A university got itself banned from the Linux kernel (2021) • Hacker News Board

Re: A university got itself banned from the Linux kernel (2021)

#21

Post by jovial_cavalier » Tue, Jan 13, 2026, 9:16 PM UTC

arjie wrote: post #11

jovial_cavalier wrote: post #7

Earlier quoted context omitted.

No, random anonymous contributors with cheng3920845823@gmail.com as their email address are not as trustworthy as your wife, and blindly merging PRs from them into some of the most security-critical and widely used code in the entire world without so much as running a static analyzer is not reasonable.

Oh I misunderstood the sections in the article about the umn.edu email stuff. My mistake. The actual course of events: 1. Prof and students make fake identities 2. They submit these secret vulns to Greg KH and friends 3. Some of these patches are accepted 4. They intervene at this point and reveal that the patches are malicious 5. The patches are then not merged 6. This news comes out and Greg KH applies big negative…

>No one likes being cheated out of work that they did, especially when a lot of it is volunteer work.

You know what would really be wasteful of volunteer hours? Instituting a policy whereby the community has to trawl through 20 years of commits from umn.edu addresses and manually review them for vulnerabilities even though you have no reasonable expectation that such commits are likely to contain malicious code and you're actually just butthurt. (they found nothing after weeks of doing this btw)

Re: A university got itself banned from the Linux kernel (2021)

#22

Post by wtallis » Tue, Jan 13, 2026, 9:17 PM UTC

jovial_cavalier wrote: post #18

caycep wrote: post #17

Earlier quoted context omitted.

I mean...there is a whole discussion about the questionable ethics of the research methods in the verge article. And human subjects and issues-of-consent questions aside, they are also messing with a mission critical system (linux kernel), and apparently left crappy code in there for all the maintainers to go back and weed out.

1) once hypocrite commits were accepted, the authors would immediately retract them 2) I don't think it's unethical to send someone an email that has bad code in it. You shouldn't need an IRB to send emails.

> I don't think it's unethical to send someone an email that has bad code in it.

It's unethical because of the bits you left out: sending code you know is bad, and doing so under false pretenses.

Whether or not you think this rises to the level of requiring IRB approval, surely you must be able to understand that wasting people's time like this is going to be viewed negatively by almost anyone. Some people might be willing to accept that doing this harm is worth it for the greater cause of the research, but that doesn't erase the harm done.

Re: A university got itself banned from the Linux kernel (2021)

#23

Post by 9cb14c1ec0 » Tue, Jan 13, 2026, 9:18 PM UTC

The stupid thing about the experiment was that it's never been a secret that the kernel is vulnerable to malicious patches. The kernel community understood this long before these academics wasted kernel maintainer time with a silly experiment.

Re: A university got itself banned from the Linux kernel (2021)

#24

Post by something765478 » Tue, Jan 13, 2026, 9:22 PM UTC

While I did see some problems with their approach (i.e. doing the IRB reviews retroactively instead of doing them ahead of time, and not properly disclosing the experiments afterwards), I think this research is valuable, and I don't think the authors were too unethical. The event that this most reminds me of the Sokal Squared scandal, where researchers sent bogus papers to journals in order to test those journal's peer review standards.

Re: A university got itself banned from the Linux kernel (2021)

#25

Post by AlotOfReading » Tue, Jan 13, 2026, 9:24 PM UTC

jovial_cavalier wrote: post #18

caycep wrote: post #17

Earlier quoted context omitted.

I mean...there is a whole discussion about the questionable ethics of the research methods in the verge article. And human subjects and issues-of-consent questions aside, they are also messing with a mission critical system (linux kernel), and apparently left crappy code in there for all the maintainers to go back and weed out.

1) once hypocrite commits were accepted, the authors would immediately retract them 2) I don't think it's unethical to send someone an email that has bad code in it. You shouldn't need an IRB to send emails.

1) How did they hit stable then? [0]

2) Yes, emails absolutely need IRB sign-off too. If you email a bunch of people asking for their health info or doing a survey, the IRB would smack you for unapproved human research without consent. Consent was obviously not given here.

[0] https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3N...

Re: A university got itself banned from the Linux kernel (2021)

#26

Post by firefax » Tue, Jan 13, 2026, 9:25 PM UTC

something765478 wrote: post #20

paultopia wrote: post #8

Woah, the thing that leapt out at me, as a professor, is that they somehow got an exemption from the UMN institutional review board. Uh, how?? It's clearly human subjects research under the conventional federal definition[1] and obviously posed a meaningful risk of harm, in addition to being conducted deceptively. Someone has to have massively been asleep at the wheel at that IRB. [1] https://grants.nih.gov/policy-an…

I think they should have gotten permission from IRB ahead of time, but this doesn't sound like they were researching human subjects? They were studying the community behind the Linux kernel, and specifically the process for gatekeeping bad changes from making it to the kernel; they weren't experimenting on specific community members. Would you consider it human experimentation if I was running an experiment to see if…

>I think they should have gotten permission from IRB ahead of time, but this doesn't sound like they were researching human subjects?

