5 ms·
They were “researching” how feasible it is to submit insecure code. In other words, if can they slip some vulnerabilities past the maintainers. To me, it’s th
by stephenhuey 6y ago
They were “researching” how feasible it is to submit insecure code. In other words, if can they slip some vulnerabilities past the maintainers. To me, it’s the same as sabotage. Not only is it unkind, but if it succeeded, many real people depending on that code could be negatively impacted.
- AnIdiotOnTheNet 6y agoThe real problem is that it wasn't done with the informed consent of any kernel maintainers. The information gathered during the exercise is potentially quite valuable for informing policy and procedure around how code is reviewed and accepted, it just wasn't gathered in an ethical way.
- voiper1 6y agoThere's a method for testing this sort of thing: pen-tests with consent from higher ups or "war games" with blue-team/red-team. It's not even a novel thing to do this properly.
- tmotwu 6y agoNope. Lets say IRB made the correct decision and demanded informed consent. Then informed consent must be requested from ALL participants, maintainers, and reviewers of the study. Higher up maintainers don't make that decision for others in this scenario, sorry. Novel or not, lets be completely honest with ourselves, it's not an easy experiment to frame properly.