10 ms·

Not a big loss: these professors likely hate open source. [edit: they do not. See child comments.] They are conducting research to demonstrate that it is easy

Not a big loss: these professors likely hate open source. [edit: they do not. See child comments.] They are conducting research to demonstrate that it is easy to introduce bugs in open source... (whereas we know that the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards) [removed this ranting that does not apply since they are contributing a lot to the kernel in good ways too]

throwaway823882 6y ago
> the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards That's not true at all. There are many internet-critical projects with tons of holes that are not found for decades, because nobody except the core team ever looks at the code. You have to actually write tests, do fuzzing, static/memory analysis, etc to find bugs/security holes. Most open source projects don't even have tests. Assuming people are always looking for bugs in FOSS projects is like assuming people are always looking for code violations in skyscrapers, just because a lot of people walk around them.
gspr 6y ago
> It's likely a university with professors that hate open source. This is a ridiculous conclusion. I do agree with the kernel maintainers here, but there is no way to conclude that the researchers in question "hate open source", and certainly not that such an attitude is shared by the university at large.
- henearkr 6y ago
  [Edit: they seem to truly love OSS. See child comments. Sorry for my erroneous judgement. It reminded too much of anti-opensource FUD, I'm probably having PTSD of that time...] I fixed my sentence. I still think that these professors, either genuinely or by lack of willingness, do not understand the mechanism by which free software warrants its greater quality compared to proprietary ones (which is a fact). They just remind me the good old days of FUD against open source by Microsoft and its minions...
  - meepmorp 6y ago
    What papers or statements has this professor made to support that kind of allegation? Can you provide some links or references, please?
    - henearkr 6y ago
      I don't have the name of the professor. [Edited: it seems like they do love OSS and contribute a lot. See child comments.] I had based my consideration on the way they are testing the open-source development model. These professors actually love OSS... but they need to respect kernel maintainers request to stop these "experiments".
      - Pyramus 6y ago
        From the researchers: > In the past several years, we devote most of our time to improving the Linux kernel, and we have found and fixed more than one thousand kernel bugs; the extensive bug finding and fixing experience also allowed us to observe issues with the patching process and motivated us to improve it. Thus, we consider ourselves security researchers as well as OSS contributors. We respect OSS volunteers and honor their efforts. https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... It feels to me you have jumped to an untenable conclusion without even considering their point of view.
        henearkr 6y ago
        Yes. I removed a lot of my ranting accordingly. Thanks, and sorry.
        Pyramus 6y ago
        Thank you, appreciated.
        unanswered 6y ago
        My analysis of that exact same quote was that it was insincere cover to allow them to continue operating an anti-OSS agenda which was made clear in the paper itself.
- theknocker 6y ago
  Seems like a reasonable default assumption to me, until the people repeatedly attempting to sabotage the open source community condescend to -- you know -- stop doing it and then explain wtf they are thinking.
rusticpenn 6y ago
At least in the university where I did my studies, each professor had their own way of thinking and you could not group them into any one basket.
- henearkr 6y ago
  Fair point. I'll just leave my comment as it is. The university administration still bears responsibility in the fact that they waived the IRB.
  - tehwebguy 6y ago
    From the link, not sure if accurate: > Those commits are part of the following research: > https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap... > They introduce kernel bugs on purpose. Yesterday, I took a look on 4 accepted patches from Aditya and 3 of them added various severity security "holes".
    - dash2 6y ago
      Interestingly, that paper states that they introduced 3 patches with bugs, but after acceptance, they immediately notified the maintainers and replaced the patches with correct, bug-free ones. So they claim the bugs never hit any git tree. They also state that their research had passed the university IRB. I don't know if that research relates to what they are doing now, though.
AnIdiotOnTheNet 6y ago
> (whereas we know that the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards) Which is why there have never been multi-year critical security vulnerabilities in FOSS software.... right? Sarcasm aside, because of how FOSS software is packaged on Linux we've seen critical security bugs introduced by package maintainers into software that didn't have them!
- henearkr 6y ago
  You need to compare what happens with vulnerabilities in OSS vs in proprietary. A maintainer pakage is just one more open source software (thus also in need of reviews and audits)... which is why some people prefer upstream-source-based distribs, such as Gentoo, Arch when you use git-based AUR packages, or LFS for the hardcore fans.
  - acdha 6y ago
    > You need to compare what happens with vulnerabilities in OSS vs in proprietary. Yes, you do need to make that comparison. Taking it as a given without analysis is the same as trusting the proprietary software vendors who claim to have robust QA on everything. Security is hard work and different from normal review. The number of people who hypothetically could do it is much greater than the number who actually do, especially if there isn’t an active effort to support that type of analysis. I’m not a huge fan of this professor’s research tactic but I would ask what the odds are that, say, an intelligence agency isn’t doing the same thing but with better concealment. Thinking about how to catch that without shutting down open-source contributions seems like an important problem.
TeMPOraL 6y ago
> Not a big loss: these professors likely hate open source. > They are conducting research to demonstrate that it is easy to introduce bugs in open source... That's a very dangerous thought pattern. "They try to find flaws in a thing I find precious, therefore they must hate that thing." No, they may just as well be trying to identify flaws to make them visible and therefore easier to fix. Sunlight being the best disinfectant, and all that. (Conversely, people trying to destroy open source would not publicly identify themselves as researchers and reveal what they're doing.) > whereas we know that the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards How do we know that? We know things by regularly testing them. That's literally what this research is - checking how likely it is that intentional vulnerabilities are caught during review process.
- henearkr 6y ago
  Auditability is at the core of its advantage over closed development. Submitting bugs is not really testing auditability, which happens over a longer timeframe and involves an order of magnitude more eyeballs. To adress your first critic: benevolence, and assuming everyone wants the best for the project, is very important in these models, because the resources are limited and dependent on enthusiasm. Blacklisting bad actors (even if they have "good reasons" to be bad) is very well justified.
  - idiotsecant 6y ago
    If the model assumes benevolence how can it possibly be viable long-term?
    - henearkr 6y ago
      Like that: malevolent actors are banned as soon as detected.
      - idiotsecant 6y ago
        What do you suppose is the ratio of undetected bad actors / detected bad actors? If it is anything other than zero I think the original point holds.

