honestly fsck these "pen testers", spend some time trying to make things better rather than trying to break shit and finger pointing. Starting to feel like pen testing is a broken profession.
These were not pen testers by profession.
Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
81–90 of 121 posts
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#82Isn't the moral of the story here that it's probably trival for organizations like the FSB/NSA/Chinese equivalent to get malicious patches accepted into Linux.
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#83Earlier quoted context omitted.
> that this could be a good pen-test for the kernel Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "suggestions" the researchers made in their paper[1]? They're clueless. It's like pointing out that buildings can be robbed by breaking their windows. No shit. What do you want to do about it? [1] https://twitter.com/SarahJamieLewis/status/13848800341465743...
How else were they supposed to get that much exposure for their tier 2 CS program?
Bother the freedesktop project?
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#84Earlier quoted context omitted.
"ALL the proposals that were intentionally vulnerable and were really vulnerabilities were not accepted" The thing is there is no way you can actually know that. So this is not some kind of revenge. This is rather a valid precaution.
>The thing is there is no way you can actually know that. We do know since the researchers have told the linux community, the university and IEEE what those patches where. Please do not spread further misinformation about the case. Please read the IEEE statement and the full Linux TAB review. https://www.ieee-security.org/TC/SP2021/downloads/2021_PC_St... https://lkml.org/lkml/2021/5/5/1244
>We do know since the researchers have told the linux community, the university and IEEE what those patches where. Please do not spread further misinformation about the case.
We should just trust the liars when they pinky swear to tell the truth? There's a certain saying about what you win when you play shitty games that comes to mind. Being deceptive causes people to lose trust in you.
Or, my personal favorite: fuck around, find out. UMN fucked around, now they're finding out.
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#85Earlier quoted context omitted.
> the overreaction from gregkh on the LKML I don't think it was an overreaction. I think it was a very valid reaction.
The sort of reaction an emperor has upon finding their shiny new clothes don't actually exist. It's bad the tailors sold fake clothes, but it's also bad the emperor and co. didn't notice sooner. Here we saw the emperor go on a full war path against the entire place of origin of a couple of misguided individuals. Not a proportionate response.
The emperor doesn't lack for clothing its just only bulletproof up to a point and a lot of security is actually down to trust and so when an apparently trusted individual walked up and put a rifle to the emperors chest the bullet got through. Nothing of value was learned. Everyone on earth knew a bad patch pushed by a trusted party could potentially get through.
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#86Isn't the moral of the story here that it's probably trival for organizations like the FSB/NSA/Chinese equivalent to get malicious patches accepted into Linux.
They already have malicious backdoors at bios level ref: intel-me
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#87Isn't the moral of the story here that it's probably trival for organizations like the FSB/NSA/Chinese equivalent to get malicious patches accepted into Linux.
[deleted]
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#88Earlier quoted context omitted.
>These are not independent malicious actors. These are researchers and students at a University. They wanted to prove that others are too trusting, they got exactly what they wanted: heightened suspicion to things that are normally expected to be done in good faith. I understand that inside the academic world the status imparted by "researchers and students at a University" is significant and important. For those of…
This situation is in combination with the longstanding disconnect between academic researchers and applied sciences folks. I say “disconnect” as if that were a two way street, but most of the spherical cow thinkers are on the academic side. People doing real work bristle at their lack of exposure to reality. I worked while still in school and the difference was literally and figuratively night and day. I quickly beca…
The fact that this paper was in the best 5% of papers submitted to this IEEE conference[1] tells you all you need to know about academia.
[1] https://www.ieee-security.org/TC/SP2021/downloads/2021_PC_St...
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#89[deleted]
Re: Linux 5.13 Reverts and Fixes the Problematic University of Minnesota Patches
#90Earlier quoted context omitted.
>The thing is there is no way you can actually know that. We do know since the researchers have told the linux community, the university and IEEE what those patches where. Please do not spread further misinformation about the case. Please read the IEEE statement and the full Linux TAB review. https://www.ieee-security.org/TC/SP2021/downloads/2021_PC_St... https://lkml.org/lkml/2021/5/5/1244
I just read that IEEE statement, I'm glad someone else has started noticing the paper was bullshit in addition to unethical: > Investigation of these patches revealed that the description provided by the authors in the paper is ambiguous and in some cases misleading. The experiments do not provide convincing evidence to substantiate the main claims in the paper and the technical contributions of the work need to be r…
Err the PC is already supposed to vet for quality. That they failed to do so adequately is not because the policies omitted that requirement, but probably more because Oakland receives many many submissions