15 ms·

UMN CS&E Statement on Linux Kernel Research

• Traster 5y ago
  This is a great statement, they confirm they're aware of the issue, they acknowledge the concerns and they set out their intention to gather the full facts whilst suspending the operation of the research in the meantime. They also acknowledge the systematic way the need to deal with this. I hope their follow up is as thorough but I want to applaud this, it's a good approach.
  • AdamJacobMuller 5y ago
    This statement rings true because it is the wordsmith'd version of exactly what the department head probably said when he first heard, which probably went something like "what the f*k did you do, who the f*k thought this was a good idea, and who the f*k told you you could do this?"
    • DannyBee 5y ago
      Yeah, i thought the same thing. This is basically someone yelling in an office put through a diplomacy filter, which is what you would expect happened.
    • mike_d 5y ago
      I'm pretty sure the biggest program at UMN is Social Sciences. Conducting research experiments on unwitting subjects (the kernel maintainers) is a huge ethics violation. I can only imagine the other department heads screaming at the head of the, relatively speaking, small CS department.
      • mumblemumble 5y ago
        When I was in grad school for a branch of social sciences, we had a whole class on how to conduct research experiments on unwitting subjects. It's something that social scientists do all the time. (Tangentially, it's something that computer people do even more often, and probably with fewer ethics controls. A/B testing, for one prominent example.) But it's typically only allowed when it's clear that the risk of harm to the participants is pretty much negligible. Which is clearly not the case here. As others have said, it's probably the case that the reason this got past the IRB is not because the research was clandestine, but because the team lied about how it might affect people. And probably also, I'm guessing, the IRB had their guard down because they weren't expecting that particular department to be conducting social science field experiments.
  • mewse-hn 5y ago
    I also think it's a good response but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt. The way their statement stands they can investigate themselves and determine they did nothing wrong, we'll have to see what they say down the road.
    • belval 5y ago
      Perhaps I am naive but I think the apology should come after the internal investigation. It is more likely that you just have an administrator that became aware of the issue, they won't make an apology until they understand what happened.
    • kenjackson 5y ago
      They could investigate and determine that they did nothing wrong, but they aren't the final arbiter of justice. This is not like the police investigating themselves. The OSS community can come to a different conclusion and still punish them. The job of UMN is to get the facts first, and then determine actions. If the OSS community (and others) feel like the actions don't match the facts (or if they feel the facts don't match what actually happened) they can apply their own set of actions.
    • IncRnd 5y ago
      I doubt an apology would increase liability in this case, since the actions already occurred and are forensically visible.
    • tw04 5y ago
      >but I think an apology would be in order - perhaps left out because it can be considered an admission of guilt. I think an apology before they've had a chance to review everything that occurred would be rather empty, don't you? "I'm sorry you're upset"? I far prefer what they've stated they're going to do which is stop the activity they know about immediately, and to review how we got to this point. If, on the off chance, the professor was being honest about ensuring they weren't wasting anyone's time, and ensuring no bad code made it into the kernel, then the situation becomes a bit more murky. They'd need to go through all of the associated emails both public and internal to validate that. If on the other hand this is in fact a duck, I would expect them to both to issue a meaningful apology at that point, as well as lay out the steps they've taken to ensure it doesn't happen again (which they've indicated is their plan). And hopefully restore the trust of the OSS community.
  • IncRnd 5y ago
    There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1] [1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
    • deleted 5y ago
      [deleted]
    • MattGaiser 5y ago
      I would argue that first requires investigation. They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.
      • IncRnd 5y ago
        > I would argue that first requires investigation. Why do you think that enough of an investigation hasn't been performed in order to understand culpability? Thay already know what happened and want to learn why it was approved. That was what their comment said. Take a look at the actual PDF from the researchers, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" [1] [1] https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
        • alexeldeib 5y ago
          The prof overseeing the paper clarified that they initially did not seek IRB approval, and then received an IRB exemption [0]. I'd want to ask the IRB why they approved that, for starters. Maybe because they'd already done the research and hoped it would blow over, vs. the controversy of rejecting it when they'd already done the work? 0: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....
  • Zarathust 5y ago
    If they really care about being banned, they'll have no choice but to follow thorough
    • simlevesque 5y ago
      Yeah and that's some heavy shade on a university. They'll lose good students if this is not fixed.
      • munk-a 5y ago
        I don't think that's the case (due to how fame works) and I don't even think it's particularly productive to bring up that point. Their actions should be rectified since they did wrong - not out of fear of a punishment. When we bring only a specific punishment in as a consequence then the question of how to respond can be shifted over to a "which is worse" proposition which means that the punishment needs to be properly proportioned. At any rate - I doubt admissions would be appreciably impacted even if they handled this incident extremely poorly - some potential grad students might look elsewhere while most would likely be ignorant of the whole incident.
        • bluGill 5y ago
          There are enough of us here that have heard about this as to make a UMN degree worth less because we will trash a resume with that name on it.
