I'm sure many advisors have tons of students contributing to the Kernel or other projects, every single year.
For research groups, the faculty advisor is the responsible party; once that party has been shown to act maliciously, extra scrutiny is warranted, unless there is some evidence that durable reform has occurred. (The same might be said less strongly of the institutional source, as well.)
> I'm sure many advisors have tons of students contributing to the Kernel or other projects, every single year.
And virtually all of them have not been—either advisor or institution—responsible for malicious kernel patches.
Actions have consequences.
It's nonsense that they acted maliciously. The original research was handled terribly, but it was not malicious. They intended to help, not hurt, even if they did so very poorly.
Further, that is one advisor, whose name is not being dragged. Aditya's name, however, is, thanks to Greg's slanderous comments.
https://twitter.com/trishalynn/status/1385410960278491137 "I am disgusted by the actions of Aditya Pakki"
https://twitter.com/hedleyroos/status/1386290204298735617 "Aditya Pakki is going to have a hard time finding employment." (this one directly retweeted Greg's post)
https://twitter.com/_mackal/status/1384910754151866370 "The simple fact that Aditya Pakki is so butt hurt proves this wasn't in good faith and their only reason for doing it is to shit out another hit piece. That email you quoted is fucking insane."
https://twitter.com/BeardyNotes/status/1384900450059788288 "Sleazeballs like Aditya Pakki should be fired and disbarred from doing any "research" anywhere in the world!"
https://twitter.com/seakoz/status/1384895697414148096 "Aditya Pakki will forever be googleable as the guy who deliberately tried to make Linux insecure."
Does that seem right to you? Are these the "consequences" you think are justified, because Aditya was trying to add legitimate patches for a tool he was working on to contribute to the kernel?
Greg should publicly apologize to Aditya.
The commit that spurred this whole mess was for static analysis research, totally unrelated to the previous commits from quite some time ago related to bugdoors in the kernel.
Greg's reaction was to the static analysis commits, and he alleged (in an incredibly insulting and hostile way) that they were made with malice.
This is not the same source! It's the same UNIVERSITY, which has thousands of students every year. And the source of the bugs wasn't even from university addresses, it was from random gmail addresses.
Aditya submitted LEGITIMATE patches based on his static analysis tool.
He is being slandered because people won't take 5 seconds to learn the facts.
>And the source of the bugs wasn't even from university addresses, it was from random gmail addresses.
I don't know why this really matters. They could be running a similar experiment this time pretending UMN was compromised.
I'm not sure who Pakki is, if he's not part of the first research group at all it is truly unfortunate he is receiving the blame for it. If he was, the internet's reaction is still unwarranted but frankly typical. I don't see how Kroah-Hartman is at fault though.
Because Greg's response doesn't actually address any problem, it's purely grandstanding. The researchers explicitly performed their work not using university addresses, so banning the university does nothing. As Kees Cook has already noted, the vast majority of patches from the university are legitimate.
> I'm not sure who Pakki is
The researcher who submitted output from his legitimate research to try to fix bugs. Greg responded by insulting him, saying he is incompetent, stating that he is malicious, and then that he would ban the university over this.
How could Greg not be at fault? His post made false allegations against Aditya, claiming that he was acting maliciously, and because no one fucking reads anymore, people think Aditya was trying to insert vulnerabilities into the kernel.
I believe Greg was not saying Aditya was both incompetent and malicious. Greg was saying incompetent or malicious. The incompetence stemmed from how Aditya handled his static analysis patches: seemingly no manual review and no explicit statement that the patches were from a tool (which is apparently standard procedure).
Most of Aditya's patches were legitimate. Multiple upstream developers have confirmed this:
> https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvW...
Other kernel maintainers have already picked up on this.
> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work.
Here is a direct quote from Greg where he falsely alleges that Aditya is responsible for the previous work.
> Now you submit a new series of obviously-incorrect patches again,
Many of the patches are correct - see the above link where one maintainer points this out.
> So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches?
Another false allegation that Aditya is experimenting on the kernel, attributing malice.
> You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect.
Many were legitimate. Again, a false accusation from Greg.
Then Greg goes on to attack him some more, instead of just explaining things to him, like "Hey, in the future can you add 'found by tool xyz'". In other mailing lists kernel maintainers point out that that would have been the sane response, not going to bother to link that.
> Our community welcomes developers who wish to help and enhance Linux. That is NOT what you are attempting to do here, so please do not try to frame it that way.
