TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

“They introduce kernel bugs on purpose”

3025 点作者 kdbg大约 4 年前

248 条评论

dang大约 4 年前
This thread is paginated, so to see the rest of the comments you need to click More at the bottom of the page, or like this:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=2" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=2</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=3" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=3</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=4" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=4</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=5" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=5</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=6" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=6</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=7" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670&amp;p=7</a><p>(Posts like this will go away once we turn off pagination. It&#x27;s a workaround for performance, which we&#x27;re working on fixing.)<p>Also, <a href="https:&#x2F;&#x2F;www.neowin.net&#x2F;news&#x2F;linux-bans-university-of-minnesota-for-sending-buggy-patches-in-the-name-of-research&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.neowin.net&#x2F;news&#x2F;linux-bans-university-of-minneso...</a> gives a bit of an overview. (It was posted at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26889677" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26889677</a>, but we&#x27;ve merged that thread hither.)<p>Edit: related ongoing thread: <i>UMN CS&amp;E Statement on Linux Kernel Research</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26895510" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26895510</a> - April 2021 (205 comments and counting)
rzwitserloot大约 4 年前
The professor gets exactly what they want here, no?<p>&quot;We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time&quot;.<p>That&#x27;ll be a fun paper to write, no doubt.<p>Additional context:<p>* One of the committers of these faulty patches, Aditya Pakki, writes a reply taking offense at the &#x27;slander&#x27; and indicating that the commit was in good faith[1].<p>Greg KH then immediately calls bullshit on this, and then proceeds to ban the entire university from making commits [2].<p>The thread then gets down to business and starts coordinating revert patches for everything committed by University of Minnesota email addresses.<p>As was noted, this obviously has a bunch of collateral damage, but such drastic measures seem like a balanced response, considering that this university decided to _experiment_ on the kernel team and then lie about it when confronted (presumably, that lie is simply continuing their experiment of &#x27;what would someone intentionally trying to add malicious code to the kernel do&#x27;)?<p>* Abhi Shelat also chimes in with links to UMN&#x27;s Institutional Review Board along with documentation on the UMN policies for ethical review. [3]<p>[1]: Message has since been deleted, so I&#x27;m going by the content of it as quoted in Greg KH&#x27;s followup, see footnote 2<p>[2]: <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;YH%2FfM%2FTsbmcZzwnX@kroah.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;YH%2FfM%2FTsbmcZzwnX@kroah...</a><p>[3]: <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;3B9A54F7-6A61-4A34-9EAC-95332709BAE7@northeastern.edu&#x2F;#t" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;3B9A54F7-6A61-4A34-9EAC-95...</a>
评论 #26889743 未加载
评论 #26888903 未加载
评论 #26889166 未加载
评论 #26889019 未加载
评论 #26894213 未加载
评论 #26895637 未加载
评论 #26895244 未加载
评论 #26899658 未加载
评论 #26896631 未加载
评论 #26897077 未加载
评论 #26895220 未加载
评论 #26894617 未加载
评论 #26896731 未加载
评论 #26896621 未加载
评论 #26895730 未加载
评论 #26895654 未加载
评论 #26917599 未加载
评论 #26896954 未加载
评论 #26897168 未加载
评论 #26894396 未加载
评论 #26888843 未加载
评论 #26889635 未加载
ENOTTY大约 4 年前
Later down thread from Greg K-H:<p>&gt; Because of this, I will now have to ban all future contributions from your University.<p>Understandable from gkh, but I feel sorry for any unrelated research happening at University of Minnesota.<p>EDIT: Searching through the source code[1] reveals contributions to the kernel from umn.edu emails in the form of an AppleTalk driver and support for the kernel on PowerPC architectures.<p>In the commit traffic[2], I think all patches have come from people currently being advised by Kangjie Liu[3] or Liu himself dating back to Dec 2018. In 2018, Wenwen Wang was submitting patches; during this time he was a postdoc at UMN and co-authored a paper with Liu[4].<p>Prior to 2018, commits involving UMN folks appeared in 2014, 2013, and 2008. None of these people appear to be associated with Liu in any significant way.<p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;torvalds&#x2F;linux&#x2F;search?q=%22umn.edu%22" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;torvalds&#x2F;linux&#x2F;search?q=%22umn.edu%22</a><p>[2]: <a href="https:&#x2F;&#x2F;github.com&#x2F;torvalds&#x2F;linux&#x2F;search?q=%22umn.edu%22&amp;type=commits" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;torvalds&#x2F;linux&#x2F;search?q=%22umn.edu%22&amp;typ...</a><p>[3]: <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;</a><p>[4]: <a href="http:&#x2F;&#x2F;cobweb.cs.uga.edu&#x2F;~wenwen&#x2F;" rel="nofollow">http:&#x2F;&#x2F;cobweb.cs.uga.edu&#x2F;~wenwen&#x2F;</a>
评论 #26888510 未加载
评论 #26888307 未加载
评论 #26888687 未加载
评论 #26888721 未加载
评论 #26888673 未加载
评论 #26894113 未加载
评论 #26893046 未加载
评论 #26888555 未加载
评论 #26888012 未加载
评论 #26888031 未加载
评论 #26888544 未加载
评论 #26887907 未加载
ltfish大约 4 年前
Some clarifications since they are unclear in the original report.<p>- Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&amp;P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&amp;P 2021 paper.<p>- According to the authors&#x27; clarification [1], the S&amp;P 2021 paper did not introduce any bugs into Linux kernel. The three attempts did not even become Git commits.<p>Greg has all reasons to be unhappy since they were unknowingly experimented on and used as lab rats. However, the round of patches that triggered his anger *are very likely* to have nothing to do with the three intentionally incorrect patch attempts leading to the paper. Many people on HN do not seem to know this.<p>[1] <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a>
评论 #26890731 未加载
评论 #26890715 未加载
评论 #26891010 未加载
评论 #26892348 未加载
评论 #26892520 未加载
评论 #26890745 未加载
评论 #26891680 未加载
评论 #26899689 未加载
评论 #26890881 未加载
评论 #26897031 未加载
评论 #26890673 未加载
评论 #26890762 未加载
评论 #26891066 未加载
评论 #26892218 未加载
motohagiography大约 4 年前
This isn&#x27;t friendly pen-testing in a community, this is an attack on critical infrastructure using a university as cover. The foundation should sue the responsible profs personally and seek criminal prosecution. I remember a bunch of U.S. contractors said they did the same thing to one of the openbsd vpn library projects about 15 years ago as well.<p>What this professor is proving out is that open source and (likely, other) high trust networks cannot survive really mendacious participants, but perhaps by mistake, he&#x27;s showing how important it is to make very harsh and public examples of said actors and their mendacity.<p>I wonder if some of these or other bug contributors have also complained that the culture of the project governance is too aggressive, that project leads can create an unsafe environment, and discourage people from contributing? If counter-intelligence prosecutors pull on this thread, I have no doubt it will lead to unravelling a much broader effort.
评论 #26895161 未加载
评论 #26890332 未加载
评论 #26890607 未加载
karsinkk大约 4 年前
Here&#x27;s a clarification from the Researchers over at UMN[1].<p>They claim that none of the Bogus patches were merged to the Stable code line :<p>&gt;Once any maintainer of the community responds to the email,indicating “looks good”,we immediately point out the introduced bug and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our proper patch. In all the three cases, maintainers explicitly acknowledged and confirmed to not move forward with the incorrect patches. This way, we ensure that the incorrect patches will not be adopted or committed into the Git tree of Linux.<p>I haven&#x27;t been able to find out what the 3 patches which the reference are, but the discussions on Greg&#x27;s UMN Revert patch [2] does indicate that some of the fixes have indeed been merged to Stable and are actually Bogus.<p>[1] : <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a><p>[2] : <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh@linuxfoundation.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh...</a>
评论 #26891549 未加载
评论 #26891275 未加载
评论 #26891548 未加载
评论 #26891110 未加载
评论 #26896748 未加载
评论 #26894460 未加载
评论 #26891327 未加载
评论 #26892309 未加载
karlding大约 4 年前
The University of Minnesota&#x27;s Department of Computer Science and Engineering released a statement [0] and &quot;suspended this line of research&quot;.<p>[0] <a href="https:&#x2F;&#x2F;cse.umn.edu&#x2F;cs&#x2F;statement-cse-linux-kernel-research-april-21-2021" rel="nofollow">https:&#x2F;&#x2F;cse.umn.edu&#x2F;cs&#x2F;statement-cse-linux-kernel-research-a...</a>
评论 #26895432 未加载
评论 #26903755 未加载
评论 #26896668 未加载
Dumbdo大约 4 年前
In the follow up chain it was stated that some of their patches made it to stable: <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;YH%2F8jcoC1ffuksrf@kroah.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;YH%2F8jcoC1ffuksrf@kroah.c...</a><p>Can someone who&#x27;s more invested into kernel devel find them and analyze their impact? That sounds pretty interesting to me.<p>Edit: This is the patch reverting all commits from that mail domain: <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh@linuxfoundation.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh...</a><p>Edit 2: Now that the first responses to the reversion are trickling in, some merged patched were indeed discovered to be malicious, like the following. Most of them seem to be fine though or at least non malicious. <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;78ac6ee8-8e7c-bd4c-a3a7-5a90c7ccb399@roeck-us.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;78ac6ee8-8e7c-bd4c-a3a7-5a90c7c...</a>
whack大约 4 年前
Let me play devil&#x27;s advocate here. Such pen-testing is absolutely essential to the safety of our tech ecosystem. Countries like Russia, China and USA are without a doubt, doing exactly the same thing that this UMN professor is doing. Except that instead of writing a paper about it, they are going to abuse the vulnerabilities for their own nefarious purposes.<p>Conducting such pen-tests, and then publishing the results openly, helps raise awareness about the need to assume-bad-faith in all OSS contributions. If some random grad student was able to successfully inject 4 vulnerabilities before finally getting caught, I shudder to think how many vulnerabilities were successfully injected, and hidden, by various nation-states. In order to better protect ourselves from cyberwarfare, we need to be far more vigilant in maintaining OSS.<p>Ideally, such research projects should gain prior approval from the project maintainers. But even though they didn&#x27;t, this paper is still a net-positive contribution to society, by highlighting the need to take security more seriously when accepting OSS patches.
