5 ms·

Can they prosecute UMN? A lot of people and businesses could have suffered extensive damages from their changes, and it seems like some kind of charge should h

Can they prosecute UMN? A lot of people and businesses could have suffered extensive damages from their changes, and it seems like some kind of charge should hold up in court. Should we all contact UMN to complain? Edit: please explain why I’m being downvoted for asking sincere questions.

hn8788 6y ago
You're probably being downvoted because "Should we all contact UMN to complain?" sounds like what twitter outrage mobs do.
- stephenhuey 6y ago
  Fair enough, but I’m not advocating a DDOS attack or anything like that. Just a phone call or email similar to how we might contact our representative.
  - dooglius 6y ago
    This would effectively be a DDOS attack, whether or not you intend it as one.
    - threatofrain 6y ago
      If that’s the case, then although you can wish that all reps have huge staff to collect communications from their constituents, it’s not true, and telling people to call their reps would be even more DDOS because at least universities can act as a firewall. Your local reps in comparison will Never be as well resourced.
      - dooglius 6y ago
        The purpose of calling reps is to air grievances, everyone involved understands this, and they almost certainly have other phone lines for more critical functions. In contrast, a university is contacted for all sorts of reasons related to research/study, and complaining en mass would be highly disruptive to this.
        threatofrain 6y ago
        So the argument you lead with is about extra phone lines? Then one can expect that professors have a university office line, and universities have Way More competency and discretionary budget in hiring PR firms and in-house staff to deal with dynamic and acute events. In terms of sheer muscle power, most public officials can't compare to the behemoth that is a university. They are even outclassed on agility. It may be your local official's job to do something, but the reality of budget anemia is stiffer than their obligations to you.
  - zekrioca 6y ago
    That's the problem with your suggestion. The authors of the papers did not mean to advocate to make human experiments either, yet they did. You suggestion would result in a DDoS attack anyway..
syshum 6y ago
Most likely because of the "suffered extensive damages", which does not seem to be supported by facts. This is more a pride / trust issue than it is actual damages
- invaliduser 6y ago
  How is creating trust issues on a kernel not an actual damage?
  - syshum 6y ago
    Actual Damages is generally a legal term in which someone has to point to an actual dollar value of the damages they suffered. i.e John ran into my car, here is an estimate for $1,000 to repair the damages. Trust is very hard to make an actual damages claim for, it can be done but outside of the Linux Foundation I am not sure what companies would have an actual damages claim
    - lmkg 6y ago
      Actual Damages would be the time & effort to review previous patches for vulnerabilities, which is also the motivation for their demands from UMN. That's complicated by the fact that it's unpaid volunteer work, but a bill for the man-hours to evaluate the extent of the mess and clean it up seems like a clear-cut basis for establishing damages.
      - HarryHirsch 6y ago
        Hopefully, the Linux Foundation or someone with standing sends the university a bill - if they don't have intrinsic motivation to behave ethically, then the force of the market is a powerful motivation.
      - dbcurtis 6y ago
        I have spent time doing contract development, and also made volunteer contributions to open source projects (not the Linux kernal, though). Certainly, if I were pulled into reviewing UMN kernel patches, I would be tracking my hours at my standard hourly rate, so that I would have the documentation for a claim for actual damages. Cleaning up other people's bad-faith crap is not what open source developers volunteer for. UMN caused real work for real people for bad-faith reasons, and should pay up. The work they caused is deflecting volunteers from otherwise productive activities. I suspect many volunteer kernel developers do contract development to pay the bills -- it should not be hard for them to just create a billing code for UMN clean-up. The Linux foundation can aggregate them all and dump that on UMN. (Also, I have a MSEE from UMN, and I can tell you that the next attempt at fund raising from me is not going to go well for them.)
fluidcruft 6y ago
What extensive damages could anyone have suffered from their actions? Anyone can knowingly or unknowingly submit "hypocrite" patches. Beyond that each of the patches fixed a different already-existing security flaw and the research design included removing the hypocrite feature with a followup patch and maintainer education if the first were accepted.
- bluGill 6y ago
  As a graduate of the UMN these actions have reduced the value of my degree. Nobody should trust me because I'm probably tainted with the lack of ethics, and thus I'm unhireable. Fortunately I have a job that I'm proven in, but if they hit a downturn I might be in trouble.
  - jefepstein 6y ago
