UMN CS&E Statement on Linux Kernel Research • Hacker News Board

Re: UMN CS&E Statement on Linux Kernel Research

#291

Post by burnished » Thu, Apr 22, 2021, 8:01 AM UTC

Causality1 wrote: post #117

Traster wrote: post #2

This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.

I disagree. There's not a single word of apology in it.

Too early. The shit storm is less than a day old. You wouldn't accept an insincere apology right? So we shouldn't demand an apology before a sincere one could possibly be issued.

Re: UMN CS&E Statement on Linux Kernel Research

#292

Post by burnished » Thu, Apr 22, 2021, 8:11 AM UTC

oh_sigh wrote: post #185

g42gregory wrote: post #105

I don't know why, but somehow I am not too bothered by the research itself. Sure, in retrospect, it does not sounds like it was the right thing to do (or the right way to do). But, you know, stuff happens. Instead, what bothered me immensely is the way the PhD student handled that interaction: immediately claiming "bias", "slander", playing "victim", etc... I don't know if he learned such a way to communicate from hi…

It's entirely possible that Aditya is actually just working on a static analysis tool, it is buggy, and he wasn't aware of the other research his advisor does. If that is the case, I can kind of understand his response. I would be pretty upset if I knew I was just trying to submit some honest(if buggy) patches, but was accused of being a scoundrel because of something that didn't even involve me. Of course, it's also…

Greg did make it clear that social convention was also violated by delivering a patch, evidently the result of a tool, without stating as such.

Re: UMN CS&E Statement on Linux Kernel Research

#293

Post by burnished » Thu, Apr 22, 2021, 8:15 AM UTC

kapp_in_life wrote: post #253

unanswered wrote: post #213

Earlier quoted context omitted.

Except that patch is clearly BS! You can't patch a double-read vulnerability by checking for a capability; that's not a thing that works. So either the description is wrong, or the patch is wrong, or both. And the point of the reverts is that the kernel maintainers don't have the unlimited time that would be necessary to re-review all of these questionable patches for probable malicious underhanded C, so they are rev…

You don't think reverting a patch from someone whose only relation is working(worked?) at the same university as the advisor initially responsible for the security "research" is overkill? If the goal is to prevent security bugs in mainline then maybe haphazardly reverting everything that doesn't conflict and fixing it later isn't the best approach. I'm disappointed at seeing hackernews jump on this mindless mob justi…

Seems like the problem was from more than one person. This doesn't seem like mob justice, it seems like a pretty measured response to a source of repeat bad faith actors.

Re: UMN CS&E Statement on Linux Kernel Research

#294

Post by thrwaeasddsaf » Thu, Apr 22, 2021, 8:16 AM UTC

alisonkisk wrote: post #250

seanieb wrote: post #192

Hopefully the reviewers that failed to do proper reviews of those patches get relived of their privileges too. And the process gets throughly reviewed to prevent reviews being a glorified rubber stamp process.

I don't think you understand how Linux works. It's run by criminally underfunded volunteers. No one's getting "relieved of their privileges" do to intensely difficult, under-appreciated work.

Maybe they should just kick out all those hobo beggars from red hat, intel, oracle, etc. and get some well compensated professionals on board.

Re: UMN CS&E Statement on Linux Kernel Research

#295

Post by burnished » Thu, Apr 22, 2021, 8:20 AM UTC

kentonv wrote: post #177

tytso wrote: post #78

Earlier quoted context omitted.

gregkh sent a 190 patch series to revert all of the "easy" UMN reverts, pending review. People are now looking at the patches and saying things like, "that's one OK, don't revert". There are another 68 commits which did not revert cleanly, in some cases because they were later fixed up, already reverted, or some other patch has touched those lines of code. This will require further manual work. We basically at this p…

Temporarily banning UMN until they can get their IRB act together makes sense, but wholesale reverting every commit ever made by a UMN e-mail address -- whether affiliated with this research or not -- seems kind of extreme? I'm not sure how many people here understand this, but the University of Minnesota is quite large, over 50,000 people. That's comparable to the entire population of Palo Alto and is larger than MI…

Seems like you might be overvaluing the schools contributions? 50k people is a lot but how many changes were reverted?

