5 ms·

This is not responsible research. This is similar to initiating fluid mechanics experiments on the wings of a Lufthansa A320 in flight to Frankfurt with a load

by xbar 6y ago

This is not responsible research. This is similar to initiating fluid mechanics experiments on the wings of a Lufthansa A320 in flight to Frankfurt with a load of Austrians. There are a lot of people to feel bad for, but none is at the University of Minnesota. Think of the Austrians.

mort96 6y ago
No, it's totally okay to feel sorry for good, conscientious researchers and students at the University of Minnesota who have been working on the kernel in good faith. It's sad that the actions of irresponsible researchers and associated review boards affect people who had nothing to do with professor Lu's research. It's not wrong for the kernel community to decide to blanket ban contributions from the university. It obviously makes sense to ban contributions from institutions which are known to send intentionally buggy commits disguised as fixes. That doesn't mean you can't feel bad for the innocent students and professors.
- unanswered 6y ago
  > good, conscientious researchers and students at the University of Minnesota who have been working on the kernel in good faith All you have to do is look at the reverted patches to see that these are either mythical or at least few and far in between.
  - sand500 6y ago
    Didn't they just blanket revert all patches from University of Minnesota? https://news.ycombinator.com/item?id=26889550 https://news.ycombinator.com/item?id=26889550
  - rjayatilleka 6y ago
    To be clear, Linux kernel patches from good UMN researchers and students are rare. We have plenty of great people at the University of Minnesota, they just don't work on the Linux kernel. It's justifiable and natural for our name to be dragged in the mud here, but as a run of the mill software engineer who graduated from UMN, I hope our reputation isn't soured too much.
    - unanswered 6y ago
      Sure, I hope it was clear from my original comment I only question whether the UMN contributors to the kernel are acting in good faith. I have identified other questionable patches personally, out of curiosity. Naturally I tend to attribute them to ignorance rather than malice... except, that bad actors intentionally pushing bad patches to an OSS project will inevitably rely on people assuming ignorance rather than malice. This has been well-understood for decades.
  - CRConrad 6y ago
    Someone in this HN thread found kernel patches (at a guess, not among those now reverted?) from UMN dating back to 2008, -09, and -13 (IIRC). Probably by totally unrelated people. So at least definitely not "totally mythical".
einpoklum 6y ago
> This is similar to initiating fluid mechanics experiments on the wings of a Lufthansa A320 in flight to Frankfurt with a load of Austrians. This analogy is invalid, because: 1. The experiment is not on live, deployed, versions of the kernel. 2. There are mechanisms in place for preventing actual merging of the faulty patches. 3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant. All of the above is not true for the in-flight airline. However - I'm not claiming the experiment was not ethically faulty. Certainly, the U Minnesota IRB needs to issue a report and an explanation on its involvement in this matter.
- inetknght 6y ago
  > 1. The experiment is not on live, deployed, versions of the kernel. The patches were merged and the email thread discusses that the patches made it to the stable tree. Some (many?) distributions of Linux have and run from stable. > 2. There are mechanisms in place for preventing actual merging of the faulty patches. Those mechanisms failed. > 3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant. Arguably. But I think this is a weak argument.
  - einpoklum 6y ago
    > The patches were merged The approved methodology - described in the linked paper - was that when a patch with the introduced vulnerabilities is accepted by its reviewer, the patch submitter indicates that the patch introduces a vulnerability exists, and sends a no-vulnerability version. That's what the paper describes. If the researchers did something other than what the methodology called for (and what the IRB approved), then perhaps the analogy may be valid.
    - Zevis 6y ago
      There are literally mails in that list pointing out that commits made it to stable. At least read the damn thing before repeating the professor's/student's nonsense lies.

by xbar 6y ago

mort96 6y ago

No, it's totally okay to feel sorry for good, conscientious researchers and students at the University of Minnesota who have been working on the kernel in good faith. It's sad that the actions of irresponsible researchers and associated review boards affect people who had nothing to do with professor Lu's research. It's not wrong for the kernel community to decide to blanket ban contributions from the university. It obviously makes sense to ban contributions from institutions which are known to send intentionally buggy commits disguised as fixes. That doesn't mean you can't feel bad for the innocent students and professors.

unanswered 6y ago
> good, conscientious researchers and students at the University of Minnesota who have been working on the kernel in good faith All you have to do is look at the reverted patches to see that these are either mythical or at least few and far in between.
- sand500 6y ago
  Didn't they just blanket revert all patches from University of Minnesota? https://news.ycombinator.com/item?id=26889550 https://news.ycombinator.com/item?id=26889550
- rjayatilleka 6y ago
  To be clear, Linux kernel patches from good UMN researchers and students are rare. We have plenty of great people at the University of Minnesota, they just don't work on the Linux kernel. It's justifiable and natural for our name to be dragged in the mud here, but as a run of the mill software engineer who graduated from UMN, I hope our reputation isn't soured too much.
  - unanswered 6y ago
    Sure, I hope it was clear from my original comment I only question whether the UMN contributors to the kernel are acting in good faith. I have identified other questionable patches personally, out of curiosity. Naturally I tend to attribute them to ignorance rather than malice... except, that bad actors intentionally pushing bad patches to an OSS project will inevitably rely on people assuming ignorance rather than malice. This has been well-understood for decades.
- CRConrad 6y ago
  Someone in this HN thread found kernel patches (at a guess, not among those now reverted?) from UMN dating back to 2008, -09, and -13 (IIRC). Probably by totally unrelated people. So at least definitely not "totally mythical".

einpoklum 6y ago

> This is similar to initiating fluid mechanics experiments on the wings of a Lufthansa A320 in flight to Frankfurt with a load of Austrians. This analogy is invalid, because: 1. The experiment is not on live, deployed, versions of the kernel. 2. There are mechanisms in place for preventing actual merging of the faulty patches. 3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant. All of the above is not true for the in-flight airline. However - I'm not claiming the experiment was not ethically faulty. Certainly, the U Minnesota IRB needs to issue a report and an explanation on its involvement in this matter.

inetknght 6y ago
> 1. The experiment is not on live, deployed, versions of the kernel. The patches were merged and the email thread discusses that the patches made it to the stable tree. Some (many?) distributions of Linux have and run from stable. > 2. There are mechanisms in place for preventing actual merging of the faulty patches. Those mechanisms failed. > 3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant. Arguably. But I think this is a weak argument.
- einpoklum 6y ago
  > The patches were merged The approved methodology - described in the linked paper - was that when a patch with the introduced vulnerabilities is accepted by its reviewer, the patch submitter indicates that the patch introduces a vulnerability exists, and sends a no-vulnerability version. That's what the paper describes. If the researchers did something other than what the methodology called for (and what the IRB approved), then perhaps the analogy may be valid.
  - Zevis 6y ago
    There are literally mails in that list pointing out that commits made it to stable. At least read the damn thing before repeating the professor's/student's nonsense lies.