Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“They introduce kernel bugs on purpose”

lore.kernel.org

Post reply on HN
Print view View original

851–860 of 1001 posts

Re: “They introduce kernel bugs on purpose”

#851

Post by inquisitivemind »

I have a question for this community:

Insofar as this specific method of injecting flaws matches a foreign country's work done on U.S. soil - as many people in this thread have speculated - do people here think that U.S. three letter agencies (in particular NSA/CIA) should have the ability to look at whether the researchers are foreign agents/spies, even though the researchers are operating from the United States? For example, should the three letter agencies have the ability to review these researchers' private correspondence and social graphs?

Insofar as those agencies should have this ability, then, when should they use it? If they do use it, and find that someone is a foreign agent, in what way and with whom should they share their conclusions?

Re: “They introduce kernel bugs on purpose”

#852

Post by marcinzm »

whack wrote: post #784

Let me play devil's advocate here. Such pen-testing is absolutely essential to the safety of our tech ecosystem. Countries like Russia, China and USA are without a doubt, doing exactly the same thing that this UMN professor is doing. Except that instead of writing a paper about it, they are going to abuse the vulnerabilities for their own nefarious purposes. Conducting such pen-tests, and then publishing the results…

> this paper is still a net-positive contribution to society

There's claims that one vulnerability got committed and was not reverted by the research group. In fact the research group didn't even notice that it got committed. So I'd argue that this was a net negative to society because it introduced a live security vulnerability into linux.

Re: “They introduce kernel bugs on purpose”

#854

Post by bsder »

flowerlad wrote: post #832
rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

But this raises an obvious question: Doesn't Linux need better protection against someone intentionally introducing security vulnerabilities? If we have learned anything from the SolarWinds hack, it is that if there is a way to introduce a vulnerability then someone will do it, sooner or later. And they won't publish a paper about it, so that shouldn't be the only way to detect it!

> Doesn't Linux need better protection against someone intentionally introducing security vulnerabilities?

Yes, it does.

Now, how do you do that other than having fallible people review things?

Re: “They introduce kernel bugs on purpose”

#855

Post by spullara »

rzwitserloot wrote: post #181

The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time". That'll be a fun paper to write, no doubt. Additional context: * One of the committers of these faulty patches, Aditya Pak…

Perhaps the Linux kernel team should actively support a Red Team to do this with a notification when it would be merged into the stable branch.

Re: “They introduce kernel bugs on purpose”

#856

Post by ahepp »

wolverine876 wrote: post #721

I don't see the difference between these and other 'hackers', white-hat, black-hat etc. The difference I see is the institution tested, Linux, is beloved here. Usually people are admired here for finding vulnerabilities in all sorts of systems and processes. For example, when someone submits a false paper to a peer-reviewed journal, people around here root for them; I don't see complaints about wasting the time and v…

The outrage and does seem out of place to me. I think it's fair (even reasonable) for the kernel maintainers to ban those responsible, but I'm not sure why everyone here is getting so offended about fairly abstract harms like "wasting the time of the maintainers"

Re: “They introduce kernel bugs on purpose”

#857

Post by theknocker »

tcelvis wrote: post #664
gregkh wrote: post #267

Earlier quoted context omitted.

Thanks for the support. I also now have submitted a patch series that reverts the majority of all of their contributions so that we can go and properly review them at a later point in time: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

Putting the ethical question of the researcher aside, the fact you want to "properly review them at a later point in time" seems to suggest a lack of confidence in the kernel review process. Since this researcher is apparently not an established figure in the kernel community, my expectation is the patches have gone through the most rigorous review process. If you think the risk of malicious patches from this person…

>I've never performed any meaningful debugging or postmortem ever in my life and might not even know how to program at all.

Re: “They introduce kernel bugs on purpose”

#858

Post by 1970-01-01 »

whack wrote: post #784

Let me play devil's advocate here. Such pen-testing is absolutely essential to the safety of our tech ecosystem. Countries like Russia, China and USA are without a doubt, doing exactly the same thing that this UMN professor is doing. Except that instead of writing a paper about it, they are going to abuse the vulnerabilities for their own nefarious purposes. Conducting such pen-tests, and then publishing the results…

An excellent point, however without prior approval and safety mechanisms, they were absolutely malicious in their acts. Treating them as anything but malicious, even if "for the greater good of OSS" sets a horrible precedent. The road to hell is paved with good intentions is the quote that comes to mind. Minnesota got exactly what they deserve.

Re: “They introduce kernel bugs on purpose”

#859

Post by kfarr »

bjornsing wrote: post #836
karlding wrote: post #818

The University of Minnesota's Department of Computer Science and Engineering released a statement [0] and "suspended this line of research". [0] https://cse.umn.edu/cs/statement-cse-linux-kernel-research-a...

They don’t seem all that happy about it. :)

> We take this situation extremely seriously. We have immediately suspended this line of research. yeah those department heads seemed pretty pissed
Post reply on HN