Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“They introduce kernel bugs on purpose”

lore.kernel.org

Post reply on HN
Print view View original

861–870 of 1001 posts

Re: “They introduce kernel bugs on purpose”

#861

Post by re »

shakna wrote: post #670
ltfish wrote: post #413

Some clarifications since they are unclear in the original report. - Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&P 2021 paper. - According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kerne…

> According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kernel. The three attempts did not even become Git commits. Except that at least one of those three, did [0]. The author is incorrect that none of their attempts became git commits. Whatever process that they used to "check different versions of Linux and further confirmed that none of the incorrect patches was ado…

> The author is incorrect that none of their attempts became git commits

That doesn't appear to be one of the three patches from the "hypocrite commits" paper, which were reportedly submitted from pseudononymous gmail addresses. There are hundreds of other patches from UMN, many from Pakki[0], and some of those did contain bugs or were invalid[1], but there's currently no hard evidence that Pakki was deliberately making bad-faith commits--just the association of his advisor being one of the authors of the "hypocrite" paper.

[0] https://github.com/torvalds/linux/commits?author=pakki001@um...

[1] Including his most recent that was successfully applied: https://lore.kernel.org/lkml/YH4Aa1zFAWkITsNK@zeniv-ca.linux...

Re: “They introduce kernel bugs on purpose”

#863

Post by totalZero »

eatbitseveryday wrote: post #419
motohagiography wrote: post #314

This isn't friendly pen-testing in a community, this is an attack on critical infrastructure using a university as cover. The foundation should sue the responsible profs personally and seek criminal prosecution. I remember a bunch of U.S. contractors said they did the same thing to one of the openbsd vpn library projects about 15 years ago as well. What this professor is proving out is that open source and (likely, o…

> The foundation should sue the responsible profs personally and seek criminal prosecution. This is overkill and uncalled for.

How exactly is a lawsuit overkill? If the researchers are in the right, the court will find in their favor.

Re: “They introduce kernel bugs on purpose”

#864

Post by GRBurst »

Actually I do understand BOTH sides, BUT:

The way the university did this tests and the reactions afterwards are just bad.

What I see here and what the Uni of Minnesota seem to neglected is: 1. Financial damage (time is wasted) 2. Ethical reasons of experimenting with human beings

As a result, the University should give a clear statement on both and should donate a generous amount of on money for compensation of (1.)

For part (2.), a simple bit honest apology can do wonders!

---

Having said that, I think there are other and ethically better ways to achieve these measurement.

Re: “They introduce kernel bugs on purpose”

#865

Post by danielbot »

corty wrote: post #850
flowerlad wrote: post #832

Earlier quoted context omitted.

But this raises an obvious question: Doesn't Linux need better protection against someone intentionally introducing security vulnerabilities? If we have learned anything from the SolarWinds hack, it is that if there is a way to introduce a vulnerability then someone will do it, sooner or later. And they won't publish a paper about it, so that shouldn't be the only way to detect it!

That question has been obvious for quite some time. It is always possible to introduce subtle vulnerabilities. Research has tried for decades to come up with a solution, to no real avail.

Assassinating the researchers doesn't help.

Re: “They introduce kernel bugs on purpose”

#866

Post by up2isomorphism »

From an outsider, the main question is: does this expose an actual weakness in the Linux development model?

From what I understand, this answer seems to be a "yes".

Of course, it is understandable that GKH is frustrated, and if his community do not like someone pointing out this issue, it is OK too.

However, one researcher does not represent the whole university, so it seems immature to vent this to other unrelated people just because you can.

Re: “They introduce kernel bugs on purpose”

#868

Post by colinmhayes »

dm319 wrote: post #799
whack wrote: post #784

Let me play devil's advocate here. Such pen-testing is absolutely essential to the safety of our tech ecosystem. Countries like Russia, China and USA are without a doubt, doing exactly the same thing that this UMN professor is doing. Except that instead of writing a paper about it, they are going to abuse the vulnerabilities for their own nefarious purposes. Conducting such pen-tests, and then publishing the results…

The world works better without everyone being untrusting of everyone else, and this is especially true of large collaborative projects. The same goes in science - it has been shown over and over again that if researchers submit deliberately fraudulent work, it is unlikely to be picked up by peer review. Instead, it is simply deemed as fraud, and researchers that do that face heavy consequences, including jail time. W…

If that's the model Linux uses there's no doubt in my mind that the US, China, and probably Russia have vulnerabilities in the kernel.

Re: “They introduce kernel bugs on purpose”

#869

Post by space_rock »

up2isomorphism wrote: post #866

From an outsider, the main question is: does this expose an actual weakness in the Linux development model? From what I understand, this answer seems to be a "yes". Of course, it is understandable that GKH is frustrated, and if his community do not like someone pointing out this issue, it is OK too. However, one researcher does not represent the whole university, so it seems immature to vent this to other unrelated p…

The university has an ethics board to review experiments. So what experiments get allowed reflects on the whole university

Re: “They introduce kernel bugs on purpose”

#870

Post by devit »

gregkh wrote: post #267
rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

Thanks for the support. I also now have submitted a patch series that reverts the majority of all of their contributions so that we can go and properly review them at a later point in time: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

Well, you or whoever was the responsible maintainer completely failed in reviewing these patches, which is your whole job as a maintainer.

Just reverting those patches (which may well be correct) makes no sense, you and/or other maintainers need to properly review them after your previous abject failure at doing so, and properly determine whether they are correct or not, and if they aren't how they got merged anyway and how you will stop this happening again.

Or I suppose step down as maintainers, which may be appropriate after a fiasco of this magnitude.

Post reply on HN