7 ms·

I just want you to know that this is extremely unethical to create a paper where you attempt to discredit others by just using your university's reputation to t

I just want you to know that this is extremely unethical to create a paper where you attempt to discredit others by just using your university's reputation to try to create vulnerabilities on purpose. I back your decision and fuck these people. I will additionally be sending a strongly worded email to this person, their advisor and their whoever's in charge of this joke of a computer science school. Sometimes I wish we had the ABA equivalent for computer science.

incrudible 6y ago
I completely disagree with this framing. A real malicious actor is going to be planted in some reputable institution, creating errors that look like honest mistakes. How do you test if the process catches such vulnerabilities? You do it the just the way that these researchers did. Yes, it creates extra homework for some people with certain responsibilities, that doesn't mean it's unethical. Don't shoot the messenger.
- hctaw 6y ago
  These are real malicious actors.
  - incrudible 6y ago
    You don't know that, but that's also irrelevant. There's always plausible deniability with such bugs. The point is that you need to catch the errors no matter where they come from, because you can't trust anyone.
    - WrtCdEvrydy 6y ago
      But that's the point, you're a security researcher wanting to get the honors of getting a PhD, not a petty criminal, so you're supposed to have a strong ethical background. A security researcher doesn't just delete a whole hard drive's worth of data to prove they have the rights to delete things, they are trusted for this reason.
    - hctaw 6y ago
      Carrying out an attack for personal gain is malicious. It doesn't matter if the payload is for crypto mining, creating a backdoor for the NSA, or a vulnerability you can cite in a paper. Pentesting unwitting participants is malicious, and in many cases illegal.
    - mannykannot 6y ago
      It is ironic that you introduce plausible deniability here. No one as concerned about security as you profess to be should consider the presence of plausible deniability as being grounds for terminating a threat analysis. In the real world, where we cannot be sure of catching every error, identifying actual threats, and their capabilities and methods, is a security-enhancing analysis.
- WrtCdEvrydy 6y ago
  > A real malicious actor They introduced a real vulnerability in a codebase that lowers world-wide cybersecurity used by billions so they could jerk themselves off over a research paper. They are a real malicious actor and I hope they hit by the CFAA.
  - toomuchtodo 6y ago
    There is a specific subsection of the CFAA that applies to this situation (deployment of unauthorized code that makes its way into non consenting systems). This was a bold and unwise exercise, especially if you’re an academic in country on a revocable visa who participated.
    - sharken 6y ago
      Others would call it stupid to submit the patches and it would be fine if there were further consequences to deter others.
      - toomuchtodo 6y ago
        Was attempting politeness. You’re not wrong.
- andrewzah 6y ago
  No. There are processes to do such sorts of penetration testing. Randomly sending buggy commits or commits with security vulns to "test the process" is extremely unethical. The linux kernel team are not lab rats.
  - xiphias2 6y ago
    It's not simply unethical, it's a national security risk. Is there a proof that the Chinese government was not sponsoring this ,,research '' for example?
    - andrewzah 6y ago
      Linux kernel vulnerabilities affect the entire world. The world does not revolve around the U.S., and I find it extremely unlikely a university professor in the U.S. doing research for a paper did this on behalf of the Chinese government. It's far more likely that professor is so out of touch that they honestly think their behavior is acceptable.
      - discoduck1 6y ago
        The bio of the assistant professor, Kangjie Lu, is here: https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/ It probably IS from being out of touch, or perhaps desperation to become tenured. However, he is also an alumnus of Chongqing University: http://www.cse.cqu.edu.cn/info/2095/5360.htm http://www.cse.cqu.edu.cn/info/2095/5360.htm
        kodah 6y ago
        How about that question gets asked when there's actually some semblance of evidence that supports that theory. When you just throw, what I call, "dual loyalty" out as an immediate possibility just because the person is from China it starts to sound real nasty from the observers point of view.
        6y ago
- willtemperley 6y ago
  This would absolutely be true if this were an authorised penetration test, however it was unauthorised and therefore unethical.
  - incrudible 6y ago
    How exactly do you "authorize" these tests? Giving advance notice would defeat the purpose, obviously.
    - WrtCdEvrydy 6y ago
      "We're writing research on the security systems involved around the Linux kernel, would it be acceptable to submit a set of patches to be reviewed for security concerns just as if it was a regular patch to the Linux kernel?" This is what you do as a grownup and the other side is expected to honor your request and perform the same thing they do for other commits... the problem is that people think of pen testing as an adversarial relationship where one person needs to win over the other one.
