Re:“They introduce kernel bugs on purpose”
by Cthulhu_ on Wednesday April 21, 2021 @08:12AM
(#26888559)
If they wanted to do security research, they could have done so in the form of asking the reviewers to help; send them a patch and ask 'Is this something you would accept?', instead of intentionally sending malicious commits and causing static on the commit tree and mailing lists.
[ Parent
| on HN ]
Re:“They introduce kernel bugs on purpose”
by TOMDM on Wednesday April 21, 2021 @09:25AM
(#26889351)
Even better
Notify someone up the chain that you want to submit malicious patches, and ask them if they want to collaborate.
If your patches make it through, treat it as though they essentially just got red teamed, everyone who reviewed it and let it slip gets to have a nervous laugh and the commit gets rejected, everyone having learned something.
Re:“They introduce kernel bugs on purpose”
by stingraycharles on Wednesday April 21, 2021 @05:13PM
(#26895517)
Exactly what I was thinking. This should have been set up like a normal pen test, where only seniors very high up the chain are in on it.
I wonder if informing anyone of the experiment would be frowned upon as it might affect the outcome? However, this research doesn’t appear to be fastidious about scientific integrity so maybe you are right.
Re:“They introduce kernel bugs on purpose”
by scaladev on Wednesday April 21, 2021 @08:40AM
(#26888854)
Wouldn't that draw more attention to the research patches, compared to a "normal" lkml patch? If you (as a maintainer) expected the patch to be malicious, wouldn't you be extra careful in reviewing it?
Re:“They introduce kernel bugs on purpose”
by aflag on Wednesday April 21, 2021 @04:01PM
(#26894679)
You probably can learn more and faster about new drugs by testing them in humans rather than rats. However, science is not above ethics. That is a lesson history has taught us in the most unpleasant of ways.
Re:“They introduce kernel bugs on purpose”
by Dobbs on Wednesday April 21, 2021 @08:56AM
(#26889016)
You don't have to say you are studying the security implications, you could be say you are studying something else like turn around time for patches, or level of critique, or any number of things.
Re:“They introduce kernel bugs on purpose”
by colechristensen on Wednesday April 21, 2021 @10:00AM
(#26889803)
Yes you do. In no circumstances is it ethical to do penetrating tests without approval.
Re:“They introduce kernel bugs on purpose”
by joshuamorton on Wednesday April 21, 2021 @12:03PM
(#26891434)
In the thread you're in, the assumption is that the patches are never actually submitted.
Re:“They introduce kernel bugs on purpose”
by tapland on Wednesday April 21, 2021 @08:23AM
(#26888659)
Dd they keep track of and submit a list of additions to revert after they managed to get it added?
From the looks of it they didn't even when it was heading out to stable releases?
That's just using the project with no interest in not causing issues.
Re:“They introduce kernel bugs on purpose”
by Verdex on Wednesday April 21, 2021 @10:01AM
(#26889813)
Yeah, so an analogy would be to put human feces into food and then see if the waiter is going to actually give it to the dinning customer. And then if they do, just put a checkmark on a piece of paper and then leave without warning someone that they're about to eat poop.