评论 #26894742 未加载
评论 #26895171 未加载
评论 #26895674 未加载
评论 #26895581 未加载
评论 #26897063 未加载
评论 #26895411 未加载
评论 #26894538 未加载
评论 #26899577 未加载
评论 #26895914 未加载
gnfargbl大约 4 年前
From <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;CADVatmNgU7t-Co84tSS6VW=3NcPu=17qyVyEEtVMVR_g51Ma6Q@mail.gmail.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;CADVatmNgU7t-Co84tSS6VW=3N...</a>,<p><i>&gt; A lot of these have already reached the stable trees.</i><p>If the researchers were trying to prove that it is possible to get malicious patches into the kernel, it seems like they succeeded -- at least for an (insignificant?) period of time.
评论 #26887852 未加载
评论 #26888417 未加载
评论 #26888030 未加载
评论 #26887882 未加载
评论 #26888139 未加载
评论 #26888027 未加载
Aissen大约 4 年前
Greg does not joke around: <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh@linuxfoundation.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh...</a><p><pre><code> [PATCH 000&#x2F;190] Revertion of all of the umn.edu commits</code></pre>
评论 #26898165 未加载
评论 #26889717 未加载
评论 #26896878 未加载
评论 #26905592 未加载
random5634大约 4 年前
How does something like this get through IRB - I always felt IRB was over the top - and then they approve something like this?<p>UMN looks pretty shoddy - the response from the researcher saying these were automated by a tool looks like a potential lie.
评论 #26890084 未加载
评论 #26890497 未加载
评论 #26890856 未加载
评论 #26890079 未加载
评论 #26891239 未加载
评论 #26890368 未加载
kwdc大约 4 年前
It would be fascinating to see the ethics committee exemption. I sense there was none.<p>Or is this kind of experiment deemed fair game? Red vs blue team kind of thing? Penetration testing.<p>But if it was me in this situation, I&#x27;d ban them for ethics violation as well. Acting like a Evil doer means you might get caught... and punished. I found the email about cease and desist particularly bad behavior. If that student was lying then that university will have to take real action. Reputation damage and all that. Surely a academic reprimand.<p>I&#x27;m sure there&#x27;s plenty of drama and context we don&#x27;t know about.
评论 #26892101 未加载
评论 #26892716 未加载
评论 #26893878 未加载
评论 #26895591 未加载
kdbg大约 4 年前
I don&#x27;t think there have been any recent comments from anyone at U.Mn. So, back when the original research (happened last year) the following clarification was offered by Qiushi Wu and Kangjie Lu which atleast paints their research in somewhat better light: <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a><p>That said the current incident seems to have gone beyond the limits of that one and is a new incident. I just thought it would be fair to include their &quot;side&quot;
评论 #26887762 未加载
评论 #26887822 未加载
评论 #26887768 未加载
评论 #26889812 未加载
评论 #26887801 未加载
FrameworkFred大约 4 年前
This feels like the kind of thing that &quot;white hat&quot; hackers have been doing forever. UMN may have introduced useful knowledge into the world in the same way some random hacker is potentially &quot;helping&quot; a company by pointing out that they&#x27;ve left a security hole exposed in their system.<p>With that said, kernel developers and companies with servers on the internet are busy doing work that&#x27;s important to them. This sort of thing is always an unwelcome distraction.<p>And, if my neighbors walks in my door at 3 a.m. to let me know I left it unlocked, I&#x27;m going to treat them the same way UMN is getting treated in this situation. Or worse.
评论 #26891948 未加载
评论 #26892272 未加载
评论 #26892603 未加载
toxik大约 4 年前
The problem here is really that they’re wasting time of the maintainers without their approval. Any ethics board would require prior consent to this. It wouldn’t even be hard to do.
评论 #26888453 未加载
评论 #26887908 未加载
gjvc大约 4 年前
I hope USENIX et al ban this student &#x2F; professor &#x2F; school &#x2F; university associated with this work from submitting anything to any of their conferences for 10 years.<p>This was his clarification <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a><p>...in which they have the nerve to say that this is not considered &quot;human research&quot;. It most definitely is, given that their attack vector is the same one many people would be keen on using for submitting legitimate requests for getting involved.<p>If anything, this &quot;research&quot; highlights the notion that coding is but a small proportion of programming and delivery of a product, feature, or bugfix from start-to-finish is a much bigger job than many people like to admit to themselves or others.
g42gregory大约 4 年前
Reading this email exchange, I worry about the state of our education system, including computer science departments. Instead of making coherent arguments, this PhD student speaks about &quot;preconceived biases&quot;. I loved Greg&#x27;s response. The spirit of Linus lives within the Kernel! These UMN people should be nowhere near the kernel. I guess they got the answer to their research on what would happen if you keep submitting stealth malicious patches to the kernel: you will get found out and banned. Made my day.
评论 #26894106 未加载
javier10e6大约 4 年前
The researched yielded non surprising results: Stealthy patches without a proper smoke screen to provide a veil of legitimacy will cause the the purveyor of the patches to become black listed....DUH!
ansible大约 4 年前
I still don&#x27;t get the point of this &quot;research&quot;.<p>You&#x27;re just testing the review ability of particular Linux kernel maintainers at a particular point in time. How does that generalize to the extent needed for it to be valid research on open source software development in general?<p>You would need to run this &quot;experiment&quot; hundreds or thousands of times across most major open source projects.
评论 #26888795 未加载
评论 #26890422 未加载
angry_octet大约 4 年前
Research without ethics is research without value.<p>Unbelievable that this could have passed ethics review, so I&#x27;d bet it was never reviewed. Big black eye for University of Minnesota. Imagine if you are another doctoral student is CS&#x2F;EE and this tool has ruined your ability to participate in Linux.
评论 #26890512 未加载
评论 #26891012 未加载
评论 #26891838 未加载
评论 #26894650 未加载
评论 #26890688 未加载
评论 #26892993 未加载
dsr12大约 4 年前
Plonk is a Usenet jargon term for adding a particular poster to one&#x27;s kill file so that poster&#x27;s future postings are completely ignored.<p>Link: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Plonk_(Usenet)" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Plonk_(Usenet)</a>
qalmakka大约 4 年前
Well, they had it coming. They abused the community&#x27;s trust once in order to gain data for their research, and now it&#x27;s understandable GKH has very little regard for them. Any action has consequences.
segmondy大约 4 年前
Uhhh, I just read the paper, I stopped reading when I read what I pasted below. You attempt to introduce severe security bugs into the kernel and this is your solution?<p>To mitigate the risks, we make several suggestions. First, OSS projects would be suggested to update the code of conduct by adding a code like &quot;By submitting the patch, I agree to not intend to introduce bugs.&quot;
评论 #26897084 未加载
rincebrain大约 4 年前
Prior discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670</a>
评论 #26890612 未加载
评论 #26893951 未加载
endisneigh大约 4 年前
Though I disagree with the research in general, if you <i>did</i> want to research &quot;hypocrite commits&quot; in an actual OSS setting, there isn&#x27;t really any other way to do it other than actually introducing bugs per their proposal.<p>That being said, I think it would&#x27;ve made more sense for them to have created some dummy complex project for a class and have say 80% of the class introduce &quot;good code&quot;, 10% of the class review all code and 10% of the class introduce these &quot;hypocrite&quot; commits. That way you could do similar research without having to potentially break legit code in use.<p>I say this since the crux of what they&#x27;re trying to discover is:<p>1. In OSS anyone can commit.<p>2. Though people are incentivized to reject bad code, complexities of modern projects make 100% rejection of bad code unlikely, if not impossible.<p>3. Malicious actors can take advantage of (1) and (2) to introduce code that does both good and bad things such that an objective of theirs is met (presumably putting in a back-door).
评论 #26891209 未加载
评论 #26891105 未加载
traveler01大约 4 年前
So, for &quot;research&quot; you&#x27;re screwing around the development of one of the most widely used components in the computer world. Worse, introducing security holes that could reach production environments...<p>That&#x27;s a really stupid behavior ...
robrtsql大约 4 年前
Very embarrassed to see my alma mater in the news today. I was hoping these were just some grad students going rogue but it even looks like the IRB allowed this &#x27;research&#x27; to happen.
评论 #26890326 未加载
dcchambers大约 4 年前
So I won&#x27;t lie, this seems like an interesting experiment and I can understand why the professor&#x2F;research students at UMN wanted to do it, but my god the collateral damage against the University is massive. Banning all contributions from a major University is no joke. I also completely understand the scorched earth response from Greg. Fascinating.
jl2718大约 4 年前
I would check their ties to nation-state actors.<p>In closed source, nobody would even check. Modern DevOps has essentially replaced manual code review with unit tests.
评论 #26889506 未加载
评论 #26897880 未加载
评论 #26888521 未加载
throwawayffffas大约 4 年前
As a user of the linux kernel, I feel legal action against the &quot;researchers&quot; should be pursued.
评论 #26890336 未加载
评论 #26888551 未加载
评论 #26903501 未加载
评论 #26888011 未加载
ajarmst大约 4 年前
I used to sit on a research ethics board. This absolutely would not have passed such a review. Not a &#x27;revise and resubmit&#x27; but a hard pass accompanied with &#x27;what the eff were you thinking?. And, yes, this should have had a REB review: testing the vulnerabilities of a system that includes people is experimenting on human subjects. Doing so without their knowledge absolutely requires a strict human subject review and these &quot;studies&quot; would not pass the first sniff test. I don&#x27;t think it&#x27;s even legal in most jurisdictions.
评论 #26891688 未加载
omginternets大约 4 年前
I did my Ph.D in cognitive neuroscience, where I conducted experiments on human subjects. Running these kinds of experiments required approval from an ethics committee, which for all their faults (and there are many), are quite good at catching this kind of shenanigans.<p>Is there not some sort of equivalent in this field?
评论 #26890942 未加载
cblconfederate大约 4 年前
I guess someone had to do this unethical experiment, but otoh, what is the value here? There&#x27;s a high chance someone would later find these &quot;intentional bugs&quot; , it&#x27;s how open source works anyway. They just proved that OSS is not military-grade , but nobody thought so anyway
评论 #26888499 未加载
评论 #26888359 未加载
评论 #26888098 未加载
devmunchies大约 4 年前
Aditya: <i>I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts.</i><p>Greg: <i>You can&#x27;t quit, you&#x27;re fired.</i>
neatze大约 4 年前
Interesting, if they provided to NSF human subject research section, to me this is potential research ethics issue.<p>Imagine, saying we would like to test how fire department responds to fire, by setting buildings on fire in NYC.
评论 #26890632 未加载
waihtis大约 4 年前
Should&#x27;ve at least sought approval from the maintainer party, and perhaps tried to orchestrate it so that the patch approver didn&#x27;t have information about it, but some part of the org did.<p>In a network security analogy, this is just unsolicited hacking VS being a penetration test which it claims more so to be.
