4 ms·

As a user of the linux kernel, I feel legal action against the "researchers" should be pursued.

by throwawayffffas 6y ago

Avamander 6y ago
Your feelings do not invalidate the results unfortunately.
- AntiImperialist 6y ago
  In a fairer country, they would be hanged.
jnxx 6y ago
I feel somewhat similar. Since I am using Linux, they ultimately were trying to break the security of my computers. If I do that with any company without their consent, I can easily end up in jail.
- foobar33333 6y ago
  >they ultimately were trying to break the security of my computers. No they weren't. They made sure the bad code never made it in. They are only guilty of wasting peoples time.
  - azernik 6y ago
    Except, from that email chain, it turns out that some of the bad code did make it into the stable branch. Clearly, they weren't keeping very close tabs on their bad code's progress through the system.
    - x86ARMsRace 6y ago
      At minimum, the argument could be made that they were grossly negligent in how they conducted the experiment.
- throwawayffffas 6y ago
  It's more than that, if there is no consequences for this kind of action, we are going to get a wave of "security researcher" wannabes trying to pull similar bullshit. Ps: I have put security researcher in quotes because this kind of thing is not security research, it's a publicity stunt.
- Avamander 6y ago
  How dare they highlight the vulnerability that exists in the process! The blasphemy! How about you think about what they just proved, about the actors that *actually* try to break the security of the kernel.
weagle05 6y ago
I agree, I think they should be looking at criminal charges. This is the equivalent of getting a job at Ford on the assembly line and then damaging vehicles to see if anyone notices. I've been in software security for 13 years and the "Is Open Source Really Secure" question is so over done. We KNOW there is risk associated with open source.
ginko 6y ago
I believe as a user of the kernel the warranty exclusion in GPLv2 means you have no legal recourse: > 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html ..which is generally a good thing even if it also protects clearly malicious actions like this.

As a user of the linux kernel, I feel legal action against the "researchers" should be pursued.

Avamander 6y ago

Your feelings do not invalidate the results unfortunately.

AntiImperialist 6y ago
In a fairer country, they would be hanged.

jnxx 6y ago

I feel somewhat similar. Since I am using Linux, they ultimately were trying to break the security of my computers. If I do that with any company without their consent, I can easily end up in jail.

foobar33333 6y ago
>they ultimately were trying to break the security of my computers. No they weren't. They made sure the bad code never made it in. They are only guilty of wasting peoples time.
- azernik 6y ago
  Except, from that email chain, it turns out that some of the bad code did make it into the stable branch. Clearly, they weren't keeping very close tabs on their bad code's progress through the system.
  - x86ARMsRace 6y ago
    At minimum, the argument could be made that they were grossly negligent in how they conducted the experiment.
throwawayffffas 6y ago
It's more than that, if there is no consequences for this kind of action, we are going to get a wave of "security researcher" wannabes trying to pull similar bullshit. Ps: I have put security researcher in quotes because this kind of thing is not security research, it's a publicity stunt.
Avamander 6y ago
How dare they highlight the vulnerability that exists in the process! The blasphemy! How about you think about what they just proved, about the actors that *actually* try to break the security of the kernel.

weagle05 6y ago

I agree, I think they should be looking at criminal charges. This is the equivalent of getting a job at Ford on the assembly line and then damaging vehicles to see if anyone notices. I've been in software security for 13 years and the "Is Open Source Really Secure" question is so over done. We KNOW there is risk associated with open source.

ginko 6y ago

I believe as a user of the kernel the warranty exclusion in GPLv2 means you have no legal recourse: > 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html ..which is generally a good thing even if it also protects clearly malicious actions like this.