    > As a graduate of the UMN these actions have reduced the value of my degree. Isn't that like saying an MIT Media Lab degree has reduced in value due to their relationship with Jeffrey Epstein, Nicky Negroponte and other deplorables.
    - dvhh 6y ago
      At least these "deplorables" weren't acting on behalf or with monetary contributions from the MIT Media Lab
    - Accujack 6y ago
      >Isn't that like saying an MIT Media Lab degree has reduced in value due to their relationship with Jeffrey Epstein, Nicky Negroponte and other deplorables. Yes, and this is also true.
    - bluGill 6y ago
      Sortof, but I'll bet you heard of MIT in a good way before, while this is the only time you have heard of the UMN. Thus they are tainted different
  - 6y ago
weagle05 6y ago
I'm giving you an upvote. Look around your house and count the number of linux kernels running. My count is 6 that I know about. I haven't seen the actual vulnerable code submitted to know how critical the vulnerabilities are but I believe these grad students are liable both civilly and criminally. Not advocating for mob justice but there needs to be more than a slap on the wrist. For those of us who live and breath software security everyday this is kind of a big deal.
- zekrioca 6y ago
  I don't agree this is the way to fix the bigger problem, which is the acceptance that every commit to the kernel is done in good faith. As mentioned in another comment, I believe having these grad students to take a look at the ethical impacts of their research is a way forward. Another would be to somehow cast some blame into their supervisor, which should know more. I understand that what they did was, and is bad and shouldn't be done. However how many other people do not also purposely submit buggy patches? In the end of the day, this happening just show vulnerabilities of the merging system itself.
  - threatofrain 6y ago
    The issue isn’t that every commit and committer is treated in good faith. They aren’t. The issue is that U of Minnesota, and universities in general, had a good standing reputation with the Linux kernel group. Students at the University can still submit patches, but not currently with the strength of institutional credibility standing behind them. Knowing who to trust and updating your trust when you’re wrong is part of healthy security.
  - weagle05 5y ago
    I think we disagree on the bigger problem. In my view the bigger problem is the erosion of trust for open source. Over the last 10-ish years there has been a flood of research and marketing around open source software security. I wrote a white paper about it back in 2011. We know there are risks in open source and we know vulnerabilities are created both intentionally and accidentally. We also know open source maintainers are overworked and human. There will be mistakes and we must prepare for them. This is the reason why the fine folks at Sonatype, Snyk, and WhiteSource have jobs. These grad students wanted to make a splash and went after one of the most important code bases on the planet. It stopped being an ethical problem when the kernel maintainers had to manually search for vulnerabilities. They are using hours that could be used elsewhere. The Linux Foundation is paying Greg Kroah-Hartman to solve this problem, so they have a financial loss due to the actions of these grad students. There's your civil liability. They "knowingly cause(d) the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer" so there's your criminal liability from the Computer Fraud and Abuse Act. There's probably criminal liability in the state where they live as well.
tsujp 6y ago
I'd argue yes. Linux is a dependency in a non-trivial subset of global infrastructure. If you tainted _without permission_ (implying no guidelines, no test scenario, no restrictions etc) your local water supply to see if you could and went with "It was a test! Here's some chlorine to fix it." you'd be in serious trouble. This study purposefully tainted the mainline kernel and in doing so absolutely everything that would be built on top of it. This was purposeful malicious action. Malicious actors should be punished.
tw04 6y ago
>Should we all contact UMN to complain? For what purpose other than to harass UMN staff? It's obvious they're well aware of the issue and that the community isn't happy with their actions. They've got staff and students that read HN and twitter. Calling them at this point doesn't accomplish much other than being a DDoS attack and shooting the messenger (there's no way you're going to get in contact with the people who actually conducted the study).
Accujack 6y ago
Prosecute, no. However, if this were in a more traditional scientific field, this sort of error would be treated as a serious lapse of experimental oversight protocols and the school or the participants would be sanctioned according to their professional discipline (in this case, that would probably be the IEEE). Unethical experiments are a huge deal. If this had been an experiment on people face to face in e.g. a sociology context, then these students would likely have been expelled (and probably deported) and would likely be leaving the field. Since it was in an IT area, the U's oversight rules probably weren't even applied.