          • munk-a 5y ago
            I certainly wouldn't do so - this looks like it was a research topic by one professor and one grad student... So nearly no one with a degree from UMN was involved with this. Even the specific grad student was college aged at the time and we all did stupid stuff when we were young. I think this only really rubs off on the professor since they clearly should've known better. Honestly I think the biggest blow to the university will be when it comes to hiring CS professors - those are the only folks likely to do the due diligence on this topic or be passively aware of it.
  • aspaceman 5y ago
    They also didn't just throw the group under the bus and try and wash their hands clean - good move.
    • balozi 5y ago
      Academia runs on egos and reputations. You can be sure the the fallout is coming.
  • agf 5y ago
    It is a good statement, and I believe they'll follow through, but it's missing something important that is often missing from otherwise professional communication. The last line is "We will report our findings back to the community as soon as practical." It should be followed by "and we will provide an update in no more than 30 days". Without any explicit time frame, holding them publicly accountable becomes trickier. At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more. Note that the companies that do ongoing incident updates on status sites best all do this -- "We will provide an update by 10:30pm PST".
    • boomboomsubban 5y ago
      > At any point they can just say "we're still investigating" until enough time has passed people aren't paying attention any more. They need to act to get the ban rescinded, they can't just ignore this issue away.
      • agf 5y ago
        I agree, that's why in this case (as I say in my post) I believe they'll follow through.
        • boomboomsubban 5y ago
          As the pressure is already on them to rectify the situation, there's no need to for an artificial deadline. It adds nothing, but could delay their announcement or force them to publish an incomplete response.
        • GauntletWizard 5y ago
          "and we admit that a full accounting for these actions is necessary before our ban is rescinded" is a valid (albeit even less common) form of making sure that they are held accountable. Nonetheless, it is important that the accused admits it. The common case today is that admitting you are due to account for your actions is the same as admitting that you are at fault. I have been denied jobs because I have admitted that to being accountable for my decisions, whereas I got the distinct impression had I simply not accounted for them they wouldn't have cared.
  • Causality1 5y ago
    I disagree. There's not a single word of apology in it.
    • xiphias2 5y ago
      They don't have to, it's the ,,redearcher'' who has to apologize. The University has to do exactly what they have done and follow up, to keep their reputation.
      • melenaboija 5y ago
        They have to investigate and also apologize accordingly in the name of the university. Saying the researcher is the only responsible of a work that is managed by the university (with things such as probably funds and for sure resources) is just wrong.
    • burnished 5y ago
      Too early. The shit storm is less than a day old. You wouldn't accept an insincere apology right? So we shouldn't demand an apology before a sincere one could possibly be issued.
  • spfzero 5y ago
    I agree, and given that they have only just started to look into it, I think it shows an appropriate amount of concern and urgency. They'll at least want to talk to the researchers and get their point of view, before committing any further. This is about the best you could expect at this point, they'll want to proceed methodically.
  • mariksolo 5y ago
    It doesn't take much to write a single paragraph, though. I think the quality of their response will become much more clear later.
    • elliekelly 5y ago
      Have you ever drafted a public response for an issue receiving a lot of attention on social media when you don’t know the whole story but, from what little you do know, things aren’t looking great for the entity you represent? You vastly underestimate how much effort and attention was put into writing that “single paragraph” because I promise you it sure does take much.
  • dleslie 5y ago
    Is it? Their ethics committee approved the research, and yet I see no acknowledgement of their responsibility.
    • macintux 5y ago
      The story just broke. We don’t know what the IRB saw, we don’t know what they said. Throwing anyone under the bus before there any time to even start asking questions is not what any smart administration should do.
      • dleslie 5y ago
        We know that they approved the research.
        • remarkEon 5y ago
          I think it’s more accurate to say that “we know that they approved something. Whether or not that something turns out to be exactly that this professor and his student did here is I gather a different question.
          • tytso 5y ago
            The "hypocrite commit" preprint/abstract was a controversy which broke late last year. Prof. Lu at that point published an FAQ stating that he didn't think it was Human Subject Research (HSR) and got a post hoc review from the UMN IRB giving him a free pass, agreeing that attempting to con humans is apparently not HSR by their lights. This is three month old news at this point, and is quite well established. What triggered the ban now is another set of suspicious commits was sent by a graduate student in the same research group.
            • remarkEon 5y ago
              Thanks, I didn't know that background (shame on me for not reading through all the history I guess). Odd decisions appear to have been made here by all parties. Though I was born in Iowa, I grew up in Minnesota and have a lot of friends who went there (Twin Cities campus, mostly). Definitely not "Minnesota Nice".
• adamrezich 5y ago
  basically the response I expected & hoped for. hopefully an eventual follow-up statement will detail what their investigation finds & what actions they took as a result
• stabbles 5y ago
  It was a good idea to ban the uni entirely, cause that way they had to respond.
