UMN CS&E Statement on Linux Kernel Research • Hacker News Board

Re: UMN CS&E Statement on Linux Kernel Research

#21

Post by MattGaiser » Wed, Apr 21, 2021, 9:32 PM UTC

IncRnd wrote: post #14

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.gi…

I would argue that first requires investigation.

They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.

Re: UMN CS&E Statement on Linux Kernel Research

#22

Post by detaro » Wed, Apr 21, 2021, 9:32 PM UTC

fhars wrote: post #15

detaro wrote: post #9

I found these statements by the associate department head interesting: https://twitter.com/lorenterveen/status/1384955467051454466 > I do work in Social Computing, and this situation is directly analogous to a number of incidents on Wikipedia quite awhile ago that led to that community and researchers reaching an understanding on research methods that are and are not acceptable. and https://twitter.com/lorenterveen/s…

That whole twitter thread is really interesting, starting from https://twitter.com/lorenterveen/status/1384954220705722369

Yes Twitter is "weird" about with sub-thread it picks as the "main" one (well, it choses one and didn't pick the interesting one here), so I had to explicitly link the latter point.

Re: UMN CS&E Statement on Linux Kernel Research

#23

Post by epage » Wed, Apr 21, 2021, 9:33 PM UTC

IncRnd wrote: post #14

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.gi…

I'm up for "wait and see". From an administrative perspective, removed from what is happening, I can see investigating first before admitting fault. I'd much rather people understanding why they were wrong, even if it takes some time.

Re: UMN CS&E Statement on Linux Kernel Research

#24

Post by hn8788 » Wed, Apr 21, 2021, 9:34 PM UTC

IncRnd wrote: post #14

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.gi…

They shouldn't have. This appears to be a pretty clear cut case, but made up outrage-bait has made it to the top of HN before. Investigating claims is the correct thing to do.

Re: UMN CS&E Statement on Linux Kernel Research

#25

Post by tw04 » Wed, Apr 21, 2021, 9:34 PM UTC

mewse-hn wrote: post #8

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

I also think it's a good response but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt. The way their statement stands they can investigate themselves and determine they did nothing wrong, we'll have to see what they say down the road.

>but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt.

I think an apology before they've had a chance to review everything that occurred would be rather empty, don't you? "I'm sorry you're upset"?

I far prefer what they've stated they're going to do which is stop the activity they know about immediately, and to review how we got to this point.

If, on the off chance, the professor was being honest about ensuring they weren't wasting anyone's time, and ensuring no bad code made it into the kernel, then the situation becomes a bit more murky. They'd need to go through all of the associated emails both public and internal to validate that.

If on the other hand this is in fact a duck, I would expect them to both to issue a meaningful apology at that point, as well as lay out the steps they've taken to ensure it doesn't happen again (which they've indicated is their plan). And hopefully restore the trust of the OSS community.

Re: UMN CS&E Statement on Linux Kernel Research

#26

Post by spuz » Wed, Apr 21, 2021, 9:34 PM UTC

gumby wrote: post #13

This kind of research is interesting and important but should not be done by a computer science department, any more than the social science department should try to develop a process control system.

Which department should do it?

Re: UMN CS&E Statement on Linux Kernel Research

#27

Post by bronson » Wed, Apr 21, 2021, 9:35 PM UTC

IncRnd wrote: post #14

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.gi…

It’s too early for that. I expect their followup will have details on failures but first they need to figure out exactly what happened. That will take some time and effort.

At least now they’re burning UMN time and not kernel maintainer time.

Re: UMN CS&E Statement on Linux Kernel Research

#28

Post by evgen » Wed, Apr 21, 2021, 9:35 PM UTC

Animats wrote: post #7

This is starting to snowball. Industry news sites are picking up the story.[1] Hasn't hit the mainstream press yet. No word from DHS Cybersecurity yet. [1] https://www.google.com/search?channel=fs&q=university+of+min...

So far it has only been 'insiders' (FOSS-aware/friendly press and trade press a bit closer to the dev side than the management side) but the real question will be if it hits any large mainstream news sites by tomorrow. If it does not land until Friday then the story is over in terms of real consequences, but the PR team at UMN is probably hoping that fast damage control now can push anything major out a day or two where it disappear into the weekend trash.

Re: UMN CS&E Statement on Linux Kernel Research

#29

Post by detaro » Wed, Apr 21, 2021, 9:36 PM UTC

gumby wrote: post #13

This kind of research is interesting and important but should not be done by a computer science department, any more than the social science department should try to develop a process control system.

No, computer science departments should be adequately equipped and trained to handle this. Lots of areas of computing involve humans and need to be studied by people also knowledgeable about the technical side. (and "computer science" departments usually are not strictly "pure computer science" departments, it's just the usual label under which most of computing ends up)

Re: UMN CS&E Statement on Linux Kernel Research

#30

Post by Will_Do » Wed, Apr 21, 2021, 9:36 PM UTC

I guess the question I have is "Did any *previous* research done by UMN successfully introduce bugs into the Linux Kernel git commit log?"

There are weasel words in this statement that make it unclear and the researchers have been really dishonest already. But! If it's true that their research has never made it out of email chains then it does seem like the reaction is a bit disproportionate to the damages here.