8 ms·
Response from Greg Kroah-Hartman to University of Minnesota Researchers
- clonexy 6y agoIf really only three fake patches were involved, then I don't understand gkh's response. He hasn't been able to show further intent, and the tendency to dismiss even a grovelling apology as not sincere enough is plain stupid. What should they do? Immolate themselves and burn down the university. A group piling on individuals seems to be the new sport of the 21st century.
- pritambaral 6y ago> If really only three fake patches were involved, then I don't understand gkh's response. No, not only three fake patches. Those three fake patches were in 2020. This year's affair was precipitated by another known-invalid patch [1] and furthered by the research group playing victim [2]. 1: https://lore.kernel.org/linux-nfs/YH5%2Fi7OvsjSmqADv@kroah.com/ https://lore.kernel.org/linux-nfs/YH5%2Fi7OvsjSmqADv@kroah.c... 2. https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/ https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah... > He hasn't been able to show further intent From [2] above: "So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches?" > ... to dismiss even a grovelling apology as not sincere enough 1. From TFA, it hasn't been dismissed. Nor has it been labelled anything, let alone "not sincere enough". 2. The apology was hardly "grovelling"; more like, "we're sorry we got caught, we're sorry you felt bad about it, but we see no other way to do what we did." > What should they do? As the TFA says, the steps for reconciliation have been sent to them through the appropriate legal channels. > Immolate themselves and burn down the university. > A group piling on individuals seems to be the new sport of the 21st century. You seem to be reading a lot of things that aren't there. It'd help if you take off the outrage hat.
- someguy101010 6y agowhat are the specific actions that the university has to take that were mentioned here?
- ibero 6y agoi don’t believe those have been made public.
- outside1234 6y agoI do think that is a mistake. They should have sent an open letter for transparency.
- someguy101010 6y ago¯\_(ツ)_/¯ it's not really anyone's business. If it's super unfair the uni would disclose it. I was just kind of curious.
- Zancarius 6y agoI agree with someguy101010. I don't think it's anyone's business outside the university since this is between them and the kernel team. I would imagine the kernel folks wouldn't be apt to make it public since it would draw even more attention to this than really needs to be brought, at least from the university's perspective. It would start to smell a bit of airing dirty laundry. The damage has already been done. There's no need to make it worse.
- infogulch 6y agoPerhaps we'll find out more details when the research group and university start to perform those actions.
- specktr 6y agoIt seems to me like it’s in the best interest of the community to have an understanding of what steps were asked to be taken in the event contributions are made by those parties in the future. I feel it is important for regaining trust, overall project transparency and for setting a certain degree of precedent.
- deleted 6y ago
- nickstinemates 6y agoWell, not really an apology rejection.. just a comment that the demands they have need to be met.
- meepmorp 6y agoLeaving aside the fact that I don't think he rejected their apology, accepting an apology doesn't mean everything goes back to normal. It's reasonable for there to be consequences even if the other party is legitimately sorry.
- fossuser 6y agoYeah this title is editorialized badly. This is not a rejection - it’s just stating their terms for reengagement were already provided. The rest is just fluff if they don’t meet those terms, it doesn’t matter.
- asddubs 6y agoI wonder what the terms are - they're not public, are they?
- staticassertion 6y agoIt's worth noting that: a) The vulnerabilities being introduced to the kernel for previous research were not done from university accounts (so banning the university would not have helped) b) The static analysis research was completely unrelated, it had nothing to do with the work to insert vulns into the kernel.
- CameronNemo 6y agoI'm not sure how relatable this is, but I have been hesitant to accept apologies that are not backed by action. Call it trauma, but I have been burned too many times in the past to accept the words "I am sorry" at face value. Someone who has wronged you is often someone who will make an apology that is insincere.
- ziffusion 6y agoBesides, love means never having to say you're sorry. Like you said, if you let them go, and they say sorry but don't follow it up with action, maybe they were not yours to begin with.
- toomuchtodo 6y agoIt’s a gift either way (love or truth).