  • earthscienceman 5y ago
    Anyone saying that it was a bad idea to ban the entire University isn't looking at the big picture. I look at it from a very philosophical standpoint: The entire idea of an academic (research) institution can be summarized as "an entity representing a group of trusted people who act in good faith of that institution". The moment one of your researchers acts in bad faith, or shows that they cannot be trusted, it's clear that the institute cannot be trusted until the institute takes decisive restorative action. By banning the University, you are saying "we no longer trust you in your authority as an institution until it can be made clear that this isn't a systemic problem."... you are not saying "every single person at the University is terrible" as it was framed by some commenters in the other thread. This is why, in any broad case, it's so upsetting when an institution of any variety doesn't take clear responsibility for the behavior and actions of its members or representatives (take for example the police, or the federal government). When that is true, the behavior of any member of that institution should be subject to scrutiny and distrust. It's not a complicated social phenomena.
    • toss1 5y ago
      Yup, it had to be dealt with on an org level, not only the offending person/group. Although it isn't the medical profession, the same directive should apply to research: "First, do no harm." This deliberate poisoning of OS projects without prior permission to 'test the security' violated that big time. I'm astonished it got past any ethics review, indicating to me that there likely was none.
      • seoaeu 5y ago
        Ah, but you're missing the directive that medicine doesn't have: "If a doctor commits malpractice, immediately disregard all medical advice given to you by any other doctors at their hospital"
• elcomet 5y ago
  That was quick. I'm glad they will look into this and I hope we don't see this kind of research in the future. This story reminded me of facebook experimenting on their users to control their emotional state (but they said users were volunteers because "terms of service"...)
• deleted 5y ago
  [deleted]
• Animats 5y ago
  This is starting to snowball. Industry news sites are picking up the story.[1] Hasn't hit the mainstream press yet. No word from DHS Cybersecurity yet. [1] https://www.google.com/search?channel=fs&q=university+of+minnesota+banned https://www.google.com/search?channel=fs&q=university+of+min...
  • evgen 5y ago
    So far it has only been 'insiders' (FOSS-aware/friendly press and trade press a bit closer to the dev side than the management side) but the real question will be if it hits any large mainstream news sites by tomorrow. If it does not land until Friday then the story is over in terms of real consequences, but the PR team at UMN is probably hoping that fast damage control now can push anything major out a day or two where it disappear into the weekend trash.
    • thatguy0900 5y ago
      Your tech department being blackballed from submitting Linux patches is a pretty embarrassing consequence. What else would happen? It's not like anyone will fine them.
      • dporter 5y ago
        Loss of grant money
        • thatguy0900 5y ago
          Oh, true
      • tjalfi 5y ago
        > Your tech department being blackballed from submitting Linux patches is a pretty embarrassing consequence. What else would happen? It's not like anyone will fine them. The ban could affect donations from alumni or corporations.
  • alpb 5y ago
• detaro 5y ago
  I found these statements by the associate department head interesting: https://twitter.com/lorenterveen/status/1384955467051454466 https://twitter.com/lorenterveen/status/1384955467051454466 > I do work in Social Computing, and this situation is directly analogous to a number of incidents on Wikipedia quite awhile ago that led to that community and researchers reaching an understanding on research methods that are and are not acceptable. and https://twitter.com/lorenterveen/status/1384966202301337603 https://twitter.com/lorenterveen/status/1384966202301337603 > Yes! This was an IRB 'failure'. Again, in my area of Social Computing, it's been clear for awhile that IRBs often do not understand the issues and the potential risks/harms of doing research in online communities / social media. An interesting question is IMHO who people actually tried to contact in the first round of this getting publicity (and I guess how many did so at all), and if leadership should thus have been aware earlier that there was controversy worth looking into.
  • fhars 5y ago
    That whole twitter thread is really interesting, starting from https://twitter.com/lorenterveen/status/1384954220705722369 https://twitter.com/lorenterveen/status/1384954220705722369
    • detaro 5y ago
      Yes Twitter is "weird" about with sub-thread it picks as the "main" one (well, it choses one and didn't pick the interesting one here), so I had to explicitly link the latter point.
    • debaserab2 5y ago
      Yeah, it gets even worse: https://twitter.com/SarahJamieLewis/status/1384871385537908736 https://twitter.com/SarahJamieLewis/status/13848713855379087...
      • deleted 5y ago
        [deleted]
      • alisonkisk 5y ago
• gumby 5y ago
  This kind of research is interesting and important but should not be done by a computer science department, any more than the social science department should try to develop a process control system.
  • spuz 5y ago
    Which department should do it?
    • gumby 5y ago
      Sociology or anthropology. Possibly, though less so, political science, economics, or even a B school. These are all disciplines that study the social behavior of groups. As as study of a group activity it seems inapplicable to a psychology department, though that could be a bias on my part.
      • drexlspivey 5y ago
        How would sociologists and anthropologists know how to write kernel code ..?
        • gumby 5y ago
          Assuming you are not joking, they would presumably partner with someone who does write such code. And similarly for other kinds open source projects.
  • detaro 5y ago
    No, computer science departments should be adequately equipped and trained to handle this. Lots of areas of computing involve humans and need to be studied by people also knowledgeable about the technical side. (and "computer science" departments usually are not strictly "pure computer science" departments, it's just the usual label under which most of computing ends up)
• cperciva 5y ago
  The title here should probably be "UMN CSE Department Statement..." rather than merely "UMN Statement ..." since it's coming from the department head and associate department head, not from the university as a whole. cc/ dang
  • YetAnotherNick 5y ago
    Sorry for getting sidetracked, but does cc has any special function here or you are hoping that dang would read all the comments and see your cc?
