| Date | Wed, 21 Apr 2021 15:01:55 -0300 | From | Jason Gunthorpe <> | Subject | Re: [PATCH 000/190] Revertion of all of the umn.edu commits |
| |
On Wed, Apr 21, 2021 at 02:57:55PM +0200, Greg Kroah-Hartman wrote: > I have been meaning to do this for a while, but recent events have > finally forced me to do so. > > Commits from @umn.edu addresses have been found to be submitted in "bad > faith" to try to test the kernel community's ability to review "known > malicious" changes. The result of these submissions can be found in a > paper published at the 42nd IEEE Symposium on Security and Privacy > entitled, "Open Source Insecurity: Stealthily Introducing > Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University > of Minnesota) and Kangjie Lu (University of Minnesota).
I noted in the paper it says:
A. Ethical Considerations
Ensuring the safety of the experiment. In the experiment, we aim to demonstrate the practicality of stealthily introducing vulnerabilities through hypocrite commits. Our goal is not to introduce vulnerabilities to harm OSS. Therefore, we safely conduct the experiment to make sure that the introduced UAF bugs will not be merged into the actual Linux code
So, this revert is based on not trusting the authors to carry out their work in the manner they explained?
From what I've reviewed, and general sentiment of other people's reviews I've read, I am concerned this giant revert will degrade kernel quality more than the experimenters did - especially if they followed their stated methodology.
Jason
|