5 ms·

I'm just going to quote part of the UMN response, which should clear up the constant misconceptions I see from people who are doing real harm to legitimate rese

I'm just going to quote part of the UMN response, which should clear up the constant misconceptions I see from people who are doing real harm to legitimate researchers. The “hypocrite commits” work was carried out in August 2020; it aimed to improve the security of the patching process in Linux. As part of the project, we studied potential issues with the patching process of Linux, including causes of the issues and suggestions for addressing them. This work did not introduce vulnerabilities into the Linux code. The three incorrect patches were discussed and stopped during exchanges in a Linux message board, and never committed to the code. We reported the findings and our conclusions (excluding the incorrect patches) of the work to the Linux community before paper submission, collected their feedback, and included them in the paper. All the other 190 patches being reverted and re-evaluated were submitted as part of other projects and as a service to the community; they are not related to the “hypocrite commits” paper. These 190 patches were in response to real bugs in the code and all correct--as far as we can discern--when we submitted them. We understand the desire of the community to gain access to and examine the three incorrect patches. Doing so would reveal the identity of members of the community who responded to these patches on the message board. Therefore, we are working to obtain their consent before revealing these patches. Our recent patches in April 2021 are not part of the “hypocrite commits” paper either. We had been conducting a new project that aims to automatically identify bugs introduced by other patches (not from us). Our patches were prepared and submitted to fix the identified bugs to follow the rules of Responsible Disclosure, and we are happy to share details of this newer project with the Linux community. tl;dr Greg attacked a researcher, alleging malice where there was none. This was someone trying to legitimately help the kernel. p.s. here's Linus's response > Linus Torvalds: "most of the patches are valid (and the ones that aren't are generally 'useless' rather than 'actively malicious'), so it's basically a huge waste of people's time to now go over those things again just because one source has shown itself to not be above board."

cyphar 5y ago
Submitting patches you know contain vulnerabilities to a project as part of a social engineering experiment shows a fundamental lack of ethics -- it doesn't matter if the patches themselves were merged, the intent itself matters. Since the research was sanctioned by the University, the University has shown they do not have strong ethical controls for their research and thus any work they conduct should be considered suspect until those issues are resolved. Saying "the three incorrect[sic] patches were discussed and stopped during exchanges in a Linux message board, and never committed to the code" is a non-sequitur. Nobody claimed the malicious patches were merged, everyone is saying that the simple act of submitting in bad faith them is the issue. (I also find it funny they use the word "incorrect" when the correct word is "malicious".) If someone sent patches to your project that you later discovered were malicious and sent in bad faith, would you seriously allow them to continue being part of your community? I sure as hell wouldn't.
- staticassertion 5y ago
  Malice implies that the intent was to cause harm, which there was not. The execution was negligent, at worst, but not malicious. And you've ignored the rest of the post, which is that the patches that Greg was blowing up about had nothing to do with that research. Please actually read the whole post and try to understand the situation. This entire thing started with Greg alleging that legitimate patches from a security researcher were malicious. They were not. Previous patches, from another group, a year ago, are what you're referring to.
  - cyphar 5y ago
    > Please actually read the whole post and try to understand the situation. I'm aware of what has happened, I personally think they should've banned the University last year. And the quote in your post only tells one side of the story. This latest incident was just the trigger for the response and as usual the internet ends up confusing the trigger and the original issue (in Greg's original email he simply said to not accept patches because of the previous research which was being run by the same supervisor -- only later did he get into the argument with the researcher where he said they were either incompetent or malicious.) I agree that a lot of people have assumed that the current patches were malicious when they are not, though they were submitted in a way that isn't in line with how automated tool patches are usually submitted. But that's the internet for you, they manage to misinterpret even the most basic situations. > Malice implies that the intent was to cause harm, which there was not. How is submitting patches which you know have bugs to a review process where they may end up being merged not count as "intending to cause harm"? If the patches had not been blocked by the review process, what would have the end result have been? More importantly, as a reviewer there is no difference to me whether the person really is a an attacker or a researcher cosplaying as an attacker -- the end result is that I'm being asked to review patches that are known by the author to contain security bugs and were submitted under false pretenses.
    - staticassertion 5y ago
      > I agree that a lot of people have assumed that the current patches were malicious when they are not Who can blame them when Greg says things like "> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work." Greg is explicitly alleging, "You", that Aditya is being malicious. So of course the idiot readers will think so. He repeatedly alleges that Aditya is malicious. This isn't just "the internet", it's Greg's false accusations, which he has yet to retract. Look at the damage. I'm linking LKML, links from other maintainers, a quote from Linus, and facts and all of my posts are downvoted. Greg's bungling has caused a massive false perception. > How is submitting patches which you know have bugs to a review process where they may end up being merged not count as "intending to cause harm"? Because they did not intend to cause harm. They intended the opposite - to improve Linux security by demonstrating flaws in the process. Obviously they did a bad job of it, no one is defending that research, UMN apologized for it explicitly. But they did not intend harm. They were not hoping to exploit those vulnerabilities. It was not malicious. It was negligent. I think it's very important to recognize the difference, critical really.