    • dredmorbius 5y ago
      The recommended mode of reaching HN's moderation team is by email at hn@ycombinator.com Though I suspect periodic searches for recent mentions of dang's username in comments are also employed. It's a matter of what's most efficient and convenient for the team, and what community practices have evolved.
    • cperciva 5y ago
      I think dang might have something in place which alerts him when he is mentioned. Certainly he tends to show up quickly when people "page" him like this.
      • deleted 5y ago
        [deleted]
      • CoastalCoder 5y ago
        It's a bit like saying Voldemort, somehow he always knows. But opposite because dang is helpful and nice.
      • dang 5y ago
        I used to have that, but it stopped working with the last re-Lisp of my moderation software. It's on my list to redo it. https://news.ycombinator.com/item?id=20652146 https://news.ycombinator.com/item?id=20652146 Some of this stuff will eventually get open-sourced and/or integrated into HN for everybody.
• h2odragon 5y ago
  "We discovered some folks have been urinating into the campus coffee urns, in order research whether people will object to the flavor. We have told them to stop."
  • kapp_in_life 5y ago
    Allegedly. Of course the department will want to do their due diligence and investigate the accusations.
  • infogulch 5y ago
    A potent analogy, perhaps it will sway those that don't consider consent an important part of social research. I expect the department and university to perform a thorough investigation, and respond with decisive action afterwards. Not the other way around.
    • h2odragon 5y ago
      > respond with decisive action afterwards. Not the other way around. ... absolutely. Perhaps people liked the flavor.
      • infogulch 5y ago
        Your insinuation that I think there may have been no wrongdoing is unjustified and insulting. The behavior has been halted from both sides, no more active harm is being done; your urgency is misplaced. Somehow you think it's unreasonable to investigate before casting judgement -- as if justice itself is invalid if not met out at the pace of a twitter mob's attention span.
        • h2odragon 5y ago
          I beg your pardon; i do not insinuate anything on your part: I agree with you. Investigate this and see if there's been any wrongdoing or just honest mistakes and correct those that were made... at the professional, academic level; that certainly seems proper. I am snarking about the apparent disconnect between the previous suspect activities that have apparently not yet resulted in that kind of oversight thus requiring this kind of sanction from the kernel team. I am snarking because the "poor us" these folks already pulled on LKML shows any debate is pointless, as this is firmly a matter of identity politics already. In other words, yes, some people do prefer that flavor.
• janoc 5y ago
  That sounds like someone's academic career has just landed in the toilet ...
  • tolbish 5y ago
    I wonder if potential collaborators will come to light, from UMN or other universities.
  • Fordec 5y ago
    Apparently the researchers in question don't have tenure. If that is so, RIP to their achedemic careers right now.
    • thu2111 5y ago
      That seems optimistic. Scientific fraud is caught all the time and basically never results in anything happening. The university here repeatedly signed off on this so it's institutionally culpable. Normally when bad stuff happens in research academics just all blatantly deny anything is wrong and dare you to do anything about it.
• Will_Do 5y ago
  I guess the question I have is "Did any *previous* research done by UMN successfully introduce bugs into the Linux Kernel git commit log?" There are weasel words in this statement that make it unclear and the researchers have been really dishonest already. But! If it's true that their research has never made it out of email chains then it does seem like the reaction is a bit disproportionate to the damages here.
  • hannasanarion 5y ago
    Much focus is on the 3 patches from the paper last year, but others have been submitted before and since by the same group, and some that have been found to be malicious did make it into the Stable branch: https://lore.kernel.org/lkml/78ac6ee8-8e7c-bd4c-a3a7-5a90c7ccb399@roeck-us.net/ https://lore.kernel.org/lkml/78ac6ee8-8e7c-bd4c-a3a7-5a90c7c...
  • finnthehuman 5y ago
    Lu has posted to LKML today, weasel wording around when asked point blank for a list of everything malicious sent to the kernel. https://lore.kernel.org/lkml/YIBMKSovJumS79SR@pendragon.ideasonboard.com/ https://lore.kernel.org/lkml/YIBMKSovJumS79SR@pendragon.idea... e: Not getting pulled into a maintainer tree isn't enough to be safe about what was posted to a kernel mailing list. People can (and testing scripts blindly do) grab and apply patches on the mailing list.
• res0nat0r 5y ago
  Being unaware of whatever this is, until this HN post just now, I'm still in the dark as exactly what was being done which was apparently unethical since the statement doesn't mention any details. Anyone have any details on what the issue is?
  • thatguy0900 5y ago
    They submitted patches that did nothing but introduce vulnerabilities, in a test to see if they would get through. They've done this previously for a research paper.
    • nomel 5y ago
      From my understanding, it wasn't this. It was that they didn't come clean or provide a quick emergency stop when they saw that the patches would make it through. Although, I'm having trouble sifting through the rage/drama.
