4 ms·

> that this could be a good pen-test for the kernel Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "sugge

> that this could be a good pen-test for the kernel Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "suggestions" the researchers made in their paper[1]? They're clueless. It's like pointing out that buildings can be robbed by breaking their windows. No shit. What do you want to do about it? [1] https://twitter.com/SarahJamieLewis/status/1384880034146574341 https://twitter.com/SarahJamieLewis/status/13848800341465743...

MaxBarraclough 5y ago
Agreed. As I mentioned in an earlier thread on this scandal, [0] we already know that security bugs can make their way into the kernel. [0] https://news.ycombinator.com/item?id=26888129 https://news.ycombinator.com/item?id=26888129
- coldpie 5y ago
  Check out my groundbreaking research. I smashed windows on 20 buildings and took cash out of their registers. In order to fix this vulnerability, I suggest you make everyone who passes by your building sign this piece of paper saying they won't smash your windows and take your money. I will happily receive your nearest Nobel prize now, thank you. Signed, UMN Researchers. Edit: Wait, the cops are here. We sincerely apologize for any harm our research group did to your business. Our goal was to identify issues with the windows on your buildings and we are very sorry that the method used in the “smashing windows to take cash” paper was inappropriate.
  - Supermancho 5y ago
    > I smashed windows on 20 buildings and took cash out of their registers. More like they posted on your facebook pro-<insert your kink here> messages. There's some value in grounding the analogy in reality.
    - generalizations 5y ago
      I think the cash theft is analogous to the dev time the researchers wasted.
      - Supermancho 5y ago
        What exactly is the value? How did you come to it? The pay rate of people who would be working on the software regardless of the MNU boondoggle, is not wasted anymore than any other day is wasted. This is part of development. Dead ends, circling back, accounting, maintenance, et al. > I think the cash theft is analogous to the dev time the researchers wasted. That's a fantasy that developers would like to believe because they put an inappropriate valuation on the the time spent on software. The inability to face this, has been disturbing from the start.
  - MaxBarraclough 5y ago
    Related: there's a reason the Certified Ethical Hacker course places such emphasis on getting written permission before doing anything. If you're messing with someone's systems, or (as in this case) with someone's processes, you don't get to claim to be the good guy unless they agreed to it before the fact. It's not rocket science.
dec0dedab0de 5y ago
Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "suggestions" the researchers made in their paper[1]? They're clueless Fair enough. The kernel maintainers are probably much more aware of this than the average open source project. Maybe for some projects it would change their mindset from knowing that this could be happening, to knowing that this will be happening. Maybe it's a pipe dream, but I have a feeling it could lead to discussions of "what could we have done to catch this automatically," which in turn would lead to better static analysis tools. Edit: It would be about as useful as pen testing that includes social engineering. That is to say, everyone knows there are dishonest people, but they may not be aware of some of the techniques they use.
- coldpie 5y ago
  > Maybe it's a pipe dream, but I have a feeling it could lead to discussions of "what could we have done to catch this automatically," which in turn would lead to better static analysis tools. It did do that, at least twenty years ago. Static analysis tooling is a huge, active area of research and the kernel is frequently a target of that research. Ditto for other areas like language development (see the recent work on getting Rust into the kernel). If these students had tried making real contributions to those areas, I'm sure they would have been welcome. But that kind of work is difficult and requires real research and development, which these students aren't interested in and/or capable of. So we got this trash instead, and now hopefully you understand the harsh reaction to it.
  - dec0dedab0de 5y ago
    To be clear, I 100% understand the harsh reaction. If anything I think they were lucky no criminal charges were pressed.
    - coldpie 5y ago
      Yeah. I'm not trying to come down hard on you or anything, I just feel like a common reaction to this research is, "ethics aside, didn't they point out a real vulnerability?" And I want to make it crystal clear that, no, they didn't. Their research was entirely without value.
908B64B197 5y ago
How else were they supposed to get that much exposure for their tier 2 CS program?
- teknopaul 5y ago
  smash some windows in their own university
- HarryHirsch 5y ago
  <s> Bother the freedesktop project? </s>
teknopaul 5y ago
This. and more so, they should be charged for the broken windows. dev hours times 80.

