Re: [PATCH] SUNRPC: Add a check for gss_release_msg

[J. Bruce Fields]

On Wed, Apr 21, 2021 at 11:58:08AM +0000, Shelat, Abhi wrote:
> Academic research should NOT waste the time of a community.
> 
> If you believe this behavior deserves an escalation, you can contact
> the Institutional Review Board (irb@xxxxxxx) at UMN to investigate
> whether this behavior was harmful; in particular, whether the research
> activity had an appropriate IRB review, and what safeguards prevent
> repeats in other communities.

For what it's worth, they do address security, IRB, and maintainer-time
questions in "Ethical Considerations", starting on p. 8:

	https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf

(Summary: in that experiment, they claim actual fixes were sent before
the original (incorrect) patches had a chance to be committed; that
their IRB reviewed the plan and determined it was not human research;
and that patches were all small and (after correction) fixed real (if
minor) bugs.)

This effort doesn't appear to be following similar protocols, if Leon
Romanvosky and Aditya Pakki are correct that security holes have already
reached stable.

Also, I still don't understand the explanation of the original SUNRPC
patch.  I don't know much about static analyzers, but it really doesn't
look like the kind of mistake I'd expect one to make.

--b.