Name: News and Advice on the World's Latest Innovations | ZDNET
Brand: zdnet.com
SKU: zdnet-com-586
Availability: OnlineOnly

critic

News and Advice on the World's Latest Innovations | ZDNET

preview

/&gt;Some researchers tried to slip bad patches into the Linux kernel as a "test." When they kept trying, Greg Kroah-Hartman, the Linux kernel maintainer for the stable branch, put an end to their efforts.Thanks to the , have become an important issue. Naturally enough, there's a lot of research being done into these attacks. Two graduate students at the University of Minnesota working on a paper entitled, "" tried to put the vulnerability into the Linux kernel. This kind of is commonplace… when the project includes people who know what's going on beforehand. That wasn't the case here. When they tried it again, Greg Kroah-Hartman, the Linux kernel maintainer for the stable branch, had had enough.&nbsp; Kroah-Hartman, one of the most respected of all the Linux kernel developers, tweeted, ", we have enough real work to do."&nbsp; In the Linux Kernel Mailing List (LKML), Kroah-Hartman made this even clearer when they tried again to introduce a bogus patch. "If you look at the code, this is impossible to have happen[ed]. Your professor is playing around with the review process in order to achieve a paper in some strange and bizarre way. This is not ok, it is wasting our time, and we will have to report this, AGAIN, to your university…" Leon Romanovsky, a senior Linux kernel developer explained to those who came in late that, "." That's a huge no-no in any open-source community, but especially in the Linux kernel community where trust between programmers is a vital part of the development process. As Kroah-Hartman continued, "All contributions by this group of people need to be reverted, if they have not been done so already, as and is not acceptable and totally unethical." You might think that these graduate students might get the hint. They didn't. One of the researchers, Aditya Pakki, doubled down. Pakki sent Kroah-Hartman a message stating, "I respectfully ask you to cease and desist from making wild accusations that are bordering on slander." He also claimed these patches were the result of a new static analyzer he'd written. Pakki closed, "I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non-experts." Kroah-Hartman had had enough. He replied: You, and your group, have and published a paper based on that work. Now you submit a new series of obviously incorrect patches again, so what am I supposed to think of such a thing? They obviously were _NOT_ created by a static analysis tool that is of any intelligence, as they all are the result of totally different patterns and all of which are obviously not even fixing anything at all. So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches? When submitting patches created by a tool, everyone who does so submits them with wording like "found by tool XXX, we are not sure if this is correct or not, please advise." which is NOT what you did here at all. You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect. A few minutes with anyone with the semblance of knowledge of C can see that your submissions do NOT do anything at all, so to think that a tool created them, and then that you thought they were a valid "fix" is totally negligent on your part, not ours.&nbsp; You are the one at fault, it is not our job to be the test subjects of a tool you create. Our community welcomes developers who wish to help and enhance Linux. That is NOT what you are attempting to do here, so please do not try to frame it that way. Our community does not appreciate being experimented on, and being "tested" by submitting known patches that are either do nothing on purpose or introduce bugs on purpose.&nbsp; If you wish to do work like this, I suggest you find a different community to run your experiments on, you are not welcome here. These developers won't be coming back again. And, because the University of Minnesota didn't stop them after being warned, Kroah-Hartman hit the entire school with the biggest club in the Linux kernel arsenal: "I will now have to ban all future contributions from your University and rip out your previous contributions, as they were obviously submitted in bad-faith with the intent to cause problems." Most Linux kernel developers and other programmers agree with Kroah-Hartman. Ted T'so, a senior Linux kernel developer and Google engineer, notes that while the professor in charge of this project, Kangjie Lu, has done useful security work in the past: &nbsp; The problem is that Prof. , and has some very... skewed... ideas over what is considered ethical, and acceptable behavior vis-a-vis the Kernel development community.&nbsp; The fact that the UMN IRB [Institutional Review Board] team believes that what Prof. Lu is doing isn't considered in scope for human experimentation means that there isn't any kind of institutional controls at UMN for this sort of behavior -- which is why a University-wide Ban may be the only right answer, unfortunately. Red Hat Technology Strategist, Jered Floyd, went farther in his tweet, "; this is like saying you're a 'safety researcher' by going to a grocery store and cutting the brake lines on all the cars to see how many people crash when they leave. Enormously unethical." The researchers claim in their paper that none of their patches actually ever made it into any Linux code repositories, that they only appeared in an e-mail rather than becoming a Git commit to any Linux kernel branch. That is not the case. Romanovsky reported that he had looked at four accepted patches from Pakki "and Sudip Mukherjee, Linux kernel driver and developer, followed up and said "a lot of these have " These patches are now being removed.&nbsp; So, not only did these "researchers" waste the time of Linux committers but they actually introduced bad code into the Linux kernel. After this, I think I can safely say none of them will ever be welcome in the Linux kernel or any other open-source project in the future.&nbsp; Related Stories:

/&gt;Some researchers tried to slip bad patches into the Linux kernel as a "test." When they kept trying, Greg Kroah-Hartman, the Linux kernel maintainer for the stable branch, put an end to their efforts.Thanks to the , have become an important issue. Naturally enough, there's a lot of research being done into these attacks. Two graduate students at the University of Minnesota working on a paper entitled, "" tried to put the vulnerability into the Linux kernel. This kind of is commonplace… when the project includes people who know what's going on beforehand. That wasn't the case here. When...

public

Steven Vaughan-Nichols

Steven J. Vaughan-Nichols

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

News and Advice on the World's Latest Innovations | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS