Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“They introduce kernel bugs on purpose”

lore.kernel.org

Post reply on HN
Print view View original

881–890 of 1001 posts

Re: “They introduce kernel bugs on purpose”

#881

Post by xwolfi »

rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

I had a uni teacher who thought she was a genius because her research team powdered wikipedia with fake information while timing how long it took to remove them.

"Earth is center of universe" took 1000 years to remove from books, I'm not sure what her point was :D

Re: “They introduce kernel bugs on purpose”

#882

Post by de6u99er »

karlding wrote: post #818

The University of Minnesota's Department of Computer Science and Engineering released a statement [0] and "suspended this line of research". [0] https://cse.umn.edu/cs/statement-cse-linux-kernel-research-a...

Not sure how this university is run but this doesn't sound plausible to me.

>... learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel

And this sounds like mainly a lot of damage control is going to happen.

>We will report our findings back to the community as soon as practical.

Re: “They introduce kernel bugs on purpose”

#883

Post by Khaine »

rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

Interestingly, the Sokal Squared guy got banned from future research for "unauthorized human experimentation".

It's a different university, but I wonder if these people will see the same result.

Re: “They introduce kernel bugs on purpose”

#884

Post by de6u99er »

karsinkk wrote: post #521

Here's a clarification from the Researchers over at UMN[1]. They claim that none of the Bogus patches were merged to the Stable code line : >Once any maintainer of the community responds to the email,indicating “looks good”,we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all t…

It's disrespectful to people who are contributing their personal time while working for free on open source projects.

With more than 60% of all acedemic publications not being reproducible [1], one would think academia has better things to do than wasting other people's time.

[1] https://en.wikipedia.org/wiki/Replication_crisis

Re: “They introduce kernel bugs on purpose”

#885

Post by felixhammerl »

paxys wrote: post #824
whack wrote: post #784

Let me play devil's advocate here. Such pen-testing is absolutely essential to the safety of our tech ecosystem. Countries like Russia, China and USA are without a doubt, doing exactly the same thing that this UMN professor is doing. Except that instead of writing a paper about it, they are going to abuse the vulnerabilities for their own nefarious purposes. Conducting such pen-tests, and then publishing the results…

Pen testing is essential, yes, but there are correct and incorrect ways to do it. This was the latter. In fact attempts like this harm the entire industry because it reflects poorly on researchers/white hat hackers who are doing the right thing. For example, making sure your testing is non-destructive is the bare minimum, as is promptly informing the affected party when you find an exploit. These folks did neither.

Unrelated to the Linux kernel, there is a good example of how Mario Heiderich (probably the most knowledgeable person for XSS on the globe) purposefully introduced an XSS vuln into AngularJS through a patch after (!!!) checking it with the relevant authorities and even then it was a close-ish call: https://m.youtube.com/watch?v=wzrojHHyQwc

Re: “They introduce kernel bugs on purpose”

#886

Post by de6u99er »

bluGill wrote: post #213
rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

If the IRB is any good the professor doesn't get that. Universities are publish or perish, and the IRB should force the withdrawal of all papers they submitted. This is might be enough to fire the professor with cause - including remove any tenure protection they might have - which means they get a bad reference. I hope we hear from the IRB in about a year stating exactly what happened. Real investigations of bad con…

What about IEEE and the peer reviewers who didn't object to their publications?

I think the real problem is rooted more fundamentally in academia than it seems. And I think it has mostly to do with a lack of ethics!

Re: “They introduce kernel bugs on purpose”

#887

Post by x86ARMsRace »

znpy wrote: post #683

I think it's a fair measure, albeit drastic. What happens if any of that patches ends up in a kernel release? It's like setting random houses on fire just to test the responsiveness of local firefighters.

More like replacing random locks with junk in banks and seeing how long until they're discovered.

Re: “They introduce kernel bugs on purpose”

#888

Post by passivate »

bradleyjg wrote: post #599
ltfish wrote: post #413

Some clarifications since they are unclear in the original report. - Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&P 2021 paper. - According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kerne…

It shouldn’t be up to the victim to sort that out. The only thing that could perhaps have changed here is for the university wide ban to have been announced earlier. Perhaps the kernel devs assumed that no one would be so shameless as to continue to send students back to someone they had already abused.

The person in power here is Greg KH. It seems like he can accept/reject/ban anyone for any reason with little recourse for the counter-party. I'm willing to withhold judgement on these allegations until the truth comes out. Seems like many here want retribution before any investigation.

Re: “They introduce kernel bugs on purpose”

#889

Post by de6u99er »

Aissen wrote: post #253

Greg does not joke around: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh... [PATCH 000/190] Revertion of all of the umn.edu commits

>Some of them are not able to be reverted as they already have been reverted, or fixed up with follow-on patches as they were determined to be invalid. Proof that these submissions were almost universally wrong.

Re: “They introduce kernel bugs on purpose”

#890

Post by de6u99er »

kstenerud wrote: post #3
kdbg wrote: post #2

I don't think there have been any recent comments from anyone at U.Mn. So, back when the original research (happened last year) the following clarification was offered by Qiushi Wu and Kangjie Lu which atleast paints their research in somewhat better light: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... That said the current incident seems to have gone beyond the limits of that one and is a new incid…

From their explanation: (3). We send the incorrect minor patches to the Linux community through email to seek their feedback. (4). Once any maintainer of the community responds to the email, indicating “looks good”, we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all the three…

>You do not experiment on people without their consent. This is in fact the very FIRST point of the Nuremberg code:

>1. The voluntary consent of the human subject is absolutely essential.

Does this also apply to scrapping people's data?

Post reply on HN