lkml.org 
[lkml]   [2021]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 000/190] Revertion of all of the umn.edu commits
    From
    Date
    On Wed, 2021-04-21 at 15:01 -0300, Jason Gunthorpe wrote:
    > On Wed, Apr 21, 2021 at 02:57:55PM +0200, Greg Kroah-Hartman wrote:
    > > I have been meaning to do this for a while, but recent events have
    > > finally forced me to do so.
    > >
    > > Commits from @umn.edu addresses have been found to be submitted in
    > > "bad
    > > faith" to try to test the kernel community's ability to review
    > > "known
    > > malicious" changes.  The result of these submissions can be found in
    > > a
    > > paper published at the 42nd IEEE Symposium on Security and Privacy
    > > entitled, "Open Source Insecurity: Stealthily Introducing
    > > Vulnerabilities via Hypocrite Commits" written by Qiushi Wu
    > > (University
    > > of Minnesota) and Kangjie Lu (University of Minnesota).
    >
    > I noted in the paper it says:
    >
    >   A. Ethical Considerations
    >
    >   Ensuring the safety of the experiment. In the experiment, we aim to
    >   demonstrate the practicality of stealthily introducing
    > vulnerabilities
    >   through hypocrite commits. Our goal is not to introduce
    >   vulnerabilities to harm OSS. Therefore, we safely conduct the
    >   experiment to make sure that the introduced UAF bugs will not be
    >   merged into the actual Linux code
    >
    > So, this revert is based on not trusting the authors to carry out
    > their work in the manner they explained?
    >
    > From what I've reviewed, and general sentiment of other people's
    > reviews I've read, I am concerned this giant revert will degrade
    > kernel quality more than the experimenters did - especially if they
    > followed their stated methodology.

    I have to agree with Jason. This seems like trying to push a thumbtack
    into a bulletin board using a pyle driver. Unless the researchers are
    lying (which I've not seen a clear indication of), the 190 patches you
    have selected here are nothing more than collateral damage while you are
    completely missing the supposed patch submission addresses from which
    the malicious patches were sent!

    This all really sounds like a knee-jerk reaction to thier posting. I
    have to say, I think it's the wrong reaction to have. Remember, these
    guys are the ones explaining how things can be done and exposing the
    tricks. That puts them in the white-hat hacker camp, not the black-hat
    hacker camp. You shouldn't be banning them, you should be listening to
    them and seeing if they found any constructive ways to improve and
    harden the maintenance process against these sorts of things.

    --
    Doug Ledford <dledford@redhat.com>
        GPG KeyID: B826A3330E572FDD
        Fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2021-04-22 20:55    [W:2.473 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site