Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open letter from researchers involved in the “hypocrite commit” debacle

lore.kernel.org

Post reply on HN
Print view View original

71–80 of 384 posts

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#71

Post by dane-pgp »

sweettea wrote: post #20

To summarize: -they apologize for the three patches in 2020 -they claim asking permission would have defeated their research -they claim the other 200 were legitimate patch attempts (a sample of which were, from my personal reading, from 'innocuous but useless' to 'slightly harmful'). Hard to believe, but plausible.

> they claim asking permission would have defeated their research

But surely this proves malice aforethought. If you interact with someone under false pretences to deliberately mislead them, then you are effectively lying to them. In fact, if you are doing so in order to receive something of value from them (such as their time reviewing your code) then it could even be seen as fraud.

Did they tell their IRB that their research involved deception? Before declaring the project exempt from oversight, the IRB should have required that the researchers answer a question like "Does your research involve interacting with people who are not aware of your project and who would act differently if they were aware?"

Until the IRB process at the university contains at least this level of protection against such ethical failings (not just in Computer Science research but across all areas of study) I think it is right for the kernel team to refuse to interact with members of that institution.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#72

Post by neatze »

gadf wrote: post #67

Contrarian thought: Linux Kernel Community, forever above board, pure, pristine and virtuous, is perhaps eager to cast the first stone against these researcher / activists in order to clean their own clothes by dirtying others, or deflect attention from their own failings? Quick search through the Lore for "problematic" phrases: - site:lkml.org intext:moronic ~ 46 results - site:lkml.org intext:idiotic ~ 278 results…

But you have a choice to interact with community or not to interact with an community, difference is that researcher's of “hypocrite commit” did not give such choice to community members, as of today there is overwhelming indication that this researcher's violated basic and fundamental principles of scientific ethical research.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#73

Post by SquibblesRedux »

shash wrote: post #55
SquibblesRedux wrote: post #44

Whether it is appropriate or not, the Linux kernel is used in many mission critical and essential services. One could very convincingly argue that the open source Linux kernel is a vital part of mission critical infrastructure found all around the world. An apology, likely written under duress, for an inappropriate research method or for consuming the time of maintainers (either volunteer or paid) does not address th…

To be fair, you wouldn’t expect these individual researchers to address the governance question. That should come from the University or the department in question.

Indeed, I agree -- the University of Minnesota should shoulder a degree of responsibility. That is even more so the case given that the researchers do not seem to understand (or clearly acknowledge that they understand) the importance of informed consent in both research and security operations, how much reputational damage (for them and the university) can result from unethical research, and the potential for actual harm to occur when research or security operations are conducted in an exclusively clandestine manner.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#74

Post by shash »

StefanKarpinski wrote: post #53

The thing I’m still missing is a detailed explanation of what the heck was going on with the recent bogus commit that triggered the banning. Supposedly the “hypocrite commit” research was all done in 2020 and is now in the past. So what was going on with this latest bad commit? The student who submitted it claimed it was generated by a static analysis tool, which kernel maintainers have plausibly called bullshit on.…

The latest patch adds a null check around a call to gss_release_msg. The commit message says “ The patch adds a check to avoid a potential double free.”

According to other people in the conversation, this is already taken care of by reference counting (https://lore.kernel.org/linux-nfs/20210407153458.GA28924@fie... ) and the patch apparently does nothing. The commit doesn’t reference any specific tool they’re using, or any bug they faced.

Looks innocuous, but I guess past behaviour from this group left enough of a bad taste for Greg KH to be suspicious.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#75

Post by deagle50 »

astrange wrote: post #56
deagle50 wrote: post #47

Earlier quoted context omitted.

Yep, it's called accountability. Would you prefer people acted without regard for others knowing that magic words can be spoken after the damage is done?

I would prefer you not go around saying someone is "apologizing wrong" because you've found the magic formula to turn all apology text into "I'm sorry you feel bad". There's no point in making a statement like that the original person can't respond to, anyway.