- tertius 6y ago"Now go and sin no more."
- ctur 6y agoIt's curious the specific actions haven't been made public given how public the denouncements and reactions have been.
- boomboomsubban 6y agoI think it's asking a lot for them to generate the specific actions in under a week, particularly as these actions will presumably not be needed until the start of the Summer semester at the earliest.
- g42gregory 6y agoI really liked Greg's response to the non-apology from the UMN researchers. Based on their communication, this research group does not have any idea of what have they done wrong. At the very least they should have said: we're sorry, we won't do this again, and here is what we will do different next time. But frankly, this research group should have been mostly apologizing for the way they communicated with the kernel group. Slimy, underhanded attempts to play the victim and use social pressure to silence the valid criticism from the kernel group. No excuse for that in my book. I suspect it's their internal culture that was coming through. They should be nowhere near the kernel or any other important software projects.
- Aperocky 6y agoIt's really hard to just say "I fucked up" I've seen it multiple time and had strong urges to do it myself. The way I see it, when such become normal is when the organization starts its painful decline.
- staticassertion 6y ago> But frankly, this research group should have been mostly apologizing for the way they communicated with the kernel group. ??? They submitted patches to the kernel based on a static analysis tool they were building, and then Greg started accusing them of malice, and banned the entire univirsity - how is it the research group that communicated poorly? Why would they not "do this again" ? They were trying to contribute to the kernel, whether their patches were low quality or not, there was no malice from this group. They haven't used any social pressure - on the contrary, it's Greg who began this inflammatory, overblown reaction to ban an entire university based on previous research done under non university affiliated email addresses. Greg made numerous false accusations against Aditya. edit: Oh and to everyone who I'm sure will just downvote, https://lwn.net/Articles/854319/ https://lwn.net/Articles/854319/ Here's kernel maintainers explaining this mess that Greg made. People are conflating multiple unrelated events because Greg did.
- boomboomsubban 6y agoThere's two separate research groups involved in this, and while the one that most recently submitted patches did nothing wrong the one behind the "hypocrite commits" did.
- sodality2 6y agoRejects? Responds would be far more accurate. All he said was "we have said what you need to do, other than that nothing needs to be said". He didn't say "you failed to do so, therefore banished forever".
- tolbish 6y agoThe submission title should be changed to something accurate like "Response from Greg Kroah-Hartman to University of Minnesota Researchers".
- R0b0t1 6y agoIt is pretty clearly a rejection to me, though a polite one. He's stating that their message is irrelevant and he doesn't care for it.
- pengaru 6y ago> It is pretty clearly a rejection to me, though a polite one. He's stating that their message is irrelevant and he doesn't care for it. Considering he thanks them for their response, this is not a rejection. It's a tacit acceptance while simultaneously stating what's necessary because an email apology is simply inadequate.
- R0b0t1 6y agoLike I said, it's polite, but does not seem like acceptance to me. It's a little hard to capture the sentiment but: "It’s not an apology if it comes with an excuse."
- nimbius 6y agocool. so can someone unflag it now
- modsmustgo 6y agoonly after you have completed [REDACTED] actions!
- floatingatoll 6y agoBest to email the mods about that.
- deleted 6y ago
- modsmustgo 6y agoIf they can just ban an entire university for a few students actions then someone remind me again why a "code of conduct" is needed at all, and what rule in that document was broken? It's clearly not needed, and will only be abused IMO.
- asddubs 6y agoPrevious thread about the Apology (prior to the response): https://news.ycombinator.com/item?id=26929470 https://news.ycombinator.com/item?id=26929470
- skwb 6y agoDid University of Minnesota have any type of IRB? I sorta hope this can be the "come to Jesus moment" for academic CS to implement safeguards (such as IRBs) to prevent harm.
- temp8964 6y agoThey did approve because the research is not a human study, which in my opinion is a correct decision. But, this decision does not endorse the study to be totally ethical, which is a totally different issue.
