Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open letter from researchers involved in the “hypocrite commit” debacle

lore.kernel.org

Post reply on HN
Print view View original

371–380 of 384 posts

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#371

Post by tmotwu »

shkkmo wrote: post #365
tmotwu wrote: post #290

Earlier quoted context omitted.

> Non-academics get fired for doing unethical things entirely unrelated to their jobs all the time, just to avoid bad publicity. Yes, only if it's unrelated to their jobs. People get hired, not fired, to do unethical research in industry labs. Ethics is breached all the time in industry - rarely even considered. Google tried to make amends, but decided caring too much about ethics was a roadblock to their goals. Tesl…

I wasn't comparing morality of academia and industry, I was making an argument about what are considered a reasonable grounds to calling for someone's firing. If you are trying to argue that publicly funded research institutions don't think ethics are a core part of research, that seems like something that needs to be addressed.

I still do not get your initial point. You argue that firing would be justifiable in industry, e.g. non-academics, yet we don't hear Google or Facebook [1] scientists getting fired for controversially unethical experiments with poor publicity. The research they did was what they were funded by the government to do. So no, your standards for employment doesn't exist anywhere, industry or academia.

And to be more precise, ethics IS a core part of research. There's an entire subfield dedicated to it in academic labs. Graduate research is very specialized, and researchers do not have the intuition for a difficult topic outside of their expertise. Then there are IRBs, who are most qualified, and yet we see it remains a problem for computing ethics because it's a completely different environment.

We can continue to blame this lab, fine. I agree, huge ethical blunder. But don't forget that this passed IRB, a responsibility of the university, and several phases of anonymous peer review for a major security conference. The security conference that most definitely has reviewers from industry. Was there a lapse of judgement on ALL the scientists and engineers, all with immense experience in their respective fields, who touched this paper and participated through the entire process? Do you seriously believe that? Should they all be fired? Is it really hard to believe that computing ethics is actually not as clear, communicated, and well understood to MANY? There are so many caveats, and not much policies of conduct exist for the breadth of situations.

[1] https://www.theatlantic.com/technology/archive/2014/06/every...

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#372

Post by CRConrad »

junon wrote: post #341
kmm wrote: post #266

Earlier quoted context omitted.

Obviously the intent was never to introduce security vulnerabilities, no matter how naive and badly thought-out their methodology was. The intent was to show it could be done. None of the proposed vulnerabilities ever got in the kernel, whenever they were at risk of being accepted, the maintainer was warned and the process was aborted.

Not from what I read. They mentioned there were multiple commits on stable branch.

Yes, but that's among all those previous commits from anyone with a University of Minnesota address that mr Kroah-Hartman ripped out; some going back over a decade ago, others five or six years. AFAICT those were from totally unrelated people, many of whom may not even be there any more, and who had nothing to do with this project. If there are bugs in those, then I think we must conclude that those are "genuine" inadvertent bugs. Unless we were to assume there have been similar research projects there before... Which were never publicised anywhere at all and remain secret to this day? That wouldn't be a research project but genuine black-hat activity. But AFAICS there's no more logical reason to suspect former UMinn contributors of that than any other former contributors.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#373

Post by CRConrad »

29athrowaway wrote: post #3

I was reading this thread... https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh... The Linux kernel team had to revert changes in over 200 files. They will also have to go back and review hundreds of commits to make sure they do not contain any malicious code. The technical effort in addition to all the time spent dealing with the backlash of this is a waste of time for a lot of people doing important work…

> The Linux kernel team had to revert changes in over 200 files.

No, they didn't have to. That seems like quite a bit of an over-reaction by mr Kroah-Hartman.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#374

Post by Igelau »

ddingus wrote: post #141
Igelau wrote: post #57

Earlier quoted context omitted.

> hallmarks of a non-apology Is that a thing? Like there's some non-apology Bingo card you can fill out? I don't see a connection between the criteria you listed and genuine-vs-false contrition. You may perceive these things one way, but ultimately you can't know the minds of others well enough to tell if they are sincere or not about anything. You don't get to just declare yourself the arbiter of their feelings beca…

Does the difficulty of knowing others not put something like this in the court of opinion? I would expect it to be there and would minimize attempts to marginalize my apology with direct, precise, and inclusive language. For every word created or omitted to those ends, the number of negative comments will be reduced. Fact is people take it how they take it and feel what they feel. There really is no "can't" in any of…

I wish I knew.