      - yjftsjthsd-h 6y ago
        To play Devil's Advocate, I suspect that this would if different results because people behave differently when they know that there is something going on.
        WrtCdEvrydy 6y ago
        That's the thing, you just told the person to review the request for security... in a true double blind, you submit 10 PRs and see how many get rejected / approved. If all 10 are rejected but only one had a security concern, then the process is faulty in another way. Edit: There is this theory that penetration testing is adversarial but in the real world people want the best outcome for all. The kernel maintainers are professionals so I would expect the same level of caring for a "special PR" versus a "normal PR"
        captn3m0 6y ago
- michelpp 6y ago
  It is unethical. You cannot experiment on people without their consent. Their own university has explicit rules against this.
deleted 6y ago
[deleted]
mbauman 6y ago
Don't harass people.
- WrtCdEvrydy 6y ago
  I'm not harassing anyone... I'm politely reminding this person that ethics are a real thing.
  - jdsully 6y ago
    Unless you are an involved party you're just adding to the mob. The kernel maintainers said their piece there's no need for everyone to pile on.
    - WrtCdEvrydy 6y ago
      I am a user of the Linux kernel which a publicly funded university using my tax dollars just attempted to subvert in order to jerk themselves off over a research paper.
    - burnished 6y ago
      Maybe there is? I'm not convinced of my own position but I'd suggest there is a difference from an outcry sourced in people that are well informed of their complaint and the sort of brigading/bandwagoning you can see come from personal details being posted under a complaint.
      - jdsully 6y ago
        I guess the question is what more is there to accomplish? They’ve been banned and I gurantee they already know the community is pissed. Is filling up their inbox with angry emails going to actually help in any way?
        burnished 6y ago
        I'm trying to reconcile what you are saying with all the "write your senator" I've heard all my life, you know? I think the answer is "yes it will help, in as much strong arguments may be persuasive". Honestly I'm not sure there is a good answer considering that part of what we're weighing against is the potential for the internet to help create an outsized or aggravated response.
DyslexicAtheist 6y ago
just write to irb@umn.edu and ask if this was a) reviewed and b) who approved it. It seems they have anyway violated the Human Research Protection Program Plan. The researchers should not have done this, but ultimately it's the faculty that must be held accountable for allowing this to happen in the first place. They are a for-profit institution and should not get away with harassing people who are contributing their personal time. So nail them to the proverbial cross but make sure the message is heard by those who slipped up (not the researchers who should have been stopped before it happened).
dang 6y ago
Please don't fulminate on HN (see https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). It's not what this site is for, because it leads to considerably worse conversation. Even if you're justifiably steaming about something, please wait to cool down before posting here. We detached this subthread from https://news.ycombinator.com/item?id=26889743 https://news.ycombinator.com/item?id=26889743.
- WrtCdEvrydy 6y ago
  Are you serious? If I publish a paper on the social engineering vulnerabilities we have used over the last three months to gain access to your password and attempt to take over Hacker News, you would be fine with it? No outburst, no angrily banning my account...
  - burnished 6y ago
    It seems odd that you are responding with a threat, or at least a threatening hypothetical to a (the?) moderator. The way I understand it is that unnecessarily angry or confrontational posts tend to lower the overall tone. They are cathartic/fun to write, fast to write, and tend to get wide overall agreement/votes. So if they are allowed then most of the discussion on a topic gets pushed down beneath that sort of post. Hence why we are asked to refrain, to permit more room for focused and substantive discussion.
    - WrtCdEvrydy 6y ago
      No, I'm asking if he thinks as a person who built Hacker News if this is what we want out of the technology ecosystem from the cybersecurity professionals. Edit: dang is a good person and I don't understand how he's taking sides here with people sending out malware (because that's what this sums up to). I understand I came on a little hot, but that was unexpected.
      - burnished 6y ago
        I'm glad we agree on the merits of dang. After reviewing the thread I don't see any of what you are asking, here, upstream. I don't seem dang coming out on the same side as people sending out malware, and I don't really see that question present. I wish I had something more concrete to say, but I think your take here (and only here) is wrong and that you might have just entered this one on the wrong foot?

