Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

phoronix.com

Post reply on HN
Print view View original

41–50 of 121 posts

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#41

Post by greenwich26 »

The guilt by association here is now approaching Biblical scales. Like the guy in the comments who wants to close down the entire Computer Science and Electrical Engineering departments at UMN, which probably employ/educate the best part of a thousand people. Ha!

In general, the fury and seethe which this experiment inspired is amazing. IMO the real disgrace is not the experiment itself, but the response. The kernel developers need to stop being martyrs and playing blame games. They need to be rational and take responsibility for improving their own procedures. Because, if they didn't already have them, governments now have entire departments studying how to use deliberate vulnerabilities in open source projects, for military intelligence and other purposes. And they will not be deterred by the continued public flogging of the University of Minnesota.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#42

Post by rcxdude »

blumomo wrote: post #6
Foxboron wrote: post #4

Earlier quoted context omitted.

>The thing is there is no way you can actually know that. We do know since the researchers have told the linux community, the university and IEEE what those patches where. Please do not spread further misinformation about the case. Please read the IEEE statement and the full Linux TAB review. https://www.ieee-security.org/TC/SP2021/downloads/2021_PC_St... https://lkml.org/lkml/2021/5/5/1244

"Please do not spread further misinformation about the case." Let's assume that most people are giving their opinions to their best knowledge. We shall be careful when telling someone to stop spreading misinformation as this is how fascism starts. "I am right, you are wrong, stop talking!"

Even when people are giving their opinions to their best knowledge they can be spreading misinformation.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#43

Post by rcxdude »

finnthehuman wrote: post #16
Foxboron wrote: post #4

Earlier quoted context omitted.

>The thing is there is no way you can actually know that. We do know since the researchers have told the linux community, the university and IEEE what those patches where. Please do not spread further misinformation about the case. Please read the IEEE statement and the full Linux TAB review. https://www.ieee-security.org/TC/SP2021/downloads/2021_PC_St... https://lkml.org/lkml/2021/5/5/1244

I just read that IEEE statement, I'm glad someone else has started noticing the paper was bullshit in addition to unethical: > Investigation of these patches revealed that the description provided by the authors in the paper is ambiguous and in some cases misleading. The experiments do not provide convincing evidence to substantiate the main claims in the paper and the technical contributions of the work need to be r…

Yeah, the most hilarious part of the TAB report is that one of the hypocrite commits which was supposed to be incorrect was in fact accidentally correct because the authors failed to understand how the code worked. This was also the only commit which got accepted. This makes the conclusions and way data was presented in the paper extremely questionable.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#44

Post by mimimi31 »

dec0dedab0de wrote: post #36

What is really sad, is that this could be a good pen-test for the kernel. Especially the idea of introducing bugs that are only vulnerabilities when they all come in together. If only they had contacted the Linux Foundation ahead of time to get permission, and set up terms, like a real pen-test. Then work could be done on detecting, and preventing these sorts of attacks, maybe resulting in a system that could help ev…

Why would the Linux Foundation get to decide on if those researchers are allowed to experiment on and waste the time of volunteer developers?

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#45

Post by bombcar »

microtherion wrote: post #38
wrs wrote: post #23

Just from a code quality process standpoint, that’s an interesting result. Now I’m wondering what would happen if you picked a set of 150 random kernel patches and told 80 reviewers to re-review them assuming they could be malicious. I bet you’d find quite a few fixes.

I was wondering the same thing, and it appears it would be worth the effort, but getting enough high quality reviewers would be a problem. Maybe the NCAA could organize competitive code reviewing leagues? I bet you would get e.g. a highly motivated Caltech team reviewing USC contributed patches, and vice versa.

I'd suggest it sounds like a perfect project for some university students, but that may not go over very well right now.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#46

Post by coldpie »

dec0dedab0de wrote: post #36

What is really sad, is that this could be a good pen-test for the kernel. Especially the idea of introducing bugs that are only vulnerabilities when they all come in together. If only they had contacted the Linux Foundation ahead of time to get permission, and set up terms, like a real pen-test. Then work could be done on detecting, and preventing these sorts of attacks, maybe resulting in a system that could help ev…

> that this could be a good pen-test for the kernel

Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "suggestions" the researchers made in their paper[1]? They're clueless.

It's like pointing out that buildings can be robbed by breaking their windows. No shit. What do you want to do about it?

[1] https://twitter.com/SarahJamieLewis/status/13848800341465743...

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#47

Post by belval »

greenwich26 wrote: post #41

The guilt by association here is now approaching Biblical scales. Like the guy in the comments who wants to close down the entire Computer Science and Electrical Engineering departments at UMN, which probably employ/educate the best part of a thousand people. Ha! In general, the fury and seethe which this experiment inspired is amazing. IMO the real disgrace is not the experiment itself, but the response. The kernel…

Most maintainers are volunteer, meaning that they spend their evenings, weekends and holidays developing the kernel because they like it, it gives them a sense of worth and fulfillment that can be hard to come across.

I don't know if you've ever talked to one, but they take a real pride in their work, most make a pitiful salary in comparison to FAANG levels but they still do it because it is full of interesting challenges you can't find anywhere else.

UMN broke that trust. No one is asking the departements to close least of all the maintainers, but you have to understand that kernel devs are not a faceless machine. They spend their limited time on something that is used to make a prodigious amount of money, while never really getting any. In that context they are more than within their rights to be livid.

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#48

Post by blumomo »

rcxdude wrote: post #42
blumomo wrote: post #6

Earlier quoted context omitted.

"Please do not spread further misinformation about the case." Let's assume that most people are giving their opinions to their best knowledge. We shall be careful when telling someone to stop spreading misinformation as this is how fascism starts. "I am right, you are wrong, stop talking!"

Even when people are giving their opinions to their best knowledge they can be spreading misinformation.

Is it forbidden to do mistakes? In such cases is it a good idea to respond to your colleagues with "Please stop doing mistakes!" as the parent did?

Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches

#50

Post by hinkley »

mimimi31 wrote: post #44
dec0dedab0de wrote: post #36

What is really sad, is that this could be a good pen-test for the kernel. Especially the idea of introducing bugs that are only vulnerabilities when they all come in together. If only they had contacted the Linux Foundation ahead of time to get permission, and set up terms, like a real pen-test. Then work could be done on detecting, and preventing these sorts of attacks, maybe resulting in a system that could help ev…

Why would the Linux Foundation get to decide on if those researchers are allowed to experiment on and waste the time of volunteer developers?

The Linux foundation is in a position to ensure that Linux users don’t accidentally get experimented on when the PRs are approved.
Post reply on HN