- infogulch 6y agoHow can you categorize this as "not a human study"? They were experimenting on "the patching process" which is not some abstract concept, it's a system that humans designed and execute by individual action. If it was not a human study, then why couldn't they just stimulate it on a computer where the maintainers are completely uninvolved? Obviously that's not possible. Why? Because they were studying the humans themselves. This is so clear even from the apology email that is the topic of this thread, I don't understand how people are still confused here. This is not a US patent grant where simply adding "yeah that but on a computer" gives you an instant rubber stamp.
- staticassertion 6y agoI'm just going to quote part of the UMN response, which should clear up the constant misconceptions I see from people who are doing real harm to legitimate researchers. The “hypocrite commits” work was carried out in August 2020; it aimed to improve the security of the patching process in Linux. As part of the project, we studied potential issues with the patching process of Linux, including causes of the issues and suggestions for addressing them. This work did not introduce vulnerabilities into the Linux code. The three incorrect patches were discussed and stopped during exchanges in a Linux message board, and never committed to the code. We reported the findings and our conclusions (excluding the incorrect patches) of the work to the Linux community before paper submission, collected their feedback, and included them in the paper. All the other 190 patches being reverted and re-evaluated were submitted as part of other projects and as a service to the community; they are not related to the “hypocrite commits” paper. These 190 patches were in response to real bugs in the code and all correct--as far as we can discern--when we submitted them. We understand the desire of the community to gain access to and examine the three incorrect patches. Doing so would reveal the identity of members of the community who responded to these patches on the message board. Therefore, we are working to obtain their consent before revealing these patches. Our recent patches in April 2021 are not part of the “hypocrite commits” paper either. We had been conducting a new project that aims to automatically identify bugs introduced by other patches (not from us). Our patches were prepared and submitted to fix the identified bugs to follow the rules of Responsible Disclosure, and we are happy to share details of this newer project with the Linux community. tl;dr Greg attacked a researcher, alleging malice where there was none. This was someone trying to legitimately help the kernel. p.s. here's Linus's response > Linus Torvalds: "most of the patches are valid (and the ones that aren't are generally 'useless' rather than 'actively malicious'), so it's basically a huge waste of people's time to now go over those things again just because one source has shown itself to not be above board."
- cyphar 6y agoSubmitting patches you know contain vulnerabilities to a project as part of a social engineering experiment shows a fundamental lack of ethics -- it doesn't matter if the patches themselves were merged, the intent itself matters. Since the research was sanctioned by the University, the University has shown they do not have strong ethical controls for their research and thus any work they conduct should be considered suspect until those issues are resolved. Saying "the three incorrect[sic] patches were discussed and stopped during exchanges in a Linux message board, and never committed to the code" is a non-sequitur. Nobody claimed the malicious patches were merged, everyone is saying that the simple act of submitting in bad faith them is the issue. (I also find it funny they use the word "incorrect" when the correct word is "malicious".) If someone sent patches to your project that you later discovered were malicious and sent in bad faith, would you seriously allow them to continue being part of your community? I sure as hell wouldn't.
- temp8964 6y agoRemember the Sokal Hoax [1] and the New Sokal Hoax [2]? And other publishing stings [3]? How are they different? Honest question. At least those journals did not ban researchers from the whole university... 1. https://en.wikipedia.org/wiki/Sokal_affair https://en.wikipedia.org/wiki/Sokal_affair 2. https://www.theatlantic.com/ideas/archive/2018/10/new-sokal-hoax/572212/ https://www.theatlantic.com/ideas/archive/2018/10/new-sokal-... 3. https://en.wikipedia.org/wiki/List_of_scholarly_publishing_stings https://en.wikipedia.org/wiki/List_of_scholarly_publishing_s...
- HKH2 6y agoIf those hoaxes were along the lines of 'vaccines cause autism', they might be cause for concern too.
- throwaway19937 6y ago> How are they different? Honest question. The security of the Linux kernel affects millions of people. Submitting fake papers to omphaloskeptic social science journals affects thousands at most.
- temp8964 6y agoReally? How many computers were hacked because of their fake patches?