lkml.org 
[lkml]   [2021]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 000/190] Revertion of all of the umn.edu commits
    From
    Date
    On 22/04/2021 20:53, Doug Ledford wrote:
    > On Wed, 2021-04-21 at 15:01 -0300, Jason Gunthorpe wrote:
    >> On Wed, Apr 21, 2021 at 02:57:55PM +0200, Greg Kroah-Hartman wrote:
    >>> I have been meaning to do this for a while, but recent events have
    >>> finally forced me to do so.
    >>>
    >>> Commits from @umn.edu addresses have been found to be submitted in
    >>> "bad
    >>> faith" to try to test the kernel community's ability to review
    >>> "known
    >>> malicious" changes.  The result of these submissions can be found in
    >>> a
    >>> paper published at the 42nd IEEE Symposium on Security and Privacy
    >>> entitled, "Open Source Insecurity: Stealthily Introducing
    >>> Vulnerabilities via Hypocrite Commits" written by Qiushi Wu
    >>> (University
    >>> of Minnesota) and Kangjie Lu (University of Minnesota).
    >>
    >> I noted in the paper it says:
    >>
    >>   A. Ethical Considerations
    >>
    >>   Ensuring the safety of the experiment. In the experiment, we aim to
    >>   demonstrate the practicality of stealthily introducing
    >> vulnerabilities
    >>   through hypocrite commits. Our goal is not to introduce
    >>   vulnerabilities to harm OSS. Therefore, we safely conduct the
    >>   experiment to make sure that the introduced UAF bugs will not be
    >>   merged into the actual Linux code
    >>
    >> So, this revert is based on not trusting the authors to carry out
    >> their work in the manner they explained?
    >>
    >> From what I've reviewed, and general sentiment of other people's
    >> reviews I've read, I am concerned this giant revert will degrade
    >> kernel quality more than the experimenters did - especially if they
    >> followed their stated methodology.
    >
    > I have to agree with Jason. This seems like trying to push a thumbtack
    > into a bulletin board using a pyle driver. Unless the researchers are
    > lying (which I've not seen a clear indication of), the 190 patches you
    > have selected here are nothing more than collateral damage while you are
    > completely missing the supposed patch submission addresses from which
    > the malicious patches were sent!
    >
    > This all really sounds like a knee-jerk reaction to thier posting. I
    > have to say, I think it's the wrong reaction to have.

    Nothing stops you from participating in the review of this
    revert-series, if you think these are valuable commits. Patches getting
    the review, won't be reverted (as I understood).


    Best regards,
    Krzysztof

    \
     
     \ /
      Last update: 2021-04-23 09:02    [W:4.069 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site