Re: [PATCH 000/190] Revertion of all of the umn.edu commits

[Doug Ledford]

On Wed, 2021-04-21 at 15:01 -0300, Jason Gunthorpe wrote:
> On Wed, Apr 21, 2021 at 02:57:55PM +0200, Greg Kroah-Hartman wrote:
> > I have been meaning to do this for a while, but recent events have
> > finally forced me to do so.
> > 
> > Commits from @umn.edu addresses have been found to be submitted in
> > "bad
> > faith" to try to test the kernel community's ability to review
> > "known
> > malicious" changes.  The result of these submissions can be found in
> > a
> > paper published at the 42nd IEEE Symposium on Security and Privacy
> > entitled, "Open Source Insecurity: Stealthily Introducing
> > Vulnerabilities via Hypocrite Commits" written by Qiushi Wu
> > (University
> > of Minnesota) and Kangjie Lu (University of Minnesota).
> 
> I noted in the paper it says:
> 
>   A. Ethical Considerations
> 
>   Ensuring the safety of the experiment. In the experiment, we aim to
>   demonstrate the practicality of stealthily introducing
> vulnerabilities
>   through hypocrite commits. Our goal is not to introduce
>   vulnerabilities to harm OSS. Therefore, we safely conduct the
>   experiment to make sure that the introduced UAF bugs will not be
>   merged into the actual Linux code
> 
> So, this revert is based on not trusting the authors to carry out
> their work in the manner they explained?
> 
> From what I've reviewed, and general sentiment of other people's
> reviews I've read, I am concerned this giant revert will degrade
> kernel quality more than the experimenters did - especially if they
> followed their stated methodology.

I have to agree with Jason.  This seems like trying to push a thumbtack
into a bulletin board using a pyle driver.  Unless the researchers are
lying (which I've not seen a clear indication of), the 190 patches you
have selected here are nothing more than collateral damage while you are
completely missing the supposed patch submission addresses from which
the malicious patches were sent!

This all really sounds like a knee-jerk reaction to thier posting.  I
have to say, I think it's the wrong reaction to have.  Remember, these
guys are the ones explaining how things can be done and exposing the
tricks.  That puts them in the white-hat hacker camp, not the black-hat
hacker camp.  You shouldn't be banning them, you should be listening to
them and seeing if they found any constructive ways to improve and
harden the maintenance process against these sorts of things.

-- 
Doug Ledford <dledford@xxxxxxxxxx>
    GPG KeyID: B826A3330E572FDD
    Fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

Attachment: signature.asc
Description: This is a digitally signed message part