评论 #26888226 未加载
veltas大约 4 年前
Regardless of whether consent (which was not given) was required, worth pointing out the emails sent to the mailing list were also intentionally misleading, or fraudulent, so some kind of ethic has obviously been violated there.
forgotpwd16大约 4 年前
Not wanting to play the devil&#x27;s advocate here but though scummy, they still successfully introduced vulnerabilities to the kernel. Suppose the paper hadn&#x27;t been released or an adversary had done it. How long they&#x27;ll be lingering around if they&#x27;re ever removed? The paper makes a case that FOSS projects shouldn&#x27;t merely trust authority for security (neither the ones submitting or the ones reviewing) but utilize tools to find potential vulnerabilities for every commit.
评论 #26891080 未加载
评论 #26892914 未加载
kleiba大约 4 年前
This is bullshit research. I mean, what they have actually found out through their experiments is that you can maliciously introduce bugs into the linux kernel. But, did anyone have doubts about this being possible prior to this &quot;research&quot;?<p>Obviously, bugs gets introduced into all software projects <i>all the time</i>. And the bugs don&#x27;t know whether they&#x27;ve been put there intentionally or accidentally. Alls bugs that ever appeared in the linux kernel obviously made it through the review process. Even when no-one actively tried to introduce them.<p>So, why should it not be possible to intentionally insert bugs if it already &quot;works&quot; unintentionally? What is the insight gained from this innovative &quot;research&quot;?
causality0大约 4 年前
<i>I respectfully ask you to cease and desist from making wild accusations that are bordering on slander.</i><p>Responding properly to that statement would require someone to step out of the HN community guidelines.
closeparen大约 4 年前
This is a community that thinks it’s gross negligence if something with a real name on it fails to be airgapped.<p>Social shame and reputation damage may be useful defense mechanisms in general, but in a hacker culture where the right to make up arbitrarily many secret identities is a moral imperative, people who burn their identities can just get new ones. Banning or shaming is not going to work against someone with actual malicious intent.
评论 #26912197 未加载
djohnston大约 4 年前
Wow this &quot;researcher&quot; is a complete disaster. Who nurtures such a toxic attitude of entitlement and disregard for others time and resources? Not to mention the possible real world consequences of introducing bugs into this OS. He and his group need to be brought before an IRB.
评论 #26890945 未加载
nwsm大约 4 年前
I would say the research was a success. They found that when a bad actor submits malicious patches they are appropriately banned from the project.
评论 #26897090 未加载
1970-01-01大约 4 年前
So be it. Greg is a very trusted member, and has overwhelming support from the community for swinging the banhammer. We have a living kernel to maintain. Minnesota is free to fork the kernel, build their own, recreate the patch process, and send suggestions from there.
jokoon大约 4 年前
I&#x27;m pretty confident the NSA has been doing this for at least two decades, it&#x27;s not a crazy enough conspiracy theory.<p>Inserting backdoors in the form of bugs is not difficult. Just hijack the machine of a maintainer, insert a well placed semicolon, done!<p>Do you remember the quote of Linus Torvalds ? &quot;Given enough eye balls, all bugs are shallow.&quot; ? Do you really believe the Linux source code is being reviewed for bugs?<p>By the way, how do you write tests for a kernel?<p>I like open source, but security implies a lot of different problems and open source is not always better for security.
protomyth大约 4 年前
FYI The IRB for University of Minnesota <a href="https:&#x2F;&#x2F;research.umn.edu&#x2F;units&#x2F;irb" rel="nofollow">https:&#x2F;&#x2F;research.umn.edu&#x2F;units&#x2F;irb</a> has a Human Research Protection Program <a href="https:&#x2F;&#x2F;research.umn.edu&#x2F;units&#x2F;hrpp" rel="nofollow">https:&#x2F;&#x2F;research.umn.edu&#x2F;units&#x2F;hrpp</a> where I cannot find anything on research on people without their permission. There is a Participant&#x27;s Bill of Rights <a href="https:&#x2F;&#x2F;research.umn.edu&#x2F;units&#x2F;hrpp&#x2F;research-participants&#x2F;participant-bill-rights" rel="nofollow">https:&#x2F;&#x2F;research.umn.edu&#x2F;units&#x2F;hrpp&#x2F;research-participants&#x2F;pa...</a> that would seem to indicate uninformed research is not allowed. I would be curious how doing research on the reactions of people to test stimulus in a non-controlled environment is not human research.
aisio大约 4 年前
One reviewers comments to a patch of theirs from 2 weeks ago<p>&quot;Plainly put, the patch demonstrates either complete lack of understanding or somebody not acting in good faith. If it&#x27;s the latter[1], may I suggest the esteemed sociologists to fuck off and stop testing the reviewers with deliberately spewed excrements?&quot;<p><a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;YH4Aa1zFAWkITsNK@zeniv-ca.linux.org.uk&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;YH4Aa1zFAWkITsNK@zeniv-ca.linux...</a>
评论 #26892832 未加载
devit大约 4 年前
The project is interesting, but how can they be so dumb as to post these patches under an @umn.edu address instead of using a new pseudonymous identity for each patch?!?<p>I mean, sneakily introducing vulnerabilities obviously only works if you don&#x27;t start your messages by announcing you are one of the guys known to be trying to do so...
评论 #26888177 未加载
chandmk大约 4 年前
I am wondering if Aditya didn&#x27;t respond the way he did (using corporate lawyer&#x27;s langauge), Greg would have not reached to this conclusion? I am a bit surprised by the entitlement he was showing. Why would anyone use those words despite sending a nonsense patch! What kind of defence he was thinking he had among a group of seasoned developers other than being honest about intentions? I wouldn&#x27;t be surprised if his professor doesn&#x27;t even know what he was doing!
philsnow大约 4 年前
This seems like wanton endangerment. Kernels get baked into medical devices and never, ever updated.<p>I would be livid if I found that code from these &quot;researchers&quot; was running in a medical device that a family member relied upon.
resoluteteeth大约 4 年前
I suspect the university will take some sort of action now that this has turned into incredibly bad press (although they really should have done something earlier).
nspattak大约 4 年前
WTF? They are experimenting with people without their consent? And they haven&#x27;t been kicked out of the academic community????
Metacelsus大约 4 年前
Yikes, and what are they hoping to accomplish with this &quot;research&quot;?
评论 #26887797 未加载
评论 #26887788 未加载
评论 #26887865 未加载
评论 #26887811 未加载
inquisitivemind大约 4 年前
I have a question for this community:<p>Insofar as this specific method of injecting flaws matches a foreign country&#x27;s work done on U.S. soil - as many people in this thread have speculated - do people here think that U.S. three letter agencies (in particular NSA&#x2F;CIA) should have the ability to look at whether the researchers are foreign agents&#x2F;spies, even though the researchers are operating from the United States? For example, should the three letter agencies have the ability to review these researchers&#x27; private correspondence and social graphs?<p>Insofar as those agencies <i>should</i> have this ability, then, when should they use it? If they do use it, and find that someone is a foreign agent, in what way and with whom should they share their conclusions?
atleta大约 4 年前
Now one of the problems with research in general is that negative results don&#x27;t get published. While in this case it probably resolved itself automatically, if they have any ethical standards then they&#x27;ll write a paper about how it ended. Something like &quot;our assumption was that it&#x27;s relatively easy to deliberately sneak in bugs into the Linux kernel but it turns out we were wrong. We managed to get our whole university banned and all former patches from all contributors from our university, including from those outside of your our research team, reversed.&quot;<p>Also, while their assumption is interesting, there sure had to be an ethical and safe way to conduct this. Especially without allowing their bugs to slip into release.
up2isomorphism大约 4 年前
From an outsider, the main question is: does this expose an actual weakness in the Linux development model?<p>From what I understand, this answer seems to be a &quot;yes&quot;.<p>Of course, it is understandable that GKH is frustrated, and if his community do not like someone pointing out this issue, it is OK too.<p>However, one researcher does not represent the whole university, so it seems immature to vent this to other unrelated people just because you can.
评论 #26899758 未加载
评论 #26896354 未加载
评论 #26901789 未加载
bloat大约 4 年前
It&#x27;s been a long time since I saw this usage of the word &quot;plonk&quot;. Brought back some memories.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Plonk_(Usenet)" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Plonk_(Usenet)</a>
svarog-run大约 4 年前
I feel like q lot of people here did not interpret this correctly.<p>As far as it&#x27;s known, garbage code was not introduced into kernel.It was caught in the review process literally on the same day.<p>However, there has been merged code from the same people, which is not necessarily vulnerable. As a precaution the older commits are also being reverted, as these people have been identified as bad actors
评论 #26889418 未加载
tsujp大约 4 年前
This is categorically unethical behaviour. Attempting to get malicious code into an open source project that powers a large set of the worlds infrastructure — or even a small project — should be punished in my view. Actors are known, its been stated by the actors as intentional.<p>I think the Linux Foundation should make an example of this.
squarefoot大约 4 年前
&quot;Yesterday, I took a look on 4 accepted patches from Aditya and 3 of them added various severity security &quot;holes&quot;.&quot;<p>Sorry for being the paranoid one here, but reading this raises a lot of warning flags.
seanieb大约 4 年前
Regardless of their methods, I think they just proved the kernel security review process is non-existent. Either in the form of static analysis or human review. Whats being done to address those issues?
评论 #26888079 未加载
评论 #26888141 未加载
评论 #26888713 未加载
评论 #26888295 未加载
评论 #26888118 未加载
francoisp大约 4 年前
I fail to see how this does not amount to vandalism of public property. <a href="https:&#x2F;&#x2F;www.shouselaw.com&#x2F;ca&#x2F;defense&#x2F;penal-code&#x2F;594&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.shouselaw.com&#x2F;ca&#x2F;defense&#x2F;penal-code&#x2F;594&#x2F;</a>
nickysielicki大约 4 年前
UMN has some egg on their face, surely, but I think the IEEE should be equally embarrassed that they accepted this paper.
icedchai大约 4 年前
Seems like completely pointless &quot;research.&quot; Clearly it wasted the maintainers&#x27; time, but also the &quot;researchers&quot; investigating something that is so obviously possible. Weren&#x27;t there any real projects to work on?
LordN00b大约 4 年前
* plonk * Was a very nice touch.
评论 #26889210 未加载
arkh大约 4 年前
&gt; I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts.<p>Maybe not being nice is part of the immune system of open source.
