The goal is not penalizing or lumping everyone together. The goal is to have the issue fixed in the most effective manner. It's not the Linux team's responsibility to allow contributions from some specific university, it's the university's. This measure enforces that responsibility. If they want access, they should rectify.

I would then say that the goal and the choice aren't aligned because "penalizing or lumping everyone together" is exactly the choice made.

They would presumably reconsider blanket ban, if the university says they will prohibit these specific researchers from committing to Linux.

If a company that sold static analysis products did this as part of a marketing campaign, would you likewise have so many reservations about blacklisting contributions from that company, or would you still be insisting on picking out individual employees?

It's pretty obvious what would happen if a firm tried this: they'd be taken to court and probably imprisoned, as this is a clear violation of the law (which is pretty broadly to capture any attempted interference with the correct operation of a computer program).

the university can easily resolve the issue by firing the professors

do you know that would resolve the issue? this just seems like idle, retributive speculation.

The University can presumably not in fact do this.

Tenure does not generally prohibit for-cause termination, and there is a whole pile of cause here.

The people who are effected by the rule or discouraged by it cannot do so.

One way to get everyone in a university on the same page is to punish them all for the bad actions of a few. It appears like this won't work here because nobody else is contributing and so they won't notice.

It's not the number of people directly affected that will matter, it's the reputational problems of "umn.edu's CS department got the entire UMN system banned from submitting to the Linux kernel and probably some other open source projects."

And anyone without much power to effect change SOL.

I know the kernel doesn't need anyone's contributions anyhow, but as a matter of policy this seems like a bad one.

This was approved by the university ethics board so if trust of the university is by part because the actions of the students need to pass an ethics bar it makes sense to remove that trust until the ethics committee has shown that they have improved.

The ethics board is most likely not at fault here. They were simply lied to, if we take Lu's paper serious. I would just expell the 3 malicious actors here, the 2 students and the Prof who approved it. I don't see any fault in Wang yet.

The damage is not that big. Only 4 committers to linux in the last decade, 2 of them, the students, with malicious backdoors, the Prof not with bad code but bad ethics, and the 4th, the Ass Prof did good patches and already left them.

So the pen-test on the ethics board showed that they had not institutionalized proper safeguards regarding malicious actors? (And not even a paper on this… ;-) )

I'd concur: the university is the wrong unit-of-ban.

For example: what happens when the students graduate- does the ban follow them to any potential employers? Or if the professor leaves for another university to continue this research?

Does the ban stay with UMN, even after everyone involved left? Or does it follow the researcher(s) to a new university, even if the new employer had no responsibility for them?

On the other hand: What obligation do the Linux kernal maintainers have to allow UMN staff and students to contribute to their project?

> Does the ban stay with UMN, even after everyone involved left?

It stays with the university until the university provides a good reason to believe they should not be particularly untrusted.

If they use a different email but someone knows they work at the university?

It's a chain that gets really unpleasant.

It's the university that allowed the research to take place. It's the university's responsibility to fix their own organisation's issues. The kernel has enough on their plate than to have to figure out who at the university is trustworthy and who isn't considering their IRB is clearly flying blind.

that is completely irrelevant. they are acting under the university, and their "Research" is backed by university and approved by university's department.

if university has a problem, then they should first look into managing this issue at their end, or force people to use personal email ids for such purposes