5 ms·

Most likely because of the "suffered extensive damages", which does not seem to be supported by facts. This is more a pride / trust issue than it is actual da

• invaliduser 6y ago
  How is creating trust issues on a kernel not an actual damage?
  • syshum 6y ago
    Actual Damages is generally a legal term in which someone has to point to an actual dollar value of the damages they suffered. i.e John ran into my car, here is an estimate for $1,000 to repair the damages. Trust is very hard to make an actual damages claim for, it can be done but outside of the Linux Foundation I am not sure what companies would have an actual damages claim
    • lmkg 6y ago
      Actual Damages would be the time & effort to review previous patches for vulnerabilities, which is also the motivation for their demands from UMN. That's complicated by the fact that it's unpaid volunteer work, but a bill for the man-hours to evaluate the extent of the mess and clean it up seems like a clear-cut basis for establishing damages.
      • HarryHirsch 6y ago
        Hopefully, the Linux Foundation or someone with standing sends the university a bill - if they don't have intrinsic motivation to behave ethically, then the force of the market is a powerful motivation.
      • dbcurtis 6y ago
        I have spent time doing contract development, and also made volunteer contributions to open source projects (not the Linux kernal, though). Certainly, if I were pulled into reviewing UMN kernel patches, I would be tracking my hours at my standard hourly rate, so that I would have the documentation for a claim for actual damages. Cleaning up other people's bad-faith crap is not what open source developers volunteer for. UMN caused real work for real people for bad-faith reasons, and should pay up. The work they caused is deflecting volunteers from otherwise productive activities. I suspect many volunteer kernel developers do contract development to pay the bills -- it should not be hard for them to just create a billing code for UMN clean-up. The Linux foundation can aggregate them all and dump that on UMN. (Also, I have a MSEE from UMN, and I can tell you that the next attempt at fund raising from me is not going to go well for them.)
  • thieving_magpie 6y ago
    Hypothetically let's say that is damage that they can be held liable for. How far does it extend? The patches would have been reviewed and approved by someone at the linux foundation. Are they complicit and liable? Same goes for the person that merged the code. I don't think that's a door I want to open.
• stephenhuey 6y ago
  Can you explain? If I sneak in an exploit to widely used code, couldn’t the damages eventually be large once I or someone else takes advantage of it?
  • syshum 6y ago
    That is hypothetical, you are claiming companies have suffered damages, not that companies COULD suffer IF an exploit made it in.
    • stephenhuey 6y ago
      Not trying to nit-pick, but your quote of what I said specifically left off my words "could have" before the word "suffered" so I do not think I claimed what you are claiming I claimed. Isn't there such a thing as people being charged with conspiracy to commit XYZ?
      • lmkg 6y ago
        Conspiracy to X is a criminal charge, not the basis for a lawsuit. You can only sue someone over actual damages (or statutory damages), not hypothetical damages. If some DA wants to pursue criminal charges against UMN, that's separate from anyone asking to be made whole for the consequences of UMN's actions. There's also no general "Conspiracy" modifier to crimes. Rather, "Conspiracy to X" is a separate law for only a handful of X.
      • tofof 6y ago
        You misunderstand why syshum answered the way he did. GP used the phrase "actual damages" which is a precise term of art in law. Damages have to exist (actual damages already suffered, or statutory damages imposed on conduct which has already transpired) to form a basis for a lawsuit -- the law does not concern itself with hypotheticals. Whether or not there could be 'large damage' in the future (your "once I or someone else takes advantage") is irrelevant, immaterial, and only barely actionable. You could seek an injunction to attempt to prevent further potentially-damaging conduct. But you would not be able to claim any actual damages and would generally not be entitled to any form of compensation, not even for the attorney's fees generated in seeking the injunction. As a sibling points out, conspiracy is question of criminal law, not civil law. Furthermore, in almost all jurisdictions within the United States, conspiracy requires at least one of the members of the conspiracy to have actually committed some overt act in furtherance of the crime. It should be impossible to find these researchers guilty of a conspiracy -- even if you claim that introducing hypocrite commits was the overt act, it is already clear that their intention is to academically investigate (and improve, if you're feeling charitable) the state of open-source security. Their actions (introducing hypocrite commits) are not in and of themselves violations of criminal law, so you'd still have to prove that they actually conspired to do something actually criminally illegal as well, e.g. intent to actually damage in some specific way, facilitated by these commits, some specific entity Foo which uses the linux kernel. It's perfectly clear that no such intent existed.