MaxBarraclough 5y ago

Agreed. As I mentioned in an earlier thread on this scandal, [0] we already know that security bugs can make their way into the kernel. [0] https://news.ycombinator.com/item?id=26888129 https://news.ycombinator.com/item?id=26888129

coldpie 5y ago
Check out my groundbreaking research. I smashed windows on 20 buildings and took cash out of their registers. In order to fix this vulnerability, I suggest you make everyone who passes by your building sign this piece of paper saying they won't smash your windows and take your money. I will happily receive your nearest Nobel prize now, thank you. Signed, UMN Researchers. Edit: Wait, the cops are here. We sincerely apologize for any harm our research group did to your business. Our goal was to identify issues with the windows on your buildings and we are very sorry that the method used in the “smashing windows to take cash” paper was inappropriate.
- Supermancho 5y ago
  > I smashed windows on 20 buildings and took cash out of their registers. More like they posted on your facebook pro-<insert your kink here> messages. There's some value in grounding the analogy in reality.
  - generalizations 5y ago
    I think the cash theft is analogous to the dev time the researchers wasted.
    - Supermancho 5y ago
      What exactly is the value? How did you come to it? The pay rate of people who would be working on the software regardless of the MNU boondoggle, is not wasted anymore than any other day is wasted. This is part of development. Dead ends, circling back, accounting, maintenance, et al. > I think the cash theft is analogous to the dev time the researchers wasted. That's a fantasy that developers would like to believe because they put an inappropriate valuation on the the time spent on software. The inability to face this, has been disturbing from the start.
- MaxBarraclough 5y ago
  Related: there's a reason the Certified Ethical Hacker course places such emphasis on getting written permission before doing anything. If you're messing with someone's systems, or (as in this case) with someone's processes, you don't get to claim to be the good guy unless they agreed to it before the fact. It's not rocket science.

dec0dedab0de 5y ago

Not really. Everyone knows this flaw exists, the interesting part is how to fix it. Did you read the "suggestions" the researchers made in their paper[1]? They're clueless Fair enough. The kernel maintainers are probably much more aware of this than the average open source project. Maybe for some projects it would change their mindset from knowing that this could be happening, to knowing that this will be happening. Maybe it's a pipe dream, but I have a feeling it could lead to discussions of "what could we have done to catch this automatically," which in turn would lead to better static analysis tools. Edit: It would be about as useful as pen testing that includes social engineering. That is to say, everyone knows there are dishonest people, but they may not be aware of some of the techniques they use.

coldpie 5y ago
> Maybe it's a pipe dream, but I have a feeling it could lead to discussions of "what could we have done to catch this automatically," which in turn would lead to better static analysis tools. It did do that, at least twenty years ago. Static analysis tooling is a huge, active area of research and the kernel is frequently a target of that research. Ditto for other areas like language development (see the recent work on getting Rust into the kernel). If these students had tried making real contributions to those areas, I'm sure they would have been welcome. But that kind of work is difficult and requires real research and development, which these students aren't interested in and/or capable of. So we got this trash instead, and now hopefully you understand the harsh reaction to it.
- dec0dedab0de 5y ago
  To be clear, I 100% understand the harsh reaction. If anything I think they were lucky no criminal charges were pressed.
  - coldpie 5y ago
    Yeah. I'm not trying to come down hard on you or anything, I just feel like a common reaction to this research is, "ethics aside, didn't they point out a real vulnerability?" And I want to make it crystal clear that, no, they didn't. Their research was entirely without value.

908B64B197 5y ago

How else were they supposed to get that much exposure for their tier 2 CS program?

teknopaul 5y ago
smash some windows in their own university
HarryHirsch 5y ago
<s> Bother the freedesktop project? </s>

teknopaul 5y ago

This. and more so, they should be charged for the broken windows. dev hours times 80.