4 ms·

That question has been obvious for quite some time. It is always possible to introduce subtle vulnerabilities. Research has tried for decades to come up with a

by corty 6y ago

That question has been obvious for quite some time. It is always possible to introduce subtle vulnerabilities. Research has tried for decades to come up with a solution, to no real avail.

danielbot 6y ago
Assassinating the researchers doesn't help.
- thelean12 6y ago
  The Linux team found the source of a security threat and have taken steps to prevent that security threat from continuing to attack them. You can't break into someone's house through their back window, tell the owners what you did, and not expect to get arrested. People don't scream "how are we going to know that people can break into houses through broken windows without these heros!?"
  - cthaeh 6y ago
    Does nobody here even understand what actually happened? Really losing my faith in the accuracy of HN if such a huge thread is full of misinformation. Basically (as I understand it, feel free to correct me) this is what happened: Researcher emailed maintained with flawed code, maintainer LGTMed it, researcher told maintainer that the code is buggy and not to merge it. The researchers confirmed that the code was not merged or commited anywhere. Paper gets published. Nothing of note happens. Now, one of the researchers grad students has submitted stuff to linux oh his own volition- he does not appear to be associated with the previous research. These commits are "obviously bad" according to linux maintainers and claim that the grad student is just continuing the "merge bad shit" research. These commits do not appear to be intentionally flawed but rather newbie mistakes (so claims the student)- which is why he feels the linux community is unwelcoming to newcomers. Now how on earth did that warp to whatever everyone here is smoking?
    - kapp_in_life 6y ago
      This seems like exactly what happened to me. I do still think the researcher should have gotten approval from maintainers or the foundation before going ahead, and the way he did the research was pretty shitty. But you also forgot the part where Greg throws a hissy fit and decides to revert every commit from umn emails, including 3+year old commits that legitimately fix security vulns.[0] Great job keeping mainline bug free with your paranoid witchhunt! https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c9318a3e0218bc9dacc25be46b9eec363259536f https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
      - db48x 6y ago
        That one has already been vouched for; I doubt it will actually be reverted: https://lore.kernel.org/lkml/b27a43bb-36bc-4b9-42de-c39a5b68f96f@namei.org/ https://lore.kernel.org/lkml/b27a43bb-36bc-4b9-42de-c39a5b68... If you know of any others that shouldn’t be reverted, you should email the list and point them out.
    - neatze 6y ago
      I read everything I could find, in short, researchers did not give any options for maintainers not to participate in research. The best analogy I could come with so far is; someone offered you compelling job offer, and when you where ready to sign up they would be yeah, that was research project, sorry - would you be ok with such behavior ? This not ok, because you did not consent to waste your time on someone else's research project.
      - cthaeh 6y ago
        They addressed this in the paper by making the change small (5 lines). Obvsiously time is still wasted, but the team felt that the research warranted it. This is up to debate and should not be used solely as a reason to crucify them.
    - akramer 6y ago
      There's a reply to the LKML from the researcher in question admitting that the new student is also working under him doing research. He claims it's not related, but it's not clear how much his word is worth now... https://lore.kernel.org/lkml/YIBBt6ypFtT+i994@pendragon.ideasonboard.com/ https://lore.kernel.org/lkml/YIBBt6ypFtT+i994@pendragon.idea...

by corty 6y ago

That question has been obvious for quite some time. It is always possible to introduce subtle vulnerabilities. Research has tried for decades to come up with a solution, to no real avail.

danielbot 6y ago

Assassinating the researchers doesn't help.

thelean12 6y ago
The Linux team found the source of a security threat and have taken steps to prevent that security threat from continuing to attack them. You can't break into someone's house through their back window, tell the owners what you did, and not expect to get arrested. People don't scream "how are we going to know that people can break into houses through broken windows without these heros!?"
- cthaeh 6y ago
  Does nobody here even understand what actually happened? Really losing my faith in the accuracy of HN if such a huge thread is full of misinformation. Basically (as I understand it, feel free to correct me) this is what happened: Researcher emailed maintained with flawed code, maintainer LGTMed it, researcher told maintainer that the code is buggy and not to merge it. The researchers confirmed that the code was not merged or commited anywhere. Paper gets published. Nothing of note happens. Now, one of the researchers grad students has submitted stuff to linux oh his own volition- he does not appear to be associated with the previous research. These commits are "obviously bad" according to linux maintainers and claim that the grad student is just continuing the "merge bad shit" research. These commits do not appear to be intentionally flawed but rather newbie mistakes (so claims the student)- which is why he feels the linux community is unwelcoming to newcomers. Now how on earth did that warp to whatever everyone here is smoking?
  - kapp_in_life 6y ago
    This seems like exactly what happened to me. I do still think the researcher should have gotten approval from maintainers or the foundation before going ahead, and the way he did the research was pretty shitty. But you also forgot the part where Greg throws a hissy fit and decides to revert every commit from umn emails, including 3+year old commits that legitimately fix security vulns.[0] Great job keeping mainline bug free with your paranoid witchhunt! https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c9318a3e0218bc9dacc25be46b9eec363259536f https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
    - db48x 6y ago
      That one has already been vouched for; I doubt it will actually be reverted: https://lore.kernel.org/lkml/b27a43bb-36bc-4b9-42de-c39a5b68f96f@namei.org/ https://lore.kernel.org/lkml/b27a43bb-36bc-4b9-42de-c39a5b68... If you know of any others that shouldn’t be reverted, you should email the list and point them out.
  - neatze 6y ago
    I read everything I could find, in short, researchers did not give any options for maintainers not to participate in research. The best analogy I could come with so far is; someone offered you compelling job offer, and when you where ready to sign up they would be yeah, that was research project, sorry - would you be ok with such behavior ? This not ok, because you did not consent to waste your time on someone else's research project.
    - cthaeh 6y ago
      They addressed this in the paper by making the change small (5 lines). Obvsiously time is still wasted, but the team felt that the research warranted it. This is up to debate and should not be used solely as a reason to crucify them.
  - akramer 6y ago
    There's a reply to the LKML from the researcher in question admitting that the new student is also working under him doing research. He claims it's not related, but it's not clear how much his word is worth now... https://lore.kernel.org/lkml/YIBBt6ypFtT+i994@pendragon.ideasonboard.com/ https://lore.kernel.org/lkml/YIBBt6ypFtT+i994@pendragon.idea...