Re:Linux Foundation’s demands to the University of Minnesota
by stephenhuey on Tuesday April 27, 2021 @10:05AM
(#26955977)
They were “researching” how feasible it is to submit insecure code. In other words, if can they slip some vulnerabilities past the maintainers. To me, it’s the same as sabotage. Not only is it unkind, but if it succeeded, many real people depending on that code could be negatively impacted.
[ Parent
| on HN ]
Re:Linux Foundation’s demands to the University of Minnesota
by AnIdiotOnTheNet on Tuesday April 27, 2021 @11:36AM
(#26957385)
The real problem is that it wasn't done with the informed consent of any kernel maintainers. The information gathered during the exercise is potentially quite valuable for informing policy and procedure around how code is reviewed and accepted, it just wasn't gathered in an ethical way.
Re:Linux Foundation’s demands to the University of Minnesota
by voiper1 on Tuesday April 27, 2021 @12:08PM
(#26957843)
There's a method for testing this sort of thing: pen-tests with consent from higher ups or "war games" with blue-team/red-team. It's not even a novel thing to do this properly.
Re:Linux Foundation’s demands to the University of Minnesota
by tmotwu on Tuesday April 27, 2021 @02:18PM
(#26959486)
Nope. Lets say IRB made the correct decision and demanded informed consent. Then informed consent must be requested from ALL participants, maintainers, and reviewers of the study. Higher up maintainers don't make that decision for others in this scenario, sorry. Novel or not, lets be completely honest with ourselves, it's not an easy experiment to frame properly.