UMN CS&E Statement on Linux Kernel Research • Hacker News Board

Re: UMN CS&E Statement on Linux Kernel Research

#31

Post by YetAnotherNick » Wed, Apr 21, 2021, 9:37 PM UTC

cperciva wrote: post #16

The title here should probably be "UMN CSE Department Statement..." rather than merely "UMN Statement ..." since it's coming from the department head and associate department head, not from the university as a whole. cc/ dang

Sorry for getting sidetracked, but does cc has any special function here or you are hoping that dang would read all the comments and see your cc?

Re: UMN CS&E Statement on Linux Kernel Research

#32

Post by res0nat0r » Wed, Apr 21, 2021, 9:39 PM UTC

Being unaware of whatever this is, until this HN post just now, I'm still in the dark as exactly what was being done which was apparently unethical since the statement doesn't mention any details. Anyone have any details on what the issue is?

Re: UMN CS&E Statement on Linux Kernel Research

#33

Post by tolbish » Wed, Apr 21, 2021, 9:39 PM UTC

janoc wrote: post #18

That sounds like someone's academic career has just landed in the toilet ...

I wonder if potential collaborators will come to light, from UMN or other universities.

Re: UMN CS&E Statement on Linux Kernel Research

#34

Post by iasmseanyoung » Wed, Apr 21, 2021, 9:39 PM UTC

I do some maintenance work for the linux kernel dvb and infrared subsystems. I reviewed and accepted some patches from umn.edu addresses. They looked fine to me, however they're all around error handling, which can get pretty tricky with long error paths.

What else can I do than revert the lot?

Re: UMN CS&E Statement on Linux Kernel Research

#35

Post by loeg » Wed, Apr 21, 2021, 9:39 PM UTC

cperciva wrote: post #16

The title here should probably be "UMN CSE Department Statement..." rather than merely "UMN Statement ..." since it's coming from the department head and associate department head, not from the university as a whole. cc/ dang

Title on the webpage is now showing as "Statement from CS&E on Linux Kernel research - April 21, 2021" vs HN's "UMN Statement on Linux Kernel Research."

Re: UMN CS&E Statement on Linux Kernel Research

#36

Post by baxter001 » Wed, Apr 21, 2021, 9:39 PM UTC

background for those unfamiliar with this: https://news.itsfoss.com/hypocrite-commits/

and Kangjie Lu's response: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

Re: UMN CS&E Statement on Linux Kernel Research

#37

Post by nickysielicki » Wed, Apr 21, 2021, 9:39 PM UTC

Now we wait for the IEEE statement.

They will release a statement, right?

Re: UMN CS&E Statement on Linux Kernel Research

#38

Post by loeg » Wed, Apr 21, 2021, 9:40 PM UTC

res0nat0r wrote: post #32

Being unaware of whatever this is, until this HN post just now, I'm still in the dark as exactly what was being done which was apparently unethical since the statement doesn't mention any details. Anyone have any details on what the issue is?

It's still #3 on the front page: https://news.ycombinator.com/item?id=26887670 (and other iterations on the same story earlier today).

Re: UMN CS&E Statement on Linux Kernel Research

#39

Post by 29athrowaway » Wed, Apr 21, 2021, 9:41 PM UTC

Linux is used for very sensitive stuff. Stuff that involves a lot of money.

Messing with Linux is messing with that sensitive stuff, which means messing with important people and organizations. That is something that is very hard to get away with.

That guy just got himself into a legal supernightmare.

If someone is running a stock exchange on Linux and a guy introduces vulnerabilities on purpose, I am sure that person will be pretty upset and pursue litigation.

Re: UMN CS&E Statement on Linux Kernel Research

#40

Post by Isthatablackgsd » Wed, Apr 21, 2021, 9:41 PM UTC

IncRnd wrote: post #14

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.gi…

The department heads just learn of what is happening. They cannot say "we didn't do anything wrong!!!" without investigation because it will make the university in a very negative light (it is a serious ramifications). They need to get all the facts and knowing how it happens and who is responsible for this. So this way they can make a concise action and they will make a proper statement. They are taking "investigation first and comment after" cautiously and seriously.