3 ms·
> This is similar to initiating fluid mechanics experiments on the wings of a Lufthansa A320 in flight to Frankfurt with a load of Austrians. This analogy is i
by einpoklum 6y ago
> This is similar to initiating fluid mechanics experiments on the wings of a Lufthansa A320 in flight to Frankfurt with a load of Austrians.
This analogy is invalid, because:
1. The experiment is not on live, deployed, versions of the kernel.
2. There are mechanisms in place for preventing actual merging of the faulty patches.
3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant.
All of the above is not true for the in-flight airline.
However - I'm not claiming the experiment was not ethically faulty. Certainly, the U Minnesota IRB needs to issue a report and an explanation on its involvement in this matter.
- inetknght 6y ago> 1. The experiment is not on live, deployed, versions of the kernel. The patches were merged and the email thread discusses that the patches made it to the stable tree. Some (many?) distributions of Linux have and run from stable. > 2. There are mechanisms in place for preventing actual merging of the faulty patches. Those mechanisms failed. > 3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant. Arguably. But I think this is a weak argument.
- einpoklum 6y ago> The patches were merged The approved methodology - described in the linked paper - was that when a patch with the introduced vulnerabilities is accepted by its reviewer, the patch submitter indicates that the patch introduces a vulnerability exists, and sends a no-vulnerability version. That's what the paper describes. If the researchers did something other than what the methodology called for (and what the IRB approved), then perhaps the analogy may be valid.
- Zevis 6y agoThere are literally mails in that list pointing out that commits made it to stable. At least read the damn thing before repeating the professor's/student's nonsense lies.
- einpoklum 6y agoThe mails in the pointed-to threads indicate that commits by those UMin people made it to stable; it does not say that commits which introduce bugs made it to stable - it is following a decision/suggestion to back out all patches by these people to the kernel. There is further indication that the patches to revert are not mostly/not at all vulnerability-introducing patches in a message by "Steve" which says: > The one patch from Greg's reverts that affects my code was actually a legitimate fix So, again, while it is still theoretically possible that vulnerabilities were introduced into stable, that is not known to be the case.
- deleted 6y ago[deleted]
- tremon 6y agoHow would you feel about researchers delivering known-faulty-under-some-conditions AoA sensors to Boeing, just to see if Boeing's QA process would catch those errors before final assembly?
- splistud 6y agoI would feel that I'm wasting time that I could be using to find out why Boeing makes this possible (or any other corporate or government body with a critical system).
- einpoklum 6y agoI would feel that you are switching analogies... This analogy is pretty valid, the in-flight-experiment analogy is invalid.
- slenk 6y agoIs it? Linux underpins many medical devices - it too could lead to life and death consequences
- einpoklum 6y agoYou are ignoring the problematic experiment's methodology, which explicitly prevents the problematic patches from making it in by drawing attention to the vulnerability after they are accepted. Now, if this protocol were not followed, that's a different story, but we do not know this to be the case.
- matheusmoreira 6y agoYou seem to think this experiment was performed on the Linux kernel itself. It was not. This research was performed on human beings. It's irrelevant whether any bugs were ultimately introduced into the kernel. The fact is the researchers deliberately abused the trust of other human beings in order to experiment on them. A ban on further contributions is a very light punishment for such behavior.
- einpoklum 6y agoYou seem to think I condone the experiment because I described an analogy as invalid.