3 ms·
Key point: >>"kernel maintainers (and maintainers of many other free-software projects) are overworked and do not have the time to properly review every patch
by toss1 6y ago
Key point:
>>"kernel maintainers (and maintainers of many other free-software projects) are overworked and do not have the time to properly review every patch that passes through their hands. They are, as a result, forced to rely on the trustworthiness of the developers who submit patches to them. The kernel development process is, arguably, barely sustainable when that trust is well placed; it will not hold together if incoming patches cannot, in general, be trusted. "
Yet these UMN "researchers" deliberately chose to violate that trust.
Are they so ethically clueless and arrogant that they didn't think to review the plan? Did they hold any kind of ethical review and pass it, or fail it and decide to proceed anyway?
In any case, they've now alerted the entire world that the Linux dev process and OS dev processes in general are incredibly vulnerable to malicious actors.
This vulnerability is also shown by another #1 HN story[1]
[1] https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/ https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/
- detaro 6y agoHow does the netlab link have anything to do with Linux development processes?
- toss1 6y ago>> "... a backdoor targeting Linux X64 systems, a family that has been around for at least 3 years." The point is that OS systems fundamentally depend on the trustworthiness of the contributors and the diliginece and bandwidth of the maintainers. Both are examples showing that the diligence and bandwidth is not infinite, and can be relatively easily overwhelmed or outmaneuvered. The UMN hack showed how easily the trust can be violated, and the netlab 3 year lifetime before discovery shows how easily flaws can stay hidden. The saying is "many eyes make shallow bugs". In an ideal case and with systems that are small relative to the body of people maintaining and actively scrutinizing it, that's true. The reality is that the scale of Linux and most OS is now well beyond the set of people scrutinizing it. How much source code did you review before you installed your latest build?
- detaro 6y agoThe "backdoor" is a program running on Linux. It's not a modification to any system component. "will run arbitrary binaries" is not an issue with lack of trustworthiness. (The way it came onto that system might be, but we don't know anything about that)
- kuratkull 6y agoYou are confused about the kernel vs. userland.