University of Minnesota Linux "Hypocrite Commit" Researchers Publish Open Letter

[phoronix]

Phoronix: University of Minnesota Linux "Hypocrite Commit" Researchers Publish Open Letter

The drama in kernel land this week was University of Minnesota being banned from Linux kernel development over research they previously carried out looking at "hypocrite commits" and the possibility of intentionally introducing vulnerabilities (such as use-after-free bugs) into the kernel source tree. This weekend those researchers involved published an open latter to the Linux kernel community...

https://www.phoronix.com/scan.php?page=news_item&px=Hypocrite-Commit-Open-Letter

[andyprough]

They should be unbanned. Cancel culture has no place in a software movement whose foundational concepts are all derived from freedom of speech.

[jacob]

To me the real drama is that we now live in a world where this is considered "research". I know I shouldn't be surprised when "universities" have long switched from Education to vocational training. Still I can't help it, to me "research" is supposed to mean fundamental advances in hard science, history or philosophy (and I don't mean intersectional studies).

[skeevy420]

published an open latter

anyhoo

[skeevy420]

They should be unbanned. Cancel culture has no place in a software movement whose foundational concepts are all derived from freedom of speech.

Freedom of speech ends when you intentionally sabotage a project in the name of "research". To me, that's a crime.

[jacob]

They should be unbanned. Cancel culture has no place in a software movement whose foundational concepts are all derived from freedom of speech.

In the unlikey event you are not a troll or trying to be sarcastic, while I'm 100% behind freedom of speech, it has never included knowingly spreading lies. Saying "andyprough is a serial killer" is not free speech, it's lie and defamation and spreading it would be illegal in every country I know of. By the same token, saying "here is a bugfix" that doesn't actually fix any bug but instead deliberately introduces one is not free speech; it's false advertising at the very least.

[coder]

The researchers offer their apologies to the community for any harm and the lack of communicating their study or permission from Linux stakeholders to do so. The letter noted, "we now understand that it was hurtful to the
community to make it a subject of our research, and to waste its effort reviewing these patches without its knowledge or permission."

This is such a load of BS. What they did was a clear violation of ethics and standards in research that I believe the only thing they're really sorry about is that they got busted.

[coder]

They should be unbanned. Cancel culture has no place in a software movement whose foundational concepts are all derived from freedom of speech.

Wow, so you don't think intentionally contributing bugs to an open source project should merit getting future contributions rejected? You smokin' crack, dude? Even a high number of unintentional bugs should be enough to get someone banned.

Nobody has a right to contribute to the Linux kernel. This isn't about politics or culture, it's about protecting the security and integrity of the kernel.

Troll somewhere else, please.

[coder]

Please stop. There may be a lot of good commits in there, so this is just regressing rather than progressing.
You may even end up breaking the kernel by doing that.......

Wow, for an editor, you haven't been reading a number of recent articles very carefully. The article stated that he hadn't followed through on that particular threat. I'd imagine there would be objections raised if he started backing out a lot of good commits.

I think it was a threat made in anger, and sounds like it was effective in letting people know what was at stake.

[marlock]

L_A_G
I wouldn't discredit all universities over this, like I wouldn't discredit all FOSS software if one FOSS project failed to see such a ruse and accepted this kind of patches in good faith...

What this does is show that ironically the kernel development community is having less of a hard time maintaining healthy trust chains and peer-reviewing processes than the research instituition that tried to prove otherwise.

Peer-review is absolutely essential in both FOSS software development and in science, and there is a well-recognized scarcity of qualified and available reviewers in some fields of science... not that there are few of them... but there are so many publications that it's just hard to keep them all in check all the time to ensure nothing bogus gets by.

In a sense, it's actually to be expected that a researcher with little faith in the academic checks and balances would propose to prove similar checks and balances to be flawed in the kernel... and went straight for the biggest target, getting greedy and burned in the failed attempt.

To those despairing over Greg's mention of reverting old patches: he never did it blindly, and in assessing the potential damage has already changed his mind over it. This is now a race against time to review all patches before any eventually merged vulnerabilities gets exploited by ill-intentioned actors watching this show... but clearly if there are any they're not as many as they could potentially be when there was no assessment, so IMHO his chain of statements so far made a lot of sensen including how he changed his mind as things progressed.