评论 #26890485 未加载
评论 #26890799 未加载
评论 #26890770 未加载
评论 #26890385 未加载
评论 #26890398 未加载
评论 #26890923 未加载
评论 #26890796 未加载
评论 #26890664 未加载
评论 #26890971 未加载
评论 #26890536 未加载
评论 #26892339 未加载
评论 #26890712 未加载
评论 #26891986 未加载
评论 #26892437 未加载
评论 #26890961 未加载
评论 #26891063 未加载
leeuw01大约 4 年前
In a follow-up [1], the author suggests: OSS projects would be suggested to update the code of conduct, something like “By submitting the patch, I agree to not intend to introduce bugs”<p>How can one be so short-sighted?...<p>[1] <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a>
macspoofing大约 4 年前
Linux maintainers should log a complaint with the University&#x27;s ethics board. You can&#x27;t just experiment on people without consent.
评论 #26890093 未加载
评论 #26890490 未加载
评论 #26890308 未加载
评论 #26890290 未加载
评论 #26890656 未加载
评论 #26890338 未加载
评论 #26890311 未加载
评论 #26890228 未加载
pushcx大约 4 年前
CS researchers at the University of Chicago did a similar experiment on me and other maintainers a couple years ago: <a href="https:&#x2F;&#x2F;github.com&#x2F;lobsters&#x2F;lobsters&#x2F;issues&#x2F;517" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lobsters&#x2F;lobsters&#x2F;issues&#x2F;517</a><p>And similarly to U Minn, their IRB covered for them: <a href="https:&#x2F;&#x2F;lobste.rs&#x2F;s&#x2F;3qgyzp&#x2F;they_introduce_kernel_bugs_on_purpose#c_bxb4rk" rel="nofollow">https:&#x2F;&#x2F;lobste.rs&#x2F;s&#x2F;3qgyzp&#x2F;they_introduce_kernel_bugs_on_pur...</a><p>My experience felt really shitty, and I&#x27;m sorry to see I&#x27;m not alone. If anyone is organizing a broad response to redress previous abuses or prevent future abuse, I&#x27;d appreciate hearing about it, my email&#x27;s on my profile.
rubyn00bie大约 4 年前
This is supremely fucked up and I’d say is borderline criminal. It’s really lucky asshole researchers like this haven’t caused a bug that cost billions of dollars, or killed someone, because eventually shit like this will... and holy shit will “it was just research” do nothing to save them.
评论 #26890499 未加载
评论 #26891677 未加载
评论 #26893237 未加载
评论 #26892606 未加载
评论 #26890574 未加载
评论 #26890554 未加载
评论 #26891221 未加载
评论 #26894351 未加载
评论 #26890911 未加载
评论 #26890496 未加载
WaitWaitWha大约 4 年前
There is so much disdain for unethical, ivory tower thinking in universities, this is not helping.<p>But, allow me to pull a different thread. How liable is the professor, the IRB, and the university if there is any calamity caused by the known code?<p>What is the high level difference between their action, and spreading malware intentionally?
jedimastert大约 4 年前
Out of curiosity, what would be an actually good way to poke at the pipeline like this? Just ask if they&#x27;d OK a patch w&#x2F;o actually submitting it? A survey?
评论 #26888122 未加载
评论 #26888435 未加载
评论 #26888028 未加载
评论 #26888068 未加载
wuxb大约 4 年前
Sending those patches is just disgraceful. I guess they&#x27;re using the edu emails so banning the university is a very effective action so someone will respond to it. Otherwise, the researchers will just quietly switch to other communities such as Apache or GNU. Who want buggy patches?
评论 #26909550 未加载
devwastaken大约 4 年前
this is not surprising to me given the quality of minnesotta universities. U of M should be banned from existence. I remember vividly how they&#x27;d break their budgets redesigning cafeterias, hiring low quality &#x27;professors&#x27; that refused to make paper assignments digitized. (They didnt know how). Artificially inflated dorm costs without access to affordable cooking. (Meal plans only). They have bankrupted plenty of students that were forced to drop out due to their policies on mental health. It&#x27;s essentially against policy to be depressed or suicidal. They predate on kids in high school who don&#x27;t at all know what they&#x27;re signing up for.<p>Defund federal student loans. Make these universities stand on their own two feet or be replaced by something better.
Taylor_OD大约 4 年前
The professor is going to give a ted talk in about a year talking about how he got banned from open source development and the five things he learned from it.
eatbitseveryday大约 4 年前
Clarification from their work that was posted on the professor&#x27;s website:<p><a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a>
kleiba大约 4 年前
How is such a ban going to be effective? The &quot;researchers&quot; could easily continue their experiments using different credentials, right?
评论 #26890306 未加载
评论 #26890063 未加载
评论 #26890027 未加载
评论 #26890072 未加载
评论 #26890069 未加载
评论 #26890170 未加载
评论 #26890058 未加载
评论 #26890137 未加载
评论 #26890220 未加载
NalNezumi大约 4 年前
So the professor in center of this event, Kangjie Lu[0] is also program comitee at IEEE S&amp;P 2021.[1]<p>I&#x27;m by no means an security expert nor a kernel contributor but considering he&#x27;s program comitee, is these kind of practices a common place in Security&#x2F;Privacy researchers?<p>Does idea&#x2F;practises like this get a pass on conference publishing regularly?<p>[0] <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;</a> [1] <a href="https:&#x2F;&#x2F;www.ieee-security.org&#x2F;TC&#x2F;SP2022&#x2F;cfpapers.html" rel="nofollow">https:&#x2F;&#x2F;www.ieee-security.org&#x2F;TC&#x2F;SP2022&#x2F;cfpapers.html</a>
sida大约 4 年前
Let me play devil&#x27;s advocate here though. This is absolutely necessary and shows the process in the kernel is vulnerable.<p>Sure, this is &quot;just&quot; a university research project this time. And sure, this is done in bad taste.<p>But there are legitimately malicious national actors (well, including the US govt and the various 3 letter agencies) that absolutely do this. And the national actors are likely even far more sophisticated than a couple of PhD students. They have the time, resources and energy to do this over a very long period of time.<p>I think on the whole, this is very net positive in that it reveals the vulnerability of open source kernel development. Despite, how shitty it feels.
评论 #26898728 未加载
jrm4大约 4 年前
Sure. And we are <i>well past</i> the time in which we need to develop real legal action and&#x2F;or policy -- with consequences against this sort of thing.<p>We have an established legal framework to do this. It&#x27;s called &quot;tort law,&quot; and we need to learn how to point it at people who negligently or maliciously create and or mess with software.<p>What makes it difficult, of course, is that not only should it be pointed at jerk researchers, but anyone who works on software, provably knows the harm their actions can or do cause, and does it anyway. This describes &quot;black hat hackers,&quot; but also quite a few &quot;establishment&quot; sources of software production.
Pensacola大约 4 年前
&lt;consipracy theory&gt;This is intentionally malicious activity conducted with a perfect cover story&lt;&#x2F;conspiracy theory&gt;
kerng大约 4 年前
Where does such &quot;research&quot; end... sending phishing mails to all US citizens to see how many passwords can be stolen?
mrleinad大约 4 年前
Well, the University got pissed off.<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;UMNComputerSci&#x2F;status&#x2F;1384948683821694976" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;UMNComputerSci&#x2F;status&#x2F;138494868382169497...</a>
lamp987大约 4 年前
Unethical and harmful.
anarticle大约 4 年前
Ah yes, showing those highly paid linux kernel developers how broken their system of trust and connection is! Great work.<p>Now if we can only find more open source developers to punish for trusting contributors!<p>Enjoy your ban.<p>Sorry if this comment seems off base, this research feels like a low blow to people trying to do good for a largely thankless job.<p>I would say they are violating some ideas of Ken Thompson: <a href="https:&#x2F;&#x2F;www.cs.cmu.edu&#x2F;~rdriley&#x2F;487&#x2F;papers&#x2F;Thompson_1984_ReflectionsonTrustingTrust.pdf" rel="nofollow">https:&#x2F;&#x2F;www.cs.cmu.edu&#x2F;~rdriley&#x2F;487&#x2F;papers&#x2F;Thompson_1984_Ref...</a>
LudwigNagasena大约 4 年前
I am honestly surprised anything like this can pass the ethic committee. The reputational risk seems huge.<p>For example, in economics departments there is usually a ban on lying to experiment participants. Many of them even explicitly explain to participants that this is a difference between economics and psychology experiments. The reason is that studying preferences is very important to economists, and if participants don’t believe that the experiment conditions are reliable, it will screw the research.
ogre_codes大约 4 年前
If the university was doing research then they should publish their findings on this most recent follow up experiment.<p>Suggested title:<p>“Linux Kernel developers found to reject nonsense patches from known bad actors”
darksaints大约 4 年前
As a side note to all of the discussion here, it would be really nice if we could find ways to take all of the incredible linux infrastructure, and repurpose it for SeL4. It is pretty scary that we&#x27;ve got ~30M lines of code in the kernel and the primary process we have to catch major security bugs is to rely on the experienced eyes of Greg KH or similar. They&#x27;re awesome, but they&#x27;re also human. It would be much better to rely on capabilities and process isolation.
nemoniac大约 4 年前
Who funds this? They acknowledge funding from the NSF but you could imagine that it would benefit some other large players to sow uncertainty and doubt about Open Source Software.
DonHopkins大约 4 年前
Shouldn&#x27;t the university researchers compensate their human guinea pigs with some nice lettuce?
znpy大约 4 年前
I think it&#x27;s a fair measure, albeit drastic.<p>What happens if any of that patches ends up in a kernel release?<p>It&#x27;s like setting random houses on fire just to test the responsiveness of local firefighters.