  • loeg 5y ago
    It's still #3 on the front page: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 (and other iterations on the same story earlier today).
    • res0nat0r 5y ago
      Ah thanks. How moronic, whomever thought this was in any way a good idea is pretty out of touch with reality.
      • a-dub 5y ago
        isn't it just a form of red teaming? has red teaming fallen out of fashion?
        • detaro 5y ago
          red teaming without approval of the target org is out of fashion, yes.
• iasmseanyoung 5y ago
  I do some maintenance work for the linux kernel dvb and infrared subsystems. I reviewed and accepted some patches from umn.edu addresses. They looked fine to me, however they're all around error handling, which can get pretty tricky with long error paths. What else can I do than revert the lot?
  • tytso 5y ago
    gregkh sent a 190 patch series to revert all of the "easy" UMN reverts, pending review. People are now looking at the patches and saying things like, "that's one OK, don't revert". There are another 68 commits which did not revert cleanly, in some cases because they were later fixed up, already reverted, or some other patch has touched those lines of code. This will require further manual work. We basically at this point assuming bad faith for all UMN patches and reviewing them all before allowing them to stay in. (Or if they get reverted by default, someone else can manually apply them after they go through strict review.) Fool me once, shame on you, fool me twice....
    • tedd4u 5y ago
      What a mess, that could be hundreds of hours of work …
    • kapp_in_life 5y ago
      >We basically at this point assuming bad faith for all UMN patches This seems like a gross overreaction to three commits that didn't even make it into mainline. Especially when done for commits years before the "research" was done. But I suppose nobody can miss a chance to let loose a little outrage
      • Denvercoder9 5y ago
        There were more than three buggy commits, at least one of which is from this month
        • kapp_in_life 5y ago
• baxter001 5y ago
  background for those unfamiliar with this: https://news.itsfoss.com/hypocrite-commits/ https://news.itsfoss.com/hypocrite-commits/ and Kangjie Lu's response: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....
  • Doctor_Fegg 5y ago
    The sheer entitlement of this: > Does this project waste certain efforts of maintainers? > Unfortunately, yes. We would like to sincerely apologize to the maintainers involved in the corresponding patch review process; this work indeed wasted their precious time. We had carefully considered this issue, but could not figure out a better solution in this study. Here’s a better solution: don’t do it. You do not have a divine right to carry out this “research” no matter what.
    • WrtCdEvrydy 5y ago
      I blew up at someone in the different thread and got roasted... but I don't understand why you couldn't talk to the team reviewing the patches... Seriously, tell them "we're going to send 10 patches for security review, don't merge any of them, tell us if it's good or not"
      • julianlam 5y ago
        I don't want to defend the researcher, but that's not a solution. The way it was done was at least blinded (even if ethically wrong).
        • burnished 5y ago
          What would be wrong with that? It seems like it would have handled the issue of consent pretty straight forwardly.
          • CRConrad 5y ago
• nickysielicki 5y ago
  Now we wait for the IEEE statement. They will release a statement, right?
  • WrtCdEvrydy 5y ago
    I sent an email to the chair of the conference asking if this was ethically okay...
  • pbzcnepu 5y ago
    if they release a statement as fast as they did for the ISCA'19 peer review fraud case you might be waiting a while (took more or less 2 years)
• 29athrowaway 5y ago
  Linux is used for very sensitive stuff. Stuff that involves a lot of money. Messing with Linux is messing with that sensitive stuff, which means messing with important people and organizations. That is something that is very hard to get away with. That guy just got himself into a legal supernightmare. If someone is running a stock exchange on Linux and a guy introduces vulnerabilities on purpose, I am sure that person will be pretty upset and pursue litigation.
• kbumsik 5y ago
  For someone who don't know what happened: “They introduce kernel bugs on purpose” https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670
• readingnews 5y ago
  Eh, I work at a uni. This came from a dept head. The university is taking it seriously?? Doubt it. Now, when a Dean puts up a webpage... things just got serious.
  • elliekelly 5y ago
    I wonder if there’s anyone higher up in the administration even aware this is happening.
    • bluGill 5y ago
      There should be at least a minute at the regular deans meeting about this. Which means the head of the other departments know. When I was there CS was both an engineering degree and a liberal arts degree, so that probably means heads of departments like Mechanical Engineering, and Music have heard of it. For now it can be a "something CS is taking care of, but you need to be aware of it in case they don't".
  • korethr 5y ago
    IMO, the CompSci department would be the one most severely and immediately affected. Is it not better that the CompSci dept head addresses the issues of their department before the dean has to get involved?
