5 ms·

What is really sad, is that this could be a good pen-test for the kernel. Especially the idea of introducing bugs that are only vulnerabilities when they all c

What is really sad, is that this could be a good pen-test for the kernel. Especially the idea of introducing bugs that are only vulnerabilities when they all come in together. If only they had contacted the Linux Foundation ahead of time to get permission, and set up terms, like a real pen-test. Then work could be done on detecting, and preventing these sorts of attacks, maybe resulting in a system that could help everyone. At the very least a database for security researchers that are registered, but unknown to maintainers, where they could store hashes of bad commits. Then a check if any of those commits made it through. I know the kernel makes use of rebasing, so that might not be the best approach technically, but something like that. To ease the pain of wasting developers time, sponsors could put up money that the maintainer gets if they catch it, and maybe a smaller amount if they have to revert it. EDIT: if the Linux Foundation said no, they could have tried another large open source project with a governing body, Apache, Python, Postgres, Firefox, etc. It wouldn't have been as flashy and high profile, but it would have still been the same research, and odds are you would find at least one project willing to participate.

mimimi31 5y ago
Why would the Linux Foundation get to decide on if those researchers are allowed to experiment on and waste the time of volunteer developers?
- hinkley 5y ago
  The Linux foundation is in a position to ensure that Linux users don’t accidentally get experimented on when the PRs are approved.
- dec0dedab0de 5y ago
  Why would the Linux Foundation get to decide on if those researchers are allowed to experiment on and waste the time of volunteer developers? Granted, In the case of linux, it might make more sense if it were the combination of the Linux Foundation & Linus. It's their project, they can subject their volunteers to any tests they want. It may drive away some volunteers, but wether to take that risk or not, is up to the project to decide. For something as big as the kernel they may decide to get permission from the individual maintainers, maybe even limit the research to only the subsystems that agree to participate. In any case, the point I'm trying to make, is that this kind of testing may be beneficial, if the project is aware of it, and agrees to it. Who gets to decide on behalf of the project, would depend on the hierarchy of each project.
  - ghaff 5y ago
    There are relatively few volunteers working on Linux. They mostly do it for their day jobs. Though the same criticism applies with respect to wasting time at their various companies. But, yes, there may have been some way of conducting a useful test after receiving permission--probably on a limited subsystem or set of subsystems.
- jfrunyon 5y ago
  Presumably they would do so after consultation with kernel developers, like uhh... themselves.
- ret2plt 5y ago
  I think it depends on how you frame it. If the Linux Foundation thinks this kind of research would generate useful information for the kernel project, then the developers' time wouldn't be wasted, just used in a different, yet productive, way. I concede that this is not an easy question, because the developers may have different opinions about the usefulness of this exercise, but at the end of the day, maintainers can run their projects how they see fit.
coldpie 5y ago
> that this could be a good pen-test for the kernel Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "suggestions" the researchers made in their paper[1]? They're clueless. It's like pointing out that buildings can be robbed by breaking their windows. No shit. What do you want to do about it? [1] https://twitter.com/SarahJamieLewis/status/1384880034146574341 https://twitter.com/SarahJamieLewis/status/13848800341465743...
- MaxBarraclough 5y ago
  Agreed. As I mentioned in an earlier thread on this scandal, [0] we already know that security bugs can make their way into the kernel. [0] https://news.ycombinator.com/item?id=26888129 https://news.ycombinator.com/item?id=26888129
  - coldpie 5y ago
    Check out my groundbreaking research. I smashed windows on 20 buildings and took cash out of their registers. In order to fix this vulnerability, I suggest you make everyone who passes by your building sign this piece of paper saying they won't smash your windows and take your money. I will happily receive your nearest Nobel prize now, thank you. Signed, UMN Researchers. Edit: Wait, the cops are here. We sincerely apologize for any harm our research group did to your business. Our goal was to identify issues with the windows on your buildings and we are very sorry that the method used in the “smashing windows to take cash” paper was inappropriate.
    - Supermancho 5y ago
      > I smashed windows on 20 buildings and took cash out of their registers. More like they posted on your facebook pro-<insert your kink here> messages. There's some value in grounding the analogy in reality.
      - generalizations 5y ago
        I think the cash theft is analogous to the dev time the researchers wasted.
willis936 5y ago
The stated motivations of the researchers make it seem like they are not interested in advancing the security of open source software, but rather undermining it.
- squarefoot 5y ago
  Then "on behalf of whom" should be the next question.
guilhas 5y ago
Maybe it is more productive to just do the opposite. When vulnerabilities are found investigate the committer(s) for possible links, and quality of previous work