评论 #26896793 未加载
ineedasername大约 4 年前
I don&#x27;t know how their IRB approved this, although we also don&#x27;t know what details the researchers gave the IRB.<p>It had a high human component because it was humans making many decisions in this process. In particular, there was the potential to cause maintainers personal embarrassment or professional censure by letting through a bugged patch.<p>If the researchers even considered this possibility, I doubt the IRB would have approved this experimental protocol if laid out in those terms.
tediousdemise大约 4 年前
This not only erodes trust in the University of Minnesota, but also erodes trust in the Linux kernel.<p>Imagine how downstream consumers of the kernel could be affected. The kernel is used for some extremely serious applications, in environments where updates are nonexistent. These bad patches could remain permanently in situ for mission-critical applications.<p>The University of Minnesota should be held liable for any damages or loss of life incurred by their reckless decision making.
grae_QED大约 4 年前
This is insulting. The whole premise behind the paper is that open source developers aren&#x27;t able to parse comits for malicious code. From a security standpoint, sure, I&#x27;m sure a bad actor could attempt to do this. But the fact that he tried this on the linux kernel, an almost sacred piece of software IMO, and expected it to work takes me aback. This guy either has a huge ego or knows very little about those devs.
dynm大约 4 年前
I&#x27;d be interested if there&#x27;s a more ethical way to do this kind of research, that wouldn&#x27;t involve actually shipping bugs to users. There certainly is some value in kind of &quot;penetration testing&quot; things to see how well bad actors could get away with this kind of stuff. We basically have to assume that more sophisticated actors are doing this without detection...
freewizard大约 4 年前
Using faked identity and faked papers to expose loopholes and issues in an institution is not news in science community. Kernel community may not be immune to some common challenges for any sizable institution I assume, so some ethical hacking here seems reasonable.<p>However, doing it repeatedly with real names seems not helpful to the community and indicates a questionable motivation.
bluenose69大约 4 年前
The ban seems rational, when viewed in the context of kernel development.<p>The benefit is twofold: (a) it&#x27;s simpler to block a whole university than it is to figure out who the individuals are and (b) this sends a message that there is some responsibility at the institutional level.<p>The risk is that someone writing from that university address might have something that would be useful to the software.<p>Getting patches and pull-requests accepted is not a guaranteed. And it&#x27;s asking a lot of kernel developers that they check not just bad code but also for badly-intended code.<p>I had a look at the research paper (<a href="https:&#x2F;&#x2F;github.com&#x2F;QiushiWu&#x2F;QiushiWu.github.io&#x2F;blob&#x2F;main&#x2F;papers&#x2F;OpenSourceInsecurity.pdf" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;QiushiWu&#x2F;QiushiWu.github.io&#x2F;blob&#x2F;main&#x2F;pap...</a>) and it saddens me to see such a thing coming out of a university. It&#x27;s like a medical researcher introducing a disease to see whether it spreads quickly.
francoisp大约 4 年前
(I posted this on another entry that dropped out of the first page of HN? sorry for the dupe)<p>I fail to see how this does not amount to vandalism of public property. <a href="https:&#x2F;&#x2F;www.shouselaw.com&#x2F;ca&#x2F;defense&#x2F;penal-code&#x2F;594&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.shouselaw.com&#x2F;ca&#x2F;defense&#x2F;penal-code&#x2F;594&#x2F;</a>
im3w1l大约 4 年前
I can&#x27;t help but think of the Sokal affair. But I&#x27;ll leave the comparison to someone more knowledgeable about them both.
评论 #26890473 未加载
maccard大约 4 年前
Is there a more readable version of this available somewhere? I really struggle to follow the unformatted mailing list format.
评论 #26923140 未加载
评论 #26888168 未加载
rurban大约 4 年前
This is the big revert, a good overview of all the damage they did. Some were good, most were malicious, most author names were fantasy.<p><a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh@linuxfoundation.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;lkml&#x2F;20210421130105.1226686-1-gregkh...</a>
djhaskin987大约 4 年前
Interesting tidbit from the prof&#x27;s CV where he lists the paper, interpret from it what you will[1]:<p>&gt; On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits<p>&gt; Qiushi Wu, and Kangjie Lu.<p>&gt; To appear in Proceedings of the 42nd IEEE Symposium on Security and Privacy (Oakland&#x27;21). Virtual conference, May 2021.<p>&gt; Note: The experiment did not introduce any bug or bug-introducing commit into OSS. It demonstrated weaknesses in the patching process in a safe way. No user was affected, and IRB exempt was issued. The experiment actually fixed three real bugs. Please see the clarifications[2].<p>1: <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;</a><p>2: <a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a>
darau1大约 4 年前
So FOSS is insecure if maintainers are lazy? This would hold true for any piece of software, wouldn&#x27;t it? The difference here is that even though the &quot;hypocrite commits&quot; &#x2F;were&#x2F; accepted, they were spotted soon after. Something that might not have happened quite as quickly in a closed source project.
CountSessine大约 4 年前
I have to wonder what&#x27;s going to happen to the advisor who oversaw this research. This knee-caps the whole department when conducting OS research and collaboration. If this isn&#x27;t considered a big deal in the department, it should be. I certainly wouldn&#x27;t pursue a graduate degree there in OS research now.
kerng大约 4 年前
What I dont get... why not ask the board of the Linux foundation if they could attempt social engineering attacks and get authorization. If Linux foundation sees value they&#x27;d approve it and who knows maybe such tests (hiring pentesters to do social engineering) are done anyway by the Linux foundation.
beshrkayali大约 4 年前
This seems like a pretty scummy way to do &quot;research&quot;. I mean I understand that people in academia are becoming increasingly disconnected from the real world, but wow this is low. It&#x27;s not that they&#x27;re doing this, I&#x27;m sure they&#x27;re not the first to think of this (for research or malicious reasons), but having the gall to brag about it is a new low.
评论 #26890676 未加载
评论 #26890562 未加载
评论 #26890588 未加载
评论 #26891043 未加载
评论 #26892575 未加载
评论 #26891901 未加载
评论 #26892161 未加载
评论 #26891145 未加载
评论 #26891687 未加载
评论 #26892507 未加载
评论 #26890805 未加载
评论 #26892859 未加载
评论 #26892682 未加载
评论 #26891731 未加载
评论 #26893271 未加载
评论 #26891852 未加载
评论 #26891531 未加载
johncessna大约 4 年前
As a user of linux, I want to see this ban go further. Nothing from the University of MN, it&#x27;s teaching staff, or it&#x27;s current or past post-grad students.<p>Once they clean out the garbage in the Comp Sci department and their research committee that approved this experiment, we can talk.
mycologos大约 4 年前
I agree with most commenters here that this crosses the line of ethical research, and I agree that the IRB dropped the ball on this.<p>However, zooming out a little, I think it&#x27;s kind of useful to look at this as an example of the incentives at play for a regulatory bureaucracy. Comments bemoaning such bureaucracies are pretty common on HN (myself included!), with specific examples ranging from the huge timescale of public works construction in American cities to the FDA&#x27;s slow approval of COVID vaccines. A common request is: can&#x27;t these regulators be a little less conservative?<p>Well, this story is an example of why said regulators might avoid that -- one mistake here, and there are multiple people in this thread promising to email the UMN IRB and give them a piece of their mind. One mistake! And when one mistake gets punished with public opprobrium, it seems very rational to become conservative and reject anything close to borderline to avoid another mistake. And then we end up with the cautious bureaucracies that we like to complain about.<p>Now, in a nicer world, maybe those emails complaining to the IRB would be considered valid feedback for the people working there, but unfortunately it seems plausible that it&#x27;s the kind of job where the only good feedback is no feedback.
Fordec大约 4 年前
In Ireland there was a referendum to repeal the ban on abortion referendum there was very heated arguments, bot twitter accounts and general toxicity. For the sake of peoples sanity, there was a &quot;Repeal Shield&quot; implemented that blocked bad faith actors.<p>This news makes me wish to implement my own block on the same contributors to any open source I&#x27;m involved with. At the end of the day, their ethics is their ethics. Those ethics are not Linux specific, it was just the high profile target in this instance. I would totally subscribe to or link to a group sourced file similar to a README.md or CONTRIBUTORS.md (CODERS_NON_GRATA.md?) that pulled such things.
评论 #26894769 未加载
rurban大约 4 年前
I&#x27;d really like to review now similar patches in FreeRTOS, FreeBSD and such. Their messages and fixes all follow a certain scheme, which should be easy to detect.<p>At least both of them they are free from such @umn.edu commits with fantasy names.
Radle大约 4 年前
@gregkh<p>These patches look like bombs under bridges to me.<p>Do you believe that some open source projects should have legal protection against such actors? The Linux Kernel is pretty much a piece of infrastructure that keeps the internet going.
mikaeluman大约 4 年前
Usually I am very skeptical of &quot;soft&quot; subjects like the humanities; but clearly this is unethical research.<p>In addition to wasting people&#x27;s time, you are potentially messing with software that runs the world.
评论 #26893630 未加载
fennecs大约 4 年前
They are rightfully worried about old commits? Maybe it&#x27;s time they switched to a more secure language which can more easily detect malicious code. To be honest C seems critically insecure without a whole lot of work. If a bunch of experts even struggle, seems like they need better tools. Especially since Linux is so important, and there are a lot more threats, Rust seems like a good solution.<p>Apart from some perhaps critical unsafe stuff which should have a lot of attention, requiring everything to be safe&#x2F;verified to some extent surely is the answer.
largehotcoffee大约 4 年前
This was absolutely the right move. Smells really fishy given the history. I imagine this is happening in other parts of the community (attempting to add malicious code), albeit under a different context.
ficiek大约 4 年前
Is introducing bugs into computer systems on purpose like this in some way illegal in the USA? I understand that Linux is run by a ton of government agencies as well, would they take interest in this?
gjvc大约 4 年前
see also<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;UMNComputerSci&#x2F;status&#x2F;1384948683821694976" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;UMNComputerSci&#x2F;status&#x2F;138494868382169497...</a>
wolverine876大约 4 年前
I don&#x27;t see the difference between these and other &#x27;hackers&#x27;, white-hat, black-hat etc. The difference I see is the institution tested, Linux, is beloved here.<p>Usually people are admired here for finding vulnerabilities in all sorts of systems and processes. For example, when someone submits a false paper to a peer-reviewed journal, people around here root for them; I don&#x27;t see complaints about wasting the time and violating the trust of the journal.<p>But should one of our beloved institutions be tested - now it&#x27;s an outrage?
评论 #26895747 未加载
评论 #26900906 未加载
nullc大约 4 年前
CS department security research is near universally not held to be in the scope of IRBs. This isn&#x27;t entirely bad: the IRB process that projects are subjected to is so broken that it would be a sin to bring that mess on any other things.<p>But it means the regularly &#x27;security&#x27; research does ethically questionable stuff.<p>IRBs exist because of legal risk. If parties harmed by unethical computer science research do not litigate (or bring criminal complaints, as applicable) the university practices will not substantially change.
评论 #26899741 未加载
Luker88大约 4 年前
The discussion points link to the github of the research<p><a href="https:&#x2F;&#x2F;github.com&#x2F;QiushiWu&#x2F;QiushiWu.github.io&#x2F;blob&#x2F;main&#x2F;papers&#x2F;OpenSourceInsecurity.pdf" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;QiushiWu&#x2F;QiushiWu.github.io&#x2F;blob&#x2F;main&#x2F;pap...</a><p>It has yet to be published (due next month)<p>How about opening few bug reports to correctly report the final response of the community and the actual impact?<p>Not asking to harass them: if anyone should do it, it would be the kernel devs, and I&#x27;m not one of them
fellellor大约 4 年前
What an effing idiot! And then turn around and claiming bullying! At this point I’m not even surprised. Claiming victimhood is now a very effective move in the US academia these days.