In fact, that is exactly what Aditya was trying to do.
> Our community does not appreciate being experimented on, and being "tested" by submitting known patches that are either do nothing on purpose, or introduce bugs on purpose.
Aditya did no such thing.
Greg's response is indefensible. It's just littered with insults and attacks, and factually incorrect allegations against a legitimate security researcher.
99% of his reaction was related to the previous paper's actions, it's unfortunate that Pakki is getting the blame but from the first post Kroah-Hartman tried to deflect blame away from him.
Where are people getting this from? Greg literally, explicitly, accuses Aditya of malice. I have repeatedly quoted him doing so.
Again, quoting for the millionth time,
"> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work."
YOU. The first word. In a response to Aditya. It's a false allegation, it's literally incorrect.
Aditya was NOT one of the researchers involved in that previous work.
Followed by "and your group," which is exactly what my last post said. And even if he was not part of the group that carried out the previous work, he would still be part of the UMN CS research program that "publicly admitted to sending known-buggy patches..."
I've said multiple times it seems that Pakki is receiving far more blame than he deserves. He merely submitted bad patches and got defensive about the manner in which they were rejected.
Greg has conflated Aditya Pakki with the hypocrite commits. Aditya wrote a static analysis tool that generated some bad commits and many acceptable commits.
Greg accused him of intentionally submitting bad patches. That accusation appears to be false. Greg should apologize to Aditya.
And then Linux mob mentality took over, and Aditya has been dragged through the mud over it.
Again, based on false accusations. Aditya did NOTHING that Greg alleged. Again, NOTHING.
But facts will be downvoted because the Linux mob loves grandstanding on mailing lists.
From GKH's response to Pakki's claims:
They obviously were _NOT_ created by a static analysis tool that is of any intelligence, as they all are the result of totally different patterns, and all of which are obviously not even fixing anything at all. So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches?
When submitting patches created by a tool, everyone who does so submits them with wording like "found by tool XXX, we are not sure if this is correct or not, please advise." which is NOT what you did here at all. You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect.
A few minutes with anyone with the semblance of knowledge of C can see that your submissions do NOT do anything at all, so to think that a tool created them, and then that you thought they were a valid "fix" is totally negligent on your part, not ours. You are the one at fault, it is not our job to be the test subjects of a tool you create.
Aditya submitted patches, and Greg alleged that they were malicious and insulted him repeatedly, completely crossing the line from any reasonable technical review over to a direct attack.
Aditya's reputation has suffered massively as a result of doing research to try to help the Linux kernel.
These are the facts of the situation.
I'm familiar with a case where a faculty member engaged in a case of autoplagiarism and submitted the same paper to two high-profile journals. His graduate students had trouble publishing in reputable journals for years after, and he also earned himself a ban from the national funding agency.
For that kind of breach of trust retribution is savage, and that's why you don't engage in it to begin with.
You are saying what perhaps ought to happen (and that's a matter of debate), and I am saying what has happened, I was talking of a past event that happened as described. A professor committed an act of misconduct, and his students suffered for it. Well, it's happening again.
That's what happens in a reputation-based environment and it's happening again here. We hope the University of Minnesota offers support to the affected students.
The university already apologized. Where is Greg's apology? Where is Greg's retraction for falsely accusing Adity?
As I read the discussion archive carefully: 1) A submits patch 2) G suggests a particular patch was “wasting his time”, and that he’s suspicious of this kind of submission from Dr. Lu and UofM. 3) Nearly a day later, A accuses G of ‘wild accusations, bordering on slander’.
In fact, no one denies that what G claimed is in fact true - that Dr. Lu and his students had a history of submitting “hypocrite” patches. They published about it!
But according to A, it’s G that is being ‘unwelcoming’ and ‘intimidating’, due to ‘preconceived biases’. To me, this is where it starts feeling dramatically personal in nature.
4) I don’t see the language in G’s response to (3) as nearly so personal as (3) itself. It does question A’s professionalism. I’m sympathetic. What was A thinking?
What Greg claims w.r.t. Aditya seems to be false and highly damaging.
Greg wrote: “You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them”
It now appears that Aditya’s patch was submitted in good faith. Greg accused him of intentionally submitting bad patches. That accusation was false.
Aditya’s is upset because a powerful figure in the Linux community had made false and damaging accusations against him. Aditya’s reputation has been damaged by Greg’s false accusations. Greg should apologize.