incrudible 6y ago

I completely disagree with this framing. A real malicious actor is going to be planted in some reputable institution, creating errors that look like honest mistakes. How do you test if the process catches such vulnerabilities? You do it the just the way that these researchers did. Yes, it creates extra homework for some people with certain responsibilities, that doesn't mean it's unethical. Don't shoot the messenger.

hctaw 6y ago
These are real malicious actors.
- incrudible 6y ago
  You don't know that, but that's also irrelevant. There's always plausible deniability with such bugs. The point is that you need to catch the errors no matter where they come from, because you can't trust anyone.
  - WrtCdEvrydy 6y ago
    But that's the point, you're a security researcher wanting to get the honors of getting a PhD, not a petty criminal, so you're supposed to have a strong ethical background. A security researcher doesn't just delete a whole hard drive's worth of data to prove they have the rights to delete things, they are trusted for this reason.
  - hctaw 6y ago
    Carrying out an attack for personal gain is malicious. It doesn't matter if the payload is for crypto mining, creating a backdoor for the NSA, or a vulnerability you can cite in a paper. Pentesting unwitting participants is malicious, and in many cases illegal.
  - mannykannot 6y ago
    It is ironic that you introduce plausible deniability here. No one as concerned about security as you profess to be should consider the presence of plausible deniability as being grounds for terminating a threat analysis. In the real world, where we cannot be sure of catching every error, identifying actual threats, and their capabilities and methods, is a security-enhancing analysis.
WrtCdEvrydy 6y ago
> A real malicious actor They introduced a real vulnerability in a codebase that lowers world-wide cybersecurity used by billions so they could jerk themselves off over a research paper. They are a real malicious actor and I hope they hit by the CFAA.
- toomuchtodo 6y ago
  There is a specific subsection of the CFAA that applies to this situation (deployment of unauthorized code that makes its way into non consenting systems). This was a bold and unwise exercise, especially if you’re an academic in country on a revocable visa who participated.
  - sharken 6y ago
    Others would call it stupid to submit the patches and it would be fine if there were further consequences to deter others.
    - toomuchtodo 6y ago
      Was attempting politeness. You’re not wrong.
andrewzah 6y ago
No. There are processes to do such sorts of penetration testing. Randomly sending buggy commits or commits with security vulns to "test the process" is extremely unethical. The linux kernel team are not lab rats.
- xiphias2 6y ago
  It's not simply unethical, it's a national security risk. Is there a proof that the Chinese government was not sponsoring this ,,research '' for example?
  - andrewzah 6y ago
    Linux kernel vulnerabilities affect the entire world. The world does not revolve around the U.S., and I find it extremely unlikely a university professor in the U.S. doing research for a paper did this on behalf of the Chinese government. It's far more likely that professor is so out of touch that they honestly think their behavior is acceptable.
    - discoduck1 6y ago
      The bio of the assistant professor, Kangjie Lu, is here: https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/ It probably IS from being out of touch, or perhaps desperation to become tenured. However, he is also an alumnus of Chongqing University: http://www.cse.cqu.edu.cn/info/2095/5360.htm http://www.cse.cqu.edu.cn/info/2095/5360.htm
      - kodah 6y ago
        How about that question gets asked when there's actually some semblance of evidence that supports that theory. When you just throw, what I call, "dual loyalty" out as an immediate possibility just because the person is from China it starts to sound real nasty from the observers point of view.
        6y ago
willtemperley 6y ago
This would absolutely be true if this were an authorised penetration test, however it was unauthorised and therefore unethical.
- incrudible 6y ago
  How exactly do you "authorize" these tests? Giving advance notice would defeat the purpose, obviously.
  - WrtCdEvrydy 6y ago
    "We're writing research on the security systems involved around the Linux kernel, would it be acceptable to submit a set of patches to be reviewed for security concerns just as if it was a regular patch to the Linux kernel?" This is what you do as a grownup and the other side is expected to honor your request and perform the same thing they do for other commits... the problem is that people think of pen testing as an adversarial relationship where one person needs to win over the other one.
    - yjftsjthsd-h 6y ago
      To play Devil's Advocate, I suspect that this would if different results because people behave differently when they know that there is something going on.
      - WrtCdEvrydy 6y ago
        That's the thing, you just told the person to review the request for security... in a true double blind, you submit 10 PRs and see how many get rejected / approved. If all 10 are rejected but only one had a security concern, then the process is faulty in another way. Edit: There is this theory that penetration testing is adversarial but in the real world people want the best outcome for all. The kernel maintainers are professionals so I would expect the same level of caring for a "special PR" versus a "normal PR"
      - captn3m0 6y ago
michelpp 6y ago
It is unethical. You cannot experiment on people without their consent. Their own university has explicit rules against this.