GRBurst大约 4 年前
Actually I do understand BOTH sides, BUT:<p>The way the university did this tests and the reactions afterwards are just bad.<p>What I see here and what the Uni of Minnesota seem to neglected is: 1. Financial damage (time is wasted) 2. Ethical reasons of experimenting with human beings<p>As a result, the University should give a clear statement on both and should donate a generous amount of on money for compensation of (1.)<p>For part (2.), a simple bit honest apology can do wonders!<p>---<p>Having said that, I think there are other and ethically better ways to achieve these measurement.
AshamedCaptain大约 4 年前
Researcher sends bogus papers to journal&#x2F;conference, gets them reviewed and approved, uses that to point how ridiculous the review process of the journal is =&gt; GREAT JOB, PEER REVIEW SUCKS!<p>Researcher sends bogus patches to bazaar-style project, gets them reviewed and approved, uses that to point how ridiculous the review process of the project is =&gt; DON&#x27;T DO THAT! BAD RESEARCHER, BAD!
评论 #26892820 未加载
评论 #26893928 未加载
jokoon大约 4 年前
I&#x27;m not surprised.<p>I&#x27;m repeating myself, but I&#x27;m pretty certain the NSA or other intel agencies (Israel, especially, considering their netsec expertise) have already done it in one way or another.<p>Do you remember the semicolon that caused a big wifi vuln? Hard to really know if it was just a mistake.<p>I&#x27;m going full paranoiac here, but anyway.<p>You can also imagine the NSA submitting patches to the windows source code, without the knowledge of microsoft, and so many other similar scenarios (android, apple, etc)
mabbo大约 4 年前
I think Greg KH would have been wise to add a time limit on this ban. Make it a 10-year block, for example, rather than one with no specific end-date.<p>Imagine what happens 25 years from now as some ground-breaking security research is being done at Minnesota, and they all groan: &quot;Right, shoot, back in 2021 some dumb prof got us banned forever from submitting patches&quot;.<p>Is there a mechanism for University of Minnesota to appeal, someday? Even murders have parole hearings, eventually.
评论 #26890790 未加载
评论 #26890800 未加载
theflyinghorse大约 4 年前
&quot;It&#x27;s just a prank, bro!&quot;<p>Incredible that the university researches decided this was a good idea. Has noone in the university voiced concern that perhaps this is a bad idea?
psim1大约 4 年前
UMN is still sore that http took off and gopher didn&#x27;t.
ddingus大约 4 年前
<i>plonk</i><p>Aaaaand into the kill file they go.<p>Been a while since I last saw a proper plonk.
评论 #26895210 未加载
kevinventullo大约 4 年前
Here’s a (perhaps naively) optimistic take: by publishing this research and showing it to lawmakers and industry leaders, it will sound alarms on a serious vulnerability in what is critical infrastructure for much of the tech industry and public sector. This could then lead to investment in mitigations for the vulnerability, e.g. directly funding work to proactively improve security issues in the kernel.
charonn0大约 4 年前
It seems like this debacle has created a lot of extra work for the kernel maintainers. Perhaps they should ask the university to compensate them.
davidkuhta大约 4 年前
I think the root of the problem can be traced back to the researcher&#x27;s erroneous claim that &quot;This was <i>not</i> human research&quot;.
LanceH大约 4 年前
Committing a non-volunteer of your experiment to work, and attempting to destroy their product of their work surely isn&#x27;t ethical research.
bigbillheck大约 4 年前
So how does this differ from the Sokal hoax thing?
评论 #26889164 未加载
skerit大约 4 年前
And yesterday there was another bit of Linux news by Greg KH trending on Reddit. Nice to see him stepping into the spotlight more :)
alkonaut大约 4 年前
If you really wanted to research how to get malicious code into the highest-profile projects like Linux, the social engineering bit would be the most<p>Whether some unknown contributor can submit a bad patch isn&#x27;t so interesting for this type of project. Knowing the payouts for exploits, the question is: how much money would one bad reviewer want to let one past?
kemonocode大约 4 年前
I have to question the true motivations behind this. Just a &quot;mere&quot; research paper? Or is it there an ulterior motive, such as undermining Linux kernel development, taking advantage of the perceived hostility of the LKML to make a big show of it; castigate and denounce those elitist Linux kernel devs?<p>So I hear tinfoil is on sale, mayhaps I should stock up.
GNOMES大约 4 年前
Am I missing how these patches were caught&#x2F;flagged? Was it an automated process or physically looking at the pull requests?
qwertox大约 4 年前
How is this any different to littering in order to research if it gets cleaned up properly? Or like dumping hard objects onto a highway to research if they cause harm before authorities notice it?<p>I mean, the Kernel is now starting to run in cars and even on Mars, and getting those bugs into stable is definitely no achievement one should be proud of.
fefe23大约 4 年前
Reminds me of the Tuskegee Symphilis Study.<p>Sure we infected you with Syphilis without asking for permission first, but we did it for science!
emeraldd大约 4 年前
Is there a readable version of the message Greg was replying to <a href="https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;YH%2FfM%2FTsbmcZzwnX@kroah.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lore.kernel.org&#x2F;linux-nfs&#x2F;YH%2FfM%2FTsbmcZzwnX@kroah...</a> ? Or was there more to it that what Greg quoted?
rwoerz大约 4 年前
So, next paper would be like &quot;On the Effectiveness of Using Email Domain Names for Kernel Submission Bans&quot;
mryalamanchi大约 4 年前
They just wasted the community&#x27;s time. No wonder Linus Trovalds goes batshit crazy on these kind of people!
hzzhang大约 4 年前
This type of research just looks like: let’s prove people will die if being killed, by really killing someone.
thayne大约 4 年前
After they successfully got buggy patches in, did they submit patches to fix the bugs? And were they careful to make sure their buggy patches didn&#x27;t make it into stable releases? If not, then they risked causing real damage, and is at least toeing the line of being genuinely malicious.
mosselman大约 4 年前
The tone of Aditya Pakki&#x27;s message makes me think they would be very well served by reading &#x27;How to Win Friends &amp; Influence People&#x27; by Dale Carnegie.<p>This is obviously the complete opposite of how you should be communicating with someone in most situations let alone when you want something from them.<p>I have sure been there though so if anything, take this as a book recommendation for &#x27;How to Win Friends &amp; Influence People&#x27;.
评论 #26891696 未加载
评论 #26891183 未加载
spinny大约 4 年前
Are they legally liable in any way for including deliberate flaws in a piece of software they know is widely used and therefore creating a surface attack surface for _any_ attacker with the skill to so do and putting private and public infrastructure at risk ?
shiyoon大约 4 年前
<a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a><p>Seemed to have posted some clarifications around this. worth a read
matheusmoreira大约 4 年前
It&#x27;s okay to run experiments on humans without their explicit informed consent now?
yosito大约 4 年前
Can someone explain what the kernel bugs were that were introduced, in general terms?
评论 #26897204 未加载
评论 #26888876 未加载
honeybutt大约 4 年前
Very unethical and extremely inconsiderate of the maintainers time to say the least.
kml大约 4 年前
Aditya Pakki should be banned from any open source projects. Open source depends on contributors who collectively try to do the right thing. People who purposely try to veer projects off course should face real consequences.
stakkur大约 4 年前
When you test in production...
cmclaughlin大约 4 年前
What a waste of talent... these kids know how to program, but instead of working on useful projects they’re wasting everyone’s time. It’s really troubling that any professor would have proposed or OK’d this.
booleandilemma大约 4 年前
<i>The UMN had worked on a research paper dubbed &quot;On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits&quot;.</i><p>I guess it&#x27;s not as feasible as they thought.
satai大约 4 年前
Let’s add to the question “what is the quality of code review process in Linux?” an other one “what is the quality of ethical review process at universities?”.<p>I think there should be a real world experiment to test it.
dghlsakjg大约 4 年前
Like all research institutions, University of Minnesota has an ethics committee.<p><a href="https:&#x2F;&#x2F;integrity.umn.edu&#x2F;ethics" rel="nofollow">https:&#x2F;&#x2F;integrity.umn.edu&#x2F;ethics</a><p>Feel free to write to them
dumbDev大约 4 年前
What is this? A &quot;science&quot; way of saying it&#x27;s a prank bro?
jvanderbot大约 4 年前
The most recent possible-double-free was from a bad static analyzer wasn&#x27;t it? That could have been a good-faith commit, which is unfortunate given the deliberate bad-faith commits prior.
jc2it大约 4 年前
After reading many of the comments I agree with the decision to ban the University. Why? You are free to choose your actions. You are not free to choose the consequences of your actions.
amarant大约 4 年前
I&#x27;ve been thinking, what would happen if someone intentionally hacked a university and erased all data from all their computer systems, and then lied to their faces about it?<p>New white paper due soon
omar12大约 4 年前
This raises the question: &quot;has there been state-sponsored efforts to overwhelm open source maintainers with the intent of sneaking in vulnerabilities to software applications?&quot;
ineedasername大约 4 年前
&quot;We&#x27;d like to insert malicious code into the software that runs countless millions of computers and see if they figure it out&quot;<p>I don&#x27;t think this was the pitch they gave to their IRB.
dboreham大约 4 年前
The replies here have been fascinating to read. Yes it&#x27;s bad that subterfuge was engaged in vs kernel devs. But don&#x27;t the many comments here expressing outrage at the actions of these researchers sound exactly like the kind of outrage commonly expressed by those in power when their misdeeds are exposed? e.g. Republican politicians outraged at a &quot;leaker&quot; who has leaked details of their illegal activity. It honestly looks to me like the tables have been turned here. Surely the fact that the commonly touted security advantages of OSS have been shown to be potentially fictitious, is at least as worrying as the researchers&#x27; ethics breaches?
评论 #26891590 未加载
评论 #26891629 未加载
jbirer大约 4 年前
I am baffled by the immaturity and carelessness of experimenting on a kernel that millions of critical machines use, and I applaud the maintainers for dealing swiftly with this.