  • TMWNN 5y ago
    The announcement also appears on the department's website. https://cse.umn.edu/cs https://cse.umn.edu/cs
• lmeyerov 5y ago
  Interesting, looks like the 2nd time they're doing the same thing, and 2nd time they're in hot water for it. They even apologized the first time by pleading naivete: https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... . First time they initially skipped IRB review for sending malicious patches to the mailing list, which people do install. (So IRB exemption should not apply.) A top security conference allowed a paper with a broken IRB process, and UMN IRB, when a later IRB exempt request was filed, explicitly allowed this. Bad, bad, and bad. The latest Linux incident seems like a repeat by the same CS dept, advisor, student, & presumably, UMN IRB. No naivete excuse anymore, this is now business as usual. The bigger fail to me is the UMN dept head + IRB, and the security conference review process around IRB norms. Especially damning that it's a repeat of the same IRB mess. IRB exemption matters a lot for practicing scientists, and leadership tolerating this stuff is what will get it taken away for everyone else. Fool me once..
  • re 5y ago
    > looks like the 2nd time they're doing the same thing It's not clear that they're doing the same thing--we don't know that these recent patches are deliberately bogus. See this comment with clarifications from the other post: https://news.ycombinator.com/item?id=26890583 https://news.ycombinator.com/item?id=26890583
    • lmeyerov 5y ago
      Agreed! The broader R&D group seems to work on symbolic execution, and given the patches, which it seems to stem from. Most charitably, the tool makes changes maintainers largely don't care about -- see the revert reviews that characterize past acceptances as being rubberstamping of irrelevant patches to irrelevant code -- so this just violates basics like informed consent by not disclosing what's happening. Maintainers had to figure out the nonsense, and instead of declining a second round of undesirable non-opt-in participation, banned. What would normally happen is the patches would be tagged w/ the R&D tool, so people know they're part of an experiment, and can ignore / ask them to stop / consent through action. Less charitably, it is a DoS attack on reviewers, and who knows what else is in here. Either way... not good.
• 1970-01-01 5y ago
  Good start. That was faster than expected.
• lfc07 5y ago
  I am definitely against the line of research and hope someone acknowledges their fault. I also want to appeal that the issue it taking a political turn with a lot of unwarranted hate in forums and media mostly from people who are not part of kernel community. We are talking about young researchers and some possibly are misguided or innocent. Lets now make a political feast out of this just because we can.
• vzaliva 5y ago
  Here is some background for those who are not familiar with the rules of academic research in the US. Usually, any experiments involving human subjects are subject to Univesity Institutional Review Board (IRB) [1] approval. IRB should evaluate both ethical and safety concerns. I recall having to jump through quite a few hoops just to do a simple touch screen gesture recognition test of a dozen willing fellow students. Apparently, the IRB approval step was skipped, or IRB failed to do its job in this case. [1] https://en.wikipedia.org/wiki/Institutional_review_board https://en.wikipedia.org/wiki/Institutional_review_board
  • bluGill 5y ago
    This wasn't a direct test on the maintainers, so it is easy to see how the IRB would miss that. Still not excusable to miss that there are humans involved.
• eganist 5y ago
  This is a statement announcing an investigation. Expecting a mea culpa right at this time is a bit premature considering they still need to figure out where they went wrong. There's value in setting down the pitchforks.
• motohagiography 5y ago
  The other reason this is a hotbutton issue is because it is related to the general problem of abusing the universities as a protected platform for general subversion for its own sake. It's not innovation or research, or even progress, it's actively destabilizing and subverting a targetted community that a huge part (even majority) of the economy depends on the integrity of. This is a hawkish view, but in a challenging cultural moment, their activities are very difficult to be charitable about.
• RayVR 5y ago
  The heads of departments are political animals. This is purely a damage mitigation strategy. If we give them more credit than they really deserve, the department and IRB were severely negligent.
• g42gregory 5y ago
  I don't know why, but somehow I am not too bothered by the research itself. Sure, in retrospect, it does not sounds like it was the right thing to do (or the right way to do). But, you know, stuff happens. Instead, what bothered me immensely is the way the PhD student handled that interaction: immediately claiming "bias", "slander", playing "victim", etc... I don't know if he learned such a way to communicate from his professors, other students at the CS&E department, or UMN environment in general, but it's very bothersome to me. Such way to communicate precludes constructive (and perhaps heated) exchange of ideas. I think people like that should be nowhere near important CS/EE projects.
  • dshpala 5y ago
    Maybe that was in line with the "research"? I think this can be an interesting topic in itself, how those trigger words and victim playing can get you through code reviews faster. It's certainly true in my company...
    • g42gregory 5y ago
      It looks like Linux kernel has passed the test!
      • kfajdsl 5y ago
        I think many of the responses from Linus over the years shows that Linux never needed that test ;)
  • oh_sigh 5y ago
    It's entirely possible that Aditya is actually just working on a static analysis tool, it is buggy, and he wasn't aware of the other research his advisor does. If that is the case, I can kind of understand his response. I would be pretty upset if I knew I was just trying to submit some honest(if buggy) patches, but was accused of being a scoundrel because of something that didn't even involve me. Of course, it's also possible that he is just gaslighting Greg and actually was doing the same kind of "research" as other people did before. I think that UMN will get to the bottom of it - it will be pretty clear to them what kind of research he was doing, and whether he represented himself honestly.
