Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“They introduce kernel bugs on purpose”

lore.kernel.org

Post reply on HN
Print view View original

931–940 of 1001 posts

Re: “They introduce kernel bugs on purpose”

#931

Post by fennecs »

They are rightfully worried about old commits? Maybe it's time they switched to a more secure language which can more easily detect malicious code. To be honest C seems critically insecure without a whole lot of work. If a bunch of experts even struggle, seems like they need better tools. Especially since Linux is so important, and there are a lot more threats, Rust seems like a good solution.

Apart from some perhaps critical unsafe stuff which should have a lot of attention, requiring everything to be safe/verified to some extent surely is the answer.

Re: “They introduce kernel bugs on purpose”

#932

Post by haecceity »

gregkh wrote: post #267
rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

Thanks for the support. I also now have submitted a patch series that reverts the majority of all of their contributions so that we can go and properly review them at a later point in time: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

This might not be on purpose. If you look at their article they're studying how to introduce bugs that are hard to detect not ones that are easy to detect.

Re: “They introduce kernel bugs on purpose”

#933

Post by sida »

Let me play devil's advocate here though. This is absolutely necessary and shows the process in the kernel is vulnerable.

Sure, this is "just" a university research project this time. And sure, this is done in bad taste.

But there are legitimately malicious national actors (well, including the US govt and the various 3 letter agencies) that absolutely do this. And the national actors are likely even far more sophisticated than a couple of PhD students. They have the time, resources and energy to do this over a very long period of time.

I think on the whole, this is very net positive in that it reveals the vulnerability of open source kernel development. Despite, how shitty it feels.

Re: “They introduce kernel bugs on purpose”

#934

Post by mikewarot »

sida wrote: post #933

Let me play devil's advocate here though. This is absolutely necessary and shows the process in the kernel is vulnerable. Sure, this is "just" a university research project this time. And sure, this is done in bad taste. But there are legitimately malicious national actors (well, including the US govt and the various 3 letter agencies) that absolutely do this. And the national actors are likely even far more sophisti…

Let me pile on top of that and note that if Linus had listened to his elders and used a Microkernel instead of the monolith, the kernel would be small enough that this kind of thing wouldn't be happening.

Re: “They introduce kernel bugs on purpose”

#937

Post by RogerL »

devit wrote: post #870
gregkh wrote: post #267

Earlier quoted context omitted.

Thanks for the support. I also now have submitted a patch series that reverts the majority of all of their contributions so that we can go and properly review them at a later point in time: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

Well, you or whoever was the responsible maintainer completely failed in reviewing these patches, which is your whole job as a maintainer. Just reverting those patches (which may well be correct) makes no sense, you and/or other maintainers need to properly review them after your previous abject failure at doing so, and properly determine whether they are correct or not, and if they aren't how they got merged anyway…

Greg explicitly stated "Because of this, all submissions from this group must be reverted from the kernel tree and will need to be re-reviewed again to determine if they actually are a valid fix....I will be working with some other kernel developers to determine if any of these reverts were actually valid changes, were actually valid, and if so, will resubmit them properly later. For now, it's better to be safe."

Re: “They introduce kernel bugs on purpose”

#938

Post by NalNezumi »

So the professor in center of this event, Kangjie Lu[0] is also program comitee at IEEE S&P 2021.[1]

I'm by no means an security expert nor a kernel contributor but considering he's program comitee, is these kind of practices a common place in Security/Privacy researchers?

Does idea/practises like this get a pass on conference publishing regularly?

[0] https://www-users.cs.umn.edu/~kjlu/ [1] https://www.ieee-security.org/TC/SP2022/cfpapers.html

Re: “They introduce kernel bugs on purpose”

#940

Post by hnedeotes »

de6u99er wrote: post #875
gregkh wrote: post #267

Earlier quoted context omitted.

Thanks for the support. I also now have submitted a patch series that reverts the majority of all of their contributions so that we can go and properly review them at a later point in time: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

I would be interested how many committers actually work at private and state intelligence?

you know what they say, curiosity killed the cat
Post reply on HN