Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UMN CS&E Statement on Linux Kernel Research

cse.umn.edu

Post reply on HN
Print view View original

231–240 of 332 posts

Re: UMN CS&E Statement on Linux Kernel Research

#231

Post by detaro »

dleslie wrote: post #227
detaro wrote: post #207

Earlier quoted context omitted.

> We will investigate [...] the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, And the associate department head labelling it a failure of the review process: https://twitter.com/lorenterveen/status/1384966202301337603

> To get more specific: CS department leadership didn't know about the back and forth or publicity about this work in December. "_or publicity_" I think that says enough about the U of Mn.

I mean, the "publicity" here was the paper announcement and some arguing on Twitter involving the professor, that's not automatic "department leadership needs to look into this" material. If the IRB didn't find anything, it also didn't have a reason to involve leadership. As said elsewhere, something should probably have been noticed at that point, but they intend to look into that. Seems fair, as long as that's what they do properly.

Re: UMN CS&E Statement on Linux Kernel Research

#232

Post by gumby »

drexlspivey wrote: post #163
gumby wrote: post #57

Earlier quoted context omitted.

Sociology or anthropology. Possibly, though less so, political science, economics, or even a B school. These are all disciplines that study the social behavior of groups. As as study of a group activity it seems inapplicable to a psychology department, though that could be a bias on my part.

How would sociologists and anthropologists know how to write kernel code ..?

Assuming you are not joking, they would presumably partner with someone who does write such code. And similarly for other kinds open source projects.

Re: UMN CS&E Statement on Linux Kernel Research

#233

Post by seoaeu »

notyourday wrote: post #226
seoaeu wrote: post #119

Earlier quoted context omitted.

Firing faculty is oddly difficult, but I do expect they'll take at least some actions

He is an adjunct that just trashed university's reputation. I'm sure it would even fall into firing for cause

Missed the adjunct part... I'm with you on this one.

Re: UMN CS&E Statement on Linux Kernel Research

#234

Post by notyourday »

munk-a wrote: post #223
oivey wrote: post #195

Earlier quoted context omitted.

Maybe practically this doesn’t prevent most students or faculty from doing anything, but it is a huge reputation problem. How many universities (or organizations in general) are banned from contributing to the Linux kernel? When people search for why, they’ll find a research group basically screwing over their collaborators and anyone else who uses Linux. That that exists at UMN could be viewed as a serious cultural…

I feel you're overvaluing the ability to contribute to the linux kernel - this is definitely a bad thing and the university should work to correct the situation. But when I was looking at colleges and universties (for undergrad - I didn't pursue a grad degree) I didn't ever ask if the university was blacklisted by any open source organizations. I don't think anyone would notice this ban - it'd just be an odd curiosit…

> I feel you're overvaluing the ability to contribute to the linux kernel - this is definitely a bad thing and the university should work to correct the situation. But when I was looking at colleges and universties (for undergrad - I didn't pursue a grad degree) I didn't ever ask if the university was blacklisted by any open source organizations.

You are not looking at it the right way. This is an issue for the President and the Provost because of alumni donations.

When the choice is between firing an adjunct/assistant and not getting a 100k from alumni the adjunct/assistant has no chance.

Re: UMN CS&E Statement on Linux Kernel Research

#235

Post by gomijacogeo »

oh_sigh wrote: post #185
g42gregory wrote: post #105

I don't know why, but somehow I am not too bothered by the research itself. Sure, in retrospect, it does not sounds like it was the right thing to do (or the right way to do). But, you know, stuff happens. Instead, what bothered me immensely is the way the PhD student handled that interaction: immediately claiming "bias", "slander", playing "victim", etc... I don't know if he learned such a way to communicate from hi…

It's entirely possible that Aditya is actually just working on a static analysis tool, it is buggy, and he wasn't aware of the other research his advisor does. If that is the case, I can kind of understand his response. I would be pretty upset if I knew I was just trying to submit some honest(if buggy) patches, but was accused of being a scoundrel because of something that didn't even involve me. Of course, it's also…

There does appear to be a static analysis tool.

https://www-users.cs.umn.edu/~kjlu/papers/eecatch.pdf?fbclid...

Still, given that he is 4+ years into a PhD (after a Masters), and has published on this topic before, his first deflection is "We are not experts in the linux kernel" seems disingenuous - kinda like "Hey guys, I'm not malicious, just not good at my job."

Re: UMN CS&E Statement on Linux Kernel Research

#236

Post by andy_ppp »

ac42 wrote: post #208
andy_ppp wrote: post #203

Can someone explain why engineering of bugs into products is bad but hacking to find software defects is good. I think trying to do this sort of research is good because obviously it presents a vector for malicious actors we should all be aware of. It’s good that the Linux team found these issues but I don’t see the intention as being any different than any other kind of hacking, just like some organisations will sen…

Society works because of trust. Activities like these erode trust. It's like "let's try and pour a bottle of acid into the freshwater storage facility".