• ransElectronics 5y ago
  The researchers, the researcher's bosses and pretty much every person in command at UMN had to sign off on this being an acceptable method of conducting research. This shows such an extreme lack of good faith or judgement on their part that I do not believe UMN could, or should ever be forgiven. Their actions show nothing but criminally bad faith taking place, all the way up to the top. The only rational response from the Kernel team is to revert all code submitted by any member of UMN and to permanently blacklist every person who has ever attended UMN or worked at UMN for any reason or any length of time. The only way I could see this getting forgiven is if every party that could have cancelled the project is forcibly removed from holding any position of employment or enrollment at UMN, going all the way up to the head owners and managers of the entire university.
  • seoaeu 5y ago
    > The researchers, the researcher's bosses and pretty much every person in command at UMN had to sign off on this being an acceptable method of conducting research. That is nothing like how research operates at a university like UMN. At a research university, typically the only person that actually must sign off on a computer science experiment is the grad student / professor actually doing the work. Graduate students frequently clear their work with their advisors first, but even that isn't strictly required. A small amount of work technically requires IRB approval, but unless what you're doing is very obviously human subject research, it is unlikely anyone would even notice if you went rogue and ignored it.
    • ransElectronics 5y ago
      I am not talking about people actively approving it. I am talking about people passively allowing it to happen. For this mess to have even happened in the first place, the entire workforce at UMN had to look at that and go "yep, there's nothing ethically wrong with this" and just passively let it happen. At best this shows their unchecked desire to destroy OSS projects. What is their end goal, exactly? I have no idea. The research paper they already put out seems like a charade for whatever that goal was, and we can only speculate. For this reason nobody can trust anybody working at UMN or anybody getting educated through UMN.
• jtchang 5y ago
  It's not just the linux kernel. You can imagine this having some fallout to other open source projects where they all come out and say they won't accept contributions from the university. Huge PR nightmare.
• locacorten 5y ago
  I think everybody is missing the point. If one grad student was able to do this, imagine what a team of dozens of well-paid, well-equipped, and highly experienced security experts could do. In other news, we just learned that any half-decent security agency has already injected their own vulnerabilities and back-doors in OSS.
  • aahortwwy 5y ago
    > do this They got caught and had all their contributions reverted.
    • deleted 5y ago
      [deleted]
    • seanieb 5y ago
      After the code was accepted and in mainline… the horse was well out of the barn.
    • kelnos 5y ago
      Sure, but are there others who did not get caught? Others who might be better at obscuring their changes? And who might first develop a history of good, secure work, and then slip something sketchy into one -- and only one -- patch? Seems like the UMN "researcher" was doing this over and over; the more times you do it, the more likely you are to get caught.
  • prepend 5y ago
    He didn’t succeed in injecting anything, right? It would be interesting if someone found bad stuff in the kernel, but pet of the org structure makes this hard.
    • ghughes 5y ago
      He landed code that nobody seems to understand the purpose of. That looks like success to me.
• williesleg 5y ago
  China.
• ghughes 5y ago
  Ethics of the research aside, it has succeeded in showing that it is far too easy to sneak malicious code into the kernel. It sucks that the maintainers have to play cleanup, but at least it will hopefully lead to a positive outcome.
• zadwang 5y ago
  The research approach is distasteful and dangerous. Any one should not introduce bugs or malicious code intentionally, even for research purpose. The results are also a bit trivial. It is easy to imagine that this type of code injection would be possible. So let this be an example of what is the consequence of intentional malicious code injection, even in the name of research. I wish I could be on the researchers' side, as I am both Chinese and an alum from UMN. But No - wrong is wrong.
  • isatty 5y ago
    Being Chinese has nothing to do with this discussion.
• metanonsense 5y ago
  To me reverting those hundreds of patches sounds like an overreaction, which might cause actual damage. It's not clear (at least from what I have read in the thread) that this code, which may be wrong or at least useless, is part of any "let's check their patch process" experiment (or did I just miss that?) That they did that in the past is clearly unethical and was generally a shitty thing to do, but this group also seems to do technical security research. That the student (allegedly) trusted his static code analyzer so much that he did not care to verify its findings doesn't speak for him, but Hanlon's razor may also apply here. Just banning that student (if he keeps submitting technically inferior patches) should be enough imho.
  • deleted 5y ago
    [deleted]
  • burnished 5y ago
    I'm not sure it's an overeaction on the basis that it's the response to a loss of trust. Why should they maintain a relationship that's been abused?
• mox1 5y ago
  Mats was my prof for software engineering when I was there back in 2008ish. He is a good guy I trust he will handle it well.
• xwdv 5y ago
  These people who conducted the research need to be fired immediately, but I'm pessimistic about that.
• zekrioca 5y ago
  Authors’ response: https://www-users.cs.umn.edu/%7Ekjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/%7Ekjlu/papers/clarifications-h...
  • rubidium 5y ago
    I don’t understand the news cycle on this. What happened today that lead to the blow-up if this was already public in December ?
    • gomijacogeo 5y ago
      I think GregKH complained to the university previously and then, when presented with continuing bad/bad-faith patches, decided to blow up their world very publicly.