deleted 6y ago

[deleted]

mbauman 6y ago

Don't harass people.

WrtCdEvrydy 6y ago
I'm not harassing anyone... I'm politely reminding this person that ethics are a real thing.
- jdsully 6y ago
  Unless you are an involved party you're just adding to the mob. The kernel maintainers said their piece there's no need for everyone to pile on.
  - WrtCdEvrydy 6y ago
    I am a user of the Linux kernel which a publicly funded university using my tax dollars just attempted to subvert in order to jerk themselves off over a research paper.
  - burnished 6y ago
    Maybe there is? I'm not convinced of my own position but I'd suggest there is a difference from an outcry sourced in people that are well informed of their complaint and the sort of brigading/bandwagoning you can see come from personal details being posted under a complaint.
    - jdsully 6y ago
      I guess the question is what more is there to accomplish? They’ve been banned and I gurantee they already know the community is pissed. Is filling up their inbox with angry emails going to actually help in any way?
      - burnished 6y ago
        I'm trying to reconcile what you are saying with all the "write your senator" I've heard all my life, you know? I think the answer is "yes it will help, in as much strong arguments may be persuasive". Honestly I'm not sure there is a good answer considering that part of what we're weighing against is the potential for the internet to help create an outsized or aggravated response.

DyslexicAtheist 6y ago

just write to irb@umn.edu and ask if this was a) reviewed and b) who approved it. It seems they have anyway violated the Human Research Protection Program Plan. The researchers should not have done this, but ultimately it's the faculty that must be held accountable for allowing this to happen in the first place. They are a for-profit institution and should not get away with harassing people who are contributing their personal time. So nail them to the proverbial cross but make sure the message is heard by those who slipped up (not the researchers who should have been stopped before it happened).

dang 6y ago

Please don't fulminate on HN (see https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). It's not what this site is for, because it leads to considerably worse conversation. Even if you're justifiably steaming about something, please wait to cool down before posting here. We detached this subthread from https://news.ycombinator.com/item?id=26889743 https://news.ycombinator.com/item?id=26889743.

WrtCdEvrydy 6y ago
Are you serious? If I publish a paper on the social engineering vulnerabilities we have used over the last three months to gain access to your password and attempt to take over Hacker News, you would be fine with it? No outburst, no angrily banning my account...
- burnished 6y ago
  It seems odd that you are responding with a threat, or at least a threatening hypothetical to a (the?) moderator. The way I understand it is that unnecessarily angry or confrontational posts tend to lower the overall tone. They are cathartic/fun to write, fast to write, and tend to get wide overall agreement/votes. So if they are allowed then most of the discussion on a topic gets pushed down beneath that sort of post. Hence why we are asked to refrain, to permit more room for focused and substantive discussion.
  - WrtCdEvrydy 6y ago
    No, I'm asking if he thinks as a person who built Hacker News if this is what we want out of the technology ecosystem from the cybersecurity professionals. Edit: dang is a good person and I don't understand how he's taking sides here with people sending out malware (because that's what this sums up to). I understand I came on a little hot, but that was unexpected.
    - burnished 6y ago
      I'm glad we agree on the merits of dang. After reviewing the thread I don't see any of what you are asking, here, upstream. I don't seem dang coming out on the same side as people sending out malware, and I don't really see that question present. I wish I had something more concrete to say, but I think your take here (and only here) is wrong and that you might have just entered this one on the wrong foot?