“They introduce kernel bugs on purpose” • Hacker News Board

Re: “They introduce kernel bugs on purpose”

#641

Post by aisio » Wed, Apr 21, 2021, 4:50 PM UTC

One reviewers comments to a patch of theirs from 2 weeks ago

"Plainly put, the patch demonstrates either complete lack of understanding or somebody not acting in good faith. If it's the latter[1], may I suggest the esteemed sociologists to fuck off and stop testing the reviewers with deliberately spewed excrements?"

https://lore.kernel.org/lkml/YH4Aa1zFAWkITsNK@zeniv-ca.linux...

Re: “They introduce kernel bugs on purpose”

#642

Post by protomyth » Wed, Apr 21, 2021, 4:51 PM UTC

FYI The IRB for University of Minnesota https://research.umn.edu/units/irb has a Human Research Protection Program https://research.umn.edu/units/hrpp where I cannot find anything on research on people without their permission. There is a Participant's Bill of Rights https://research.umn.edu/units/hrpp/research-participants/pa... that would seem to indicate uninformed research is not allowed. I would be curious how doing research on the reactions of people to test stimulus in a non-controlled environment is not human research.

Re: “They introduce kernel bugs on purpose”

#643

Post by mistersquid » Wed, Apr 21, 2021, 4:52 PM UTC

beshrkayali wrote: post #335

This seems like a pretty scummy way to do "research". I mean I understand that people in academia are becoming increasingly disconnected from the real world, but wow this is low. It's not that they're doing this, I'm sure they're not the first to think of this (for research or malicious reasons), but having the gall to brag about it is a new low.

This observation may very well get downvoted to oblivion: what UMN pulled is the Linux kernel development version of the Sokal Hoax.

Both are unethical, disruptive, and prove nothing about the integrity of the organizations they target.

Re: “They introduce kernel bugs on purpose”

#644

Post by rurban » Wed, Apr 21, 2021, 4:52 PM UTC

This is the big revert, a good overview of all the damage they did. Some were good, most were malicious, most author names were fantasy.

https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

Re: “They introduce kernel bugs on purpose”

#645

Post by dawnbreez » Wed, Apr 21, 2021, 4:54 PM UTC

logged into my ancient hn account just to tell all of you that pentesting without permission from higher-ups is a bad idea

yes, this is pentesting

Re: “They introduce kernel bugs on purpose”

#646

Post by kml » Wed, Apr 21, 2021, 4:55 PM UTC

Aditya Pakki should be banned from any open source projects. Open source depends on contributors who collectively try to do the right thing. People who purposely try to veer projects off course should face real consequences.

Re: “They introduce kernel bugs on purpose”

#647

Post by soheil » Wed, Apr 21, 2021, 4:55 PM UTC

First thing that comes to mind is The Underhanded C Contest [0] where contestants try to introduce code that looks harmless, but actually is malicious and even if caught should look like an innocent bug at worse.

[0] http://www.underhanded-c.org

Re: “They introduce kernel bugs on purpose”

#648

Post by wglb » Wed, Apr 21, 2021, 4:55 PM UTC

While it is easy to consider this a unsportsmanlike, one might view this as a supply chain attack. I don't particularly support this approach, but consider for a moment that as a defender (in the security team sense), you need to be aware of all possible modes of attack and compromise. While the motives of this class are clear, ascribing to attackers any particular motive is likely to miss.

To the supply chain type of attacks, there isn't an easy answer. Classical methods left both the SolarWinds and Codecov attacks in place for way too many days.

Re: “They introduce kernel bugs on purpose”

#649

Post by ncann » Wed, Apr 21, 2021, 4:55 PM UTC

ltfish wrote: post #413

Some clarifications since they are unclear in the original report. - Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&P 2021 paper. - According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kerne…

I read through that clarification doc. I don't like their experiment but I have to admit their patch submission process is responsible (after receiving a "looks good" for the bad patch, point out the flaw in the patch, give the correct fix and make sure the bad patch doesn't get into the tree).

Re: “They introduce kernel bugs on purpose”

#650

Post by fellellor » Wed, Apr 21, 2021, 4:56 PM UTC

What an effing idiot! And then turn around and claiming bullying! At this point I’m not even surprised. Claiming victimhood is now a very effective move in the US academia these days.