6 ms·

No. There are processes to do such sorts of penetration testing. Randomly sending buggy commits or commits with security vulns to "test the process" is extremel

No. There are processes to do such sorts of penetration testing. Randomly sending buggy commits or commits with security vulns to "test the process" is extremely unethical. The linux kernel team are not lab rats.

xiphias2 6y ago
It's not simply unethical, it's a national security risk. Is there a proof that the Chinese government was not sponsoring this ,,research '' for example?
- andrewzah 6y ago
  Linux kernel vulnerabilities affect the entire world. The world does not revolve around the U.S., and I find it extremely unlikely a university professor in the U.S. doing research for a paper did this on behalf of the Chinese government. It's far more likely that professor is so out of touch that they honestly think their behavior is acceptable.
  - discoduck1 6y ago
    The bio of the assistant professor, Kangjie Lu, is here: https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/ It probably IS from being out of touch, or perhaps desperation to become tenured. However, he is also an alumnus of Chongqing University: http://www.cse.cqu.edu.cn/info/2095/5360.htm http://www.cse.cqu.edu.cn/info/2095/5360.htm
    - kodah 6y ago
      How about that question gets asked when there's actually some semblance of evidence that supports that theory. When you just throw, what I call, "dual loyalty" out as an immediate possibility just because the person is from China it starts to sound real nasty from the observers point of view.
      - cameronh90 6y ago
        Although there's nothing to suggest that this professor is in any way supported by the Chinese state, I don't think it's completely unreasonable to wonder. The UK government has already said that China is targeting the UK via academics and students. China is a very aggressive threat with a ton of resources. It's certainly a real scenario to consider. Just as this "research" has burnt the trust between the kernel maintainers and the UMN, if China intentionally installs spies into western academia, at some point you have to call into question the background of any Chinese student. It's not fair, but currently China is relying on the fact that we care about fairness and due process.
        kodah 6y ago
        I acknowledged it's a possibility and there is precedence for it, at least in industry, in the US. That said, prove what they did was wrong, prove whether controls like the IRB were used properly and informed correctly, prove or disqualify the veracity of their public statements (like the ones they made to the IEEE), then start looking at possible motivations other than the ones stated. I get that's difficult because these folks have already proven to be integrity violators but I think it's worthwhile to try to stick to. If you jump straight to dual loyalty it is unfortunately also a position that will be easily co-opted by other bad faith actors and needlessly muddies the conversation because not all good faith and reasonable possibilities have been explored yet. I'm promoting the idea of a well-defined process here so that nobody can claim that it's just bigoted people making these accusations.
      - splistud 6y ago
        So asking 'why?' in this situation is in some way unethical because the person in question is from China? Or is it that we have to limit the answers to our question because the person is from China? Please advise, and further clarify what thoughts are not permitted based on the nationality of the person in question.
      - Woden501 6y ago
        It's a very real threat and possibility thus an absolutely appropriate question to be asking. There are numerous documented instances of espionage performed by Chinese nationals while operating within the US educational system. https://www.nbcnews.com/news/china/american-universities-are-soft-target-china-s-spies-say-u-n1104291 https://www.nbcnews.com/news/china/american-universities-are...
    - dang 6y ago
      Please don't do this here.
- delaynomore 6y ago
  If that's the case, why would they publish a paper and announce their "research" to the world?
incrudible 6y ago
> There are processes to do such sorts of penetration testing. What's the process then? I doubt there is such a process for the Linux kernel, otherwise the response would've been "you did not follow the process" instead of "we don't like what you did there".
- andrewzah 6y ago
  Well, if there's no process, then it's not ethical (and sometimes, not legal) to purposefully introduce bad commits or do things like that. You need consent. Firstly, it accomplishes nothing. We already all know that PRs and code submission is a potential vector for buggy code or security vulnerabilities. This is like saying water is wet. Secondly, it wastes the time of the people working on the linux kernel and ruins the trust of code coming from the university of minnesota. All of this happened due to caring about one's own research more than the ethics of doing this sort of thing. And continuing to engage in this behavior after receiving a warning.
  - incrudible 6y ago
    First of all, whether something is ethical is an opinion, and in my opinion, it is not unethical. Even if I considered it unethical, I would still want this test to be performed, because I value kernel security above petty ideological concerns. If this is illegal, then I don't think it should be illegal. There's always debates about the legality of hacking, but there's no doubt that many illegal (and arguably unethical) acts of hacking have improved computer security. If you remember the dire state of computer security in the early 2000s, remember that the solution was not throw all the hacker kids in jail.
    - WrtCdEvrydy 6y ago
      > I would still want this test to be performed, because I value kernel security above petty ideological concerns. The biggest issue around this is consent. You can totally send an email saying "we're doing research on the security implications of the pull request process, can we send you a set of pull requests and you can give up approve/deny on each one?" > If you remember the dire state of computer security in the early 2000s, remember that the solution was not throw all the hacker kids in jail. You weren't there when Mirai caused havok due to thousands of insecure IoT devices getting pwned and turned into a botnet... and introducing more vulnerabilities is never the answer.

