their reply.

Re: “They introduce kernel bugs on purpose”

#539

Post by speedgoose »

zulban wrote: post #394
mort96 wrote: post #348

The previous discussion seems to have suddenly disappeared from the front page: https://news.ycombinator.com/item?id=26887670

Thanks for pointing that out. 4 hours old, 1000+ points, it seems to have been hit with an invisible penalty.

From what I understood, when a new post has a lot of comments, it disappears from the frontpage.
Post reply on HN