3 ms·
There appears to be a disconnect. Their FAQ says otherwise. > We did not introduce or intend to introduce any bug or vulnerability in the Linux kernel. All the
by wnevets 6y ago
There appears to be a disconnect. Their FAQ says otherwise.
> We did not introduce or intend to introduce any bug or vulnerability in the Linux kernel. All the
bug-introducing patches stayed only in the email exchanges, without being adopted or merged into any
Linux branch, which was explicitly confirmed by maintainers. Therefore, the bug-introducing patches in
the email did not even become a Git commit in any Linux branch. None of the Linux users would be
affected. The following shows the specific procedure of the experiment. [1]
https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.... [1]
- angry_octet 6y agoMy understanding from the LWN article is that the patches were rejected by the maintainers, not that the authors pulled them after passait review. Lacking informed consent from the kernel mgmt (i.e. G K-H), or external academic oversight, we can't be certain what they planned; I can't see why they deserve the benefit of the doubt. CS researchers need to catch up with life sciences: pre-registered research, trials plans, external ethical oversight by experts in the technology and ethics.
- dkersten 6y agoThat only states that no commits were made. The text I quoted states that malicious patches were submitted, but were rejected (ie not committed).