3 ms·
Except that patch is clearly BS! You can't patch a double-read vulnerability by checking for a capability; that's not a thing that works. So either the descript
by unanswered 6y ago
Except that patch is clearly BS! You can't patch a double-read vulnerability by checking for a capability; that's not a thing that works. So either the description is wrong, or the patch is wrong, or both.
And the point of the reverts is that the kernel maintainers don't have the unlimited time that would be necessary to re-review all of these questionable patches for probable malicious underhanded C, so they are reverted for now for triage (not permanently).
For the linked patch, I would judge it possibly malicious as it leaves the identified vulnerability in the kernel for later exploit by the attackers, namely, the UMN research team.
- kapp_in_life 6y agoYou don't think reverting a patch from someone whose only relation is working(worked?) at the same university as the advisor initially responsible for the security "research" is overkill? If the goal is to prevent security bugs in mainline then maybe haphazardly reverting everything that doesn't conflict and fixing it later isn't the best approach. I'm disappointed at seeing hackernews jump on this mindless mob justice like other sites would.
- capsulecorp 6y agoIts a completely reasonable response. I'd say your point of view is the mindless one.
- burnished 6y agoSeems like the problem was from more than one person. This doesn't seem like mob justice, it seems like a pretty measured response to a source of repeat bad faith actors.
- pessimizer 6y ago> I'm disappointed at seeing hackernews jump on this mindless mob justice like other sites would. Having your patch reverted pending review is hardly punishment. Calling this mob justice is an insult to both mobs and justice.