4 ms·

Anyone saying that it was a bad idea to ban the entire University isn't looking at the big picture. I look at it from a very philosophical standpoint: The enti

Anyone saying that it was a bad idea to ban the entire University isn't looking at the big picture. I look at it from a very philosophical standpoint: The entire idea of an academic (research) institution can be summarized as "an entity representing a group of trusted people who act in good faith of that institution". The moment one of your researchers acts in bad faith, or shows that they cannot be trusted, it's clear that the institute cannot be trusted until the institute takes decisive restorative action. By banning the University, you are saying "we no longer trust you in your authority as an institution until it can be made clear that this isn't a systemic problem."... you are not saying "every single person at the University is terrible" as it was framed by some commenters in the other thread. This is why, in any broad case, it's so upsetting when an institution of any variety doesn't take clear responsibility for the behavior and actions of its members or representatives (take for example the police, or the federal government). When that is true, the behavior of any member of that institution should be subject to scrutiny and distrust. It's not a complicated social phenomena.

toss1 5y ago
Yup, it had to be dealt with on an org level, not only the offending person/group. Although it isn't the medical profession, the same directive should apply to research: "First, do no harm." This deliberate poisoning of OS projects without prior permission to 'test the security' violated that big time. I'm astonished it got past any ethics review, indicating to me that there likely was none.
- seoaeu 5y ago
  Ah, but you're missing the directive that medicine doesn't have: "If a doctor commits malpractice, immediately disregard all medical advice given to you by any other doctors at their hospital"
  - hutzlibu 5y ago
    If one doctor at a hospital does very bad things - then yes, I would avoid that hospital completely. Because in a working environment, bad actors would be detected by colleagues, etc. And since this not happened, one can only assume the whole hospital to be deeply flawed.
    - toss1 5y ago
      Indeed! If I heard that a doctor was deliberately and repeatedly poisoning his patients, I'd absolutely avoid the place because proper oversight is clearly lacking. Perhaps the hospital actually has excellent oversight and it is just that the evil doctor is exceptionally clever at avoiding it. But, Occam's Razor says that is a poor bet.
kapp_in_life 5y ago
Banning the university is fine to send a message, but reverting all patches from umn emails seems very shortsighted to me. Especially blindly reverting patches years before this "research" was conducted that almost certainly have had context changes around them, likely introducing more harm than good.
- zacwest 5y ago
  I could easily see sending in a bad patch to see what happens and then waiting a few years to do more and write them up; there's no realistic way to guarantee when the bad-faith contributions started.
- shultays 5y ago
  they are re-reviewing the patches and will be accepting them back if they look fine, it is not really blindly rejecting them all
  - kapp_in_life 5y ago
    And in the meantime allowing patched permissions vulnerabilities to reappear in mainline? Seems to be a bit of an overreaction no? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c9318a3e0218bc9dacc25be46b9eec363259536f https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
    - unanswered 5y ago
      Except that patch is clearly BS! You can't patch a double-read vulnerability by checking for a capability; that's not a thing that works. So either the description is wrong, or the patch is wrong, or both. And the point of the reverts is that the kernel maintainers don't have the unlimited time that would be necessary to re-review all of these questionable patches for probable malicious underhanded C, so they are reverted for now for triage (not permanently). For the linked patch, I would judge it possibly malicious as it leaves the identified vulnerability in the kernel for later exploit by the attackers, namely, the UMN research team.

toss1 5y ago

Yup, it had to be dealt with on an org level, not only the offending person/group. Although it isn't the medical profession, the same directive should apply to research: "First, do no harm." This deliberate poisoning of OS projects without prior permission to 'test the security' violated that big time. I'm astonished it got past any ethics review, indicating to me that there likely was none.

seoaeu 5y ago
Ah, but you're missing the directive that medicine doesn't have: "If a doctor commits malpractice, immediately disregard all medical advice given to you by any other doctors at their hospital"
- hutzlibu 5y ago
  If one doctor at a hospital does very bad things - then yes, I would avoid that hospital completely. Because in a working environment, bad actors would be detected by colleagues, etc. And since this not happened, one can only assume the whole hospital to be deeply flawed.
  - toss1 5y ago
    Indeed! If I heard that a doctor was deliberately and repeatedly poisoning his patients, I'd absolutely avoid the place because proper oversight is clearly lacking. Perhaps the hospital actually has excellent oversight and it is just that the evil doctor is exceptionally clever at avoiding it. But, Occam's Razor says that is a poor bet.

kapp_in_life 5y ago

Banning the university is fine to send a message, but reverting all patches from umn emails seems very shortsighted to me. Especially blindly reverting patches years before this "research" was conducted that almost certainly have had context changes around them, likely introducing more harm than good.

zacwest 5y ago
I could easily see sending in a bad patch to see what happens and then waiting a few years to do more and write them up; there's no realistic way to guarantee when the bad-faith contributions started.
shultays 5y ago
they are re-reviewing the patches and will be accepting them back if they look fine, it is not really blindly rejecting them all
- kapp_in_life 5y ago
  And in the meantime allowing patched permissions vulnerabilities to reappear in mainline? Seems to be a bit of an overreaction no? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c9318a3e0218bc9dacc25be46b9eec363259536f https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
  - unanswered 5y ago
    Except that patch is clearly BS! You can't patch a double-read vulnerability by checking for a capability; that's not a thing that works. So either the description is wrong, or the patch is wrong, or both. And the point of the reverts is that the kernel maintainers don't have the unlimited time that would be necessary to re-review all of these questionable patches for probable malicious underhanded C, so they are reverted for now for triage (not permanently). For the linked patch, I would judge it possibly malicious as it leaves the identified vulnerability in the kernel for later exploit by the attackers, namely, the UMN research team.