MR4D大约 4 年前
Looks like vandalism masquerading as “research”.<p>Greg’s response is totally right.
redmattred大约 4 年前
I thought there were ethical standards for research where a good study should not knowingly do harm or at the very least make those involved aware of their participation
devillius大约 4 年前
An appropriate place to make a report: <a href="https:&#x2F;&#x2F;compliance.umn.edu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;compliance.umn.edu&#x2F;</a>
wglb大约 4 年前
While it is easy to consider this a unsportsmanlike, one might view this as a supply chain attack. I don&#x27;t particularly support this approach, but consider for a moment that as a defender (in the security team sense), you need to be aware of all possible modes of attack and compromise. While the motives of this class are clear, ascribing to attackers any particular motive is likely to miss.<p>To the supply chain type of attacks, there isn&#x27;t an easy answer. Classical methods left both the SolarWinds and Codecov attacks in place for way too many days.
dumpsterdiver大约 4 年前
Could someone clarify: this made it to the stable branch, so does that mean that it made it out into the wild? Is there action required here?
autoconfig大约 4 年前
A lot of people seem to consider this meaningless and a waste of time. If we disregard the the problems with the patches reaching stable branches for a second (which clearly is problematic), what is the difference between this and companies conducting red team exercises? It seems to me a potentially real and dangerous attack vector has been put under the spotlight here. Increasing awareness around this can&#x27;t be all bad, particularly in a time where state sponsored cyber attacks are getting ever more severe.
BTCOG大约 4 年前
Now I&#x27;m not one for cancel culture, but fuck these guys. Put their fuckin&#x27; names out there to get blackballed. Bunch of clowns.
xmly大约 4 年前
So they A&#x2F;B tested the kernel maintainers and got banned. What about the kernel security? Is the patch process getting improved?
soheil大约 4 年前
Is getting reactions from HN also part of their experiment and should we expect our comments to be written about in their paper?
dawnbreez大约 4 年前
logged into my ancient hn account just to tell all of you that pentesting without permission from higher-ups is a bad idea<p>yes, this is pentesting
uglygoblin大约 4 年前
If the researchers desired outcome is more vigilance during patches and contributions I guess they might achieve that outcome?
liendolucas大约 4 年前
Could have this happened also on other open source projects like FreeBSD, OpenBSD, etc or other popular open source software?
评论 #26890357 未加载
francoisp大约 4 年前
Me thinks that If you hold a degree from the University of Minnesota it would be a good idea to let your university know what you think of this.
评论 #26890925 未加载
评论 #26891994 未加载
评论 #26890775 未加载
duerra大约 4 年前
I&#x27;ll give you one guess nation states do.
beprogrammed大约 4 年前
Well we get to look at the real results of this in realtime, as they get there whole organization banned from the kernel.
kome大约 4 年前
Does the University of Minnesota have an ethical review board or research ethics board? They need to be contacted ASAP.
评论 #26888770 未加载
HelloNurse大约 4 年前
They seem to be teaching social engineering. Using a young, possibly foreign student as a front is a classy touch.
评论 #26891069 未加载
freewilly1040大约 4 年前
Is there some tool that provides a nicer view of these types of threads? I find them hard to navigate and read.
limaoscarjuliet大约 4 年前
To me it was akin to spotting volunteers cleaning up streets and, right after they passed, dumping more trash on the same street to see if they come and clean it up again. Low blow if you ask me.
soheil大约 4 年前
Experiment: let&#x27;s blow up the world to find out who might stop us so we can write a paper about it.
lfc07大约 4 年前
Their research could have been an advisory email or a blogpost for the maintainers without the nasty experiments. If they really cared for OSS they would have have collaborated with the maintainers and persuaded them to use their software tools for patch work. There is research for good of all and there is research for selfish gains. I am convinced this is the later.
moron4hire大约 4 年前
It&#x27;s funny. When someone like RMS or ESR or (formerly) Torvalds is &quot;disrespectful&quot; to open source maintainers, this is called &quot;tough love&quot;, but when someone else does it, it&#x27;s screamed about like it&#x27;s some kind of high crime, with calls to permanently cancel access for all people even loosely related to the original offender.
评论 #26888580 未加载
评论 #26888447 未加载
davidkuhta大约 4 年前
Anyone else find the claim that &quot;This was not human research&quot; as erroneous as I do?
CTDOCodebases大约 4 年前
Fair. You are either part of the solution, part of the problem or just part of the landscape.
8bitsrule大约 4 年前
Couldn&#x27;t help themselves. Once they thought of it, they just <i>had</i> to Gopher it.
coward76大约 4 年前
Make an ethics complaint with the state and get their certification and charter pulled.
评论 #26890663 未加载
soheil大约 4 年前
First thing that comes to mind is The Underhanded C Contest [0] where contestants try to introduce code that looks harmless, but actually is malicious and even if caught should look like an innocent bug at worse.<p>[0] <a href="http:&#x2F;&#x2F;www.underhanded-c.org" rel="nofollow">http:&#x2F;&#x2F;www.underhanded-c.org</a>
pertymcpert大约 4 年前
I want to know how TF the PC at the IEEE conference decided this was acceptable?
nitinreddy88大约 4 年前
Can anyone enlighten me why these were not caught in review process itself?
enz大约 4 年前
I wonder if they can be sued (by the Linux Foundation, maybe) for that...
Apofis大约 4 年前
Minnesota being Minnesota.
birdyrooster大约 4 年前
Straight up grift. If it looks like a duck, quacks like a duck...
shiyoon大约 4 年前
<a href="https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc.pdf" rel="nofollow">https:&#x2F;&#x2F;www-users.cs.umn.edu&#x2F;~kjlu&#x2F;papers&#x2F;clarifications-hc....</a><p>posted some clarifications around this, worth a read
ilamont大约 4 年前
Reminded me of story more than a decade ago about an academic who conducted a series of &quot;breaching experiments&quot; in City of Heroes&#x2F;City of Villains to study group behavior, basically breaking the social rules (but not the game rules) without other participants&#x27; or the game studio&#x27;s knowledge. It was discussed on HN in 2009 (<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=690551" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=690551</a>)<p>Here&#x27;s how the professor (a sociologist) described his methodology:<p><i>These three sets of behaviors – rigidly competitive pvp tactics (e. g., droning), steadfastly uncooperative social play outside the game context (e. g., refusing to cooperate with zone farmers), and steadfastly uncooperative social play within the game context (e. g., playing solo and refusing team invitations) – marked Twixt’s play from the play of all others within RV.</i><p>Translation: He killed other players in situations that were allowed by the game&#x27;s creators but frowned upon by the majority of real-life participants. For instance, &quot;villains&quot; and &quot;heroes&quot; aren&#x27;t supposed to fraternize, but they do anyway. When &quot;Twixt&quot; happened upon these and other situations -- such as players building points by taking on easy missions against computer-generated enemies -- he would ruin them, often by &quot;teleporting&quot; players into unwinnable killzones. The other players would either die or have their social relations disrupted. Further, &quot;Twixt&quot; would rub it in by posting messages like:<p><i>Yay, heroes. Go good team. Vills lose again.</i><p>The reaction to the experiment and to the paper was what you would expect. The author later said it wasn&#x27;t an experiment in the academic sense, claiming:<p><i>... this study is not really an experiment. I label it as a “breaching experiment” in reference to analogous methods of Garfinkel, but, in fact, neither his nor my methods are experimental in any truly scientific sense. This should be obvious in that experimental methods require some sort of control group and there was none in this case. Likewise, experimental methods are characterized by the manipulation of a treatment variable and, likewise, there was none in this case.</i><p>Links:<p><a href="http:&#x2F;&#x2F;www.nola.com&#x2F;news&#x2F;index.ssf&#x2F;2009&#x2F;07&#x2F;loyola_university_professor_be.html" rel="nofollow">http:&#x2F;&#x2F;www.nola.com&#x2F;news&#x2F;index.ssf&#x2F;2009&#x2F;07&#x2F;loyola_university...</a><p><a href="https:&#x2F;&#x2F;www.ilamont.com&#x2F;2009&#x2F;07&#x2F;academic-gets-rise-from-breaching.html" rel="nofollow">https:&#x2F;&#x2F;www.ilamont.com&#x2F;2009&#x2F;07&#x2F;academic-gets-rise-from-brea...</a>
sadfev大约 4 年前
Dang, I am not sure how to feel about this kind of “research”
werber大约 4 年前
Could this have just been someone trying to cover up being a mediocre programmer in academia by framing it in a lens that would work in the academy with some nonsense vaguely liberal arts sounding social experiment premise?
metalliqaz大约 4 年前
Wow, shocking and completely unethical by that professor.
ne38大约 4 年前
It is not done for research purpose. NSA is behind them
iou大约 4 年前
Did Linus comment on any of this get? :popcorn:
shadowgovt大约 4 年前
Is banning an entire university&#x27;s domain from submitting to a project due to the actions of a few of its members an example of cancel culture?
评论 #26892259 未加载
LegitShady大约 4 年前
They should be reported to the authorities for attempting to introduce security vulnerabilities into software intentionally. This is not ok.
评论 #26890713 未加载
评论 #26890328 未加载
评论 #26890947 未加载
评论 #26890288 未加载
评论 #26890595 未加载
balozi大约 4 年前
Uff da! I really do hope the administrators at University of Minnesota truly understand the gravity of this F* up. I doubt they will though.
TacticalCoder大约 4 年前
Or some enemy state pawn(s) trying to add backdoors and then use the excuse of &quot;university research paper&quot; should they get caught?
gumby大约 4 年前
This is the kind of study (unusual for CS) that requires IRB approval. I wonder if they thought to seek approval, and if they received it?
crazypython大约 4 年前
Trust is currency. Trust is an asset.
francoisp大约 4 年前
those that can&#x27;t do teach, and those that can&#x27;t teach troll open source devs?
readme大约 4 年前
these people have no ethics
nabla9大约 4 年前
If it was up to me, I would<p>1) send ethics complaint to the University of Minnesota, and<p>2) report this to FBI cyber crime division.
jcun4128大约 4 年前
huh I never knew of <i>plonk</i> I bet I&#x27;ve been plonked before
foolfoolz大约 4 年前
how can i see these prs?
评论 #26890481 未加载
brundolf大约 4 年前
What a bizarre saga.
a-dub大约 4 年前
so basically they demonstrated that the oss security model, as it operates today, is not working as it had been previously hoped.<p>it&#x27;s good work and i&#x27;m glad they&#x27;ve done it, but that&#x27;s depressing.<p>now what?
devpbrilius大约 4 年前
Weirdly enough
dt123大约 4 年前
cannot wait for Rust in the kernel..
ElectricMind大约 4 年前
Will he get job&#x2F;work somewhere again?
arua442大约 4 年前
Disgusting.
treesknees大约 4 年前
The full title is &quot;Linux bans University of Minnesota for sending buggy patches in the name of research&quot; and it seems to justify the ban. It&#x27;s not as though these students were just bad programmers, they were intentionally introducing bugs, performing unethical experimentation on volunteers and members of another organization without their consent.<p>Unfortunately even if the latest submissions were sent with good intentions and have nothing to do with the bug research, the University has certainly lost the trust of the kernel maintainers.
