“They introduce kernel bugs on purpose” • Hacker News Board

Re: “They introduce kernel bugs on purpose”

#561

Post by endisneigh » Wed, Apr 21, 2021, 3:53 PM UTC

Sanzig wrote: post #552

endisneigh wrote: post #478

Though I disagree with the research in general, if you did want to research "hypocrite commits" in an actual OSS setting, there isn't really any other way to do it other than actually introducing bugs per their proposal. That being said, I think it would've made more sense for them to have created some dummy complex project for a class and have say 80% of the class introduce "good code", 10% of the class review all c…

They could have contacted a core maintainer and explained to them what they planned to do. That core maintainer could have then spoken to other senior core maintainers in confidence (including Greg and Linus) to decide if this type of pentest was in the best interest of Linux and the OSS community at large. That decision would need to weigh the possibility of testing and hardening Linux's security review process agai…

I don't disagree, but the point of the research is more to point out a flaw in how OSS supposedly is conducted, not to actually introduce bugs. If you agree with what they were researching (and I don't) any sort of pre-emptive disclosure would basically contradict the point of their research.

I still think the best thing for them would be to simply create their own project and force their own students to commit, but they probably felt that doing that would be too contrived.

Re: “They introduce kernel bugs on purpose”

#562

Post by capableweb » Wed, Apr 21, 2021, 3:54 PM UTC

runeks wrote: post #548

mosselman wrote: post #380

The tone of Aditya Pakki's message makes me think they would be very well served by reading 'How to Win Friends & Influence People' by Dale Carnegie. This is obviously the complete opposite of how you should be communicating with someone in most situations let alone when you want something from them. I have sure been there though so if anything, take this as a book recommendation for 'How to Win Friends & Influence P…

I’ve seen this book mentioned a couple of times on HN now. I’m curious: did you learn about this book from the fourth season of the Fargo? This is where I encountered it first.

I think it's just a common book to recommend people who seem to be lacking in the "social communication" department. I would know, I got it gifted to me when I was young, angsty and smug.

Re: “They introduce kernel bugs on purpose”

#563

Post by karsinkk » Wed, Apr 21, 2021, 3:54 PM UTC

notdang wrote: post #536

karsinkk wrote: post #521

Here's a clarification from the Researchers over at UMN[1]. They claim that none of the Bogus patches were merged to the Stable code line : >Once any maintainer of the community responds to the email,indicating “looks good”,we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all t…

The main issue here is that it wastes the time of the reviewers and they did not address it in their reply.

Agreed. This feel more like an involuntary social experiment and it just uses up the Kernel maintainers bandwidth. Reviewing code is difficult, even more so when the committer is set out to introduce bad code in the first place.

Re: “They introduce kernel bugs on purpose”

#564

Post by dboreham » Wed, Apr 21, 2021, 3:55 PM UTC

The replies here have been fascinating to read. Yes it's bad that subterfuge was engaged in vs kernel devs. But don't the many comments here expressing outrage at the actions of these researchers sound exactly like the kind of outrage commonly expressed by those in power when their misdeeds are exposed? e.g. Republican politicians outraged at a "leaker" who has leaked details of their illegal activity. It honestly looks to me like the tables have been turned here. Surely the fact that the commonly touted security advantages of OSS have been shown to be potentially fictitious, is at least as worrying as the researchers' ethics breaches?

Re: “They introduce kernel bugs on purpose”

#565

Post by megous » Wed, Apr 21, 2021, 3:56 PM UTC

karsinkk wrote: post #521

Here's a clarification from the Researchers over at UMN[1]. They claim that none of the Bogus patches were merged to the Stable code line : >Once any maintainer of the community responds to the email,indicating “looks good”,we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all t…

How can they be trusted though?

Re: “They introduce kernel bugs on purpose”

#566

Post by ajarmst » Wed, Apr 21, 2021, 3:57 PM UTC

I used to sit on a research ethics board. This absolutely would not have passed such a review. Not a 'revise and resubmit' but a hard pass accompanied with 'what the eff were you thinking?. And, yes, this should have had a REB review: testing the vulnerabilities of a system that includes people is experimenting on human subjects. Doing so without their knowledge absolutely requires a strict human subject review and these "studies" would not pass the first sniff test. I don't think it's even legal in most jurisdictions.

Re: “They introduce kernel bugs on purpose”

#567

Post by FrameworkFred » Wed, Apr 21, 2021, 3:59 PM UTC

This feels like the kind of thing that "white hat" hackers have been doing forever. UMN may have introduced useful knowledge into the world in the same way some random hacker is potentially "helping" a company by pointing out that they've left a security hole exposed in their system.

With that said, kernel developers and companies with servers on the internet are busy doing work that's important to them. This sort of thing is always an unwelcome distraction.

And, if my neighbors walks in my door at 3 a.m. to let me know I left it unlocked, I'm going to treat them the same way UMN is getting treated in this situation. Or worse.

Re: “They introduce kernel bugs on purpose”

#568

Post by megous » Wed, Apr 21, 2021, 3:59 PM UTC

m3kw9 wrote: post #553

rubyn00bie wrote: post #321

This is supremely fucked up and I’d say is borderline criminal. It’s really lucky asshole researchers like this haven’t caused a bug that cost billions of dollars, or killed someone, because eventually shit like this will... and holy shit will “it was just research” do nothing to save them.

So aren’t there tests and code reviews before pushing them to the Stable code base?

Yes, there are. Will they find everything? No. Would I be pissed, if this caused silent corruption of my filesystem, or some such crap that's hard to test, due to this uni trying to push in memory misuse vulnerabilities into the kernel into some obscure driver that is not normally that much tested, but I use it on my SBC farm? Yes.

Maybe they had some plan for immediate revert when the bogus patch got into stable, but some people update stable quickly, for a good reason, and it's just not good to do this research this way.

Re: “They introduce kernel bugs on purpose”

#569

Post by [deleted] » Wed, Apr 21, 2021, 3:59 PM UTC

capableweb wrote: post #559

karsinkk wrote: post #521

Here's a clarification from the Researchers over at UMN[1]. They claim that none of the Bogus patches were merged to the Stable code line : >Once any maintainer of the community responds to the email,indicating “looks good”,we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all t…

In the end, the damage has been done and the Linux developers are now going back and removing all patches from any user with a @umn.edu email. Not sure how the researchers didn't see how this would backfire, but it's a hopeless misuse of their time. I feel really bad for the developers who now have to spend their time fixing shit that shouldn't even be there, just because someone wanted to write a paper and their pee…

[deleted]

Re: “They introduce kernel bugs on purpose”

#570

Post by devenson » Wed, Apr 21, 2021, 4:00 PM UTC

mccr8 wrote: post #473

arkh wrote: post #342

> I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts. Maybe not being nice is part of the immune system of open source.

Being rude isn't going to discourage malicious actors, who are motivated by fame or wealth. If you ran a bank and had a bunch of rude bank tellers, you are only going to dissuade customers, not bank robbers.

Enforcing formal behavior makes the deviant behavior more noticeable.