I assure you that it falls under IRB's purview -- I came into the thread intending to make grandparent's comment. When using deception in a human subjects experiment, there is an additional level of rigor -- you usually need to debrief the participant about said deception, not wait for them to read about it in the press.

(And if a human is reviewing these patches, then yes, it is human subjects research.)

Re: A university got itself banned from the Linux kernel (2021)

#27

Post by firefax » Tue, Jan 13, 2026, 9:27 PM UTC

>Then, there’s the dicier issue of whether an experiment like this amounts to human experimentation. It doesn’t, according to the University of Minnesota’s Institutional Review Board. Lu and Wu applied for approval in response to the outcry, and they were granted a formal letter of exemption.

I had to apply for exemptions often in grad school. You must do so before performing the research -- it is not ethical to wait for outcry then apply after the fact. Any well run CS department trains it's incoming students on IRB procedures during orientation, and Minnesota risks all federal funding if they continue to allow researchers to operate in this manner.

(Also "exempt" usually refers to exempt from the more rigorous level of review used for medical experiments -- you still need to articulate why your experiment is exempt to avoid people just doing whatever they want then asking for forgiveness after the fact)

Re: A university got itself banned from the Linux kernel (2021)

#28

Post by arjie » Tue, Jan 13, 2026, 9:34 PM UTC

yjftsjthsd-h wrote: post #14

arjie wrote: post #11

Earlier quoted context omitted.

Oh I misunderstood the sections in the article about the umn.edu email stuff. My mistake. The actual course of events: 1. Prof and students make fake identities 2. They submit these secret vulns to Greg KH and friends 3. Some of these patches are accepted 4. They intervene at this point and reveal that the patches are malicious 5. The patches are then not merged 6. This news comes out and Greg KH applies big negative…

> 3. Some of these patches are accepted > 4. They intervene at this point and reveal that the patches are malicious > 5. The patches are then not merged It's not clear to me that they revealed anything, just that they did fix the problems: > In their paper, Lu and Wu claimed that none of their bugs had actually made it to the Linux kernel — in all of their test cases, they’d eventually pulled their bad patches and pr…

You know there's a lot of he-said she-said here. The truth is that I was repeating there what they claimed in the paper which is that they intervened prior to merge to mainline.

Re: A university got itself banned from the Linux kernel (2021)

#29

Post by dessimus » Tue, Jan 13, 2026, 9:39 PM UTC

something765478 wrote: post #20

paultopia wrote: post #8

Woah, the thing that leapt out at me, as a professor, is that they somehow got an exemption from the UMN institutional review board. Uh, how?? It's clearly human subjects research under the conventional federal definition[1] and obviously posed a meaningful risk of harm, in addition to being conducted deceptively. Someone has to have massively been asleep at the wheel at that IRB. [1] https://grants.nih.gov/policy-an…

I think they should have gotten permission from IRB ahead of time, but this doesn't sound like they were researching human subjects? They were studying the community behind the Linux kernel, and specifically the process for gatekeeping bad changes from making it to the kernel; they weren't experimenting on specific community members. Would you consider it human experimentation if I was running an experiment to see if…

> Would you consider it human experimentation if I was running an experiment to see if I could get crappy products listed on Amazon, for example?

Yes, if in the course of that experimentation, you also shipped potentially harmful products to buyers of those products "to see if Amazon actually let me".

Re: A university got itself banned from the Linux kernel (2021)

#30

Post by nearlyepic » Tue, Jan 13, 2026, 9:40 PM UTC

something765478 wrote: post #20

paultopia wrote: post #8

Woah, the thing that leapt out at me, as a professor, is that they somehow got an exemption from the UMN institutional review board. Uh, how?? It's clearly human subjects research under the conventional federal definition[1] and obviously posed a meaningful risk of harm, in addition to being conducted deceptively. Someone has to have massively been asleep at the wheel at that IRB. [1] https://grants.nih.gov/policy-an…

I think they should have gotten permission from IRB ahead of time, but this doesn't sound like they were researching human subjects? They were studying the community behind the Linux kernel, and specifically the process for gatekeeping bad changes from making it to the kernel; they weren't experimenting on specific community members. Would you consider it human experimentation if I was running an experiment to see if…

> they weren't experimenting on specific community members.

Yes, they were. What kind of argument is this? If you submit a PR to the kernel you are explicitly engaging with the maintainer(s) of that part of the kernel. That's usually not more than half a dozen people. Seems pretty specific to me.