3 ms·

> he couldn't blindly trust something coming from the same source. This is not the same source! It's the same UNIVERSITY, which has thousands of students every

> he couldn't blindly trust something coming from the same source. This is not the same source! It's the same UNIVERSITY, which has thousands of students every year. And the source of the bugs wasn't even from university addresses, it was from random gmail addresses. Aditya submitted LEGITIMATE patches based on his static analysis tool. He is being slandered because people won't take 5 seconds to learn the facts.

boomboomsubban 5y ago
From what I've been told, UMN aren't active kernel contributors, not making a submission between 2014 and the relevant paper in 2020. >And the source of the bugs wasn't even from university addresses, it was from random gmail addresses. I don't know why this really matters. They could be running a similar experiment this time pretending UMN was compromised. I'm not sure who Pakki is, if he's not part of the first research group at all it is truly unfortunate he is receiving the blame for it. If he was, the internet's reaction is still unwarranted but frankly typical. I don't see how Kroah-Hartman is at fault though.
- staticassertion 5y ago
  > I don't know why this really matters. Because Greg's response doesn't actually address any problem, it's purely grandstanding. The researchers explicitly performed their work not using university addresses, so banning the university does nothing. As Kees Cook has already noted, the vast majority of patches from the university are legitimate. > I'm not sure who Pakki is The researcher who submitted output from his legitimate research to try to fix bugs. Greg responded by insulting him, saying he is incompetent, stating that he is malicious, and then that he would ban the university over this. How could Greg not be at fault? His post made false allegations against Aditya, claiming that he was acting maliciously, and because no one fucking reads anymore, people think Aditya was trying to insert vulnerabilities into the kernel.
  - fiter 5y ago
    I agree that it's terrible that people did not read before tweeting. I believe Greg was not saying Aditya was both incompetent and malicious. Greg was saying incompetent or malicious. The incompetence stemmed from how Aditya handled his static analysis patches: seemingly no manual review and no explicit statement that the patches were from a tool (which is apparently standard procedure).
    - staticassertion 5y ago
      I don't know why you're trying to defend Greg so vehemently when all of the facts show that he slandered Aditya - Greg's own words, factual accounts of reality. Most of Aditya's patches were legitimate. Multiple upstream developers have confirmed this: > https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvWRLF_sZHGpRFuB72-13zg@mail.gmail.com/ https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvW... Other kernel maintainers have already picked up on this. > You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work. Here is a direct quote from Greg where he falsely alleges that Aditya is responsible for the previous work. > Now you submit a new series of obviously-incorrect patches again, Many of the patches are correct - see the above link where one maintainer points this out. > So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches? Another false allegation that Aditya is experimenting on the kernel, attributing malice. > You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect. Many were legitimate. Again, a false accusation from Greg. Then Greg goes on to attack him some more, instead of just explaining things to him, like "Hey, in the future can you add 'found by tool xyz'". In other mailing lists kernel maintainers point out that that would have been the sane response, not going to bother to link that. > Our community welcomes developers who wish to help and enhance Linux. That is NOT what you are attempting to do here, so please do not try to frame it that way. In fact, that is exactly what Aditya was trying to do. > Our community does not appreciate being experimented on, and being "tested" by submitting known patches that are either do nothing on purpose, or introduce bugs on purpose. Aditya did no such thing. Greg's response is indefensible. It's just littered with insults and attacks, and factually incorrect allegations against a legitimate security researcher.
trengrj 5y ago
His supervisor published the hypocrite paper with the introduced vulnerabilities so they are far more linked than just both being at UMN.

boomboomsubban 5y ago

From what I've been told, UMN aren't active kernel contributors, not making a submission between 2014 and the relevant paper in 2020. >And the source of the bugs wasn't even from university addresses, it was from random gmail addresses. I don't know why this really matters. They could be running a similar experiment this time pretending UMN was compromised. I'm not sure who Pakki is, if he's not part of the first research group at all it is truly unfortunate he is receiving the blame for it. If he was, the internet's reaction is still unwarranted but frankly typical. I don't see how Kroah-Hartman is at fault though.

staticassertion 5y ago
> I don't know why this really matters. Because Greg's response doesn't actually address any problem, it's purely grandstanding. The researchers explicitly performed their work not using university addresses, so banning the university does nothing. As Kees Cook has already noted, the vast majority of patches from the university are legitimate. > I'm not sure who Pakki is The researcher who submitted output from his legitimate research to try to fix bugs. Greg responded by insulting him, saying he is incompetent, stating that he is malicious, and then that he would ban the university over this. How could Greg not be at fault? His post made false allegations against Aditya, claiming that he was acting maliciously, and because no one fucking reads anymore, people think Aditya was trying to insert vulnerabilities into the kernel.
- fiter 5y ago
  I agree that it's terrible that people did not read before tweeting. I believe Greg was not saying Aditya was both incompetent and malicious. Greg was saying incompetent or malicious. The incompetence stemmed from how Aditya handled his static analysis patches: seemingly no manual review and no explicit statement that the patches were from a tool (which is apparently standard procedure).
  - staticassertion 5y ago
    I don't know why you're trying to defend Greg so vehemently when all of the facts show that he slandered Aditya - Greg's own words, factual accounts of reality. Most of Aditya's patches were legitimate. Multiple upstream developers have confirmed this: > https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvWRLF_sZHGpRFuB72-13zg@mail.gmail.com/ https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvW... Other kernel maintainers have already picked up on this. > You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work. Here is a direct quote from Greg where he falsely alleges that Aditya is responsible for the previous work. > Now you submit a new series of obviously-incorrect patches again, Many of the patches are correct - see the above link where one maintainer points this out. > So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches? Another false allegation that Aditya is experimenting on the kernel, attributing malice. > You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect. Many were legitimate. Again, a false accusation from Greg. Then Greg goes on to attack him some more, instead of just explaining things to him, like "Hey, in the future can you add 'found by tool xyz'". In other mailing lists kernel maintainers point out that that would have been the sane response, not going to bother to link that. > Our community welcomes developers who wish to help and enhance Linux. That is NOT what you are attempting to do here, so please do not try to frame it that way. In fact, that is exactly what Aditya was trying to do. > Our community does not appreciate being experimented on, and being "tested" by submitting known patches that are either do nothing on purpose, or introduce bugs on purpose. Aditya did no such thing. Greg's response is indefensible. It's just littered with insults and attacks, and factually incorrect allegations against a legitimate security researcher.

trengrj 5y ago

His supervisor published the hypocrite paper with the introduced vulnerabilities so they are far more linked than just both being at UMN.