cyphar 5y ago

Submitting patches you know contain vulnerabilities to a project as part of a social engineering experiment shows a fundamental lack of ethics -- it doesn't matter if the patches themselves were merged, the intent itself matters. Since the research was sanctioned by the University, the University has shown they do not have strong ethical controls for their research and thus any work they conduct should be considered suspect until those issues are resolved. Saying "the three incorrect[sic] patches were discussed and stopped during exchanges in a Linux message board, and never committed to the code" is a non-sequitur. Nobody claimed the malicious patches were merged, everyone is saying that the simple act of submitting in bad faith them is the issue. (I also find it funny they use the word "incorrect" when the correct word is "malicious".) If someone sent patches to your project that you later discovered were malicious and sent in bad faith, would you seriously allow them to continue being part of your community? I sure as hell wouldn't.

staticassertion 5y ago
Malice implies that the intent was to cause harm, which there was not. The execution was negligent, at worst, but not malicious. And you've ignored the rest of the post, which is that the patches that Greg was blowing up about had nothing to do with that research. Please actually read the whole post and try to understand the situation. This entire thing started with Greg alleging that legitimate patches from a security researcher were malicious. They were not. Previous patches, from another group, a year ago, are what you're referring to.
- cyphar 5y ago
  > Please actually read the whole post and try to understand the situation. I'm aware of what has happened, I personally think they should've banned the University last year. And the quote in your post only tells one side of the story. This latest incident was just the trigger for the response and as usual the internet ends up confusing the trigger and the original issue (in Greg's original email he simply said to not accept patches because of the previous research which was being run by the same supervisor -- only later did he get into the argument with the researcher where he said they were either incompetent or malicious.) I agree that a lot of people have assumed that the current patches were malicious when they are not, though they were submitted in a way that isn't in line with how automated tool patches are usually submitted. But that's the internet for you, they manage to misinterpret even the most basic situations. > Malice implies that the intent was to cause harm, which there was not. How is submitting patches which you know have bugs to a review process where they may end up being merged not count as "intending to cause harm"? If the patches had not been blocked by the review process, what would have the end result have been? More importantly, as a reviewer there is no difference to me whether the person really is a an attacker or a researcher cosplaying as an attacker -- the end result is that I'm being asked to review patches that are known by the author to contain security bugs and were submitted under false pretenses.
  - staticassertion 5y ago
    > I agree that a lot of people have assumed that the current patches were malicious when they are not Who can blame them when Greg says things like "> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work." Greg is explicitly alleging, "You", that Aditya is being malicious. So of course the idiot readers will think so. He repeatedly alleges that Aditya is malicious. This isn't just "the internet", it's Greg's false accusations, which he has yet to retract. Look at the damage. I'm linking LKML, links from other maintainers, a quote from Linus, and facts and all of my posts are downvoted. Greg's bungling has caused a massive false perception. > How is submitting patches which you know have bugs to a review process where they may end up being merged not count as "intending to cause harm"? Because they did not intend to cause harm. They intended the opposite - to improve Linux security by demonstrating flaws in the process. Obviously they did a bad job of it, no one is defending that research, UMN apologized for it explicitly. But they did not intend harm. They were not hoping to exploit those vulnerabilities. It was not malicious. It was negligent. I think it's very important to recognize the difference, critical really.