Re: UMN CS&E Statement on Linux Kernel Research

#296

Post by burnished » Thu, Apr 22, 2021, 8:29 AM UTC

metanonsense wrote: post #140

To me reverting those hundreds of patches sounds like an overreaction, which might cause actual damage. It's not clear (at least from what I have read in the thread) that this code, which may be wrong or at least useless, is part of any "let's check their patch process" experiment (or did I just miss that?) That they did that in the past is clearly unethical and was generally a shitty thing to do, but this group also…

I'm not sure it's an overeaction on the basis that it's the response to a loss of trust. Why should they maintain a relationship that's been abused?

Re: UMN CS&E Statement on Linux Kernel Research

#297

Post by burnished » Thu, Apr 22, 2021, 8:31 AM UTC

julianlam wrote: post #262

WrtCdEvrydy wrote: post #109

Earlier quoted context omitted.

I blew up at someone in the different thread and got roasted... but I don't understand why you couldn't talk to the team reviewing the patches... Seriously, tell them "we're going to send 10 patches for security review, don't merge any of them, tell us if it's good or not"

I don't want to defend the researcher, but that's not a solution. The way it was done was at least blinded (even if ethically wrong).

What would be wrong with that? It seems like it would have handled the issue of consent pretty straight forwardly.

Re: UMN CS&E Statement on Linux Kernel Research

#298

Post by burnished » Thu, Apr 22, 2021, 8:41 AM UTC

a-dub wrote: post #199

detaro wrote: post #176

Earlier quoted context omitted.

To quote my comment above: > If you wanted to know if the kernel review process is able to reliably catch malicious attempts you literally could have just asked the kernel maintainers and they'd told you that no, review can't go that deep. Or looked at non-malicious bugs and observed that no, review does not catch all bugs with security implications. > You'd very likely would have been able to get code past them even…

> But you don't get splashy outrage, and thus less success at "raising awareness" with people that didn't care before, which is what your comment seemed to argue for. the reason for doing it, is basic quality science. it's proper blinding. the result is raising awareness, which if it leads to more scrutiny and a better and more secure linux kernel, seems to be a good thing... in the long run. i mean, i get it. a lot…

So wait, anyone can run an attack if they publish the results? No matter how senseless, or pointless?

Re: UMN CS&E Statement on Linux Kernel Research

#299

Post by hutzlibu » Thu, Apr 22, 2021, 8:49 AM UTC

seoaeu wrote: post #265

toss1 wrote: post #55

Earlier quoted context omitted.

Yup, it had to be dealt with on an org level, not only the offending person/group. Although it isn't the medical profession, the same directive should apply to research: "First, do no harm." This deliberate poisoning of OS projects without prior permission to 'test the security' violated that big time. I'm astonished it got past any ethics review, indicating to me that there likely was none.

Ah, but you're missing the directive that medicine doesn't have: "If a doctor commits malpractice, immediately disregard all medical advice given to you by any other doctors at their hospital"

If one doctor at a hospital does very bad things - then yes, I would avoid that hospital completely. Because in a working environment, bad actors would be detected by colleagues, etc. And since this not happened, one can only assume the whole hospital to be deeply flawed.

Re: UMN CS&E Statement on Linux Kernel Research

#300

Post by hutzlibu » Thu, Apr 22, 2021, 8:54 AM UTC

locacorten wrote: post #127

I think everybody is missing the point. If one grad student was able to do this, imagine what a team of dozens of well-paid, well-equipped, and highly experienced security experts could do. In other news, we just learned that any half-decent security agency has already injected their own vulnerabilities and back-doors in OSS.

"In other news, we just learned that any half-decent security agency has already injected their own vulnerabilities and back-doors in OSS."

We did not learn that today, but we still assume it.

Btw. the professional agencies have their vulnerabilities injected probably way down in hardware level. Intel ME etc. and or even more bare to the metal.