throwaway823882 6y ago

> the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards That's not true at all. There are many internet-critical projects with tons of holes that are not found for decades, because nobody except the core team ever looks at the code. You have to actually write tests, do fuzzing, static/memory analysis, etc to find bugs/security holes. Most open source projects don't even have tests. Assuming people are always looking for bugs in FOSS projects is like assuming people are always looking for code violations in skyscrapers, just because a lot of people walk around them.

gspr 6y ago

> It's likely a university with professors that hate open source. This is a ridiculous conclusion. I do agree with the kernel maintainers here, but there is no way to conclude that the researchers in question "hate open source", and certainly not that such an attitude is shared by the university at large.

henearkr 6y ago
[Edit: they seem to truly love OSS. See child comments. Sorry for my erroneous judgement. It reminded too much of anti-opensource FUD, I'm probably having PTSD of that time...] I fixed my sentence. I still think that these professors, either genuinely or by lack of willingness, do not understand the mechanism by which free software warrants its greater quality compared to proprietary ones (which is a fact). They just remind me the good old days of FUD against open source by Microsoft and its minions...
- meepmorp 6y ago
  What papers or statements has this professor made to support that kind of allegation? Can you provide some links or references, please?
  - henearkr 6y ago
    I don't have the name of the professor. [Edited: it seems like they do love OSS and contribute a lot. See child comments.] I had based my consideration on the way they are testing the open-source development model. These professors actually love OSS... but they need to respect kernel maintainers request to stop these "experiments".
    - Pyramus 6y ago
      From the researchers: > In the past several years, we devote most of our time to improving the Linux kernel, and we have found and fixed more than one thousand kernel bugs; the extensive bug finding and fixing experience also allowed us to observe issues with the patching process and motivated us to improve it. Thus, we consider ourselves security researchers as well as OSS contributors. We respect OSS volunteers and honor their efforts. https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... It feels to me you have jumped to an untenable conclusion without even considering their point of view.
      - henearkr 6y ago
        Yes. I removed a lot of my ranting accordingly. Thanks, and sorry.
        Pyramus 6y ago
        Thank you, appreciated.
      - unanswered 6y ago
        My analysis of that exact same quote was that it was insincere cover to allow them to continue operating an anti-OSS agenda which was made clear in the paper itself.
theknocker 6y ago
Seems like a reasonable default assumption to me, until the people repeatedly attempting to sabotage the open source community condescend to -- you know -- stop doing it and then explain wtf they are thinking.