I get what you're saying and I don't want that that either. But I also don't think a simple apology that doesn't attempt to justify one's actions can be so easily flipped.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#76

Post by ENOTTY »

at_a_remove wrote: post #38
sombragris wrote: post #24

I really appreciate the apology and as they stated, its unconditional nature. Good. However, I find something very problematic. This quote shows it: "We have learned some important lessons about research with the open source community from this incident." This is something I don't like. This is not something about "research with the open source community". If anything, they should have learned something about treatin…

Going further, "with" seems like the wrong preposition. "On" seems more accurate.

The professor is not a native English speaker. I’d cut him some slack in minor issues with his word choice.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#77

Post by dane-pgp »

RcouF1uZ4gsC wrote: post #32

Does the response of the Linux community seem like the response of some corporations when security vulnerabilities are disclosed? In each case, a vulnerability was disclosed. With Linux being used everywhere you can be sure intelligence services etc are likely sending in bad patches. If the Linux kernel requires only patchers with good intentions, and doesn’t have other means of catching this stuff, we are screwed.

> the response of some corporations when security vulnerabilities are disclosed

There's a big ethical difference between trying to exploit a piece of commercially produced software, and trying to exploit the time and actions of humans who are producing software which is given away for free.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#78

Post by neatze »

jraph wrote: post #41
january_fanatic wrote: post #25

Looking forward to the follow-up paper, "Open Source Insecurity: Concealing Vulnerabilities via Hypocrite Apologies"

The apology reads sincere to me even if it could be better, but this is for me why it might be very difficult for the Linux community to recover trust in these guys. This, and the previous mail that I found pretty insulting too and seemingly written in bad faith but I'd give the benefit of the doubt, one can react badly to a difficult situation.

I am skeptical if they are sincere, because they did not retracted IEEE paper.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#79

Post by StefanKarpinski »

shash wrote: post #74
StefanKarpinski wrote: post #53

The thing I’m still missing is a detailed explanation of what the heck was going on with the recent bogus commit that triggered the banning. Supposedly the “hypocrite commit” research was all done in 2020 and is now in the past. So what was going on with this latest bad commit? The student who submitted it claimed it was generated by a static analysis tool, which kernel maintainers have plausibly called bullshit on.…

The latest patch adds a null check around a call to gss_release_msg. The commit message says “ The patch adds a check to avoid a potential double free.” According to other people in the conversation, this is already taken care of by reference counting ( https://lore.kernel.org/linux-nfs/20210407153458.GA28924@fie... ) and the patch apparently does nothing. The commit doesn’t reference any specific tool they’re using,…

A later message claims (outraged at being accused of submitting intentionally broken code to the kernel, despite having previously done exactly that) that the patch was generated by a static analysis tool. Ok, what tool? How did you run it? The message where he claims this has since been deleted (by who? Edit: probably never sent to the list, see below) but here is a message from Greg KH which quotes it:

https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah...

You can see that Greg KH is skeptical that the patch was generated by a tool. It’s also unclear to me if the patch is actually harmless or not. It would be good to get some definitive clarity on that but the lkml discussion of it seems inconclusive.

I would add that the student’s tone in this message feels really familiar as an open source maintainer: this is the tone of someone doing something they know is bad being called out on it and trying to deflect with outrage. The last time I got that tone, it was someone who had created multiple sock puppet accounts to try to discredit my project and force moderators to reverse or apologize for a (completely justified and mild) moderation action. So I can’t help but feel that something fishy is going on here and the UMN research group still isn’t being honest about it.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#80

Post by Ygg2 »

true_religion wrote: post #65
sombragris wrote: post #24

I really appreciate the apology and as they stated, its unconditional nature. Good. However, I find something very problematic. This quote shows it: "We have learned some important lessons about research with the open source community from this incident." This is something I don't like. This is not something about "research with the open source community". If anything, they should have learned something about treatin…

I think there is something to be applauded about people who genuinely apologize even though they can't see things from the other person's point of view. They didn't decide to conduct this research on a whim. They had full approval of their university ethics board as well. They published a paper and had it peer reviewed without (as far as I know) anyone immediately calling for their heads. They can't immediately turn…

That only tells me, that there's more garbage than just one individual.

If they lack knowledge of why it was bad, what will prevent them from doing another garbage study next time.

Post reply on HN