[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YIGnUqbkYtqOAQCx@meme-cluster>
Date: Thu, 22 Apr 2021 12:41:54 -0400
From: Santiago Torres <torresariass@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Malicious commits to Linux kernel as part of
university study
> *ALL* OSS projects should review proposed changes for potential security
> issues, and harden their software & supply chain against attacks.
> I also welcome research to make that better!
> But we don’t need researchers who perform attacks
> on production systems without authorization, or perform
> attacks on developers without their consent.
Agreed, when I first heard about the paper in November I was very
excited to read about it, as I sometimes face skepticism about SC
attacks (less so, now that they appear more in the news).
Research in the space is important, but this is akin to cutting the
brakes on a bus to see when the drivers or the passengers find out...
To add to things, I don't think the researchers themselves are aware on
how the lkml actually works. They wouldn't be able to assess the result
of their experiment, or prepare a meaningful explanation for the IRB
with such a flawed model. I'm not trying to point fingers at anybody
here, but us academics need to do some soul-seeking in terms of how we
engage with the rest of the software-world.
Thanks,
-Santiago
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