• zadwang 5y ago
  The research approach is distasteful and dangerous. Any one should not introduce bugs or malicious code intentionally, even for research purpose. The results are also a bit trivial. It is easy to imagine that this type of code injection would be possible. So let this be an example of what would be the consequence of intentional malicious code injection, even in the name of research. I wish I could be on the researchers' side, as I am both Chinese and an alum of UMN. But No - wrong is wrong.
• seanieb 5y ago
  Hopefully the reviewers that failed to do proper reviews of those patches get relived of their privileges too. And the process gets throughly reviewed to prevent reviews being a glorified rubber stamp process.
  • alisonkisk 5y ago
    I don't think you understand how Linux works. It's run by criminally underfunded volunteers. No one's getting "relieved of their privileges" do to intensely difficult, under-appreciated work.
    • thrwaeasddsaf 5y ago
      Maybe they should just kick out all those hobo beggars from red hat, intel, oracle, etc. and get some well compensated professionals on board.
• jasonhansel 5y ago
  It seems concerning that the investigation is being conducted by the CS&E department itself, rather than an independent third party. There's a risk that the results of the investigation won't be seen as impartial, since the CS&E faculty obviously have an interest in protecting the department's reputation.
• andy_ppp 5y ago
  Can someone explain why engineering of bugs into products is bad but hacking to find software defects is good. I think trying to do this sort of research is good because obviously it presents a vector for malicious actors we should all be aware of. It’s good that the Linux team found these issues but I don’t see the intention as being any different than any other kind of hacking, just like some organisations will send you phishing emails once or twice a year to see if you’re susceptible.
  • ac42 5y ago
    Society works because of trust. Activities like these erode trust. It's like "let's try and pour a bottle of acid into the freshwater storage facility".
    • deleted 5y ago
      [deleted]
    • andy_ppp 5y ago
      How do we stop more malicious actors doing things like this is really the question I’m asking. People who aren’t security researchers but say state actors who want Linux backdoors?
  • seoaeu 5y ago
    What's valuable is fixing security issues. So if you "hack" some system and then provide either patches or useful guidance on how to eliminate a vulnerability that is helpful. By contrast, if a security issue is already known/is being addressed, exploiting that vulnerability just causes problems and wastes people's time.
• dleslie 5y ago
  The university's ethics committee approved the research, and it was guided by a number of their professors. I see no acknowledgement of this in the statement; instead, I see the groundwork laid for hanging the students out to dry. > The research method used raised serious concerns in the Linux Kernel community and, as of today, this has resulted in the University being banned from contributing to the Linux Kernel. The research method _approved by the University's internal authorities_.
  • detaro 5y ago
    > We will investigate [...] the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, And the associate department head labelling it a failure of the review process: https://twitter.com/lorenterveen/status/1384966202301337603 https://twitter.com/lorenterveen/status/1384966202301337603
    • dleslie 5y ago
      > To get more specific: CS department leadership didn't know about the back and forth or publicity about this work in December. "_or publicity_" I think that says enough about the U of Mn.
      • deleted 5y ago
        [deleted]
      • detaro 5y ago
        I mean, the "publicity" here was the paper announcement and some arguing on Twitter involving the professor, that's not automatic "department leadership needs to look into this" material. If the IRB didn't find anything, it also didn't have a reason to involve leadership. As said elsewhere, something should probably have been noticed at that point, but they intend to look into that. Seems fair, as long as that's what they do properly.
        • dleslie 5y ago
• pbzcnepu 5y ago
  you should notice that the professor involved is listed as being on the Program Committee for IEEE S&P 2022 already, meaning he must be well-connected with various higher ups at the conference. This is probably why they are reluctant to remove the paper. There were similar issues with the ISCA'19 peer review fraud case. IEEE/ACM are having some major issues these days.
• ac42 5y ago
  I sincerely hope they didn't just do that because someone whose empire is built on Linux rang them up.
• dang 5y ago
  Related ongoing thread: “They introduce kernel bugs on purpose” - https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 - April 2021 (1562 comments and counting)
• grendelt 5y ago
  Is there no oversight as to what research is being done? In social sciences and medicine there's the IRB, is there not some similar cursory oversight board?
• sergiogjr 5y ago
  I'm still expecting the: “We apologize again for the fault in the commits. Those responsible for sacking the people who have just been sacked have been sacked.” - UMN CS&E
• throwaway4400 5y ago
  Translation: a whole bunch of people below us in the foodchain are about to get their asses kicked. I am very curious to hear who approved wasting the time of Linux kernel developers, many of whom are volunteers, with this excuse for academic research.
• nullc 5y ago
  CS department security research is near universally not held to be in the scope of IRBs. This isn't entirely bad: the IRB process that projects are subjected to is so broken that it would be a sin to bring that mess on any other things. But it means the regularly 'security' research does ethically questionable stuff. IRBs exist because of legal risk. If parties harmed by unethical computer science research do not litigate (or bring criminal complaints, as applicable) the university practices will not substantially change.
• jfrunyon 5y ago
  > Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members Uhh... they didn't know what their own employees were doing? Don't most universities have review/approval procedures before people can do experiments or studies?