5 ms·

Can someone please explain in layman terms exactly what happened and why it’s a bad thing? I’m having a hard time figuring out why a pound of flesh needs to be

Can someone please explain in layman terms exactly what happened and why it’s a bad thing? I’m having a hard time figuring out why a pound of flesh needs to be extracted from the University.

stephenhuey 6y ago
They were “researching” how feasible it is to submit insecure code. In other words, if can they slip some vulnerabilities past the maintainers. To me, it’s the same as sabotage. Not only is it unkind, but if it succeeded, many real people depending on that code could be negatively impacted.
- AnIdiotOnTheNet 6y ago
  The real problem is that it wasn't done with the informed consent of any kernel maintainers. The information gathered during the exercise is potentially quite valuable for informing policy and procedure around how code is reviewed and accepted, it just wasn't gathered in an ethical way.
- voiper1 6y ago
  There's a method for testing this sort of thing: pen-tests with consent from higher ups or "war games" with blue-team/red-team. It's not even a novel thing to do this properly.
  - tmotwu 6y ago
    Nope. Lets say IRB made the correct decision and demanded informed consent. Then informed consent must be requested from ALL participants, maintainers, and reviewers of the study. Higher up maintainers don't make that decision for others in this scenario, sorry. Novel or not, lets be completely honest with ourselves, it's not an easy experiment to frame properly.
bakedbeanz 6y ago
Researchers associated with UMN intentionally submitted patches to the Linux kernel with vulnerabilities in them as an experiment. OSS maintainers shouldn't have to be the unwitting test subjects of experiments and have their time wasted (or worse, have vulnerabilities make it into their source code) so that researchers can write a paper about it.
- jdauriemma 6y ago
  Another key detail is that the experiment was carried out without having been submitted to or reviewed by the IRB.
  - xahrepap 6y ago
    I feel it should almost be mentioned: It seems to me that the students did this on the existing reputation of the University. The University had been contributing and were generally trusted. So maintainers were reviewing the code based on that reputation.
    - dvhh 6y ago
      Until we have detailed methodology of the experience it does not seems to have been the case (it looked like they use randomized email address). The only traceable bad patch that can be traced to the university was for one student that tried to coerce its way to patch acceptance, by invoking slander and accusing of other kind of despicable behavior from the reviewer. Which ignited the whole drama (although it started way before that, said student didn't help with the already delicate situation and gave public awareness to the drama).
not_knuth 6y ago
> However, we believe experiments on people without their consent is unethical, and likely involves many legal issues. People are an integral part of the software review and development process. The Linux kernel developers are not test subjects, and must not be treated as such. > As it is, the Linux developers and committers are now burning time reviewing several hundred UMN Linux kernel patches.
deleted 6y ago
[deleted]
splithalf 6y ago
They gave an irb waiver they should not have. The research was clearly unethical and they , the irb, gave it a rubber stamp. It’s likely there is a systemic problem and that this was not an isolated failure.
nepthar 6y ago
Other comments have explained what happened, so I'll explain that the "pound of flesh" demanded appears to be quite reasonable - assistance with finding all of the known bad bits of code that were submitted as part of this project.
underseacables 6y ago
Thank you to everyone who responded, I now understand the situation much better.

Can someone please explain in layman terms exactly what happened and why it’s a bad thing? I’m having a hard time figuring out why a pound of flesh needs to be extracted from the University.

stephenhuey 6y ago

They were “researching” how feasible it is to submit insecure code. In other words, if can they slip some vulnerabilities past the maintainers. To me, it’s the same as sabotage. Not only is it unkind, but if it succeeded, many real people depending on that code could be negatively impacted.

AnIdiotOnTheNet 6y ago
The real problem is that it wasn't done with the informed consent of any kernel maintainers. The information gathered during the exercise is potentially quite valuable for informing policy and procedure around how code is reviewed and accepted, it just wasn't gathered in an ethical way.
voiper1 6y ago
There's a method for testing this sort of thing: pen-tests with consent from higher ups or "war games" with blue-team/red-team. It's not even a novel thing to do this properly.
- tmotwu 6y ago
  Nope. Lets say IRB made the correct decision and demanded informed consent. Then informed consent must be requested from ALL participants, maintainers, and reviewers of the study. Higher up maintainers don't make that decision for others in this scenario, sorry. Novel or not, lets be completely honest with ourselves, it's not an easy experiment to frame properly.

bakedbeanz 6y ago

Researchers associated with UMN intentionally submitted patches to the Linux kernel with vulnerabilities in them as an experiment. OSS maintainers shouldn't have to be the unwitting test subjects of experiments and have their time wasted (or worse, have vulnerabilities make it into their source code) so that researchers can write a paper about it.

jdauriemma 6y ago
Another key detail is that the experiment was carried out without having been submitted to or reviewed by the IRB.
- xahrepap 6y ago
  I feel it should almost be mentioned: It seems to me that the students did this on the existing reputation of the University. The University had been contributing and were generally trusted. So maintainers were reviewing the code based on that reputation.
  - dvhh 6y ago
    Until we have detailed methodology of the experience it does not seems to have been the case (it looked like they use randomized email address). The only traceable bad patch that can be traced to the university was for one student that tried to coerce its way to patch acceptance, by invoking slander and accusing of other kind of despicable behavior from the reviewer. Which ignited the whole drama (although it started way before that, said student didn't help with the already delicate situation and gave public awareness to the drama).

not_knuth 6y ago

> However, we believe experiments on people without their consent is unethical, and likely involves many legal issues. People are an integral part of the software review and development process. The Linux kernel developers are not test subjects, and must not be treated as such. > As it is, the Linux developers and committers are now burning time reviewing several hundred UMN Linux kernel patches.

deleted 6y ago

[deleted]

splithalf 6y ago

They gave an irb waiver they should not have. The research was clearly unethical and they , the irb, gave it a rubber stamp. It’s likely there is a systemic problem and that this was not an isolated failure.

nepthar 6y ago

Other comments have explained what happened, so I'll explain that the "pound of flesh" demanded appears to be quite reasonable - assistance with finding all of the known bad bits of code that were submitted as part of this project.

underseacables 6y ago

Thank you to everyone who responded, I now understand the situation much better.