Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

phoronix.com

Post reply on HN
Print view View original

21–30 of 121 posts

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#21

Post by addingnumbers »

atoav wrote: post #11
Foxboron wrote: post #4

Earlier quoted context omitted.

>The thing is there is no way you can actually know that. We do know since the researchers have told the linux community, the university and IEEE what those patches where. Please do not spread further misinformation about the case. Please read the IEEE statement and the full Linux TAB review. https://www.ieee-security.org/TC/SP2021/downloads/2021_PC_St... https://lkml.org/lkml/2021/5/5/1244

Not trying to badmouth the university here, but having to trust the statement of those who broke your trust in the first place doesn't meet my definition of "knowing" something. Maybe "believe" would be better used here? Knowing would mean to know precisely what each of these changes does and whether they open up new vulnerabilities and then having confidence that all is well. Gaining this confidence requires work. A…

80 developers reviewing for a month isn't enough work for you? They just put more man-hours into reviewing these commits than the contributors put into writing them.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#22

Post by finnthehuman »

Foxboron wrote: post #7
4ad wrote: post #5

Earlier quoted context omitted.

Ah, so we're just supposed to trust the same people who tried introducing the vulnerabilities in the first place...

These are not independent malicious actors. These are researchers and students at a University. FUD does not serve any purpose here. And for full disclosure, I'm one of the four authors of the original complaint to IEEE back in December about the research. I fully believe all the facts have been put forth and there is no reason to spread misinformation about the incident.

>These are not independent malicious actors. These are researchers and students at a University.

They wanted to prove that others are too trusting, they got exactly what they wanted: heightened suspicion to things that are normally expected to be done in good faith.

I understand that inside the academic world the status imparted by "researchers and students at a University" is significant and important. For those of us outside the academic world, it's prudent and has no downside for us to drop our perception of them below the floor you'll continue granting them.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#23

Post by wrs »

Just from a code quality process standpoint, that’s an interesting result. Now I’m wondering what would happen if you picked a set of 150 random kernel patches and told 80 reviewers to re-review them assuming they could be malicious. I bet you’d find quite a few fixes.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#24

Post by fartcannon »

addingnumbers wrote: post #21
atoav wrote: post #11

Earlier quoted context omitted.

Not trying to badmouth the university here, but having to trust the statement of those who broke your trust in the first place doesn't meet my definition of "knowing" something. Maybe "believe" would be better used here? Knowing would mean to know precisely what each of these changes does and whether they open up new vulnerabilities and then having confidence that all is well. Gaining this confidence requires work. A…

80 developers reviewing for a month isn't enough work for you? They just put more man-hours into reviewing these commits than the contributors put into writing them.

It'll be interesting to see their next paper, where they describe in great depth how to waste 80 developers time for a month and still sneak in vulnerabilities.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#25

Post by neatze »

atoav wrote: post #11
Foxboron wrote: post #4

Earlier quoted context omitted.

>The thing is there is no way you can actually know that. We do know since the researchers have told the linux community, the university and IEEE what those patches where. Please do not spread further misinformation about the case. Please read the IEEE statement and the full Linux TAB review. https://www.ieee-security.org/TC/SP2021/downloads/2021_PC_St... https://lkml.org/lkml/2021/5/5/1244

Not trying to badmouth the university here, but having to trust the statement of those who broke your trust in the first place doesn't meet my definition of "knowing" something. Maybe "believe" would be better used here? Knowing would mean to know precisely what each of these changes does and whether they open up new vulnerabilities and then having confidence that all is well. Gaining this confidence requires work. A…

> researchers could be totally nice and ethical people.

A thorough review of the IRB documents revealed potential problems in the description of the experiments, and concluded that insufficient details about the experimental study were provided to the IRB. [0]

[0]Read the above linked IEEE response latter.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#26

Post by neatze »

Foxboron wrote: post #18
inetknght wrote: post #15

Earlier quoted context omitted.

> the overreaction from gregkh on the LKML I don't think it was an overreaction. I think it was a very valid reaction.

There are a few issues with blaming someone for sending known malicious patches which just causes confusion and is outright wrong. Brad Spengler is a... character, but I do agree with him that greg started out on this wrong. (He also goes a bit further with his criticism that I don't agree with). However yes, review of the patches was proper but all this could have been done with less unfounded accusations from gregs…

Can you provide specifics what do you mean exactly by unfounded accusations ?

Really curious who makes unfunded accusations ...

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#27

Post by fartcannon »

Foxboron wrote: post #18
inetknght wrote: post #15

Earlier quoted context omitted.

> the overreaction from gregkh on the LKML I don't think it was an overreaction. I think it was a very valid reaction.

There are a few issues with blaming someone for sending known malicious patches which just causes confusion and is outright wrong. Brad Spengler is a... character, but I do agree with him that greg started out on this wrong. (He also goes a bit further with his criticism that I don't agree with). However yes, review of the patches was proper but all this could have been done with less unfounded accusations from gregs…

From the outside, Greg appears to behave like a saint through this enitre process. The university, professors and students involved in this calamity have demonatrated precisely why software developers really need to be bound by ethics.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#28

Post by Foxboron »

neatze wrote: post #26
Foxboron wrote: post #18

Earlier quoted context omitted.

There are a few issues with blaming someone for sending known malicious patches which just causes confusion and is outright wrong. Brad Spengler is a... character, but I do agree with him that greg started out on this wrong. (He also goes a bit further with his criticism that I don't agree with). However yes, review of the patches was proper but all this could have been done with less unfounded accusations from gregs…

Can you provide specifics what do you mean exactly by unfounded accusations ? Really curious who makes unfunded accusations ...

https://lore.kernel.org/linux-nfs/YH5%2Fi7OvsjSmqADv@kroah.c...

And the resulting conversations between Aditya Pakki and Greg. Aditya was never part of the hypocrite commit research, accusing them for this is just bad.

Post reply on HN