Authors’ response: https://www-users.cs.umn.edu/%7Ekjlu/papers/clarifications-h...
I don’t understand the news cycle on this. What happened today that lead to the blow-up if this was already public in December ?
UMN CS&E Statement on Linux Kernel Research
221–230 of 332 posts
Re: UMN CS&E Statement on Linux Kernel Research
#222I'm still expecting the: “We apologize again for the fault in the commits. Those responsible for sacking the people who have just been sacked have been sacked.” - UMN CS&E
Re: UMN CS&E Statement on Linux Kernel Research
#223Earlier quoted context omitted.
>They'll lose good students if this is not fixed. "Ability to commit to the Linux kernel with my school email" isn't likely to be a major issue for many. It's a non-issue for undergrad work, and even most grad students are unlikely to be affected. Other than this research, only one other person associated with UMN has committed code to the kernel. This impacts any direct school-sponsored research work, but if some ra…
Maybe practically this doesn’t prevent most students or faculty from doing anything, but it is a huge reputation problem. How many universities (or organizations in general) are banned from contributing to the Linux kernel? When people search for why, they’ll find a research group basically screwing over their collaborators and anyone else who uses Linux. That that exists at UMN could be viewed as a serious cultural…
I feel you're overvaluing the ability to contribute to the linux kernel - this is definitely a bad thing and the university should work to correct the situation. But when I was looking at colleges and universties (for undergrad - I didn't pursue a grad degree) I didn't ever ask if the university was blacklisted by any open source organizations.
I don't think anyone would notice this ban - it'd just be an odd curiosity and impediment to any student that tried to submit a patch... that is assuming it doesn't hit the main news circuit.... But, if I hear about this on Colbert tonight I'll be amazed.
The fact that the FBI raided Steve Jackson Games[1] over GURPS: Cyberpunk is, I think, completely absent from general public knowledge at this point - even though that incident[2] led to the creation of the EFF which most folks on HN will certainly be familiar with. Notoriety is a fickle thing and no matter how negative the incident is it'll usually either fade into nothingness or give a positive boost to the organization - this is where the concept of "there's no such thing as bad press" comes from. I, at least, am far more aware of UMN now than I was this morning.
2. There's some disagreement over how central this incident was to the EFF's foundation, but from what I've read it was pretty darn central.
Re: UMN CS&E Statement on Linux Kernel Research
#224Earlier quoted context omitted.
No development model is protected from malicious actors, and this is not unique to OSS. Could the Ministry of State Security sponsor a student to study at the US, and then after graduate, that student gets a job at Microsoft, and then introduces vulnerabilities in Windows? In theory all patches should get code reviews, but could someone get a bug past code reivew? Sure! You can try to detect it before it happens, but…
so if satya nadella hires security firms to try this on the nt kernel (do they still call it that) and they succeed, then they learn from it, tighten security and process, and then move forward... but if a set of academic researchers try it on the linux kernel, nothing changes and then there's a bunch of internet drama with people calling for them to be fired because why? honestly, i've believed in oss since i encoun…
The more accurate anology would be academic researchers sending graduate students to get hired by Microsoft under false pretenses, and then demonstrates that they can introduce security vulnerabilities that don't get caught by Microsoft's code review practices --- and the submits a paper to the IEEE saying that obviously Microsoft's hiring and software engineering practices could be improved.
At least with OSS everyone can audit the code, and run their own security scanners on the open source code. If you think that somehow proprietary software is magically protected against the insider threat, you're kidding yourself. Even the NSA couldn't protect against an inside like Snowden.
Re: UMN CS&E Statement on Linux Kernel Research
#225Earlier quoted context omitted.
> The research method used raised serious concerns in the Linux Kernel community and, as of today, this has resulted in the University being banned from contributing to the Linux Kernel. > We take this situation extremely seriously. I think it’s because the last bit of the first paragraph – the ban – flows onto the second paragraph – the situation. Once you’ve had the two linked, it’s like one of those ambiguous opti…
> I think it’s because the last bit of the first paragraph – the ban – flows onto the second paragraph – the situation. So, as long as you ignore the formatting they presented it with and decide to read it without it, you can come to a different conclusion? I don't think contortions such as that to link sentences is fair, nor the fault of the organization that put forth for a statement specifically separating them .
> So, as long as you ignore the formatting they presented it with and decide to read it without it, you can come to a different conclusion?
No. It reads that way with the formatting they provided. You can’t take that paragraph break out without putting one back exactly there. It’s refreshingly transparent, and perfect if you expect them not to care about the underlying cause as much as they care about the ban.
