Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UMN CS&E Statement on Linux Kernel Research

cse.umn.edu

Post reply on HN
Print view View original

91–100 of 332 posts

Re: UMN CS&E Statement on Linux Kernel Research

#91

Post by zxspectrum1982 »

alexeldeib wrote: post #53
IncRnd wrote: post #42

Earlier quoted context omitted.

> I would argue that first requires investigation. Why do you think that enough of an investigation hasn't been performed in order to understand culpability? Thay already know what happened and want to learn why it was approved. That was what their comment said. Take a look at the actual PDF from the researchers , "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Comm…

The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

From my reading of the threads in the kernel mailing lists, it seems the IRB thought "is it bioscience with experimentation on live animals? No? Then it's all fine".

Re: UMN CS&E Statement on Linux Kernel Research

#92

Post by balozi »

Isthatablackgsd wrote: post #40
IncRnd wrote: post #14

Earlier quoted context omitted.

There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.gi…

The department heads just learn of what is happening. They cannot say "we didn't do anything wrong!!!" without investigation because it will make the university in a very negative light (it is a serious ramifications). They need to get all the facts and knowing how it happens and who is responsible for this. So this way they can make a concise action and they will make a proper statement. They are taking "investigati…

It's worth remembering that this was a repeat offense. They failed to respond to the first complaint.

Re: UMN CS&E Statement on Linux Kernel Research

#93

Post by detaro »

a-dub wrote: post #72
detaro wrote: post #60

Earlier quoted context omitted.

red teaming without approval of the target org is out of fashion, yes.

that helps a bit with regards to understanding why people are so upset about this. but honestly, it seems like valuable research to me. it's unfortunate that it took some time away from busy kernel developers, and it's unfortunate that it ultimately makes the project look worse... ...but isn't that supposed to be part of the promise behind open source? it wouldn't surprise me if i learned that management of private o…

If you wanted to know if the kernel review process is able to reliably catch malicious attempts you literally could have just asked the kernel maintainers and they'd told you that no, review can't go that deep. Or looked at non-malicious bugs and observed that no, review does not catch all bugs with security implications.

You'd very likely would have been able to get code past them even if you told them that there are attempts coming and got their approval.

Given that, you need a good justification why that wasn't enough for you, and what value you truly added over what already was the common view on the issue. But at least we got valuable recommendations from their paper, like "there should be a code of conduct forbidding malicious submissions" and "you could try vetting peoples real identities". (I guess they added to the last bit, giving additional data points that "works at a respected institution in a related field" is not sufficient to establish trust)

Re: UMN CS&E Statement on Linux Kernel Research

#94

Post by mumblemumble »

dpwm wrote: post #81
Zarathust wrote: post #47

Earlier quoted context omitted.

If they really care about being banned, they'll have no choice but to follow thorough

I’ve read and re-read that statement, and it seems like the ban is the focus – not what led to the ban. I get that they may not know anything, but there are other ways to word that without admitting liability, making it seem less like the focus is on the ban and more on the allegedly shady stuff.

I'm not sure how you get that. The ban is mentioned as part of a single sentence that acknowledges the current state of the situation, which seems obligatory, so of course it's there. Then the whole second paragraph is talking about how they're shutting down the activity that led to that situation while they work on getting to the bottom of it.

This seems like an entirely appropriate balance of text and emphasis for a statement that is short and to the point. Which is also appropriate and laudable. Typically when an organization says any more, it's to try and do some spin doctoring.

Re: UMN CS&E Statement on Linux Kernel Research

#95

Post by thatguy0900 »

dporter wrote: post #64
thatguy0900 wrote: post #44

Earlier quoted context omitted.

Your tech department being blackballed from submitting Linux patches is a pretty embarrassing consequence. What else would happen? It's not like anyone will fine them.

Loss of grant money

Oh, true

Re: UMN CS&E Statement on Linux Kernel Research

#96

Post by alexeldeib »

IncRnd wrote: post #61
alexeldeib wrote: post #53

Earlier quoted context omitted.

The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

Yes, but that doesn't have bearing on my comment that was being referenced, that they didn't say what had happened was wrong. Here is Ken Thompson's apropos paper from 1984. [0] [0] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Sure. I was answering your question:

> Why do you think that enough of an investigation hasn't been performed in order to understand culpability?

Re: UMN CS&E Statement on Linux Kernel Research

#98

Post by nolok »

dpwm wrote: post #81
Zarathust wrote: post #47

Earlier quoted context omitted.

If they really care about being banned, they'll have no choice but to follow thorough

I’ve read and re-read that statement, and it seems like the ban is the focus – not what led to the ban. I get that they may not know anything, but there are other ways to word that without admitting liability, making it seem less like the focus is on the ban and more on the allegedly shady stuff.

I entirely disagree.

Not once do they talk about getting the ban removed, instead they talk about figuring out why it happened and how to be better at having research done being ethical.

Was the ban the trigger to them (the heads) looking into it ? Of course since they do already have safeguards and review processes in place, this happened despite those, so they're saying they will investigate them to figure out how this project was validated and make sure to strengthen these processes as needed.

The end goal they give themselves in that message is not a ban removal but "safeguard against future [such] issues".

Re: UMN CS&E Statement on Linux Kernel Research

#99

Post by agf »

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

It is a good statement, and I believe they'll follow through, but it's missing something important that is often missing from otherwise professional communication.

The last line is "We will report our findings back to the community as soon as practical." It should be followed by "and we will provide an update in no more than 30 days".

Without any explicit time frame, holding them publicly accountable becomes trickier. At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more.

Note that the companies that do ongoing incident updates on status sites best all do this -- "We will provide an update by 10:30pm PST".

Re: UMN CS&E Statement on Linux Kernel Research

#100

Post by boomboomsubban »

dpwm wrote: post #81
Zarathust wrote: post #47

Earlier quoted context omitted.

If they really care about being banned, they'll have no choice but to follow thorough

I’ve read and re-read that statement, and it seems like the ban is the focus – not what led to the ban. I get that they may not know anything, but there are other ways to word that without admitting liability, making it seem less like the focus is on the ban and more on the allegedly shady stuff.

The focus is rescinding the ban, but they acknowledge that the way to do so is review their actions and set up safeguards to prevent similar things from happening. There's too much bureaucracy involved for them to already publicly review their actions.
Post reply on HN