Citation needed.
> Greg accused him of intentionally submitting bad patches.
From GKH's response to Pakki's claims:
They obviously were _NOT_ created by a static analysis tool that is of any intelligence, as they all are the result of totally different patterns, and all of which are obviously not even fixing anything at all. So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches?
When submitting patches created by a tool, everyone who does so submits them with wording like "found by tool XXX, we are not sure if this is correct or not, please advise." which is NOT what you did here at all. You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect.
A few minutes with anyone with the semblance of knowledge of C can see that your submissions do NOT do anything at all, so to think that a tool created them, and then that you thought they were a valid "fix" is totally negligent on your part, not ours. You are the one at fault, it is not our job to be the test subjects of a tool you create.
> That accusation was false.
The accusation is that either Aditya "KNEW" the fixes he claimed to be legitimate were incorrect, or he has not a "semblance of knowledge of C" to see that his submission do NOT do anything at all, or that he was "negligent" on his part.
I've seen no evidence of this accusation being false.
Scroll Up. Find https://lwn.net/Articles/854319/ point 2
Consider:
Aditya is not an author on the hypocrite commits paper.
Aditya admitted his “garbage” commit when made aware it was not correct.
Aditya is author of other papers on static analysis. Aditya’s other commits have generally survived this bulk review.
Aditya maintains his claims even as other members of UMN have explained their role in the hypocrite commits.
Aditya’s commits come from a UMN address where as hypocrite commits came from gmail.
It seems likely Aditya is a bad static analyst not a malicious committer.
Greg’s accusations:
> You, and your group, have publicly admitted to sending known-buggy patches [1]
The “you” there is false. Aditya consistently denied being part of the research they has Greg so worked up.
Greg also wrote: > Please stop submitting known-invalid patches. [2]
The evidence above strongly suggests Aditya never did that.
Greg KH has accused Aditya of submitting known buggy patches. Aditya did not do that. Greg should apologize to Aditya for the false accusation.
[1] https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah...
[2] https://lore.kernel.org/linux-nfs/YH5%[email protected]...
That is the opinion of Al Viro, who's one Linux contributor. It does not prove that Pakki was unaware his "patches were utter crap", but does accuse him of being academically dishonest and negligent.
It’s one person reaching the conclusion Aditya’s work was clumsy not malicious.
I listed a bunch of reasons why I also believe that to be so.
Do you disagree? What evidence do you see that Aditya’s commits were malicious? Do you agree with the evidence I listed above?
But you make plenty of statements claiming it's been proven.
> but it’s supporting evidence. As I said it appears he was acting in good faith.
To one (1) person in the group of Linux core contributors. There are multiple others that do not agree with him, from among the same group of people, and just as qualified, as your person.
> I listed a bunch of reasons why I also believe that to be so. > Do you disagree? What evidence do you see that Aditya’s commits were malicious?
I do disagree. The evidence that I see (and find myself agreeing with):
1. The work itself. It is so badly broken that I have to suspect foul play. And Greg's right when claiming that, if Pakki did not know the code he was submitting was broken, he had to have been horribly negligent or incompetent.
2. When presenting the patches, he tried to pass them off as his own. When the flaws were pointed out, then he reveals that the work wasn't his but that of a poorly written automated program. This sounds awfully like an excuse, and a poor one at that.
3. His first response to being called out was to play the "innocent victim" card, with barely an attempt to explain why he submitted code so badly broken. I also disagree with his passive-aggressive, subtly-hidden, claim that it was because he was just "a newbie and a non-expert".
4. I do agree that GKH was quite aggressive in labelling Pakki's work, and that he had no direct evidence for it, but he also explained his reasoning and supplied supporting evidence (I have quoted both in my GP comment), and I find it reasonable for a person in his position (i.e., an unwitting subject of an unethical human experiment) to feel that way.
For these reasons, and for the close association of Pakki and Prof. Lu (who I believe still does not see or accept any wrongdoing on his part), I cannot yet rule out the possibility, nor do I think it is low, that Pakki was also participating in a new, similar experiment.
I am not excusing GKH's rush to conclusion either, though I understand what led him to it. But the matter is still ongoing, though sadly not in public anymore, so I am waiting to see how everyone acts moving forward.
> Do you agree with the evidence I listed above?
I agree partially with some of them. Not enough to reach a conclusion like you.