> I don't think contortions such as that to link sentences is fair, nor the fault of the organization that put forth for a statement specifically separating them.
It’s not a contortion, it’s just how it reads to me. I’m not taking some deliberately contrarian stance – I was really quite shocked at the multiple comments saying how great the statement was when it inadvertently or otherwise conveyed the very message I believe they should have avoided – the one where they simply do the least they need to do to get unbanned, which may well be closer to the real objective. It’s the difference between being shamed into action and recognising why action is necessary.
I would not want to be the person to have to write such a statement
Re: UMN CS&E Statement on Linux Kernel Research
#226Earlier quoted context omitted.
They have just learned about the details of the research conducted: > Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel. I'm going to say that the odds are that the faculty member in question is not going to be a faculty member anymo…
Firing faculty is oddly difficult, but I do expect they'll take at least some actions
He is an adjunct that just trashed university's reputation. I'm sure it would even fall into firing for cause
Re: UMN CS&E Statement on Linux Kernel Research
#227The university's ethics committee approved the research, and it was guided by a number of their professors. I see no acknowledgement of this in the statement; instead, I see the groundwork laid for hanging the students out to dry. > The research method used raised serious concerns in the Linux Kernel community and, as of today, this has resulted in the University being banned from contributing to the Linux Kernel. Th…
> We will investigate [...] the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, And the associate department head labelling it a failure of the review process: https://twitter.com/lorenterveen/status/1384966202301337603
> To get more specific: CS department leadership didn't know about the back and forth or publicity about this work in December.
"_or publicity_"
I think that says enough about the U of Mn.
Re: UMN CS&E Statement on Linux Kernel Research
#228Earlier quoted context omitted.
So far it has only been 'insiders' (FOSS-aware/friendly press and trade press a bit closer to the dev side than the management side) but the real question will be if it hits any large mainstream news sites by tomorrow. If it does not land until Friday then the story is over in terms of real consequences, but the PR team at UMN is probably hoping that fast damage control now can push anything major out a day or two wh…
Your tech department being blackballed from submitting Linux patches is a pretty embarrassing consequence. What else would happen? It's not like anyone will fine them.
> Your tech department being blackballed from submitting Linux patches is a pretty embarrassing consequence. What else would happen? It's not like anyone will fine them.
The ban could affect donations from alumni or corporations.
Re: UMN CS&E Statement on Linux Kernel Research
#229Earlier quoted context omitted.
> We will investigate [...] the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, And the associate department head labelling it a failure of the review process: https://twitter.com/lorenterveen/status/1384966202301337603
> To get more specific: CS department leadership didn't know about the back and forth or publicity about this work in December. "_or publicity_" I think that says enough about the U of Mn.
[deleted]
Re: UMN CS&E Statement on Linux Kernel Research
#230Earlier quoted context omitted.
> I think it’s because the last bit of the first paragraph – the ban – flows onto the second paragraph – the situation. So, as long as you ignore the formatting they presented it with and decide to read it without it, you can come to a different conclusion? I don't think contortions such as that to link sentences is fair, nor the fault of the organization that put forth for a statement specifically separating them .
> So, as long as you ignore the formatting they presented it with and decide to read it without it, you can come to a different conclusion? No. It reads that way with the formatting they provided. You can’t take that paragraph break out without putting one back exactly there. It’s refreshingly transparent, and perfect if you expect them not to care about the underlying cause as much as they care about the ban. > I do…
> You can’t take that paragraph break out without putting one back exactly there.
Exactly. And paragraphs are used to separate concepts and statements into conceptual units. That you're letting a concept and interpretation from one apply to and influence the reading of another as if there is no break is the problem.
> It’s not a contortion, it’s just how it reads to me.
I think you have some interesting ideas of how to read. I don't think that follows necessarily for the majority of other people, and I don't think that's what was intended by the writer.
At he same time, I'm not entirely surprised. This is why writing is hard, and sometimes thankless. Regardless of intention and how clear you think you're being, someone will always read it otherwise. It's just the nature of the medium, to some degree. It can happen through something like this, where you're inferring intent across boundaries where I think that boundary is intended to clearly separate it, and it can happen if they are absolutely literally clear and denounce other stances, because people will read those denouncements as indicators of the opposite, as crazy as that sounds ("The lady doth protest too much, methinks").
I think you're better off taking a separate paragraph for what it usually meant to be. A way to separate statements so they are clearly distinct.