I tend to have pretty dry affect at certain hours of the day, which has caused considerable frustration for myself and others when I know I'm sincere but they don't. Nor does it make much sense to me for that sort of mind-reading to take place democratically. What do we then gain from it?

At best, you get an apology for a misunderstanding over the previous apology, plus a second draft that the masses might like better. Then you still get that lingering contingent that says "you just did that to placate people! Now we really know you don't mean it!"

The cultural apparatus for "Saving Face" is completely broken on a build failure for missing dependencies.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#375

Post by ufmace »

createdapril24 wrote: post #336
ric2b wrote: post #335

Earlier quoted context omitted.

> 3. Steals a web session, cached password or authentication token, resulting in compromise of employee credentials to be used elsewhere (e.g. reused to access enterprise VPN). How do you do this without a browser vulnerability (and assuming it's not also XSS/CSRF like the previous point)?

You can do this with chains of vulnerabilities, including but not limited to insecure redirects, CSP bypasses, insecure cookies. Another useful technique is session fixation - you give your victims sessions you've started and often their SSO experience will connect _their_ credentials to _your_ session. Also to distinguish between #3 and, XSS in #2 was intended to mean "persistent stored XSS" as opposed to "reflected…

I assume you're right on those techniques, but 2 things:

1. It sounds like they'd have to be pretty well targeted against the precise systems of that particular company in order to work. Which would tend to suggest more targeted spear-phishing attacks and extensive recon being done against the company systems somehow before anybody launched a real black-hat attack.

2. At that point, it feels hard to blame the individual employee versus whoever misconfigured those corporate services in the first place. Though I would guess it's fairly common for those kind of things to happen due to many systems being set up without the help of true experts and the unlikeliness of a real attack against them without either a highly-skilled black hat targeting them or securing the services of a skilled and prices pen test team.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#376

Post by ufmace »

shash wrote: post #74
StefanKarpinski wrote: post #53

The thing I’m still missing is a detailed explanation of what the heck was going on with the recent bogus commit that triggered the banning. Supposedly the “hypocrite commit” research was all done in 2020 and is now in the past. So what was going on with this latest bad commit? The student who submitted it claimed it was generated by a static analysis tool, which kernel maintainers have plausibly called bullshit on.…

The latest patch adds a null check around a call to gss_release_msg. The commit message says “ The patch adds a check to avoid a potential double free.” According to other people in the conversation, this is already taken care of by reference counting ( https://lore.kernel.org/linux-nfs/20210407153458.GA28924@fie... ) and the patch apparently does nothing. The commit doesn’t reference any specific tool they’re using,…

> Looks innocuous, but I guess past behaviour from this group left enough of a bad taste for Greg KH to be suspicious.

The idea of the kind of research they previously did is to submit patch requests with some kind of trick or hidden agenda first, then do some analysis of the results, and then later on publish a paper explaining what they did.

Now here they are again submitting a weird looking and seemingly poorly conceived patch. Who knows what they're really doing? Perhaps they're working on some kind of new paper, with who know what purpose. Maybe they'd find out in 6 months. Maybe it's a failed line of research similar to the previous ones which they won't actually publish. Or maybe they just have no idea what they're doing. Either way, it seems like a waste of time at best. The mass ban and revert sounds like an appropriate move.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#377

Post by jcims »

GordonS wrote: post #301
alanfranz wrote: post #276

Earlier quoted context omitted.

Just clicking the link is enough to fail? No need to enter private info or execute downloaded files? Either your phising emails are badly crafted or you expect employees to see the future.

Megacorp I work at does this. I think I've had around 1 phishing mail per month for the last year or so, and yes, just clicking the link is enough to fail. It's particularly annoying where I work, as the company itself sends out a completely unreasonable amount of internal spam every.single.day - often with bad spelling/grammar, and very often with the contents being a single image with rendered text (why?!?!).

A popular phishing test vendor populates message headers with a very specific word that you can build a mail rule from. In three years it has flawlessly identified every test sent my way with zero false positives.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#378

Post by neatze »

ajarmst wrote: post #332
neatze wrote: post #327

Earlier quoted context omitted.