How do we stop more malicious actors doing things like this is really the question I’m asking. People who aren’t security researchers but say state actors who want Linux backdoors?

Re: UMN CS&E Statement on Linux Kernel Research

#237

Post by a-dub »

tytso wrote: post #224
a-dub wrote: post #167

Earlier quoted context omitted.

so if satya nadella hires security firms to try this on the nt kernel (do they still call it that) and they succeed, then they learn from it, tighten security and process, and then move forward... but if a set of academic researchers try it on the linux kernel, nothing changes and then there's a bunch of internet drama with people calling for them to be fired because why? honestly, i've believed in oss since i encoun…

The more accurate anology would be academic researchers sending graduate students to get hired by Microsoft under false pretenses, and then demonstrates that they can introduce security vulnerabilities that don't get caught by Microsoft's code review practices --- and the submits a paper to the IEEE saying that obviously Microsoft's hiring and software engineering practices could be improved. At least with OSS everyo…

> The more accurate anology would be academic researchers sending graduate students to get hired by Microsoft under false pretenses, and then demonstrates that they can introduce security vulnerabilities that don't get caught by Microsoft's code review practices --- and the submits a paper to the IEEE saying that obviously Microsoft's hiring and software engineering practices could be improved.

sounds good to me! (j/k, sorta)

except here's the key point, and here's where i think the issue is: "...obviously Microsoft's hiring and software engineering practices could be improved"

...this isn't about the people involved being bad at what they do, or them being bad people, or the project being silly in some way. it's about the people, the process they use and the project itself meshing together in an unfortunate way to create a real vulnerability for society. linux is no longer a hobby project. every effort can and should be made to ensure that it is secure as possible as linux is now so pervasive that defects can literally have life and death consequences.

this isn't about some maintainer failing to catch security bugs, this is about the growing influence and criticality of the project and the vulnerability of the project to security bugs, both technically and culturally.

the only real human failure is seeing egos get in the way of improvement.

who am i to be making these arguments? i'm just a nobody. a nobody who has to live in a society that is increasingly being built on this stuff...

Re: UMN CS&E Statement on Linux Kernel Research

#238

Post by ransElectronics »

seoaeu wrote: post #193
ransElectronics wrote: post #112

The researchers, the researcher's bosses and pretty much every person in command at UMN had to sign off on this being an acceptable method of conducting research. This shows such an extreme lack of good faith or judgement on their part that I do not believe UMN could, or should ever be forgiven. Their actions show nothing but criminally bad faith taking place, all the way up to the top. The only rational response fro…

> The researchers, the researcher's bosses and pretty much every person in command at UMN had to sign off on this being an acceptable method of conducting research. That is nothing like how research operates at a university like UMN. At a research university, typically the only person that actually must sign off on a computer science experiment is the grad student / professor actually doing the work. Graduate student…

I am not talking about people actively approving it. I am talking about people passively allowing it to happen. For this mess to have even happened in the first place, the entire workforce at UMN had to look at that and go "yep, there's nothing ethically wrong with this" and just passively let it happen. At best this shows their unchecked desire to destroy OSS projects.

What is their end goal, exactly? I have no idea. The research paper they already put out seems like a charade for whatever that goal was, and we can only speculate.

For this reason nobody can trust anybody working at UMN or anybody getting educated through UMN.

Re: UMN CS&E Statement on Linux Kernel Research

#239

Post by gomijacogeo »

rubidium wrote: post #221
zekrioca wrote: post #173

Authors’ response: https://www-users.cs.umn.edu/%7Ekjlu/papers/clarifications-h...

I don’t understand the news cycle on this. What happened today that lead to the blow-up if this was already public in December ?

I think GregKH complained to the university previously and then, when presented with continuing bad/bad-faith patches, decided to blow up their world very publicly.

Re: UMN CS&E Statement on Linux Kernel Research

#240

Post by alisonkisk »

boomboomsubban wrote: post #100
dpwm wrote: post #81

Earlier quoted context omitted.

I’ve read and re-read that statement, and it seems like the ban is the focus – not what led to the ban. I get that they may not know anything, but there are other ways to word that without admitting liability, making it seem less like the focus is on the ban and more on the allegedly shady stuff.

The focus is rescinding the ban, but they acknowledge that the way to do so is review their actions and set up safeguards to prevent similar things from happening. There's too much bureaucracy involved for them to already publicly review their actions.

The entire statement has only 2 paragraphs, and says absolutely nothing at all about rescinding the ban.
Post reply on HN