rusticpenn 6y ago

At least in the university where I did my studies, each professor had their own way of thinking and you could not group them into any one basket.

henearkr 6y ago
Fair point. I'll just leave my comment as it is. The university administration still bears responsibility in the fact that they waived the IRB.
- tehwebguy 6y ago
  From the link, not sure if accurate: > Those commits are part of the following research: > https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap... > They introduce kernel bugs on purpose. Yesterday, I took a look on 4 accepted patches from Aditya and 3 of them added various severity security "holes".
  - dash2 6y ago
    Interestingly, that paper states that they introduced 3 patches with bugs, but after acceptance, they immediately notified the maintainers and replaced the patches with correct, bug-free ones. So they claim the bugs never hit any git tree. They also state that their research had passed the university IRB. I don't know if that research relates to what they are doing now, though.

AnIdiotOnTheNet 6y ago

> (whereas we know that the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards) Which is why there have never been multi-year critical security vulnerabilities in FOSS software.... right? Sarcasm aside, because of how FOSS software is packaged on Linux we've seen critical security bugs introduced by package maintainers into software that didn't have them!

henearkr 6y ago
You need to compare what happens with vulnerabilities in OSS vs in proprietary. A maintainer pakage is just one more open source software (thus also in need of reviews and audits)... which is why some people prefer upstream-source-based distribs, such as Gentoo, Arch when you use git-based AUR packages, or LFS for the hardcore fans.
- acdha 6y ago
  > You need to compare what happens with vulnerabilities in OSS vs in proprietary. Yes, you do need to make that comparison. Taking it as a given without analysis is the same as trusting the proprietary software vendors who claim to have robust QA on everything. Security is hard work and different from normal review. The number of people who hypothetically could do it is much greater than the number who actually do, especially if there isn’t an active effort to support that type of analysis. I’m not a huge fan of this professor’s research tactic but I would ask what the odds are that, say, an intelligence agency isn’t doing the same thing but with better concealment. Thinking about how to catch that without shutting down open-source contributions seems like an important problem.

TeMPOraL 6y ago

> Not a big loss: these professors likely hate open source. > They are conducting research to demonstrate that it is easy to introduce bugs in open source... That's a very dangerous thought pattern. "They try to find flaws in a thing I find precious, therefore they must hate that thing." No, they may just as well be trying to identify flaws to make them visible and therefore easier to fix. Sunlight being the best disinfectant, and all that. (Conversely, people trying to destroy open source would not publicly identify themselves as researchers and reveal what they're doing.) > whereas we know that the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards How do we know that? We know things by regularly testing them. That's literally what this research is - checking how likely it is that intentional vulnerabilities are caught during review process.

henearkr 6y ago
Auditability is at the core of its advantage over closed development. Submitting bugs is not really testing auditability, which happens over a longer timeframe and involves an order of magnitude more eyeballs. To adress your first critic: benevolence, and assuming everyone wants the best for the project, is very important in these models, because the resources are limited and dependent on enthusiasm. Blacklisting bad actors (even if they have "good reasons" to be bad) is very well justified.
- idiotsecant 6y ago
  If the model assumes benevolence how can it possibly be viable long-term?
  - henearkr 6y ago
    Like that: malevolent actors are banned as soon as detected.
    - idiotsecant 6y ago
      What do you suppose is the ratio of undetected bad actors / detected bad actors? If it is anything other than zero I think the original point holds.