hn8788 6y ago

You're probably being downvoted because "Should we all contact UMN to complain?" sounds like what twitter outrage mobs do.

stephenhuey 6y ago
Fair enough, but I’m not advocating a DDOS attack or anything like that. Just a phone call or email similar to how we might contact our representative.
- dooglius 6y ago
  This would effectively be a DDOS attack, whether or not you intend it as one.
  - threatofrain 6y ago
    If that’s the case, then although you can wish that all reps have huge staff to collect communications from their constituents, it’s not true, and telling people to call their reps would be even more DDOS because at least universities can act as a firewall. Your local reps in comparison will Never be as well resourced.
    - dooglius 6y ago
      The purpose of calling reps is to air grievances, everyone involved understands this, and they almost certainly have other phone lines for more critical functions. In contrast, a university is contacted for all sorts of reasons related to research/study, and complaining en mass would be highly disruptive to this.
      - threatofrain 6y ago
        So the argument you lead with is about extra phone lines? Then one can expect that professors have a university office line, and universities have Way More competency and discretionary budget in hiring PR firms and in-house staff to deal with dynamic and acute events. In terms of sheer muscle power, most public officials can't compare to the behemoth that is a university. They are even outclassed on agility. It may be your local official's job to do something, but the reality of budget anemia is stiffer than their obligations to you.
- zekrioca 6y ago
  That's the problem with your suggestion. The authors of the papers did not mean to advocate to make human experiments either, yet they did. You suggestion would result in a DDoS attack anyway..

syshum 6y ago

Most likely because of the "suffered extensive damages", which does not seem to be supported by facts. This is more a pride / trust issue than it is actual damages

invaliduser 6y ago
How is creating trust issues on a kernel not an actual damage?
- syshum 6y ago
  Actual Damages is generally a legal term in which someone has to point to an actual dollar value of the damages they suffered. i.e John ran into my car, here is an estimate for $1,000 to repair the damages. Trust is very hard to make an actual damages claim for, it can be done but outside of the Linux Foundation I am not sure what companies would have an actual damages claim
  - lmkg 6y ago
    Actual Damages would be the time & effort to review previous patches for vulnerabilities, which is also the motivation for their demands from UMN. That's complicated by the fact that it's unpaid volunteer work, but a bill for the man-hours to evaluate the extent of the mess and clean it up seems like a clear-cut basis for establishing damages.
    - HarryHirsch 6y ago
      Hopefully, the Linux Foundation or someone with standing sends the university a bill - if they don't have intrinsic motivation to behave ethically, then the force of the market is a powerful motivation.
    - dbcurtis 6y ago
      I have spent time doing contract development, and also made volunteer contributions to open source projects (not the Linux kernal, though). Certainly, if I were pulled into reviewing UMN kernel patches, I would be tracking my hours at my standard hourly rate, so that I would have the documentation for a claim for actual damages. Cleaning up other people's bad-faith crap is not what open source developers volunteer for. UMN caused real work for real people for bad-faith reasons, and should pay up. The work they caused is deflecting volunteers from otherwise productive activities. I suspect many volunteer kernel developers do contract development to pay the bills -- it should not be hard for them to just create a billing code for UMN clean-up. The Linux foundation can aggregate them all and dump that on UMN. (Also, I have a MSEE from UMN, and I can tell you that the next attempt at fund raising from me is not going to go well for them.)

fluidcruft 6y ago

What extensive damages could anyone have suffered from their actions? Anyone can knowingly or unknowingly submit "hypocrite" patches. Beyond that each of the patches fixed a different already-existing security flaw and the research design included removing the hypocrite feature with a followup patch and maintainer education if the first were accepted.

