23 ms·

Does the response of the Linux community seem like the response of some corporations when security vulnerabilities are disclosed? In each case, a vulnerability

Does the response of the Linux community seem like the response of some corporations when security vulnerabilities are disclosed? In each case, a vulnerability was disclosed. With Linux being used everywhere you can be sure intelligence services etc are likely sending in bad patches. If the Linux kernel requires only patchers with good intentions, and doesn’t have other means of catching this stuff, we are screwed.

dane-pgp 6y ago
> the response of some corporations when security vulnerabilities are disclosed There's a big ethical difference between trying to exploit a piece of commercially produced software, and trying to exploit the time and actions of humans who are producing software which is given away for free.
- shash 6y ago
  Also, this wasn’t a vulnerability found in existing code that was disclosed. This was an attempt to introduce several of them in the form of innocent looking commits. I don’t think the free vs commercial aspect is the main issue here; lots of kernel devs are paid for their work after all...
  - dane-pgp 6y ago
    > Also, this wasn’t a vulnerability found in existing code that was disclosed. You're right that the OP's analogy breaks down if the researchers were unsuccessful in getting their malicious patches accepted, because then there is arguably no vulnerability to report, and OP said "when security vulnerabilities are disclosed". Steelmanning that analogy, though, what the researchers were doing was "probing for possible vulnerabilities", which some vendors also complain about, especially if the target is an online service rather than software running locally on the researcher's machine. In that case, the main flaw in the analogy is still the difference between exploiting software and exploiting humans, so I probably should have focused on that. Nevertheless, there is a small ethical difference in some circumstances between software that is bought and software which is freely downloadable (regardless of the licences involved), since if you paid for something which is defective then you might deserve a refund.
shash 6y ago
However, when a vulnerability is found, you would expect that the path by which that vulnerability was introduced would be shut off, right? In this case, what they’ve done is to revert all patches from this group, pending further review, just in case something else slipped through. They’re not sweeping issues under the carpet. They are actively addressing those issues.
burnished 6y ago
No, not really. For starters, notice how (some) corporations threaten legal action when evidence of a bug is disclosed? And how, here, there was simply a public ban on account of no longer being a good faith participant?
genmud 6y ago
Everyone knows that happens. The issue is that these are presumably university funded researchers who intentionally tried to introduce vulnerabilities into the Linux kernel without working with the maintainers. It is fine to perform experiments like this, with permission. I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this. They then published a paper and thought that this was acceptable behavior from a research/ethical standpoint.
- mopsi 6y ago
  > I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this. OSS security should not rely on ethics and trust. The default assumption should be that malicious actors are using every dirty tactic they can to get their changes accepted, and that someone@something.edu is no more trustworthy than internal.security.agency@china.gov.cn. Feels like the OSS community got caught with their pants down and is now overreacting.

dane-pgp 6y ago

> the response of some corporations when security vulnerabilities are disclosed There's a big ethical difference between trying to exploit a piece of commercially produced software, and trying to exploit the time and actions of humans who are producing software which is given away for free.

shash 6y ago
Also, this wasn’t a vulnerability found in existing code that was disclosed. This was an attempt to introduce several of them in the form of innocent looking commits. I don’t think the free vs commercial aspect is the main issue here; lots of kernel devs are paid for their work after all...
- dane-pgp 6y ago
  > Also, this wasn’t a vulnerability found in existing code that was disclosed. You're right that the OP's analogy breaks down if the researchers were unsuccessful in getting their malicious patches accepted, because then there is arguably no vulnerability to report, and OP said "when security vulnerabilities are disclosed". Steelmanning that analogy, though, what the researchers were doing was "probing for possible vulnerabilities", which some vendors also complain about, especially if the target is an online service rather than software running locally on the researcher's machine. In that case, the main flaw in the analogy is still the difference between exploiting software and exploiting humans, so I probably should have focused on that. Nevertheless, there is a small ethical difference in some circumstances between software that is bought and software which is freely downloadable (regardless of the licences involved), since if you paid for something which is defective then you might deserve a refund.

shash 6y ago

However, when a vulnerability is found, you would expect that the path by which that vulnerability was introduced would be shut off, right? In this case, what they’ve done is to revert all patches from this group, pending further review, just in case something else slipped through. They’re not sweeping issues under the carpet. They are actively addressing those issues.

burnished 6y ago

No, not really. For starters, notice how (some) corporations threaten legal action when evidence of a bug is disclosed? And how, here, there was simply a public ban on account of no longer being a good faith participant?

genmud 6y ago

Everyone knows that happens. The issue is that these are presumably university funded researchers who intentionally tried to introduce vulnerabilities into the Linux kernel without working with the maintainers. It is fine to perform experiments like this, with permission. I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this. They then published a paper and thought that this was acceptable behavior from a research/ethical standpoint.

mopsi 6y ago
> I think people are upset because there is a moral, ethical and social obligation expected from academia to not intentionally do shit like this. OSS security should not rely on ethics and trust. The default assumption should be that malicious actors are using every dirty tactic they can to get their changes accepted, and that someone@something.edu is no more trustworthy than internal.security.agency@china.gov.cn. Feels like the OSS community got caught with their pants down and is now overreacting.