2 ms·

The thing that troubles me is how hundreds of good-faith patches came under suspicion. We can say that the researchers are entirely responsible for that as wel

The thing that troubles me is how hundreds of good-faith patches came under suspicion. We can say that the researchers are entirely responsible for that as well -- for creating that need for suspicion. But I do wonder if we were too quick to also fall into a pattern of outrage and absolute rejection. This story went viral partly because it seemed much worse -- "And they're still submitting malicious patches to this day!" -- than it actually was.

bigwavedave 6y ago
I dunno, I think this is one case where outrage and rejection weren't too quick in coming. Let's say you're a software architect (dunno if you are or not). You hire four new software devs, two of them from Colorado State University, and you put the two from CSU on the same team. After a year, you find out one of them has been secretly working for CSU's cyber security research department and poisoning your product with patches that do nothing or subtly introduce bugs on purpose purely so their professor can write a research paper about your company's process. Naturally, you fire the developer and that leaves a bad taste in your mouth and CSU promises not to interfere again. Then you get suspicious and start checking the work of the other CSU dev more closely and find out they're submitting bad patches too! They claim that these bad patches were submitted because their experimental static code analyzer didn't find any issues with them. What conclusion should you reach?
- MilnerRoute 6y ago
  You should conclude "I don't know whether or not these patches were submitted in good faith." People sometimes submit bad patches. Not all of them are malicious. I don't think we've fully addressed or explored the scenario where a young, bright-eyed aspiring student coder does in fact make an innocent mistake. And then is accused of deliberate malicious sabotage. And large chunks of the internet also start condemning them for deliberate and malicious sabotage. What does that say about our community?
  - kuratkull 6y ago
    It's also important to understand the situation you are in - if you are the second CSU dev you got some extra due diligence to do. This is the real world, it's not fair.

bigwavedave 6y ago

I dunno, I think this is one case where outrage and rejection weren't too quick in coming. Let's say you're a software architect (dunno if you are or not). You hire four new software devs, two of them from Colorado State University, and you put the two from CSU on the same team. After a year, you find out one of them has been secretly working for CSU's cyber security research department and poisoning your product with patches that do nothing or subtly introduce bugs on purpose purely so their professor can write a research paper about your company's process. Naturally, you fire the developer and that leaves a bad taste in your mouth and CSU promises not to interfere again. Then you get suspicious and start checking the work of the other CSU dev more closely and find out they're submitting bad patches too! They claim that these bad patches were submitted because their experimental static code analyzer didn't find any issues with them. What conclusion should you reach?

MilnerRoute 6y ago
You should conclude "I don't know whether or not these patches were submitted in good faith." People sometimes submit bad patches. Not all of them are malicious. I don't think we've fully addressed or explored the scenario where a young, bright-eyed aspiring student coder does in fact make an innocent mistake. And then is accused of deliberate malicious sabotage. And large chunks of the internet also start condemning them for deliberate and malicious sabotage. What does that say about our community?
- kuratkull 6y ago
  It's also important to understand the situation you are in - if you are the second CSU dev you got some extra due diligence to do. This is the real world, it's not fair.