Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open letter from researchers involved in the “hypocrite commit” debacle

lore.kernel.org

Post reply on HN
Print view View original

251–260 of 384 posts

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#251

Post by FridayoLeary »

thanhhaimai wrote: post #154
juliansimioni wrote: post #91

This apology fails from the 5th word: "We sincerely apologize for any harm..." While there are other requirements, a sincere apology cannot in any way entertain doubt about the fact that there WAS harm. Truly acknowledging the harm done is foundational to a real apology, and most of us (myself included) end up sneaking in weasel words or phrases like this. Psychologically, its nice for the apologizer, since it allows…

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html I think it's both unfair and non-constructive to pick apart a apology letter based on one word like that. Let's assume good faith, especially when the writer's English might not be their first language (based on their name).

those guidelines only apply to members of this community. Not an outside article. We should assume all users on hn honour the guidelines. We don't need to assume outside articles do.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#252

Post by mopsi »

genmud wrote: post #147
RcouF1uZ4gsC wrote: post #32

Does the response of the Linux community seem like the response of some corporations when security vulnerabilities are disclosed? In each case, a vulnerability was disclosed. With Linux being used everywhere you can be sure intelligence services etc are likely sending in bad patches. If the Linux kernel requires only patchers with good intentions, and doesn’t have other means of catching this stuff, we are screwed.

Everyone knows that happens. The issue is that these are presumably university funded researchers who intentionally tried to introduce vulnerabilities into the Linux kernel without working with the maintainers. It is fine to perform experiments like this, with permission. I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this. The…

> I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this.

OSS security should not rely on ethics and trust. The default assumption should be that malicious actors are using every dirty tactic they can to get their changes accepted, and that someone@something.edu is no more trustworthy than internal.security.agency@china.gov.cn.

Feels like the OSS community got caught with their pants down and is now overreacting.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#253

Post by squaresmile »

lrvick wrote: post #243

If we don't somehow make it socially acceptable to let any security researchers conduct the required social engineering to test supply chain attack susceptibility of OSS maintainers without tipping them off in advance, dangerous state actors -will- continue to do it and -not- tell anyone when they are successful. Punishing these researchers this harshly about bad manners is creating a chilling effect that will scare…

What's your suggestions on how oss maintainers can fend off state actor attacks? Always need two people to sign off on a patch?

I strongly agree that supply chain attack is a huge deal and worse attacks will come to light eventually but what should be done at the level of oss maintainers?

Like you said, I feel like Open source projects by random solo maintainers that the security of almost everyone on the internet relies on... can't do a lot of things.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#254

Post by gnud »

neatze wrote: post #132
ajarmst wrote: post #128

There are some relatively minor issues with this apology that appear to already have ample discussion here, and I'll not repeat it. I want something more: I want to hear from the sponsoring faculty, research ethics board, and editors of the journal that published the article. There appear to be some systemic issues in addition to the investigators' ill-considered project. How was it that this research, which is clear…

What are your thoughts about this article[0], my reading or article is that; author fails in similar way (to some extent) as researchers and there's IRB in regards to ethics of such research. [0] https://dave-dittrich.medium.com/security-research-ethics-re...

Both this guy, and the researchers themselves (in their article), suggests that the kernel adds "don't submit know-bad patches" to their code of conduct.

So it's sort of hard to take them seriously as human beings, and not just caricatures.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#255

Post by luckylion »

lrvick wrote: post #243

If we don't somehow make it socially acceptable to let any security researchers conduct the required social engineering to test supply chain attack susceptibility of OSS maintainers without tipping them off in advance, dangerous state actors -will- continue to do it and -not- tell anyone when they are successful. Punishing these researchers this harshly about bad manners is creating a chilling effect that will scare…

> If we don't somehow make it socially acceptable to let any security researchers conduct the required social engineering to test supply chain attack susceptibility of OSS maintainers without tipping them off in advance, dangerous state actors -will- continue to do it and -not- tell anyone when they are successful.

What's the result of that? Lots of known bad patches being sent in, wasting everyone's time, because now every researcher finds "do they spot my intentional bugs" as an easy way to get something published?

There's no reason why you can't run these studies with their consent. Ask the maintainers. "But it will tip them off", yeah, in a "they would be aware that somebody might send faulty code at some point in the future" kind of way, which they certainly already are. To get consent, you don't need to tell them exactly when you will be sending it, who will be sending it, or what exactly it would be.

If it did put them into permanent hyper-vigilance mode, then ... goal achieved?

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#256

Post by denton-scratch »

StefanKarpinski wrote: post #79
shash wrote: post #74

Earlier quoted context omitted.

The latest patch adds a null check around a call to gss_release_msg. The commit message says “ The patch adds a check to avoid a potential double free.” According to other people in the conversation, this is already taken care of by reference counting ( https://lore.kernel.org/linux-nfs/20210407153458.GA28924@fie... ) and the patch apparently does nothing. The commit doesn’t reference any specific tool they’re using,…

A later message claims (outraged at being accused of submitting intentionally broken code to the kernel, despite having previously done exactly that) that the patch was generated by a static analysis tool. Ok, what tool? How did you run it? The message where he claims this has since been deleted (by who? Edit: probably never sent to the list, see below) but here is a message from Greg KH which quotes it: https://lore…

My experience of GKH's work isn't generally very favourable; but my estination of him has been increased by this repair. He's created work for himself, but it needed doing. Credit where it's due.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#257

Post by lrvick »

squaresmile wrote: post #253
lrvick wrote: post #243

If we don't somehow make it socially acceptable to let any security researchers conduct the required social engineering to test supply chain attack susceptibility of OSS maintainers without tipping them off in advance, dangerous state actors -will- continue to do it and -not- tell anyone when they are successful. Punishing these researchers this harshly about bad manners is creating a chilling effect that will scare…

What's your suggestions on how oss maintainers can fend off state actor attacks? Always need two people to sign off on a patch? I strongly agree that supply chain attack is a huge deal and worse attacks will come to light eventually but what should be done at the level of oss maintainers? Like you said, I feel like Open source projects by random solo maintainers that the security of almost everyone on the internet re…

Dual cryptographic sign off is exactly what I recommend and have been prototyping tools to make this easier: https://github.com/distrust-foundation/sig

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#259

Post by pdimitar »

lrvick wrote: post #243

If we don't somehow make it socially acceptable to let any security researchers conduct the required social engineering to test supply chain attack susceptibility of OSS maintainers without tipping them off in advance, dangerous state actors -will- continue to do it and -not- tell anyone when they are successful. Punishing these researchers this harshly about bad manners is creating a chilling effect that will scare…

FWIW I completely agree with you but I see no way out.

The Linux kernel project needs and deserves the best security methods but (a) likely can't afford the people and (b) bringing more money aboard might draw unmotivated people only after the paycheck which could objectively deteriorate the project's code quality.

Dual cryptographic signoff still doesn't address any social issues (or I'm grossly misunderstanding it if it does). F. ex. a state actor can threaten or bribe two, five or thirty people into merging a harmful patch.

So what can actually be done?

Post reply on HN