Some of the rest of it, I think, actually points the other way. For example, the claim that "Aditya’s other commits have generally survived this bulk review" begs the question: If Pakki has demonstrated competence enough for some of his commits to survive subsequent close inspections by experts, then how could he have allowed patches as poor as the ones that sparked this whole brouhaha?
As for the rest of the "evidence" you listed: I simply cannot accept them as evidence, rather as just unsubstantiated claims and expert opinions. The latter has value, though not enough yet to settle the question.
Citation needed.
I wrote
> That accusation appears to be false
> What Greg claims w.r.t. Aditya seems to be false
> It now appears that Aditya’s patch was submitted in good faith.
Those aren’t claims of proof. appears, seems, appears.
They are weighing evidence and making a conclusion.
> I cannot yet rule out the possibility, nor do I think it is low, that Pakki was also participating in a new, similar experiment.
Cool we’re close to on the same page, do you think it’s more likely he was participating in a new, similar hypocrite commit experiment or more likely he was submitting buggy patches inadvertently?
I have plainly put forth evidence and openly asked for evidence. Emotional outrage is not a fair return.
The bias is so blatant, as always - the Linux community continues to refuse to hold maintainers accountable. If people can't be bothered to read the evidence I'm not going to continue to discuss this in good faith.
But, clearly, not everyone is reading the same things. How could they? Humans aren't a hivemind. I understand that other people can have read different things than I have, that they can have a different view of things than I do, so I present my side of the argument with the evidence that I can find.
Even given the same evidence, I understand that other people can have different interpretations of them, so I present my interpretations while asking for theirs, in the hope that they're sensible people.
> I've linked and quoted repeatedly throughout here
Your discourse with me here has consisted solely of you calling me names (specifically, "idiot cultist") and complaining about other people. Other people that you passive-aggressively lump me into.
> there's a link in the header to UMN's response.
Plenty have seen and read it. I don't know what point you're trying to make by alluding to a curt announcement that can be reduced to "we've paused the research group's activities and are looking into the matter".
Or perhaps you meant to point to the professor's response instead of UMN's. You and I clearly aren't reading it the same way, but I did not bring it up in our discussion and I do not want to now because I do not believe you are being sensible here.
> The bias is so blatant, as always - the Linux community continues to refuse to hold maintainers accountable.
Whatever their crimes are, your behaviour here has been unmitigably worse, and you refuse to hold yourself accountable.
> If people can't be bothered to read the evidence I'm not going to continue to discuss this in good faith.
You haven't been. But, what's worse, you've been trying to prevent others (like me and the person you replied to when you called me an "idiot cultist") from doing so as well.
Do you think Aditya was acting in bad faith?
Yeah, Greg seemed angry in response - I think that’s understandable. Should Greg apologize? Sure, why not. But from the skid marks on the road, I’m pretty convinced about who was driving unsafely here.
This is where we differ. Before you make a false permanent career damaging accusation you should do some basic checking if it’s true?
Greg lost his temper and now can’t back down.
He should have asked himself is it logical that a guy who has dozens of good commits over a period of a year is suddenly submitting known bad commits as part of a research paper that he is not an author of that was published months ago.
> This comes after Aditya had the opportunity to recognize that Dr. Lu and UofM were on Greg’s radar.
It’s not Aditya’s responsibility to read Greg’s mind.
> Instead, Aditya just hit back, in a personal and to my mind fairly repugnant way.
Those are strong accusations can you cite the text Aditya wrote that you believe is “repugnant” ?
Aditya wrote : “ respectfully ask you to cease and desist from making wild accusations that are bordering on slander.”
That’s extremely polite given Greg K H was spreading the phony and damaging story that Aditya was intentionally damaging the Linux kernel.
???
They submitted patches to the kernel based on a static analysis tool they were building, and then Greg started accusing them of malice, and banned the entire univirsity - how is it the research group that communicated poorly?
Why would they not "do this again" ? They were trying to contribute to the kernel, whether their patches were low quality or not, there was no malice from this group.
They haven't used any social pressure - on the contrary, it's Greg who began this inflammatory, overblown reaction to ban an entire university based on previous research done under non university affiliated email addresses.
Greg made numerous false accusations against Aditya.
edit: Oh and to everyone who I'm sure will just downvote,
https://lwn.net/Articles/854319/
Here's kernel maintainers explaining this mess that Greg made. People are conflating multiple unrelated events because Greg did.