mimimi31 5y ago

Why would the Linux Foundation get to decide on if those researchers are allowed to experiment on and waste the time of volunteer developers?

hinkley 5y ago
The Linux foundation is in a position to ensure that Linux users don’t accidentally get experimented on when the PRs are approved.
dec0dedab0de 5y ago
Why would the Linux Foundation get to decide on if those researchers are allowed to experiment on and waste the time of volunteer developers? Granted, In the case of linux, it might make more sense if it were the combination of the Linux Foundation & Linus. It's their project, they can subject their volunteers to any tests they want. It may drive away some volunteers, but wether to take that risk or not, is up to the project to decide. For something as big as the kernel they may decide to get permission from the individual maintainers, maybe even limit the research to only the subsystems that agree to participate. In any case, the point I'm trying to make, is that this kind of testing may be beneficial, if the project is aware of it, and agrees to it. Who gets to decide on behalf of the project, would depend on the hierarchy of each project.
- ghaff 5y ago
  There are relatively few volunteers working on Linux. They mostly do it for their day jobs. Though the same criticism applies with respect to wasting time at their various companies. But, yes, there may have been some way of conducting a useful test after receiving permission--probably on a limited subsystem or set of subsystems.
jfrunyon 5y ago
Presumably they would do so after consultation with kernel developers, like uhh... themselves.
ret2plt 5y ago
I think it depends on how you frame it. If the Linux Foundation thinks this kind of research would generate useful information for the kernel project, then the developers' time wouldn't be wasted, just used in a different, yet productive, way. I concede that this is not an easy question, because the developers may have different opinions about the usefulness of this exercise, but at the end of the day, maintainers can run their projects how they see fit.

coldpie 5y ago

> that this could be a good pen-test for the kernel Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "suggestions" the researchers made in their paper[1]? They're clueless. It's like pointing out that buildings can be robbed by breaking their windows. No shit. What do you want to do about it? [1] https://twitter.com/SarahJamieLewis/status/1384880034146574341 https://twitter.com/SarahJamieLewis/status/13848800341465743...

MaxBarraclough 5y ago
Agreed. As I mentioned in an earlier thread on this scandal, [0] we already know that security bugs can make their way into the kernel. [0] https://news.ycombinator.com/item?id=26888129 https://news.ycombinator.com/item?id=26888129
- coldpie 5y ago
  Check out my groundbreaking research. I smashed windows on 20 buildings and took cash out of their registers. In order to fix this vulnerability, I suggest you make everyone who passes by your building sign this piece of paper saying they won't smash your windows and take your money. I will happily receive your nearest Nobel prize now, thank you. Signed, UMN Researchers. Edit: Wait, the cops are here. We sincerely apologize for any harm our research group did to your business. Our goal was to identify issues with the windows on your buildings and we are very sorry that the method used in the “smashing windows to take cash” paper was inappropriate.
  - Supermancho 5y ago
    > I smashed windows on 20 buildings and took cash out of their registers. More like they posted on your facebook pro-<insert your kink here> messages. There's some value in grounding the analogy in reality.
    - generalizations 5y ago
      I think the cash theft is analogous to the dev time the researchers wasted.

willis936 5y ago

The stated motivations of the researchers make it seem like they are not interested in advancing the security of open source software, but rather undermining it.

squarefoot 5y ago
Then "on behalf of whom" should be the next question.

guilhas 5y ago

Maybe it is more productive to just do the opposite. When vulnerabilities are found investigate the committer(s) for possible links, and quality of previous work