Out of curiosity, study where humans are deceived about the fact that they are research subjects can be justified in general ? (to me seems like correct answer no) Some relevant cases; the Facebook case[0] suggests it is justified because of EULA, and court determination test[1] is complicated for me to comprehend (to be honest), but seems like most relevant to this discussion. [0] https://www.theatlantic.com/technol…

I'm not qualified to comment on legal issues and contracts. In the case of EULAs, my understanding is that no contract where you surrender fundamental rights is valid or enforceable. But even then, I'd want a lawyers advice before assuming it. And, of course, that's a good argument for reading EULAs very carefully. I've learned over several decades that any simple pronouncement that "X is ethical/unethical" is an eff…

Hopefully you see this, Department response to the Linux Foundation[0], does not matter how I look at it, it does not makes sense to, because deceit requires investigator(s) to participate in the activities being observed[1].

[0] https://drive.google.com/file/d/1z3Nm2bfR4tH1nOGBpuOmLyoJVEi...

[1] https://www.law.cornell.edu/cfr/text/45/46.104#d_2_iii

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#379

Post by createdapril24 »

ufmace wrote: post #375
createdapril24 wrote: post #336

Earlier quoted context omitted.

You can do this with chains of vulnerabilities, including but not limited to insecure redirects, CSP bypasses, insecure cookies. Another useful technique is session fixation - you give your victims sessions you've started and often their SSO experience will connect _their_ credentials to _your_ session. Also to distinguish between #3 and, XSS in #2 was intended to mean "persistent stored XSS" as opposed to "reflected…

I assume you're right on those techniques, but 2 things: 1. It sounds like they'd have to be pretty well targeted against the precise systems of that particular company in order to work. Which would tend to suggest more targeted spear-phishing attacks and extensive recon being done against the company systems somehow before anybody launched a real black-hat attack. 2. At that point, it feels hard to blame the individ…

1. You are correct. I would measure the effort in terms of a small number (1-3) weeks of recon and targeting for a team of two.

2. I agree. Individual employees are not at all to blame. Companies who are blaming their employees for getting phished are doing it wrong. The correct action to take is to inform employees and build the other kinds of mitigations mentioned elsewhere in this topic tree.

Re: Open letter from researchers involved in the “hypocrite commit” debacle

#380

Post by gadf »

gadf wrote: post #358
neatze wrote: post #357

Earlier quoted context omitted.

It is not just bad researchers behavior, it not just unprofessional, it is unacceptable in scientific community, this is an fact, this is where most of outrage is coming from, but at same time similar unethical behavior is legal to a degree[0] in business organization. No one is arguing that any online community perfect, no organization is perfect, but organization imperfections is not a justification for unethical b…

Thanks for repluing. I'll trie to make sense of what you're saying and maybe reply you loiter. Have good doi :)

I guess you think that it's okay for the community to be bad in some way but it's not okay for researchers because science ethics should be higher than community ethics.

It's an interesting perspective I guess it comes from the idea that communities are sort of unstructured and it's not as important that they have ethical standards as high as science because science should be more objective and people need to be able to rely on it and trust it. I guess someone could adopt this perspective that seems to excuse community bad behavior while condemning researchers behavior because they just want to get out of any accountability in this particular case. but I'm assuming that you genuinely feel like this and have had this view from before this particular incident.

I simply disagree with this view, I think everyone should behave well or at least held the same standards.

It also seems that you're (or you were when you commented) very angry and hurt by the actions of the researchers and so I guess that you're probably involved in the Linux kind of in a way and felt betrayed by this action or I had some similar experience with scientific people in the past. I wonder how much the opposite of the community is a result that they were successfully deceived and if they had caught these patches and prevented them from being merged and their reaction may be entirely different even if the research is behavior was the same. But I suspect that would still be outrage because probably a lot of people share your view to some extent but the researchers behaviors should be held to a high standard than their own.

Just seems to me that you're not really open to hearing my point of view on this and that's got nothing to do with the merits of my view it's just where you're at. But because it seems like you're not able to hear my view on this or engage with that I just didn't really feel there was a point to continue the discussion. Have a good one

Post reply on HN