xiphias2 6y ago

It's not simply unethical, it's a national security risk. Is there a proof that the Chinese government was not sponsoring this ,,research '' for example?

andrewzah 6y ago
Linux kernel vulnerabilities affect the entire world. The world does not revolve around the U.S., and I find it extremely unlikely a university professor in the U.S. doing research for a paper did this on behalf of the Chinese government. It's far more likely that professor is so out of touch that they honestly think their behavior is acceptable.
- discoduck1 6y ago
  The bio of the assistant professor, Kangjie Lu, is here: https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/ It probably IS from being out of touch, or perhaps desperation to become tenured. However, he is also an alumnus of Chongqing University: http://www.cse.cqu.edu.cn/info/2095/5360.htm http://www.cse.cqu.edu.cn/info/2095/5360.htm
  - kodah 6y ago
    How about that question gets asked when there's actually some semblance of evidence that supports that theory. When you just throw, what I call, "dual loyalty" out as an immediate possibility just because the person is from China it starts to sound real nasty from the observers point of view.
    - cameronh90 6y ago
      Although there's nothing to suggest that this professor is in any way supported by the Chinese state, I don't think it's completely unreasonable to wonder. The UK government has already said that China is targeting the UK via academics and students. China is a very aggressive threat with a ton of resources. It's certainly a real scenario to consider. Just as this "research" has burnt the trust between the kernel maintainers and the UMN, if China intentionally installs spies into western academia, at some point you have to call into question the background of any Chinese student. It's not fair, but currently China is relying on the fact that we care about fairness and due process.
      - kodah 6y ago
        I acknowledged it's a possibility and there is precedence for it, at least in industry, in the US. That said, prove what they did was wrong, prove whether controls like the IRB were used properly and informed correctly, prove or disqualify the veracity of their public statements (like the ones they made to the IEEE), then start looking at possible motivations other than the ones stated. I get that's difficult because these folks have already proven to be integrity violators but I think it's worthwhile to try to stick to. If you jump straight to dual loyalty it is unfortunately also a position that will be easily co-opted by other bad faith actors and needlessly muddies the conversation because not all good faith and reasonable possibilities have been explored yet. I'm promoting the idea of a well-defined process here so that nobody can claim that it's just bigoted people making these accusations.
    - splistud 6y ago
      So asking 'why?' in this situation is in some way unethical because the person in question is from China? Or is it that we have to limit the answers to our question because the person is from China? Please advise, and further clarify what thoughts are not permitted based on the nationality of the person in question.
    - Woden501 6y ago
      It's a very real threat and possibility thus an absolutely appropriate question to be asking. There are numerous documented instances of espionage performed by Chinese nationals while operating within the US educational system. https://www.nbcnews.com/news/china/american-universities-are-soft-target-china-s-spies-say-u-n1104291 https://www.nbcnews.com/news/china/american-universities-are...
  - dang 6y ago
    Please don't do this here.
delaynomore 6y ago
If that's the case, why would they publish a paper and announce their "research" to the world?

incrudible 6y ago

> There are processes to do such sorts of penetration testing. What's the process then? I doubt there is such a process for the Linux kernel, otherwise the response would've been "you did not follow the process" instead of "we don't like what you did there".

andrewzah 6y ago
Well, if there's no process, then it's not ethical (and sometimes, not legal) to purposefully introduce bad commits or do things like that. You need consent. Firstly, it accomplishes nothing. We already all know that PRs and code submission is a potential vector for buggy code or security vulnerabilities. This is like saying water is wet. Secondly, it wastes the time of the people working on the linux kernel and ruins the trust of code coming from the university of minnesota. All of this happened due to caring about one's own research more than the ethics of doing this sort of thing. And continuing to engage in this behavior after receiving a warning.
- incrudible 6y ago
  First of all, whether something is ethical is an opinion, and in my opinion, it is not unethical. Even if I considered it unethical, I would still want this test to be performed, because I value kernel security above petty ideological concerns. If this is illegal, then I don't think it should be illegal. There's always debates about the legality of hacking, but there's no doubt that many illegal (and arguably unethical) acts of hacking have improved computer security. If you remember the dire state of computer security in the early 2000s, remember that the solution was not throw all the hacker kids in jail.
  - WrtCdEvrydy 6y ago
    > I would still want this test to be performed, because I value kernel security above petty ideological concerns. The biggest issue around this is consent. You can totally send an email saying "we're doing research on the security implications of the pull request process, can we send you a set of pull requests and you can give up approve/deny on each one?" > If you remember the dire state of computer security in the early 2000s, remember that the solution was not throw all the hacker kids in jail. You weren't there when Mirai caused havok due to thousands of insecure IoT devices getting pwned and turned into a botnet... and introducing more vulnerabilities is never the answer.