3 ms·
From the article: In response, the UMN researchers posted an open letter apologizing to the community, followed a few days later by a summary of the work they
by dkersten 6y ago
From the article:
In response, the UMN researchers posted an open letter apologizing to the community, followed a few days later by a summary of the work they did [PDF] as part of the "hypocrite commits" project. Five patches were submitted overall from two sock-puppet accounts, but one of those was an ordinary bug fix that was sent from the wrong account by mistake. Of the remaining four, one of them was an attempt to insert a bug that was, itself, buggy, so the patch was actually valid; the other three (1, 2, 3) contained real bugs. None of those three were accepted by maintainers, though the reasons for rejection were not always the bugs in question.
So three submissions were malicious and buggy.
- wnevets 6y agoThere appears to be a disconnect. Their FAQ says otherwise. > We did not introduce or intend to introduce any bug or vulnerability in the Linux kernel. All the bug-introducing patches stayed only in the email exchanges, without being adopted or merged into any Linux branch, which was explicitly confirmed by maintainers. Therefore, the bug-introducing patches in the email did not even become a Git commit in any Linux branch. None of the Linux users would be affected. The following shows the specific procedure of the experiment. [1] https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... [1]
- angry_octet 6y agoMy understanding from the LWN article is that the patches were rejected by the maintainers, not that the authors pulled them after passait review. Lacking informed consent from the kernel mgmt (i.e. G K-H), or external academic oversight, we can't be certain what they planned; I can't see why they deserve the benefit of the doubt. CS researchers need to catch up with life sciences: pre-registered research, trials plans, external ethical oversight by experts in the technology and ethics.
- dkersten 6y agoThat only states that no commits were made. The text I quoted states that malicious patches were submitted, but were rejected (ie not committed).