4 ms·

Being unaware of whatever this is, until this HN post just now, I'm still in the dark as exactly what was being done which was apparently unethical since the st

Being unaware of whatever this is, until this HN post just now, I'm still in the dark as exactly what was being done which was apparently unethical since the statement doesn't mention any details. Anyone have any details on what the issue is?

thatguy0900 6y ago
They submitted patches that did nothing but introduce vulnerabilities, in a test to see if they would get through. They've done this previously for a research paper.
- nomel 6y ago
  From my understanding, it wasn't this. It was that they didn't come clean or provide a quick emergency stop when they saw that the patches would make it through. Although, I'm having trouble sifting through the rage/drama.
loeg 6y ago
It's still #3 on the front page: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 (and other iterations on the same story earlier today).
- res0nat0r 6y ago
  Ah thanks. How moronic, whomever thought this was in any way a good idea is pretty out of touch with reality.
  - a-dub 6y ago
    isn't it just a form of red teaming? has red teaming fallen out of fashion?
    - detaro 6y ago
      red teaming without approval of the target org is out of fashion, yes.
      - a-dub 6y ago
        that helps a bit with regards to understanding why people are so upset about this. but honestly, it seems like valuable research to me. it's unfortunate that it took some time away from busy kernel developers, and it's unfortunate that it ultimately makes the project look worse... ...but isn't that supposed to be part of the promise behind open source? it wouldn't surprise me if i learned that management of private orgs hire security firms to do this sort of thing. where does that come from in foss land, other than the ethers of others tinkering, researching and experimenting? i think this whole calling for the researchers heads business is overblown. i read their paper, it looks like they approached the situation quite ethically to me.
        a-dub 6y ago
        i think the discussion should not be around banning them as known bad actors, but instead should be around how to detect bad actors or better introduce safety and security into the project. i'll tell you one thing, it has shaken my trust in the oss kernel development model as it operates today, and honestly that seems like maybe a good thing? how many companies are literally printing money with the linux kernel? can't they throw a few bones at helping beef up code review and security analysis?
        tytso 6y ago
        No development model is protected from malicious actors, and this is not unique to OSS. Could the Ministry of State Security sponsor a student to study at the US, and then after graduate, that student gets a job at Microsoft, and then introduces vulnerabilities in Windows? In theory all patches should get code reviews, but could someone get a bug past code reivew? Sure! You can try to detect it before it happens, but very often you won't catch it until after it's landed in the source code repository, and some cases, it'll actually make it out to customers before you notice. It's true for proprietary code; it'st true for open source code; it's true for x.509 CA certificates[1]. We should still do the best job that we can, if for no other reason that there are plenty of zero-days which are introduced by human error, never mind by malicious actors. [1] https://www.thesslstore.com/blog/final-warning-last-chance-to-replace-symantec-ssl-certificates/ https://www.thesslstore.com/blog/final-warning-last-chance-t...
babayega2 6y ago
Doesn't HK summarize it clearly in his answer to the researcher https://www.neowin.net/news/linux-bans-university-of-minnesota-for-sending-buggy-patches-in-the-name-of-research/ https://www.neowin.net/news/linux-bans-university-of-minneso...
dwheeler 6y ago
It appears that the U of MN researchers experimented on Linux kernel developers without those developers' consent. The researchers didn't even go through their Institutional Review Board (IRB) until the experiment was done, which is not allowed. When they finished the experiment they then got approval from their IRB, and the IRB approved it even though the people being experimented on had not consented. There are all sorts of rules when doing an experiment on humans in the US, and they generally require consent. To be clear: I do not know all the facts in this case, and I'm not a lawyer. But I'm glad that GregKH took the "immediate ban" step, that seemed like the safest course of action with the info he had. I think experiments to see "what can slip through review" could be really valuable & important, but when humans are being experimented on, you normally need their consent first.

thatguy0900 6y ago

They submitted patches that did nothing but introduce vulnerabilities, in a test to see if they would get through. They've done this previously for a research paper.

nomel 6y ago
From my understanding, it wasn't this. It was that they didn't come clean or provide a quick emergency stop when they saw that the patches would make it through. Although, I'm having trouble sifting through the rage/drama.

loeg 6y ago

It's still #3 on the front page: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 (and other iterations on the same story earlier today).

res0nat0r 6y ago
Ah thanks. How moronic, whomever thought this was in any way a good idea is pretty out of touch with reality.
- a-dub 6y ago
  isn't it just a form of red teaming? has red teaming fallen out of fashion?
  - detaro 6y ago
    red teaming without approval of the target org is out of fashion, yes.
    - a-dub 6y ago
      that helps a bit with regards to understanding why people are so upset about this. but honestly, it seems like valuable research to me. it's unfortunate that it took some time away from busy kernel developers, and it's unfortunate that it ultimately makes the project look worse... ...but isn't that supposed to be part of the promise behind open source? it wouldn't surprise me if i learned that management of private orgs hire security firms to do this sort of thing. where does that come from in foss land, other than the ethers of others tinkering, researching and experimenting? i think this whole calling for the researchers heads business is overblown. i read their paper, it looks like they approached the situation quite ethically to me.
      - a-dub 6y ago
        i think the discussion should not be around banning them as known bad actors, but instead should be around how to detect bad actors or better introduce safety and security into the project. i'll tell you one thing, it has shaken my trust in the oss kernel development model as it operates today, and honestly that seems like maybe a good thing? how many companies are literally printing money with the linux kernel? can't they throw a few bones at helping beef up code review and security analysis?
        tytso 6y ago
        No development model is protected from malicious actors, and this is not unique to OSS. Could the Ministry of State Security sponsor a student to study at the US, and then after graduate, that student gets a job at Microsoft, and then introduces vulnerabilities in Windows? In theory all patches should get code reviews, but could someone get a bug past code reivew? Sure! You can try to detect it before it happens, but very often you won't catch it until after it's landed in the source code repository, and some cases, it'll actually make it out to customers before you notice. It's true for proprietary code; it'st true for open source code; it's true for x.509 CA certificates[1]. We should still do the best job that we can, if for no other reason that there are plenty of zero-days which are introduced by human error, never mind by malicious actors. [1] https://www.thesslstore.com/blog/final-warning-last-chance-to-replace-symantec-ssl-certificates/ https://www.thesslstore.com/blog/final-warning-last-chance-t...

babayega2 6y ago

Doesn't HK summarize it clearly in his answer to the researcher https://www.neowin.net/news/linux-bans-university-of-minnesota-for-sending-buggy-patches-in-the-name-of-research/ https://www.neowin.net/news/linux-bans-university-of-minneso...

dwheeler 6y ago

It appears that the U of MN researchers experimented on Linux kernel developers without those developers' consent. The researchers didn't even go through their Institutional Review Board (IRB) until the experiment was done, which is not allowed. When they finished the experiment they then got approval from their IRB, and the IRB approved it even though the people being experimented on had not consented. There are all sorts of rules when doing an experiment on humans in the US, and they generally require consent. To be clear: I do not know all the facts in this case, and I'm not a lawyer. But I'm glad that GregKH took the "immediate ban" step, that seemed like the safest course of action with the info he had. I think experiments to see "what can slip through review" could be really valuable & important, but when humans are being experimented on, you normally need their consent first.