[HN Gopher] Intentionally buggy commits for fame and papers (2021)
       ___________________________________________________________________
        
       Intentionally buggy commits for fame and papers (2021)
        
       Author : mmsc
       Score  : 28 points
       Date   : 2023-12-29 20:39 UTC (2 hours ago)
        
 (HTM) web link (lwn.net)
 (TXT) w3m dump (lwn.net)
        
       | kseifried wrote:
       | We covered this back then on the #osspodcast:
       | 
       | Episode 269 - Do not experiment on the Linux Kernel
       | 
       | https://opensourcesecurity.io/2021/05/02/episode-269-do-not-...
       | 
       | Josh and Kurt talk about the University of Minnesota
       | experimenting on the Linux Kernel. There's a lot to unpack in
       | this one, but the TL;DR is you probably don't want to experiment
       | on the kernel.
        
         | atq2119 wrote:
         | Yeah, my first reaction to this was "WTF, again?!". Then I
         | noticed the date. Needs a (2021)
        
       | Karellen wrote:
       | (2021)
        
         | dang wrote:
         | Added above. Thanks!
        
       | ksherlock wrote:
       | Umm, 2021.
        
       | KolmogorovComp wrote:
       | Since it's from 2021, does anybody has a follow-up on this? What
       | happened to the researchers? Did something changed in the patch
       | process to limit these attempts?
        
         | dharmab wrote:
         | Linux Foundation TAB report:
         | https://lore.kernel.org/lkml/202105051005.49BFABCE@keescook/ -
         | bottom of the report made a recommendation each for UMN and the
         | TAB
         | 
         | UMN statement: https://cse.umn.edu/cs/statement-computer-
         | science-engineerin...
        
       | throwup238 wrote:
       | Previous discussion when this story originally broke:
       | 
       |  _"They introduce kernel bugs on purpose"_ -
       | https://news.ycombinator.com/item?id=26887670 - April 2021 (1954
       | comments)
        
       | dataangel wrote:
       | I find this research to be both ethical and necessary, and I
       | think kernel devs decrying it as wasting their time are missing
       | the point. They demonstrated the whole "with enough eyes all bugs
       | are shallow" security model doesn't really work. If some of the
       | best devs out there fall for bad patches, it can happen to any
       | OSS project (and for that matter for prop code bases too, but
       | there you at least have to go through the hurdle of being hired
       | before your code is considered).
        
         | robertlagrant wrote:
         | Why's it necessary? We already know that this method of
         | software development, like all methods, isn't perfect if you
         | pick a short enough timeframe.
        
       ___________________________________________________________________
       (page generated 2023-12-29 23:00 UTC)