bluGill 6y ago
As a graduate of the UMN these actions have reduced the value of my degree. Nobody should trust me because I'm probably tainted with the lack of ethics, and thus I'm unhireable. Fortunately I have a job that I'm proven in, but if they hit a downturn I might be in trouble.
- jefepstein 6y ago
  > As a graduate of the UMN these actions have reduced the value of my degree. Isn't that like saying an MIT Media Lab degree has reduced in value due to their relationship with Jeffrey Epstein, Nicky Negroponte and other deplorables.
  - dvhh 6y ago
    At least these "deplorables" weren't acting on behalf or with monetary contributions from the MIT Media Lab
  - Accujack 6y ago
    >Isn't that like saying an MIT Media Lab degree has reduced in value due to their relationship with Jeffrey Epstein, Nicky Negroponte and other deplorables. Yes, and this is also true.
  - bluGill 6y ago
    Sortof, but I'll bet you heard of MIT in a good way before, while this is the only time you have heard of the UMN. Thus they are tainted different
- 6y ago

weagle05 6y ago

I'm giving you an upvote. Look around your house and count the number of linux kernels running. My count is 6 that I know about. I haven't seen the actual vulnerable code submitted to know how critical the vulnerabilities are but I believe these grad students are liable both civilly and criminally. Not advocating for mob justice but there needs to be more than a slap on the wrist. For those of us who live and breath software security everyday this is kind of a big deal.

zekrioca 6y ago
I don't agree this is the way to fix the bigger problem, which is the acceptance that every commit to the kernel is done in good faith. As mentioned in another comment, I believe having these grad students to take a look at the ethical impacts of their research is a way forward. Another would be to somehow cast some blame into their supervisor, which should know more. I understand that what they did was, and is bad and shouldn't be done. However how many other people do not also purposely submit buggy patches? In the end of the day, this happening just show vulnerabilities of the merging system itself.
- threatofrain 6y ago
  The issue isn’t that every commit and committer is treated in good faith. They aren’t. The issue is that U of Minnesota, and universities in general, had a good standing reputation with the Linux kernel group. Students at the University can still submit patches, but not currently with the strength of institutional credibility standing behind them. Knowing who to trust and updating your trust when you’re wrong is part of healthy security.
- weagle05 5y ago
  I think we disagree on the bigger problem. In my view the bigger problem is the erosion of trust for open source. Over the last 10-ish years there has been a flood of research and marketing around open source software security. I wrote a white paper about it back in 2011. We know there are risks in open source and we know vulnerabilities are created both intentionally and accidentally. We also know open source maintainers are overworked and human. There will be mistakes and we must prepare for them. This is the reason why the fine folks at Sonatype, Snyk, and WhiteSource have jobs. These grad students wanted to make a splash and went after one of the most important code bases on the planet. It stopped being an ethical problem when the kernel maintainers had to manually search for vulnerabilities. They are using hours that could be used elsewhere. The Linux Foundation is paying Greg Kroah-Hartman to solve this problem, so they have a financial loss due to the actions of these grad students. There's your civil liability. They "knowingly cause(d) the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer" so there's your criminal liability from the Computer Fraud and Abuse Act. There's probably criminal liability in the state where they live as well.

tsujp 6y ago

I'd argue yes. Linux is a dependency in a non-trivial subset of global infrastructure. If you tainted _without permission_ (implying no guidelines, no test scenario, no restrictions etc) your local water supply to see if you could and went with "It was a test! Here's some chlorine to fix it." you'd be in serious trouble. This study purposefully tainted the mainline kernel and in doing so absolutely everything that would be built on top of it. This was purposeful malicious action. Malicious actors should be punished.

tw04 6y ago

>Should we all contact UMN to complain? For what purpose other than to harass UMN staff? It's obvious they're well aware of the issue and that the community isn't happy with their actions. They've got staff and students that read HN and twitter. Calling them at this point doesn't accomplish much other than being a DDoS attack and shooting the messenger (there's no way you're going to get in contact with the people who actually conducted the study).

Accujack 6y ago

Prosecute, no. However, if this were in a more traditional scientific field, this sort of error would be treated as a serious lapse of experimental oversight protocols and the school or the participants would be sanctioned according to their professional discipline (in this case, that would probably be the IEEE). Unethical experiments are a huge deal. If this had been an experiment on people face to face in e.g. a sociology context, then these students would likely have been expelled (and probably deported) and would likely be leaving the field. Since it was in an IT area, the U's oversight rules probably weren't even applied.