3 ms·

Great detailed specific reply. In the end, we largely agree. It is exactly the accusation of malice when what occurred was normal error that deserves an apolo

Great detailed specific reply. In the end, we largely agree. It is exactly the accusation of malice when what occurred was normal error that deserves an apology. You teased that out well. As you note, we don’t have certainty. But we observe: Aditya is not an author on the hypocrite commits paper. Aditya withdrew his “garbage” commit when made aware it was not correct. Aditya is author of other papers on static analysis. Aditya’s other commits have generally survived this bulk review. Leon Romanovksy has offered no follow up for his claim of security holes nor explained his claim that the commits are part of the hypocrite commits research. Aditya maintains his claims even as other members of UMN have explained their role in the hypocrite commits. Aditya’s commits come from a UMN address where as hypocrite commits came from gmail. These observations make it overwhelmingly likely that Aditya’s commits are from a good faith somewhat buggy static analysis effort. This poor guy has worked for years on the Linux kernel and Greg Kroah-Hartman’s thoughtless rush to judgement threatened all that effort. Greg should apologize. Leon Romanovksy should too. They mixed up and couple things and got carried away by their emotions. It happens. They should work to undo the damage.

rincebrain 5y ago
> Aditya withdrew his “garbage” commit when made aware it was not correct. It seems like he withdrew it in response to stumbling over [2], wherein Al Viro points out that the correct thing to do with buggy commits is to request they be reverted. (Based on, among other things, the fact that said LWN post is cited in the revert.) > Leon Romanovksy has offered no follow up for his claim of security holes nor explained his claim that the commits are part of the hypocrite commits research. He did offer the patch I cited as "[2]" in my prior reply, as well as pointing out [1] the commit where they reworked the buggy logic from it. One commit does not a sinner make, but it's not correct to say he offered no data. > They mixed up and couple things and got carried away by their emotions. I'm not the biggest fan of GregKH for other reasons [3], but other than maybe explicitly requiring and verifying a list of broken commits beforehand, I'm not sure what I would have wanted him to do differently. If you have prior reason to suspect a group of behaving maliciously, and someone you trust attests that they appear to have behaved maliciously, what do you do differently? "I promise I'm not part of that research" doesn't work if you think the group might lie, and as I've pointed out other times, the only ones caught in the temporary patch removal were members of the relevant lab, and I further claim that "patches temporarily removed for re-examining" is not that severe a punishment. [1] - https://lore.kernel.org/linux-nfs/YIMDCNx4q6esHTYt@unreal/ https://lore.kernel.org/linux-nfs/YIMDCNx4q6esHTYt@unreal/ [2] - https://lwn.net/Articles/854319/ https://lwn.net/Articles/854319/ [3] - https://marc.info/?l=linux-kernel&m=154714516832389 https://marc.info/?l=linux-kernel&m=154714516832389
- nuclearnice1 5y ago
  > He did offer the patch I cited Fair point. Not sure what became of the other alleged security holes. > "I promise I'm not part of that research" This is a gross oversimplification of the evidence that Aditya is not malicious. I offered a lot of evidence above that Aditya is likely not malicious just clumsy. The lwn post you pointed to reaches the same conclusion “ I am quite certain by now that patches had been crap in good faith; the odds of that being the penetration testing, take 2, are IMO very low.” So possible that Greg wrongly judged Aditya based on trusting Leon or other bad reasoning. Fine. Now it’s abundantly clear the Aditya was not making malicious commits and Greg should apologize to him for the false accusation.
  - rincebrain 5y ago
    I think we're agreeing loudly. I agree with you that Aditya is probably not malicious, just clumsy, to be clear. But I feel like it's probably reasonable for someone in GregKH's position to have a higher threshold to clear than "probably" once the question is posed. I also wasn't trying to claim that "I promise I'm not part of that research" encompassed all the evidence, just remark that personal attestation of innocence would not have been a useful input at that juncture. I'm not sure, however, at what point an apology is merited now - anything significantly less than 100% of someone's patches seems like a poor choice given the small absolute number of bad patches that were used in that paper, but we're choosing by pseudorandom sample, but that's biased by how active/familiar the maintainers are with different parts of the code...etc. So I don't know what the right confidence level should be for concluding a prior judgment of "you might be malicious" was wrong. (Maybe enumerating+examining all the "malicious" commits remarked upon by Leon, since that's what sparked the fire?)

rincebrain 5y ago

> Aditya withdrew his “garbage” commit when made aware it was not correct. It seems like he withdrew it in response to stumbling over [2], wherein Al Viro points out that the correct thing to do with buggy commits is to request they be reverted. (Based on, among other things, the fact that said LWN post is cited in the revert.) > Leon Romanovksy has offered no follow up for his claim of security holes nor explained his claim that the commits are part of the hypocrite commits research. He did offer the patch I cited as "[2]" in my prior reply, as well as pointing out [1] the commit where they reworked the buggy logic from it. One commit does not a sinner make, but it's not correct to say he offered no data. > They mixed up and couple things and got carried away by their emotions. I'm not the biggest fan of GregKH for other reasons [3], but other than maybe explicitly requiring and verifying a list of broken commits beforehand, I'm not sure what I would have wanted him to do differently. If you have prior reason to suspect a group of behaving maliciously, and someone you trust attests that they appear to have behaved maliciously, what do you do differently? "I promise I'm not part of that research" doesn't work if you think the group might lie, and as I've pointed out other times, the only ones caught in the temporary patch removal were members of the relevant lab, and I further claim that "patches temporarily removed for re-examining" is not that severe a punishment. [1] - https://lore.kernel.org/linux-nfs/YIMDCNx4q6esHTYt@unreal/ https://lore.kernel.org/linux-nfs/YIMDCNx4q6esHTYt@unreal/ [2] - https://lwn.net/Articles/854319/ https://lwn.net/Articles/854319/ [3] - https://marc.info/?l=linux-kernel&m=154714516832389 https://marc.info/?l=linux-kernel&m=154714516832389

nuclearnice1 5y ago
> He did offer the patch I cited Fair point. Not sure what became of the other alleged security holes. > "I promise I'm not part of that research" This is a gross oversimplification of the evidence that Aditya is not malicious. I offered a lot of evidence above that Aditya is likely not malicious just clumsy. The lwn post you pointed to reaches the same conclusion “ I am quite certain by now that patches had been crap in good faith; the odds of that being the penetration testing, take 2, are IMO very low.” So possible that Greg wrongly judged Aditya based on trusting Leon or other bad reasoning. Fine. Now it’s abundantly clear the Aditya was not making malicious commits and Greg should apologize to him for the false accusation.
- rincebrain 5y ago
  I think we're agreeing loudly. I agree with you that Aditya is probably not malicious, just clumsy, to be clear. But I feel like it's probably reasonable for someone in GregKH's position to have a higher threshold to clear than "probably" once the question is posed. I also wasn't trying to claim that "I promise I'm not part of that research" encompassed all the evidence, just remark that personal attestation of innocence would not have been a useful input at that juncture. I'm not sure, however, at what point an apology is merited now - anything significantly less than 100% of someone's patches seems like a poor choice given the small absolute number of bad patches that were used in that paper, but we're choosing by pseudorandom sample, but that's biased by how active/familiar the maintainers are with different parts of the code...etc. So I don't know what the right confidence level should be for concluding a prior judgment of "you might be malicious" was wrong. (Maybe enumerating+examining all the "malicious" commits remarked upon by Leon, since that's what sparked the fire?)