评论 #26890189 未加载
评论 #26890164 未加载
WrtCdEvrydy大约 4 年前
I just want you to know that this is extremely unethical to create a paper where you attempt to discredit others by just using your university&#x27;s reputation to try to create vulnerabilities on purpose.<p>I back your decision and fuck these people. I will additionally be sending a strongly worded email to this person, their advisor and their whoever&#x27;s in charge of this joke of a computer science school. Sometimes I wish we had the ABA equivalent for computer science.
评论 #26893776 未加载
评论 #26891139 未加载
评论 #26890615 未加载
评论 #26890102 未加载
评论 #26890101 未加载
TedShiller大约 4 年前
TLDR?
mort96大约 4 年前
The previous discussion seems to have suddenly disappeared from the front page:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670</a>
评论 #26890513 未加载
评论 #26894111 未加载
评论 #26890674 未加载
atleta大约 4 年前
It&#x27;s already being discussed on HN [1] but for some reason it&#x27;s down to the 3rd page despite having ~1200 upvotes at the moment and ~600 comments, including from Greg KH. (And the submission is only 5 hours old.)<p>[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26887670</a>
评论 #26894033 未加载
评论 #26892804 未加载
donatj大约 4 年前
I wish the title were clearer. Linux bans University of Minnesota for sending buggy patches <i>on purpose</i>.
评论 #26890254 未加载
评论 #26890250 未加载
WrtCdEvrydy大约 4 年前
Yes, and robbing a bank to show that the security is lax is totally fine because the real criminals don&#x27;t notify you before they rob a bank.<p>Do you understand how dumb that sounds?
评论 #26893810 未加载
评论 #26890121 未加载
kingsuper20大约 4 年前
Since there is bound to be a sort of trust hierarchy in these commits, is it possible that bonafide name-brand university people&#x2F;email addresses come with an imprimatur that has now been damaged generally?<p>Given the size and complexity of the Linux (&#x2F;GNU) codeworld, I have to wonder if they are coming up against (or already did) the practical limits of assuring safety and quality using the current model of development.
PHDchump大约 4 年前
lol this is also how Russia does their research with Solarwinds. Do not try to attack supply chain or do security research without permission. They should be investigated by FBI for doing recon to a supply chain to make sure they weren&#x27;t trying to do something worse. Minnesota leads the way in USA embarrassment once again.
b0rsuk大约 4 年前
Think of potential downstream effects of a vulnerable patch being introduced into Linux kernel. Buggy software in mobile devices, servers, street lights... this is like someone introducing a bug into university grading system.<p>Someone should look into who sponsored this research. Was there a state agent?
calylex大约 4 年前
Reminds me of &quot;It&#x27;s just a prank bro&quot; video from Filthy Frank <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=_wldE_4xjVQ" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=_wldE_4xjVQ</a>
jtdev大约 4 年前
University of Minnesota is involved with the Confucius Institute... what could go wrong when a U.S. university accepts significant funding from a hostile foreign power?<p><a href="https:&#x2F;&#x2F;experts.umn.edu&#x2F;en&#x2F;organisations&#x2F;confucius-institute" rel="nofollow">https:&#x2F;&#x2F;experts.umn.edu&#x2F;en&#x2F;organisations&#x2F;confucius-institute</a>
knz_大约 4 年前
The bad actors here should be expelled and deported. The nationalities involved make it clear this is likely a backfired foreign intelligence operation and not just &#x27;research&#x27;.<p>They were almost certainly expecting an obvious bad patch to be reverted while trying to sneak by a less obvious one.
mnouquet大约 4 年前
In other news: the three little pigs ban wolves after wolves exposed the dubious engineering of the straw house by blowing on it for a research paper.
评论 #26895271 未加载
unanswered大约 4 年前
I am concerned that the kernel maintainers might be falling into another trap: it is possible that some patches were designed such that they are legitimate fixes, and moreover such that <i>reverting them</i> amounts to introducing a difficult-to-detect malicious bug.<p>Maybe I&#x27;m just too cynical and paranoid though.
unanswered大约 4 年前
Presumably the next step is an attempt to cancel the kernel maintainers on account of some politically powerful - oops, I mean, some politically protected characteristics of the researchers.
shadowgovt大约 4 年前
Academic reputation has always mattered, but I can&#x27;t recall the last time I&#x27;ve seen an example as stark as &quot;I attend a university that is forbidden from submitting patches to the Linux kernel.&quot;
andi999大约 4 年前
Somebody should have told them that since microsoft is now pro-open source this wouldnt land any of them a cushy position after the blowup at uni.
Quarrelsome大约 4 年前
This is ridiculously unethical research. Despite the positive underlying reasons treating someone as a lab rat (in this case maintainers reviewing PRs) feels almost sociopathic.
评论 #26888569 未加载
评论 #26890736 未加载
incrudible大约 4 年前
From an infosec perspective, I think this is a knee-jerk response to someone attempting a penetration test <i>in good faith</i> and failing.<p>The system appears to have worked, so that&#x27;s <i>good news</i> for Linux. On the other hand, now that the university has been banned, they won&#x27;t be able to find holes in the process that may remain, that&#x27;s <i>bad news</i> for Linux.
评论 #26897235 未加载
mfringel大约 4 年前
When James O&#x27; Keefe tries to run a fake witness scam on the Washington Post, and the newspaper successfully detects it, the community responds with &quot;Well played!&quot;<p>When a university submits intentionally buggy patches to the Linux Kernel, and the maintainers successfully detect it, the community responds with &quot;That was an incredibly scummy thing to do.&quot;<p>I sense a teachable moment, here.
评论 #26890933 未加载
评论 #26890857 未加载
InsomniacL大约 4 年前
Seems to me they exposed a vulnerability in the way code is contributed.<p>If this was Facebook and their response was: &gt; ~&quot;stop wasting our time&quot; &gt; ~&quot;we&#x27;ll report you&quot; the responses here would be very different.
returningfory2大约 4 年前
Commenters have been reasonably accusing the researchers of bad practice, but I think there&#x27;s another possible take here based on Hanlon&#x27;s razor: &quot;never attribute to malice that which is adequately explained by stupidity&quot;.<p>If you look at the website of the PhD student involved [1], they seem to be writing mostly legitimate papers about, for example, using static analysis to find bugs. In this kind of research, having a good reputation in the kernel community is probably pretty valuable because it allows you to develop and apply research to the kernel and get some publications&#x2F;publicity out of that.<p>But now, by participating in this separate unethical research about OSS process, they&#x27;ve damaged their professional reputation and probably setback their career somewhat. In this interpretation, their other changes were made in good faith, but now have been tainted by the controversial paper.<p>[1] <a href="https:&#x2F;&#x2F;qiushiwu.github.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;qiushiwu.github.io&#x2F;</a>
评论 #26890551 未加载
评论 #26890601 未加载
tester34大约 4 年前
Researcher(s) shows that it&#x27;s relatively not hard to introduce bugs in kernel<p>HN: let&#x27;s hate researcher(s) instead of process<p>Wow.<p>Assume good faith, I guess?
评论 #26888173 未加载
评论 #26888114 未加载
评论 #26888213 未加载
评论 #26888621 未加载
评论 #26888457 未加载
duxup大约 4 年前
I don&#x27;t like this university ban approach.<p>Universities are places with lots of different students, professors, and different people with different ideas, and inevitably people who make bad choices.<p>Universities don&#x27;t often act with a single purpose or intent. That&#x27;s what makes them interesting. Prone to failure and bad ideas, but also new ideas that you can&#x27;t do at corporate HQ because you&#x27;ve got a CEO breathing down your neck.<p>At the University of Minnesota there&#x27;s 50k+ students at the Twin Cities campus alone, 3k plus instructors. Even more at other University of Minnesota campuses.<p>None of those people did anything wrong. Putting the onus on them to effect change to me seems unfair. The people banned didn&#x27;t do anything wrong.<p>Now the kernel doesn&#x27;t &#x27;need&#x27; any of their contributions, but I think this is a bad method &#x2F; standard to set to penalize &#x2F; discourage everyone under an umbrella when they&#x27;ve taken no bad actions themselves.<p>Although I can&#x27;t put my finger on why, this ban on whole swaths of people in some ways seems very not open source.<p>The folks who did the thing were wrong to do so, but the vast majority of people now impacted by this ban didn&#x27;t do the thing.
评论 #26890447 未加载
评论 #26890461 未加载
评论 #26890428 未加载
评论 #26890545 未加载
评论 #26890503 未加载
评论 #26890493 未加载
评论 #26890478 未加载
评论 #26890621 未加载
评论 #26890505 未加载
评论 #26891068 未加载
评论 #26890546 未加载
评论 #26890462 未加载
perfunctory大约 4 年前
I don&#x27;t quite understand the outrage. Quite sure most HN readers were doing&#x2F;involved in similar experiments one way or another. Isn&#x27;t A&#x2F;B testing an experiment on consumers (people) without their consent?
评论 #26888103 未加载
评论 #26888176 未加载
ilammy大约 4 年前
So many comments here refrain, “They should have asked for consent first”. But would not that be detrimental to the research subject? Specifically, <i>stealthily</i> introducing security vulnerabilities. How should a consent request look to preserve the surprise factor? A university approaches you and says, “Would it be okay for us to submit some patches with vulnerabilities for review, and you try and guess which ones are good and which ones have bugs?” Of course you would be extra careful when reviewing those specific patches. But real malicious actors would be so kind and ethical as to announce their intentions beforehand.
评论 #26888286 未加载
评论 #26888326 未加载
评论 #26888320 未加载
评论 #26888336 未加载
评论 #26888496 未加载
noxer大约 4 年前
Someone does voluntary work and people think that gives them some ethical privilege to be asked before someone puts their work to the test? Sure it would be nice to ask but at the same time it renders the testing useless. They wanted to see how the review goes if they aren&#x27;t aware that someone is testing them. You cant do this with consent.<p>The wasting time argument is nonsense too its not like they did this thousands of times and beside that, reviewing a intentional bad code is not wasting time is just as productive as reviewing &quot;good&quot; code and together with the patch-patch it should be even more valuable work. It not only or adds a patch it also make the reviewer better.<p>Yeah it aint fun if people trick you or point out you did not succeed in what you tried to do. But instead of playing the victim an play the unethical human experiment card maybe focus on improving.
评论 #26888342 未加载
评论 #26888269 未加载
评论 #26888292 未加载
评论 #26888218 未加载
评论 #26888184 未加载