3 ms·

> I don't know why this really matters. Because Greg's response doesn't actually address any problem, it's purely grandstanding. The researchers explicitly per

> I don't know why this really matters. Because Greg's response doesn't actually address any problem, it's purely grandstanding. The researchers explicitly performed their work not using university addresses, so banning the university does nothing. As Kees Cook has already noted, the vast majority of patches from the university are legitimate. > I'm not sure who Pakki is The researcher who submitted output from his legitimate research to try to fix bugs. Greg responded by insulting him, saying he is incompetent, stating that he is malicious, and then that he would ban the university over this. How could Greg not be at fault? His post made false allegations against Aditya, claiming that he was acting maliciously, and because no one fucking reads anymore, people think Aditya was trying to insert vulnerabilities into the kernel.

fiter 5y ago
I agree that it's terrible that people did not read before tweeting. I believe Greg was not saying Aditya was both incompetent and malicious. Greg was saying incompetent or malicious. The incompetence stemmed from how Aditya handled his static analysis patches: seemingly no manual review and no explicit statement that the patches were from a tool (which is apparently standard procedure).
- staticassertion 5y ago
  I don't know why you're trying to defend Greg so vehemently when all of the facts show that he slandered Aditya - Greg's own words, factual accounts of reality. Most of Aditya's patches were legitimate. Multiple upstream developers have confirmed this: > https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvWRLF_sZHGpRFuB72-13zg@mail.gmail.com/ https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvW... Other kernel maintainers have already picked up on this. > You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work. Here is a direct quote from Greg where he falsely alleges that Aditya is responsible for the previous work. > Now you submit a new series of obviously-incorrect patches again, Many of the patches are correct - see the above link where one maintainer points this out. > So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches? Another false allegation that Aditya is experimenting on the kernel, attributing malice. > You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect. Many were legitimate. Again, a false accusation from Greg. Then Greg goes on to attack him some more, instead of just explaining things to him, like "Hey, in the future can you add 'found by tool xyz'". In other mailing lists kernel maintainers point out that that would have been the sane response, not going to bother to link that. > Our community welcomes developers who wish to help and enhance Linux. That is NOT what you are attempting to do here, so please do not try to frame it that way. In fact, that is exactly what Aditya was trying to do. > Our community does not appreciate being experimented on, and being "tested" by submitting known patches that are either do nothing on purpose, or introduce bugs on purpose. Aditya did no such thing. Greg's response is indefensible. It's just littered with insults and attacks, and factually incorrect allegations against a legitimate security researcher.
  - deleted 5y ago
    [deleted]
boomboomsubban 5y ago
Kroah-Hartman saw a number of patches containing possibly critical bugs, and given past events he assumed they were malicious rather than merely low quality. He soon seemed to realize the mistake, and instigated a second review. 99% of his reaction was related to the previous paper's actions, it's unfortunate that Pakki is getting the blame but from the first post Kroah-Hartman tried to deflect blame away from him.
- staticassertion 5y ago
  > but from the first post Kroah-Hartman tried to deflect blame away from him. Where are people getting this from? Greg literally, explicitly, accuses Aditya of malice. I have repeatedly quoted him doing so.
  - boomboomsubban 5y ago
    >Your professor is playing around with the review process...
    - staticassertion 5y ago
      OK? Greg explicitly accuses Aditya.
      - boomboomsubban 5y ago
        He accuses him of doing what his professor told him to do, a deflection of blame. Even the "explicit" accusations you mention reference that he was not acting alone.
        staticassertion 5y ago
        Aditya has nothing to do with the research where vulnerabilities were submitted to the kernel. Again, quoting for the millionth time, "> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work." YOU. The first word. In a response to Aditya. It's a false allegation, it's literally incorrect. Aditya was NOT one of the researchers involved in that previous work.

fiter 5y ago

I agree that it's terrible that people did not read before tweeting. I believe Greg was not saying Aditya was both incompetent and malicious. Greg was saying incompetent or malicious. The incompetence stemmed from how Aditya handled his static analysis patches: seemingly no manual review and no explicit statement that the patches were from a tool (which is apparently standard procedure).

staticassertion 5y ago
I don't know why you're trying to defend Greg so vehemently when all of the facts show that he slandered Aditya - Greg's own words, factual accounts of reality. Most of Aditya's patches were legitimate. Multiple upstream developers have confirmed this: > https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvWRLF_sZHGpRFuB72-13zg@mail.gmail.com/ https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvW... Other kernel maintainers have already picked up on this. > You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work. Here is a direct quote from Greg where he falsely alleges that Aditya is responsible for the previous work. > Now you submit a new series of obviously-incorrect patches again, Many of the patches are correct - see the above link where one maintainer points this out. > So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches? Another false allegation that Aditya is experimenting on the kernel, attributing malice. > You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect. Many were legitimate. Again, a false accusation from Greg. Then Greg goes on to attack him some more, instead of just explaining things to him, like "Hey, in the future can you add 'found by tool xyz'". In other mailing lists kernel maintainers point out that that would have been the sane response, not going to bother to link that. > Our community welcomes developers who wish to help and enhance Linux. That is NOT what you are attempting to do here, so please do not try to frame it that way. In fact, that is exactly what Aditya was trying to do. > Our community does not appreciate being experimented on, and being "tested" by submitting known patches that are either do nothing on purpose, or introduce bugs on purpose. Aditya did no such thing. Greg's response is indefensible. It's just littered with insults and attacks, and factually incorrect allegations against a legitimate security researcher.
- deleted 5y ago
  [deleted]

boomboomsubban 5y ago

Kroah-Hartman saw a number of patches containing possibly critical bugs, and given past events he assumed they were malicious rather than merely low quality. He soon seemed to realize the mistake, and instigated a second review. 99% of his reaction was related to the previous paper's actions, it's unfortunate that Pakki is getting the blame but from the first post Kroah-Hartman tried to deflect blame away from him.

staticassertion 5y ago
> but from the first post Kroah-Hartman tried to deflect blame away from him. Where are people getting this from? Greg literally, explicitly, accuses Aditya of malice. I have repeatedly quoted him doing so.
- boomboomsubban 5y ago
  >Your professor is playing around with the review process...
  - staticassertion 5y ago
    OK? Greg explicitly accuses Aditya.
    - boomboomsubban 5y ago
      He accuses him of doing what his professor told him to do, a deflection of blame. Even the "explicit" accusations you mention reference that he was not acting alone.
      - staticassertion 5y ago
        Aditya has nothing to do with the research where vulnerabilities were submitted to the kernel. Again, quoting for the millionth time, "> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work." YOU. The first word. In a response to Aditya. It's a false allegation, it's literally incorrect. Aditya was NOT one of the researchers involved in that previous work.